Macro is a set of commands that automates a software to perform a certain action. Threat actors took advantage of this and came up with Macro Malwares. This form of malware is known for being abusive of the VBA (Visual Basic for Application) programming in Microsoft Office macros to spread other forms of malware. These are often delivered through phishing emails, wherein the attacker lures the recipient to open the attached document. Once opened, security warning will show on the page and the document will instruct the recipient to “Enable Content”. After that, the macro will run and the recipient is affected.

What the malicious macro typically does upon enabling is that it executes a base64 PowerShell code which will download a file in %UserProfile% or in %Temp%. This downloaded file will run soon afterwards.

Infection Chain:

Behaviors:

• Delivers other malware payloads
• Uses macro
• Steals computer data, computer name, system local, operating system (OS) version and running processes

Impact:

• Compromised system security, with backdoor capabilities that can execute malicious commands

Sample Spam (Invoice Attachment)

Sample Document - "Enable Content"

• MS Word

  

• MS Excel

  

Sample Macro

• MS Word

  

• MS Excel

  

MITRE ATT&CK Matrix