ahmed-tarek22752/rce-cve-2017-0199-detection-analysis
This repository contains a full blue-team malware analysis of a real malicious DOCX exploiting CVE-2017-0199. The lab includes sandbox execution, network forensics, IOC extraction, MITRE ATT&CK mapping, dropped files review, and detection rules. Evidence screenshots are included inside the evidence folder for professional documentation.
Advanced Malware Detonation • Exploit Behaviour • IOCs • Detection Engineering.
This repository documents a **real malicious DOCX** file exploiting the **CVE-2017-0199** Microsoft Office RCE vulnerability. The sample was detonated inside a **Windows 10 ANY.RUN sandbox**, exposing:
✔ Full exploit chain
✔ Network callbacks to malicious domain (tt.vg)
✔ Dropped files & temp artefacts
✔ JA3 fingerprints
✔ Registry activity
✔ HTTP/HTTPS beaconing from WINWORD.EXE
✔ Full Blue-Team IOCs & detection rules
A document titled “BankPaymAdviceVend.Report.docx” was received through a phishing email.
Once detonated, ANY.RUN instantly marked it as Malicious and linked it to:
tt.vg/BVhaS
| Field | Value |
|---|---|
| File | BankPaymAdviceVend.Report.docx |
| Verdict | Malicious activity |
| Tags | cve-2017-0199, exploit |
| MD5 | 22EDED727467A9A26F3FD311A12A7E |
| SHA1 | 6738D1A969193459C7C7579956269D77FED8D26F |
| SHA256 | 2E1408013503C...3D6EAF9 |
| Sandbox | Windows 10 Pro x64 |
| Behaviour | Exploit → Network beaconing → Dropped files |
[ Malicious DOCX ] │ ▼ [ User Opens in Word ] │ ▼ [CVE-2017-0199 Exploit Triggers] │ ▼ [WINWORD.EXE → tt.vg via HTTP/HTTPS] │ ▼ [Remote Path: /BVhaS (GET / HEAD / OPTIONS)] │ ▼ [Temp Files, EMF Objects, Cache Files Dropped] │ ▼ [Potential Next Stage Payload — Server Returned 404]
yaml Copy code
Only one domain was malicious:
| Domain | Reputation |
|---|---|
| tt.vg | 🔴 malicious |
Resolved IPs:
188.114.96.3 188.114.97.3 172.67.138.42 (TLS v1.2)
yaml Copy code
Word tried to fetch:
GET /BVhaS HEAD /BVhaS OPTIONS / Host: tt.vg User-Agent: Microsoft Office / MSIE 7 spoof
yaml Copy code
Typical captured request:
GET /BVhaS HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0...) Connection: Keep-Alive Host: tt.vg
arduino Copy code
Server responded:
HTTP/1.1 404 Not Found
yaml Copy code
.tmp files.glox graphic objects%LOCALAPPDATA%\INetCache\Content.MSO\*.emf.LNKindex.dat logsWord accessed:
HKCU\Software\Microsoft\Office\14.0... HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings... HKLM\System\ControlSet001\Services\Tcpip\Parameters\Interfaces...
yaml Copy code
✔ Normal For Office
❌ Combined with exploit = clear malicious behaviour
Type: Remote Code Execution
Trigger: Malicious DOCX loads remote HTA without user interaction
Introduced: Microsoft Word 2007–2016
Impact: Attacker executes arbitrary code
This sample attempts to load a remote payload from:
yaml Copy code
Domain: tt.vg
IPs: 188.114.96.3 188.114.97.3 172.67.138.42
shell Copy code
091f51a7a1c3a4504a224cc081ce9cee 46f5131e766d248db0248a86c494b71c 65005c9d9ae0f0ebeaf22c210571d482 ...
yaml Copy code
This section converts the technical analysis of BankPaymAdviceVend.Report.docx into practical, production-ready detection artifacts that a SOC or Blue Team can immediately deploy. It includes Sigma rules, Suricata IDS signatures, and EDR hunting queries.
This Sigma rule detects any network connection initiated by WINWORD.EXE
towards the suspicious short domain tt.vg inside Windows network logs.
title: WINWORD Connecting To Suspicious Short Domain tt.vg
id: 0b2a5f3d-ttvg-word
status: experimental
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: '\WINWORD.EXE'
DestinationHostname: 'tt.vg'
condition: selection
level: high
tags:
- attack.command_and_control
- attack.t1071.001
- cve.2017-0199
💡 Any outdated Office system contacting tt.vg through WINWORD.EXE
should trigger an immediate investigation.
/BVhaS on tt.vg
A Suricata IDS rule that identifies an Office-originated request for
GET /BVhaS on the malicious domain tt.vg.
This catches the exploit’s attempted payload retrieval.
alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"C2 – Office WINWORD GET /BVhaS on tt.vg";
flow:established,to_server;
http.method; content:"GET";
http.uri; content:"/BVhaS"; nocase;
http.host; content:"tt.vg"; nocase;
http.user_agent; content:"MSOffice"; nocase;
reference:cve,2017-0199;
classtype:trojan-activity;
sid:4200010;
rev:1;
)
🔥 Highly effective in environments using Suricata or Zeek to monitor outbound traffic.
A KQL (Microsoft Defender) hunting query used to identify any machine in the environment
that shows similar malicious beaconing to tt.vg or its associated IP addresses.
DeviceNetworkEvents
| where InitiatingProcessFileName == "WINWORD.EXE"
| where RemoteUrl in ("tt.vg")
or RemoteIp in ("188.114.96.3","188.114.97.3","172.67.138.42")
🎯 Purpose: expand a single sandbox detonation into a full enterprise-wide hunt.
This lab demonstrates your ability to analyze a real-world phishing DOCX sample end-to-end, following a complete SOC-grade methodology:
WINWORD.EXE becomes an unexpected HTTP/S client.In other words — this lab doesn’t stop at detonation. It extracts real, actionable detection intelligence exactly like a professional SOC analyst.
Designed & Documented by Ahmed Tarek Salah(thaqib)