# Malicious XLSX Dropper Targets Systems via CVE-2017-11882

Published: 2025-07-17 · Severity: elevated
Canonical: https://vorant.io/reports/d80110bf-5ef4-50ff-9df1-30a433221970/malicious-xlsx-dropper-targets-systems-via-cve-2017-11882

> CISA reports a protected Excel file exploiting CVE-2017-11882 to download and execute malware payloads.

CISA analyzed a Microsoft Excel Open XML Format (XLSX) spreadsheet file with a protected workbook containing hidden malicious code. When opened, the file attempts to download and execute a payload via a URL shortener (urlz.fr/7pMA), which resolves to 151.106.30.115 hosting win32.exe. The malware executes from %AppData%\Roaming\svchost.exe. The malicious payload itself was unavailable during analysis. The threat leverages CVE-2017-11882, a known Office vulnerability affecting Excel and Word, to achieve remote code execution without user interaction beyond opening the file. The command-and-control IP is hosted in France by Velia.net; the shortening service uses an anonymous registrant.

## Mentioned in this report

- Vulnerabilities: CVE-2017-11882 (KEV)
- Malware: win32.exe

## Detection guidance (public sample)

### Excel Spawning Child Process Consistent with CVE-2017-11882 Exploitation

ATT&CK: T1203

Detects Excel or Word launching command shells, script hosts or LOLBins, as seen when the Equation Editor exploit (CVE-2017-11882) fetches and runs a payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Excel Spawning Child Process Consistent with CVE-2017-11882 Exploitation
description: Detects Excel/Word spawning cmd, PowerShell, mshta, bitsadmin, certutil
  or similar. The EQNEDT32 exploit chain typically runs a shell or downloader from
  the Office process tree. Generalises on the parent/child relation, not on the campaign
  URL or payload name.
tags:
- attack.execution
- attack.t1203
- attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \EXCEL.EXE
    - \WINWORD.EXE
    - \EQNEDT32.EXE
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \bitsadmin.exe
    - \certutil.exe
    - \wscript.exe
    - \cscript.exe
    - \regsvr32.exe
    - \rundll32.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Excel macros or add-ins that invoke cmd.exe for business automation
- Software packaging or reporting tools that drive Office and call helper scripts
level: high
id: 04823eff-07f6-5834-bcac-35b5fb7b8096
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133e
```

### Equation Editor EQNEDT32 Spawning Child Process

ATT&CK: T1203

EQNEDT32.EXE (the Equation Editor exploited by CVE-2017-11882) spawning any child process, which is almost never legitimate. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Equation Editor EQNEDT32 Spawning Child Process
description: Detects the legacy Equation Editor process EQNEDT32.EXE creating a child
  process, a strong indicator of CVE-2017-11882 exploitation from a malicious Office
  document.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \EQNEDT32.EXE
  condition: selection
falsepositives:
- Rare legacy documents that launch helper programs through Equation Editor
level: high
id: ae53a774-bd18-57c1-88a8-cdbf8b5faa34
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133e
```

### Svchost Executable Launched from User AppData Roaming

ATT&CK: T1105

A process named svchost.exe running from a user profile AppData\Roaming path, a masquerading dropped payload as in this XLSX dropper. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Svchost Executable Launched from User AppData Roaming
description: Detects a binary named svchost.exe executing from a user AppData\Roaming
  directory instead of System32. The legitimate svchost.exe only runs from System32
  or SysWOW64, so this indicates masquerading by a downloaded payload.
tags:
- attack.command-and-control
- attack.t1105
- attack.stealth
- attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: \AppData\Roaming\
    Image|endswith: \svchost.exe
  condition: selection
falsepositives:
- Unlikely; possibly a portable tool deliberately renamed by a developer for testing
level: high
id: 6e3b849c-52f4-57d4-ba5b-8b8f733774c5
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133e
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

4 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133e

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d80110bf-5ef4-50ff-9df1-30a433221970/malicious-xlsx-dropper-targets-systems-via-cve-2017-11882.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup