Switzerland: Embedded WinWord OLE Ransomware active around Switzerland 26.10.2016

Embedded WinWord OLE Ransomware active around Switzerland 26.10.2016

Files: Abrechnung_XXXX.DOCX,

Format: Microsoft WinWord 2007

MALWARE: LNK/Agent.A5E3!tr.dldr

Following WinWord with Embedded OLE Object drops through most of the Fortigate/Mcafee/Trend Spam, Firewall, IPS, TIE, Sandboxes. Most only scanners does not detect it.

Microsoft describes this here:

https://blogs.technet.microsoft.com/mmpc/2016/06/14/wheres-the-macro-malware-author-are-now-using-ole-embedding-to-deliver-malicious-files/

26.10.2016, 14:00 Uhr

This how the WinWord Looks

If you click

You MAY have to click again….. ;-)

Some others in that direction:

After running the OLE Object it does HIT on the Sandbox.

On most commercial Sandbox you have to activate the OLE manual…

Sites it connects to:

It does use CALC.EXE ONLY on the "Sandbox Systems" since these are old state and thus extra not patched. Or it's a new discovered 0day for calc.exe on real machines.

File download with Powershell:

Fortigate takes business serious and did report back to us after the sample was submitted around 1.5hr later

Thank you for submitting your sample to Fortinet. The sample "___Abrechnung_129.docx" with MD5:b147662ddfdae09d7becd016cb3c6801 should already be detected as LNK/Agent.A5E3!tr.dldr

This signature was released in AVDB v40.307 on October 26th, 2016 at 10AM PST

If for any reason you believe that the file is still not being detected, please let us know.

We have escalated this sample to our Fortisandbox team and we will conduct further investigation as to the nature of Fortisandbox missing this sample.

Regards,