Retour 
Co-authored by Gustavo Palazolo and Ghanashyam Satpathy
Summary
Several malware families are distributed via Microsoft Office documents infected with malicious VBA code, such as Emotet, IceID, Dridex, and BazarLoader. We have also seen many techniques employed by attackers when it comes to infected documents, such as the usage of PowerShell and WMI to evade signature-based threat detection. In this blog post, we will show three additional techniques attackers use to craft malicious Office documents.
Technique 01: VBA Code Executing Shellcode via Process Injection
The first technique involves a malicious VBA script that is used to execute a shellcode, which eventually leads to the deployment of other malware.
The VBA code is automatically executed with the “AutoOpen” feature, and from extracted macro code, we can see references to Windows APIs that are often used for process injection.
Going further, we can find a large array with integers, which are all the bytes of the shellcode.
And finally, we have the code that is responsible for executing the shellcode.
In this case, the code will be injected into “rundll32.exe” through a popular technique:
- A “rundll32.exe” process is created with CreateProcessA, named “RunStuff”;
- The code allocates a memory space in the process with VirtualAllocEx, named “AllocStuff”;
- The shellcode is written into the newly allocated space with WriteProcessMemory, named “WriteStuff”.
- Lastly, the shellcode is executed through CreateRemoteThread, named “CreateStuff”.
Once the shellcode is running, it contacts a malicious server to download the next stage, which can be any additional malware the attacker desires.