Hello, welcome to the Thursday, September 23rd, 2021 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich.

And today I'm recording from Jacksonville, Florida.

The today has yet another document for you that attempts to exploit CVE 2021-4044 for the recently patched MSHTML vulnerability.

In this case, however, the attacker went to extra mile and added some additional obfuscation

scripts. Of course, no problem for DDI.

He has just the Python script for you in order to take care of this obfuscation.

The document itself, like I said, is a Word document.

Of course, Word documents are SIP files that contain XML documents, and XML may use use entities and you've probably all seen them

in HTML, where you have an ampersand and then a character code.

That's exactly what happened here.

The attacker is taking advantage of these numeric character references or entities in order to further obfuscate the document.

DDA has his numbers to string script that will convert this and then again make it very easy for you to actually extract the malicious URLs. One interesting side note here from

DDA is about the creation of the document. When you unsip it, you get current timestamps.

Now, typically in office documents, those timestamps are set to January 1st, 1980. Not so in this case, according to D.D., that's a pretty good sign that probably this started

out as a normal office document, but then one of those exploit tools that have been released

that take an office document and add the exploit to it were used in order to modify these files.

Also supporting this is that the timestamp is, well, just September 16th,

which is about the day when these exploit tools were released, so probably someone couldn't

help themselves and applied them to this document. And if you ever

connected an email client to an exchange server, you may have gone through the auto-discover feature.

You essentially give the email client your email address and your password, and it'll magically configure everything for you.

...