From Word document to Ransomware? Investigate How Template Injection is Used to Execute Macros.

[@Hartley94]

Thank you, DR. Josh. Great insight into the malware analysis world.

[@jstrosch]

Glad you enjoyed it and you're most welcome!

[@x0rZ15t]

Thank you very much Josh. Fantastic content as usual!

[@jstrosch]

Thank you 😊

[@tysonbenson]

Josh - Fantastic comment as always. Do you plan on making a video on how to obtain the template document from a pcap file or have any resources for safely obtaining the template document via other means?

[@kwesi_Osibor]

very good training. Do you organize a private class for malware analysis?

[@jstrosch]

Yes, I have in the past but haven't had the time to offer anything lately.

[@nyshone]

As soon as user clicks Enable Content, it pulls that remote macro and executes it right away? Or does it require any more user interaction?

[@jstrosch]

Once the user opens the document, it will request the remote template and load it. Since this remote template contains macros, the user will still see the enable content ribbon. if they enable that, then macros are executed and the next stage downloaded. One reason I didn't show the full sequence of events is simply because I didn't have anything running to resolve the DNS and serve the template file, it's no longer found at the original URL. I'm planning to create a follow-up video using fakenet-ng to show how to do this though :)

[@pacificp]

when the ransomware code will be executed? Just opening the word docs or once click on enable editing button.

[@jstrosch]

Great question and sorry I didn't make that clear - when the user clicks the "Enable Editing" or "Enable Content" button.

[@pacificp]

@@jstrosch Thanks