Retour 
Summary
In April 2022, Netskope Threat Labs analyzed an Emotet campaign that was using LNK files instead of Microsoft Office documents, likely as a response to the protections launched by Microsoft in 2022 to mitigate attacks via Excel 4.0 (XLM) and VBA macros.
However, we recently came across hundreds of malicious Office documents that are being used to download and execute Emotet, indicating that some attackers are still using old delivery methods in the wild. Despite the protection Microsoft released in 2022 to prevent the execution of Excel 4.0 (XLM) macros, this attack is still feasible against users who are using outdated versions of Office. It is also feasible against users who have changed the default setting to explicitly enable macros. The fact that attackers are still using Excel 4.0 Macros indicates that outdated Office versions and users who have this protection disabled are still common.
By searching for similar files on VirusTotal, we found 776 malicious spreadsheets submitted between June 9, 2022 and June 21, 2022, which abuse Excel 4.0 (XLM) macros to download and execute Emotet’s payload. Most of the files share the same URLs and some metadata. We extracted 18 URLs out of the 776 samples, four of which were online and delivering Emotet.
In this blog post, we will analyze this Emotet campaign, showing the delivery mechanism to the last payload.
Stage 01 – Malicious Spreadsheets
The first stage is a malicious spreadsheet that abuses Excel 4.0 (XLM) macros to download and execute Emotet. These files are being delivered as email attachments.
There are also cases where the spreadsheet is attached within a password-protected ZIP file.
The spreadsheet contains a message to lure the user to remove the protected view by clicking the “Enable Editing” button.
The malicious code is obfuscated and spread across hidden spreadsheets and cells.
The code downloads the payload from an external URL via “URLDownloadToFileA” API and executes it with “regsvr32.exe”, which is a commonly used binary for the Living-off-the-Land technique.
Furthermore, most of the files we analyzed were authored by “Dream” and last saved either by “RHR