LetsDefend - MSHTML

Created: 15/01/2024 12:02 Last Updated: 19/01/2024 15:14

2021's 0-Day MSHTML

Challenge Files (pass: infected): Download

This challenge prepared by @Bohan Zhang Malware samples: MalwareBazaar

Start Investigation

Upon extracting the file, we received two folders: one containing challenge files and another containing tools that can be utilized for their analysis.

we can move forward and use oleobj for the remaining tasks.

The results obtained from Oletools also confirm that this could be a potential exploit for the CVE-2021-40444 (Microsoft MSHTML Remote Code Execution Vulnerability) vulnerability.

Now let's dig the rest of challenge files with oleobj

for futher analysis, you can read it from here - VirusTotal

Examing the Employees_Contact_Audit_Oct_2021.docx file, what is the malicious IP in the docx file?

175.24.190.249

Examing the Employee_W2_Form.docx file, what is the malicious domain in the docx file?

arsenal.30cm.tw

Examing the Work_From_Home_Survey.doc file, what is the malicious domain in the doc file?

trendparlye.com

Examing the income_tax_and_benefit_return_2021.docx, what is the malicious domain in the docx file?

hidusi.com

What is the vulnerability the above files exploited?

CVE-2021-40444

Summary

This challenge was designed for us to gain a basic understanding of MSHTML vulnerability and how we can detect them from Microsoft Office documents.