March 16, 2016 By Larry Loeb 2 min read

Using Microsoft Word macros as a vector for the propagation of malware has been mined by many cybercriminals in the past. But there has been an effort lately to take this vector to another level, CSO Online reported. What’s new is that the macros allow fileless malware to load onto a machine’s memory.

Phishing Emails, Macros and More

Palo Alto Networks found about 1,500 phishing emails being used in a campaign it called PowerSniff. These emails were crafted with more personally relevant information than is usually seen in such spam attempts.

Phishers usually included information designed to engender a feeling of trust, perhaps by offering something like a fellow worker’s location. The emails were all developed with social engineering techniques that focused on encouraging the recipient to click on the poisoned link.

Once the attachment was opened, the embedded macro would create a hidden instance of powershell.exe that contained special command-line arguments. Since PowerShell has its own scripting language, commands formed in that language will be executed.

Fileless Malware at Work

First, the malware sees if the machine is running a 32- or 64-bit Windows OS version using the result of a check against the size of the IntPtr object type. The malware payload that corresponds to the configuration of the target machine is then downloaded.

Here comes the new part of the technique: The malware powershell.exe goes on to stuff the downloaded PowerShell commands directly into memory rather than create an additional file to be read back at a later step. Loading the malware straight into memory makes it more potent; intermediate steps are reduced or eliminated in its path because of where it is located.

CSO Online noted that the malware that ends up in memory performs many tasks. “First it tries to determine if the environment is a virtual machine or sandbox like those used by malware analysts,” author Lucian Constantin wrote.

“It then scans the network configuration for strings like school, hospital, college, health and nurse. It also scans the network for other machines with names including teacher, student, schoolboard, pediatrics, orthoped, as well as POS, store, shop and sale. Cached URLs are scanned for a number of financial websites and names like Citrix and XenApp.”

If the malware finds its named target, a dynamic link library associated with that target is downloaded from its command-and-control server.

The Technique Has Spread

A similar combination of PowerShell and fileless malware was observed by the SANS Institute’s Internet Storm Center. It’s not just PowerSniff, either; the InfoSec Handlers Diary Blog has specifics about variants of this technique that are now showing up, as well.

It bears repeating: Make sure employees don’t open suspicious attachments on Word documents. This exploit is just one of the many bad things that may happen if effective caution isn’t used.

More from

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today