🛡️ BankPaymAdviceVend.Report.docx CVE-2017-0199 – Full Blue Team Sandbox Analysis

Advanced Malware Detonation • Exploit Behaviour • IOCs • Detection Engineering

🎯 1. Executive Summary

This repository documents a **real malicious DOCX** file exploiting the **CVE-2017-0199** Microsoft Office RCE vulnerability. The sample was detonated inside a **Windows 10 ANY.RUN sandbox**, exposing:

✔ Full exploit chain
✔ Network callbacks to malicious domain (tt.vg)
✔ Dropped files & temp artefacts
✔ JA3 fingerprints
✔ Registry activity
✔ HTTP/HTTPS beaconing from WINWORD.EXE
✔ Full Blue-Team IOCs & detection rules

🔍 2. Scenario Background

A document titled “BankPaymAdviceVend.Report.docx” was received through a phishing email.
Once detonated, ANY.RUN instantly marked it as Malicious and linked it to:

• CVE-2017-0199 Word RCE exploit
• WINWORD.EXE making covert HTTP/HTTPS connections
• Contacting malicious short domain tt.vg
• Attempted retrieval of remote payload /BVhaS

📄 3. Sample Information

🧬 4. Attack Chain (High-Level Diagram)

[ Malicious DOCX ] │ ▼ [ User Opens in Word ] │ ▼ [CVE-2017-0199 Exploit Triggers] │ ▼ [WINWORD.EXE → tt.vg via HTTP/HTTPS] │ ▼ [Remote Path: /BVhaS (GET / HEAD / OPTIONS)] │ ▼ [Temp Files, EMF Objects, Cache Files Dropped] │ ▼ [Potential Next Stage Payload — Server Returned 404]

yaml Copy code

🌐 5. Network Behaviour

5.1 DNS Requests

Only one domain was malicious:

Resolved IPs:

188.114.96.3 188.114.97.3 172.67.138.42 (TLS v1.2)

yaml Copy code

📡 5.2 HTTP/HTTPS Beaconing

Word tried to fetch:

GET /BVhaS HEAD /BVhaS OPTIONS / Host: tt.vg User-Agent: Microsoft Office / MSIE 7 spoof

yaml Copy code

Typical captured request:

GET /BVhaS HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0...) Connection: Keep-Alive Host: tt.vg

arduino Copy code

Server responded:

HTTP/1.1 404 Not Found

yaml Copy code

📁 6. Dropped Files

Notable Artefacts

• Multiple .tmp files
• Office .glox graphic objects
• EMF images in browser cache:
  %LOCALAPPDATA%\INetCache\Content.MSO\*.emf
• Recent document shortcut .LNK
• index.dat logs
• Office proofing dictionary changes

🔐 7. Registry & System Behaviour

Word accessed:

HKCU\Software\Microsoft\Office\14.0... HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings... HKLM\System\ControlSet001\Services\Tcpip\Parameters\Interfaces...

yaml Copy code

✔ Normal for Office
❌ Combined with exploit = clear malicious behaviour

💣 8. Exploit Breakdown — CVE-2017-0199

Type: Remote Code Execution
Trigger: Malicious DOCX loads remote HTA without user interaction
Introduced: Microsoft Word 2007–2016
Impact: Attacker executes arbitrary code

This sample attempts to load a remote payload from:

http://tt.vg/BVhaS

yaml Copy code

🧩 9. IOCs

🔥 9.1 Network Indicators

Domain: tt.vg

URLs: http://tt.vg/BVhaS https://tt.vg/BVhaS

IPs: 188.114.96.3 188.114.97.3 172.67.138.42

shell Copy code

🔐 9.2 JA3 SSL Fingerprints

091f51a7a1c3a4504a224cc081ce9cee 46f5131e766d248db0248a86c494b71c 65005c9d9ae0f0ebeaf22c210571d482 ...

yaml Copy code

🔍 10. Detection Ideas (Sigma / Suricata / EDR)

This section converts the technical analysis of BankPaymAdviceVend.Report.docx into practical, production-ready detection artifacts that a SOC or Blue Team can immediately deploy. It includes Sigma rules, Suricata IDS signatures, and EDR hunting queries.

🧾 10.1 Sigma Rule — WINWORD → tt.vg

This Sigma rule detects any network connection initiated by WINWORD.EXE towards the suspicious short domain tt.vg inside Windows network logs.

title: WINWORD Connecting To Suspicious Short Domain tt.vg
id: 0b2a5f3d-ttvg-word
status: experimental

logsource:
  category: network_connection
  product: windows

detection:
  selection:
    Image|endswith: '\WINWORD.EXE'
    DestinationHostname: 'tt.vg'
  condition: selection

level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - cve.2017-0199

💡 Any outdated Office system contacting tt.vg through WINWORD.EXE should trigger an immediate investigation.

🌐 10.2 Suricata Rule — HTTP GET /BVhaS on tt.vg

A Suricata IDS rule that identifies an Office-originated request for GET /BVhaS on the malicious domain tt.vg. This catches the exploit’s attempted payload retrieval.

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"C2 – Office WINWORD GET /BVhaS on tt.vg";
    flow:established,to_server;
    http.method; content:"GET";
    http.uri; content:"/BVhaS"; nocase;
    http.host; content:"tt.vg"; nocase;
    http.user_agent; content:"MSOffice"; nocase;
    reference:cve,2017-0199;
    classtype:trojan-activity;
    sid:4200010;
    rev:1;
)

🔥 Highly effective in environments using Suricata or Zeek to monitor outbound traffic.

🛰️ 10.3 EDR Hunting Query — WINWORD + tt.vg Indicators

A KQL (Microsoft Defender) hunting query used to identify any machine in the environment that shows similar malicious beaconing to tt.vg or its associated IP addresses.

DeviceNetworkEvents
| where InitiatingProcessFileName == "WINWORD.EXE"
| where RemoteUrl in ("tt.vg")
   or RemoteIp in ("188.114.96.3","188.114.97.3","172.67.138.42")

🎯 Purpose: expand a single sandbox detonation into a full enterprise-wide hunt.

🧩 11. What This Lab Demonstrates

This lab demonstrates your ability to analyze a real-world phishing DOCX sample end-to-end, following a complete SOC-grade methodology:

• Understanding how CVE-2017-0199 is triggered inside Microsoft Word.
• Tracking how WINWORD.EXE becomes an unexpected HTTP/S client.
• Extracting Network IOCs (domains, URLs, IPs, JA3 TLS hashes).
• Analyzing dropped files, recent shortcuts, and registry access for forensic value.
• Transforming all findings into Sigma, Suricata, and EDR hunting queries.

In other words — this lab doesn’t stop at detonation. It extracts real, actionable detection intelligence exactly like a professional SOC analyst.

Designed & Documented by Ahmed Tarek — Blue Team