Documents with malicious macros deliver fileless malware to financial-transaction systems

Attackers are using Word documents with malicious macros and PowerShell to infect computers with fileless malware, researchers warn

Spammed Word documents with malicious macros have become a popular method of infecting computers over the past few months. Attackers are now taking it one step further by using such documents to deliver fileless malware that gets loaded directly in the computer's memory.

Security researchers from Palo Alto Networks analyzed a recent attack campaign that pushed spam emails with malicious Word documents to business email addresses from the U.S., Canada and Europe.

The emails contained the recipients' names as well as specific information about the companies they worked for, which is not typical of widespread spam campaigns. This attention to detail lent more credibility to spam messages and made it more likely that victims would open the attached documents, the researchers said.

The documents contained macros that, if allowed to run, execute a hidden instance of powershell.exe with special command-line arguments. Windows PowerShell is a task automation and configuration management framework that's included in Windows by default and comes with its own scripting language.

The PowerShell command executed in this case was designed to check if the Windows OS was a 32-bit or a 64-bit version and to download an additional PowerShell script that corresponded to the OS architecture.

The rogue script performs a variety of checks on the computer. First it tries to determine if the environment is a virtual machine or sandbox like those used by malware analysts. It then scans the network configuration for strings like school, hospital, college, health and nurse. It also scans the network for other machines with names including teacher, student, schoolboard, pediatrics, orthoped, as well as POS, store, shop and sale. Cached URLs are scanned for a number of financial websites and names like Citrix and XenApp.

According to the Palo Alto researchers, the goal of these checks is to find systems that are used to conduct financial transactions and to avoid systems that belong to security researchers as well as medical and educational institutions.

Only systems that match what the attackers are looking for are flagged and reported back to a command-and-control server. For those systems, the script downloads a malicious encrypted DLL (dynamic link library) file and load it into memory.

"Due to the target-specific details contained within the spam emails and the use of memory-resident malware, this particular campaign should be treated as a high threat," the Palo Alto researchers said in a blog post.

A similar combination of PowerShell and fileless malware was observed last week by researchers from the SANS Institute's Internet Storm Center.

That malware creates a registry key that launches a hidden PowerShell instance at every system start-up. The PowerShell command executes an encoded script that's stored in a separate registry key. Its goal is to decrypt and load an executable file directly into memory without ever writing it to disk.

"By using PowerShell the attackers have been able to put malware that might otherwise be detected on a hard drive into the Windows Registry," senior SANS instructor ​Mark Baggett, said in a blog post.

Storing malicious code in the system registry, abusing the Windows PowerShell and adding malicious macros to documents are not new techniques. However, their combination can make for very potent and hard-to-detect attacks.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?