Patchfirst

Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider

QuoIntelligence · 29 Nov 2018 · github.com · Licence: CC-BY-SA-4.0; sources/annoctr/LICENSE.txt

Read the original ↗

CVEs this report names

3 CVEs
  1. CVE-2017-11882Microsoft Office Memory Corruption Vulnerability
    Microsoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter13 reports
    99.9%Top 0.03%
    88.5priority
  2. CVE-2018-0802Microsoft Office Memory Corruption Vulnerability
    Microsoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution8 reports
    93.3%Top 0.17%
    88.4priority
  3. CVE-2018-8174Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 7.5T1189Drive-by CompromiseT1059Command and Scripting Interpreter2 reports
    88.2%Top 0.23%
    84.3priority

Where it names them

CVE-2017-11882
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Original (opens in a new tab) ↗
CVE-2018-0802
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Original (opens in a new tab) ↗
CVE-2018-8174
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Original (opens in a new tab) ↗

Techniques drawn from this report

6 links, in kill-chain order

Initial Access Phishing T1566 for CVE-2017-11882

Labelled by dataset annotators

**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Original (opens in a new tab) ↗

Initial Access Phishing T1566 for CVE-2018-0802

Labelled by dataset annotators

**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Original (opens in a new tab) ↗

Initial Access Phishing T1566 for CVE-2018-8174

Labelled by dataset annotators

**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Original (opens in a new tab) ↗

Execution Exploitation for Client Execution T1203 for CVE-2017-11882

MITRE CTID mapping of the CVE

**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Original (opens in a new tab) ↗

Execution Exploitation for Client Execution T1203 for CVE-2018-8174

MITRE CTID mapping of the CVE

**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Original (opens in a new tab) ↗

Execution Exploitation for Client Execution T1203 for CVE-2018-0802

AI mapping from the description

**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close