Hackers Uses New Technique to Disable Macro Security To Launch a Weaponized MS Office Documents

Nowadays the attack rate of phishing campaigns has increased so much, that it’s becoming normal to encounter such attacks. 

Generally, the threat actors of phishing campaigns make use of Microsoft Office documents as their weapon to prompt victims to enable macros so that they can easily target the infection chain.

Day by day the techniques of the threat actors are evolving so that they can evade detection to perform a successful attack. 

The new techniques that are being utilized by the threat actors are using macro obfuscation, DDE, living off the land tools (LOLBAS), and even using legacy-supported XLS formats to execute all their operations.

Recently during a daily investigation, the experts of McAfee Labs have detected a very new method that is being used by the threat actors in phishing campaigns. This method downloads and executes malicious DLLs (Zloader) without any ill-disposed code that represents in the initial spammed attachment macro.

The malware that has been detected by the experts is known as a ZeuS banking trojan, and according to the report, this malware has been noted in the following countries:-

• The U.S.
• Canada
• Spain
• Japan
• Malaysia

Infection Chain

The experts came to know about this campaign through an email, that has a document that is presented in Microsoft Word, and whenever someone will open the document and macros are allowed, soon the document will start downloading and then another password-protected Microsoft Excel document pop-ups.

Once the downloads are done, from the XLS the Word VBA starts reading the cell; soon after it produces a new macro for the XLS file. After that, the Word document inserts the policy in the registry so that it can easily Disable Excel Macro Warning.

Word and VBA Macro Analysis

In order to keep it safe, the macros are disabled to operate by default by Microsoft Office, but the hackers are familiar with this, and that’s why they present a fake image to fool the victims so that they will allow the macros.

However, the excel file that is saved in the malicious domain generally produces an Excel application object simply utilizing the CreateObject() function and interpret the string from Combobox-1 of Userform-1 that has the string excel.

Techniques & tactics used by the malware

There are some techniques and tactics that have been used by the malware, and here we have mentioned them below:-

• E-mail Spear Phishing (T1566.001)
• Execution (T1059.005)
• Defense Evasion (T1218.011)
• Defense Evasion (T1562.001)

The experts are trying to get all the loopholes of this malware, and because of some security affairs, for now, macros are impaired by default in Microsoft Office applications. 

But, after the investigation, the security researchers affirmed that it is safe to allow macros when the document is collected from any reliable authorization.

IOC

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.