Analyzing Malicious Office Macros GREM Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A malicious Excel macro contains the following code: "url = "hxxp://malicious.example/update"" and later "Shell("powershell -w hidden -enc ...")". The macro downloads a file and then executes it. Which two IOCs should the analyst extract for detection?

   • AThe file hash of the macro document and the author's email address
   • BThe system's public IP address and the hostname
   • CThe VBA project password and the macro name
   • DThe URL and the PowerShell command line
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a legacy auto macro that runs when an Office document is opened?

   • AWorkbook_Activate
   • BAuto_Close
   • CAuto_Open
   • DDocument_Close
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary benefit of using a sandbox to analyze a malicious macro?

   • AIt automatically decodes all obfuscated strings
   • BIt prevents the macro from causing harm to the host system
   • CIt guarantees the macro will execute successfully
   • DIt removes the need for static analysis
   Reveal Solution Discussion Select an answer first
5. 29application · easy

   A security analyst is analyzing a malicious .xlsm file. The extracted VBA code contains a subroutine named Workbook_Open() that calls a function to decode a string and then uses CreateObject("WScript.Shell") to run the decoded command. When the analyst opens the file in a sandbox with macros enabled, the command executes. Which event triggered the macro?

   • AThe Workbook_Open event fired automatically when the workbook was opened
   • BThe user manually ran the macro from the Developer tab
   • CThe Auto_Open macro in a standard module executed first
   • DThe Document_Open event from a linked Word document triggered it
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A malicious Excel macro uses the following VBA code: 'Shell "powershell.exe -enc ..."'. What is the most likely payload delivery technique being used?

   • ACreating a scheduled task to run the command at a later time.
   • BSpawning a process to execute a PowerShell command.
   • CWriting a file to disk and then executing it later.
   • DDownloading a file from a remote server using URLDownloadToFile.
   Reveal Solution Discussion Select an answer first