Microsoft Excel Encryption Vulnerability Paves the Way for Malware
 

Editor’s note: Thanks to Mimecast Threat Center’s Doron Attias and Tal Dery for this discovery.

Mimecast Threat Center researchers have discovered a rise in the LimeRAT malware delivery using Microsoft Excel spreadsheet’s VelvetSweatshop default password. This new research demonstrates that making an Excel file read-only - as opposed to locking it - encrypts the file without the need for an external created password to open it, making it easier to fool a victim into installing the malware.

How VelvetSweatshop Paved the Way for Malware Delivery

Microsoft Office® files are some of the most popular file formats for the delivery of email-borne malware. The Microsoft Office applications that can open and run these files are broadly deployed, the files are easy to change to avoid simple file signature-based detection, are macro-enabled to make running custom code easy, and are regularly distributed by consumers and businesspeople via email. Certainly, few are ever surprised to receive invoices or financial spreadsheet attachments via email.

However, ease of use and broad deployment have drawbacks. This popularity means that exploiting Excel files has been a part of cybercriminals’ standard attack arsenal for a long time, and receiving password-protected Excel files is also a standard business practice, given the interesting or sensitive content.

Excel files are designed to be easily encrypted prior to being emailed, which helps attackers evade detection by common malware detection systems. When you lock an Excel file with a password, you are encrypting the entire file using the password as the encryption/decryption key. To open the file, the intended victim would need the same password. When a victim receives an encrypted attachment in a social engineered email, the victim is encouraged to use the password included in the phishing email to open the attached file. Just like that, the victim is pwned!

But what if attackers could deliver a malicious, encrypted Excel file without requiring the intended victim to do anything other than open the attached file? Skip the part of needing to encourage them to insert the password – slipping through all network defenses. Just a simple double-click of the file would do the trick.

To decrypt a given encrypted Excel file, Excel first tries to use the embedded, default password, “VelvetSweatshop,” to decrypt and open the file and run any onboard macros or other potentially malicious code, while keeping the file read-only. If it fails to decrypt the file using the “VelvestSweatshop” password, Excel will request that the user insert a password, as shown in Figure 1 below. The advantage of the read-only mode for Excel to the attacker is that it requires no user input, and the Microsoft Office system will not generate any warning dialogs other than noting the file is read-only. Using this read-only technique, the attacker can reap the obfuscation benefits of file encryption without requiring anything further from the user, taking away one step required of the intended victim for exploitation to occur.

Figure 1: A password is needed to get access to a locked Excel file

LimeRAT Malware Exploited in the Wild

Recently, Mimecast threat intelligence researchers came across a campaign which used this Excel VelvetSweatshop encryption technique to deliver LimeRAT, a malicious remote access trojan.

In this specific attack, the cybercriminals also used a blend of other techniques in an attempt to fool anti-malware systems by encrypting the content of the spreadsheet hence hiding the exploit and payload.

Once LimeRAT has landed, the attacker has many capabilities at his or her fingertips, including delivering ransomware, a cryptominer, a keylogger, or creating a bot client.

Of course, given the general capability inherent with this Excel-based malware delivery technique, any type of malware is a good candidate for delivery, so Mimecast researchers expect to see it used in many more malicious phishing campaigns in the future. Mimecast Threat Center has alerted Microsoft to this campaign.  

How to Defend Your Organization Against Payload Malware

Due to the popularity and ease of use of Microsoft Excel spreadsheet, the VelvetSweatshop technique that has risen again to deliver LimeRAT malware will likely prove to be especially dangerous. Follow these steps to mitigate your risk.

• Train your users to scrutinize all received emails, particularly those with file attachments. While this attack technique reduced the need for user involvement, it did not eliminate it altogether, as receivers were still required to open the file.
• Use an email security system with advanced malware protection capabilities that are designed to include both static file analysis as well as sandboxing to filter out these malicious emails before delivery.
• Monitor your network traffic for outbound connections to likely command-and-control services.
• Continuously update your endpoint security system to increase the likelihood of detecting malicious software loading or running on the host.

Reach out to Mimecast for more information or detail on this research.

This Threat Intelligence Research blog is for general information purposes only, and should not be used as a substitute for consultation with professional advisors. Mimecast Services Limited and its affiliates (collectively, “Mimecast”) have exercised reasonable care in the collecting, processing, and reporting of this information but have not independently verified, validated, or audited the data to verify the accuracy or completeness of the information. Mimecast shall not be responsible for any errors or omissions contained on this Threat Intelligence Research blog, and reserves the right to make changes anytime without notice. Mention of non-Mimecast products or services is provided for informational purposes only and constitutes neither an endorsement nor a recommendation by Mimecast. All Mimecast and third-party information provided in this Blog is provided on an “as is” basis.  MIMECAST DISCLAIMS ALL WARRANTIES, EXPRESSED OR IMPLIED, WITH REGARD TO ANY INFORMATION (INCLUDING ANY SOFTWARE, PRODUCTS, OR SERVICES) PROVIDED IN THIS BLOG, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. Some jurisdictions do not allow the exclusion of implied warranties, so the above exclusion may not apply to you. In no event shall Mimecast be liable for any damages whatsoever, and in particular Mimecast shall not be liable for direct, special, indirect, consequential, or incidental damages, or damages for lost profits, loss of revenue or loss of use, cost of replacement goods, loss or damage to data arising out of the use or inability to use any Mimecast website, any Mimecast solution. This includes damages arising from use of or in reliance on the documents or information present on this Blog, even if Mimecast has been advised of the possibility of such damages.

Mimecast is either a registered trademark or trademark of Mimecast Services Limited in the United States and/or other countries.   All other trademarks are the property of their respective owners.