Using Microsoft Word macros as a vector for the propagation of malware has been mined by many cybercriminals in the past. But there has been an effort lately to take this vector to another level, CSO Online reported. What’s new is that the macros allow fileless malware to load onto a machine’s memory.

Phishing Emails, Macros and More

Palo Alto Networks found about 1,500 phishing emails being used in a campaign it called PowerSniff. These emails were crafted with more personally relevant information than is usually seen in such spam attempts.

Phishers usually included information designed to engender a feeling of trust, perhaps by offering something like a fellow worker’s location. The emails were all developed with social engineering techniques that focused on encouraging the recipient to click on the poisoned link.

Once the attachment was opened, the embedded macro would create a hidden instance of powershell.exe that contained special command-line arguments. Since PowerShell has its own scripting language, commands formed in that language will be executed.

Fileless Malware at Work

First, the malware sees if the machine is running a 32- or 64-bit Windows OS version using the result of a check against the size of the IntPtr object type. The malware payload that corresponds to the configuration of the target machine is then downloaded.

Here comes the new part of the technique: The malware powershell.exe goes on to stuff the downloaded PowerShell commands directly into memory rather than create an additional file to be read back at a later step. Loading the malware straight into memory makes it more potent; intermediate steps are reduced or eliminated in its path because of where it is located.

CSO Online noted that the malware that ends up in memory performs many tasks. “First it tries to determine if the environment is a virtual machine or sandbox like those used by malware analysts,” author Lucian Constantin wrote.

“It then scans the network configuration for strings like school, hospital, college, health and nurse. It also scans the network for other machines with names including teacher, student, schoolboard, pediatrics, orthoped, as well as POS, store, shop and sale. Cached URLs are scanned for a number of financial websites and names like Citrix and XenApp.”

If the malware finds its named target, a dynamic link library associated with that target is downloaded from its command-and-control server.

The Technique Has Spread

A similar combination of PowerShell and fileless malware was observed by the SANS Institute’s Internet Storm Center. It’s not just PowerSniff, either; the InfoSec Handlers Diary Blog has specifics about variants of this technique that are now showing up, as well.

It bears repeating: Make sure employees don’t open suspicious attachments on Word documents. This exploit is just one of the many bad things that may happen if effective caution isn’t used.