Thursday, April 18, 2024

Hackers Uses New Technique to Disable Macro Security To Launch a Weaponized MS Office Documents

Nowadays the attack rate of phishing campaigns has increased so much, that it’s becoming normal to encounter such attacks. 

Generally, the threat actors of phishing campaigns make use of Microsoft Office documents as their weapon to prompt victims to enable macros so that they can easily target the infection chain.

Day by day the techniques of the threat actors are evolving so that they can evade detection to perform a successful attack. 

The new techniques that are being utilized by the threat actors are using macro obfuscation, DDE, living off the land tools (LOLBAS), and even using legacy-supported XLS formats to execute all their operations.

Recently during a daily investigation, the experts of McAfee Labs have detected a very new method that is being used by the threat actors in phishing campaigns. This method downloads and executes malicious DLLs (Zloader) without any ill-disposed code that represents in the initial spammed attachment macro.

The malware that has been detected by the experts is known as a ZeuS banking trojan, and according to the report, this malware has been noted in the following countries:-

  • The U.S.
  • Canada
  • Spain
  • Japan
  • Malaysia

Infection Chain

The experts came to know about this campaign through an email, that has a document that is presented in Microsoft Word, and whenever someone will open the document and macros are allowed, soon the document will start downloading and then another password-protected Microsoft Excel document pop-ups.

Once the downloads are done, from the XLS the Word VBA starts reading the cell; soon after it produces a new macro for the XLS file. After that, the Word document inserts the policy in the registry so that it can easily Disable Excel Macro Warning.

Word and VBA Macro Analysis

In order to keep it safe, the macros are disabled to operate by default by Microsoft Office, but the hackers are familiar with this, and that’s why they present a fake image to fool the victims so that they will allow the macros.

However, the excel file that is saved in the malicious domain generally produces an Excel application object simply utilizing the CreateObject() function and interpret the string from Combobox-1 of Userform-1 that has the string excel.

Techniques & tactics used by the malware

There are some techniques and tactics that have been used by the malware, and here we have mentioned them below:-

  • E-mail Spear Phishing (T1566.001)
  • Execution (T1059.005)
  • Defense Evasion (T1218.011)
  • Defense Evasion (T1562.001)

The experts are trying to get all the loopholes of this malware, and because of some security affairs, for now, macros are impaired by default in Microsoft Office applications. 

But, after the investigation, the security researchers affirmed that it is safe to allow macros when the document is collected from any reliable authorization.


TypeValueScannerDetection NameDetection Package Version (V3)
Main Word Document210f12d1282e90aadb532e7e891cbe4f089ef4f3ec0568dc459fb5d546c95eafENSW97M/Downloader.djx4328
Downloaded dllc55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2ENSZloader-FCVP4327
URL to download XLShxxp:// BlockedN/A
URL to download dllhxxp:// BlockedN/A

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Palo Alto ZeroDay Exploited in The Wild Following PoC Release

Palo Alto Networks has disclosed a critical vulnerability within its PAN-OS operating system, identified...

FIN7 Hackers Attacking IT Employees Of Automotive Industry

IT employees in the automotive industry are often targeted by hackers because they have...

Russian APT44 – The Most Notorious Cyber Sabotage Group Globally

As Russia's invasion of Ukraine enters its third year, the formidable Sandworm (aka FROZENBARENTS,...

SoumniBot Exploiting Android Manifest Flaws to Evade Detection

A new banker, SoumniBot, has recently been identified. It targets Korean users and is...

LeSlipFrancais Data Breach: Customers’ Personal Information Exposed

LeSlipFrancais, the renowned French underwear brand, has confirmed a data breach impacting its customer...

Cisco Hypershield: AI-Powered Hyper-Distributed Security for Data Center

Cisco has unveiled its latest innovation, Cisco Hypershield, marking a milestone in cybersecurity.This groundbreaking...

Phishing-as-a-Service Platform LabHost Seized by Authorities

Authorities have dismantled LabHost, a notorious cybercrime platform that facilitated widespread phishing attacks across...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles