Thursday, July 25, 2024

Hackers Uses New Technique to Disable Macro Security To Launch a Weaponized MS Office Documents

Nowadays the attack rate of phishing campaigns has increased so much, that it’s becoming normal to encounter such attacks. 

Generally, the threat actors of phishing campaigns make use of Microsoft Office documents as their weapon to prompt victims to enable macros so that they can easily target the infection chain.

Day by day the techniques of the threat actors are evolving so that they can evade detection to perform a successful attack. 

The new techniques that are being utilized by the threat actors are using macro obfuscation, DDE, living off the land tools (LOLBAS), and even using legacy-supported XLS formats to execute all their operations.

Recently during a daily investigation, the experts of McAfee Labs have detected a very new method that is being used by the threat actors in phishing campaigns. This method downloads and executes malicious DLLs (Zloader) without any ill-disposed code that represents in the initial spammed attachment macro.

The malware that has been detected by the experts is known as a ZeuS banking trojan, and according to the report, this malware has been noted in the following countries:-

  • The U.S.
  • Canada
  • Spain
  • Japan
  • Malaysia

Infection Chain

The experts came to know about this campaign through an email, that has a document that is presented in Microsoft Word, and whenever someone will open the document and macros are allowed, soon the document will start downloading and then another password-protected Microsoft Excel document pop-ups.

Once the downloads are done, from the XLS the Word VBA starts reading the cell; soon after it produces a new macro for the XLS file. After that, the Word document inserts the policy in the registry so that it can easily Disable Excel Macro Warning.

Word and VBA Macro Analysis

In order to keep it safe, the macros are disabled to operate by default by Microsoft Office, but the hackers are familiar with this, and that’s why they present a fake image to fool the victims so that they will allow the macros.

However, the excel file that is saved in the malicious domain generally produces an Excel application object simply utilizing the CreateObject() function and interpret the string from Combobox-1 of Userform-1 that has the string excel.

Techniques & tactics used by the malware

There are some techniques and tactics that have been used by the malware, and here we have mentioned them below:-

  • E-mail Spear Phishing (T1566.001)
  • Execution (T1059.005)
  • Defense Evasion (T1218.011)
  • Defense Evasion (T1562.001)

The experts are trying to get all the loopholes of this malware, and because of some security affairs, for now, macros are impaired by default in Microsoft Office applications. 

But, after the investigation, the security researchers affirmed that it is safe to allow macros when the document is collected from any reliable authorization.


TypeValueScannerDetection NameDetection Package Version (V3)
Main Word Document210f12d1282e90aadb532e7e891cbe4f089ef4f3ec0568dc459fb5d546c95eafENSW97M/Downloader.djx4328
Downloaded dllc55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2ENSZloader-FCVP4327
URL to download XLShxxp:// BlockedN/A
URL to download dllhxxp:// BlockedN/A

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

ShadowRoot Ransomware Attacking Organizations With Weaponized PDF Documents

A rudimentary ransomware targets Turkish businesses through phishing emails with ".ru" domain sender addresses....

BreachForumsV1 Database Leaked: Private messages, Emails & IP Exposed

BreachForumsV1, a notorious online platform for facilitating illegal activities, has reportedly suffered a massive...

250 Million Hamster Kombat Players Targeted Via Android And Windows Malware

Despite having simple gameplay, the new Telegram clicker game Hamster Kombat has become very...

Beware Of Malicious Python Packages That Steal Users Sensitive Data

Malicious Python packages uploaded by "dsfsdfds" to PyPI infiltrated user systems by exfiltrating sensitive...

Chinese Hackers Using Shared Framework To Create Multi-Platform Malware

Shared frameworks are often prone to hackers' abuses as they have been built into...

BlueStacks Emulator For Windows Flaw Exposes Millions Of Gamers To Attack

A significant vulnerability was discovered in BlueStacks, the world's fastest Android emulator and cloud...

Google Chrome 127 Released with a fix for 24 Security Vulnerabilities

Google has unveiled the latest version of its Chrome browser, Chrome 127, which is...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles