Categories: Malware

New Malicious Macro that Hijacks your Windows Desktop Shortcuts and Points to Download Malware

Cybercriminals using a malicious macro that changes the target of Desktop Shortcuts to download malware and when the user clicks on the altered shortcut file, the malware executes.

With this new campaign, attackers used common tools like WinRAR, and Ammyy Admin to gather information instead of their own tools.

Security researchers from Trend Micro uncovered the new campaign, the malware and macro are not sophisticated and researchers believe that malware development was not yet completed.

Malicious Macro Infection Chain

The attack starts with a malicious word document that contains contents written in Russian with a house image and it instructs users to enable macro’s to get the full document.

Once the user enables macro it searches for the shortcut files in desktop and replace’s with the corresponding linked files. It primarily targets file shortcut files that include Skype, Google Chrome, Mozilla Firefox, Opera, and Internet Explorer.

malicious macromalicious macro

If the user executes the shortcut from the desktop shortcut or Quick launch bar it executes the malware instead of the original file.

Once the malware triggered it drops WpmPrvSE.exe in system32 or SysWoW64 depending on the operating system type and it starts up a service called WPM Provider Host, which allow’s application on your computer to request system information.

Along with WpmPrvSE.exe it also drops a rar.exe, possibly for later use and then it recovers’s the shortcut files to its original state again.

Researchers say that “While the malware is working, the malicious service that the malware activated would already be downloading the final payloads. It downloads a RAR archive from Google Drive and GitHub.”

Malware infection chain

The download RAR archive contains config file, key, and other tools, the installer file run through the certutil command-line program and also it decodes the wsvchost[.]key the file which is the actually a well-known remote desktop utility Ammyy Admin.

By installing Ammyy Admin on user’s system and granting full permission to attackers ID via malware, an attacker could get full system access through Ammyy Admin. Trend Micro published a detailed analysis report.

Microsoft has macro’s disabled by default an it is not recommended to enable and download macro for documents form unknow resources. Also, Microsoft shows warning while enabling macros.

Researchers said the malware is not widely distributed and it is still in the PoC stage and will have further versions.

Also Read

60,000 Android Devices are Infected with Malicious Battery Saver App that Steals Various Sensitive Data

MyloBot – Highly Sophisticated Botnet Shutdown Windows Defender & Blocking Ports on the Firewall

GZipDe – A Sophisticated Malware Attack using Metasploit Backdoor with Encrypted Payload

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations, particularly…

4 hours ago

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search Service…

5 hours ago

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider, has…

5 hours ago

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800 compromised…

5 hours ago

Hackers Bypass AI Filters from Microsoft, Nvidia, and Meta Using a Simple Emoji

Cybersecurity researchers have uncovered a critical flaw in the content moderation systems of AI models…

6 hours ago

Microsoft Alerts That Default Helm Charts May Expose Kubernetes Apps to Data Leaks

Microsoft’s cybersecurity research team has issued a stark warning about the risks of using default…

6 hours ago