# CISA analyzes malicious Word dropper exploiting CVE-2015-1641

Published: 2025-07-17 · Severity: elevated
Canonical: https://vorant.io/reports/1333447a-6630-50d5-a44c-32be7bcde873/cisa-analyzes-malicious-word-dropper-exploiting-cve-2015-1641

> CISA analyzed a Word document weaponizing a five-year-old exploit to drop trojans that establish persistence and communicate to command infrastructure.

CISA's Malware Initial Findings Report (MIFR) documents analysis of a malicious Microsoft Word document (purchaseorderno.89764125.doc) designed to exploit CVE-2015-1641, a memory corruption vulnerability in Word's RTF parsing. Upon execution, the document drops and executes two .NET trojan files (~WRD8811.tmp, ~WRD8912.tmp) sharing the same MD5 hash. The trojan executable (ubndetnj.exe) performs environment detection to identify virtual analysis sandboxes; if detected, it drops copies of itself; if not, it establishes persistence through multiple registry keys, scheduled tasks, and encoded configuration entries in the HKEY_CURRENT_USER hive. The malware creates mutex objects (FireFX variants) for synchronization and establishes command-and-control by resolving the domain indogulf.hopto.org to 104.255.68.92. A companion DLL file injects code into system processes (svchost.exe, dwm.exe, taskhost.exe, slui.exe) for enumeration and execution. The dropper employs anti-analysis techniques and multi-stage execution to evade detection. This report was published in May 2020 based on analysis of submitted samples; there is no attribution or evidence of active in-the-wild exploitation at time of publication.

## Mentioned in this report

- Vulnerabilities: CVE-2015-1641 (KEV)
- Malware: ubndetnj.exe

## Detection guidance (public sample)

### Office Application Spawning Executable With .tmp Extension

ATT&CK: T1203

Word or other Office process launching a process whose image is a .tmp file, as when an exploited document (e.g. CVE-2015-1641) drops and runs a ~WRDxxxx.tmp payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Executable With .tmp Extension
description: Detects Microsoft Office processes creating a child process whose image
  file has a .tmp extension. Exploit documents such as CVE-2015-1641 RTF droppers
  write a .NET trojan to a ~WRDnnnn.tmp file and execute it directly. Generalises
  on the parent/child relation and the .tmp image, not the specific file names.
tags:
- attack.execution
- attack.t1203
- attack.t1566.001
- attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    Image|endswith: .tmp
  condition: selection
falsepositives:
- Rare Office add-in or installer helpers that run a temporary executable with a .tmp
  extension
level: high
id: 944ebfd1-c6c4-5fba-9282-3eab1f2d2fee
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133m
```

### Scheduled Task Created by Process Running From a .tmp File

ATT&CK: T1053.005

schtasks.exe /create launched by a parent whose image is a .tmp file, consistent with a dropped trojan establishing persistence via scheduled tasks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scheduled Task Created by Process Running From a .tmp File
description: Detects schtasks.exe creating a task when the parent process image is
  a .tmp file. A trojan dropped by a malicious Word document and executed from a temp-named
  file registers scheduled tasks for persistence. Generalises on the parent image
  extension and the /create flag, not the task name.
tags:
- attack.persistence
- attack.execution
- attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: .tmp
    Image|endswith: \schtasks.exe
    CommandLine|contains: /create
  filter_inno_setup:
    ParentImage|contains: \is-
  condition: selection and not filter_inno_setup
falsepositives:
- Installer frameworks that run from a temp .tmp executable and register a scheduled
  task
level: high
id: 4cc7005b-6b9a-56fe-aef1-a9b6c9d61957
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133m
```

### Run Key Persistence Written by a .tmp Executable

ATT&CK: T1547.001

A process whose image is a .tmp file writing to a Run or RunOnce autostart registry key, as a Word-dropped .NET trojan does for persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Run Key Persistence Written by a .tmp Executable
description: Detects a process running from a file with a .tmp extension that sets
  a value under a CurrentVersion Run or RunOnce key. A trojan dropped by a malicious
  Word document (e.g. CVE-2015-1641) persists through multiple registry keys in HKCU.
  Generalises on the writer image and autostart key, not value names.
tags:
- attack.persistence
- attack.t1547.001
- attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    Image|endswith: .tmp
    TargetObject|contains:
    - \CurrentVersion\Run\
    - \CurrentVersion\RunOnce\
  filter_inno_setup:
    Image|contains: \is-
  condition: selection and not filter_inno_setup
falsepositives:
- Legitimate installers that run from a temporary .tmp executable and register an
  autostart entry
level: medium
id: 71fe9595-caeb-50a8-b971-1ce0dea38e17
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133m
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

4 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133m

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1333447a-6630-50d5-a44c-32be7bcde873/cisa-analyzes-malicious-word-dropper-exploiting-cve-2015-1641.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup