Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks

Summary: Unit 42 documented a Sofacy persistence method it calls "Office Test," in which a malicious document creates the registry key HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf with a DLL path, causing Word's legitimate wwlib.dll to load the payload via LoadLibraryW each time an Office application opens. The technique worked in Word 2007, 2010, 2013, 2015 and 2016 but not 2003, and also in PowerPoint, Excel, Outlook, OneNote and Publisher; the key is not created by a default Office install and had been publicly described by Hexacorn in April 2014.

Why it matters: The key needs only current-user privileges to write, and Unit 42 found it can be neutralized by creating HKCU\Software\Microsoft\Office test and removing the user's write permission - a change Office does not need and that can be pushed by group policy.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related