Malicious RTF drops payload via CVE-2012-0158
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA analysis of RTF dropper exploiting 2012 Word vulnerability to download remote payload.
CISA's Malware Initial Findings Report (MIFR) documents analysis of a malicious RTF file named 'PRODUCT SPECIFICATION.doc' (SHA256: 96d217fc287e7ef0af46449eba405e4b49217834d6335a48b85519b75942c74c). The file exploits CVE-2012-0158, a known vulnerability in Microsoft Word affecting handling of specially crafted RTF documents, to achieve arbitrary code execution when opened. Upon execution, the RTF dropper attempts to download a secondary payload (austin2.exe) from a command-and-control server at marianvanherp.nl via HTTP GET request, with the downloaded file staged locally as pong.exe before execution. The payload host was inactive at time of analysis. The C2 infrastructure is registered in the Netherlands under Spango Internet B.V., with the domain registered through Mijn Internet Oplossing B.V. This represents a classic two-stage attack chain: exploit delivery document followed by remote payload injection.
Mentioned in this report
Detection guidance
Word Spawning Executable From User-Writable Path or Script Interpreter
WINWORD.EXE launching a child process from Temp/AppData/Public/ProgramData or a shell/script host, typical of RTF exploit (CVE-2012-0158) payload execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Word Spawning Executable From User-Writable Path or Script Interpreter
description: Detects WINWORD.EXE creating a child process that runs from a user-writable
directory (Temp, AppData, Users\Public, ProgramData) or is a command/script interpreter.
This is the typical result of a Word RTF exploit such as CVE-2012-0158 dropping
and executing a second-stage binary. Matches the parent/child relation, not any
specific payload name.
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \WINWORD.EXE
selection_child_path:
Image|contains:
- \AppData\
- \Temp\
- \Users\Public\
- \ProgramData\
selection_child_interp:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \bitsadmin.exe
- \certutil.exe
condition: selection_parent and 1 of selection_child_*
falsepositives:
- Word macros in legacy business documents that call cmd.exe or helper tools
- Document management add-ins that launch helper executables from AppData
level: high
id: 8be49731-7a53-537c-9e87-af7b18451119
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133l
Word Process Creating Executable File in User-Writable Directory
WINWORD.EXE writing an executable/DLL/script to disk in Temp, AppData, Public or ProgramData, consistent with an exploit-dropped or downloaded second stage. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Word Process Creating Executable File in User-Writable Directory
description: Detects WINWORD.EXE writing an executable, DLL or script-type file into
user-writable locations. In the CVE-2012-0158 RTF chain the document drops or downloads
a payload and stages it locally before execution. Generalises on the process/file-type
relation rather than the staged filename.
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1203
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \WINWORD.EXE
TargetFilename|endswith:
- .exe
- .dll
- .scr
- .com
- .bat
- .vbs
- .js
TargetFilename|contains:
- \AppData\
- \Temp\
- \Users\Public\
- \ProgramData\
condition: selection
falsepositives:
- Office add-in installers or updaters unpacking helper binaries into AppData
- Third-party document tools that extract components to Temp
level: high
id: 18778dd5-c3a2-5817-85ed-c1b30c9f2fad
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133l
Word Initiating Outbound Connection to External Host
WINWORD.EXE making outbound connections to public IPs on ports other than 443 (e.g. plain HTTP or non-standard ports) to fetch a payload after exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Word Initiating Outbound Connection to External Host
description: Detects WINWORD.EXE initiating network connections to public addresses
on anything other than TLS port 443. Exploited RTF documents (CVE-2012-0158) may
pull a second-stage executable via plain HTTP GET or non-standard ports. Needs tuning
for environments where users open documents from external HTTP/WebDAV locations.
tags:
- attack.command-and-control
- attack.t1571
- attack.t1105
- attack.execution
- attack.t1203
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \WINWORD.EXE
Initiated: 'true'
filter_tls:
DestinationPort: 443
filter_private:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not 1 of filter_*
falsepositives:
- Users opening documents hosted on external HTTP or WebDAV servers
- Office online template or content downloads over plain HTTP
level: medium
id: 45ea7156-7adb-5050-a5a2-548a83f4b9c5
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133l
3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133l
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs