Summary

Microsoft Excel provides a feature to its user which allows one to hide worksheets. Worksheet state is “visible” by default which can be changed to “hidden” or “very hidden”. The malicious MS-Excel files are found to be leveraging this feature to hide worksheet carrying malicious Excel 4.0 macro. These old macros have been supported since way back Excel ver.5 (1993) up to Excel 2016, thus Microsoft has been encouraging its users to use the latest version of Microsoft Visual Basic for Application (VBA).

The difference of these malwares from other formula macro malwares is that the spreadsheet is set to "Very Hidden". These are hidden spreadsheets that cannot be unhidden from Excel’s user interface, and requires a 3rd party tool should the user want to unhide it. With the macro being inside the spreadsheet, this cannot be viewed from the VB Macro window.

These files are usually propagated thru spam using socially engineered techniques like citing current events such as the COVID-19 outbreak to grab the receiver’s attention. The download URL structure, technique used, and macro code is similar to that of a campaign that delivered Zloader and URSNIF as a payload. These malicious Excel files are detected by Trend Micro as FORMULOAD and HIDDBOOK.

Infection Chain

Behaviors

• Use of normal Office function to deploy malicious code
• Automatic start of malicious code without user consent

Capabilities

• Download Routine
• Registry Editing

Impact

• Compromised system security - downloads and installs additional malware:
  • Exfiltration Over Command and Control Channel
  • Remote Command Execution

Indicators of Compromise

Please refer to this document on Excel Files with Hidden Sheets Target Users in Italy .