±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36738
New Yesterday: 0 Visitors: 134

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Excel Macro Screenshots (Author?)

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

neutralChaos
Newbie
 

Excel Macro Screenshots (Author?)

Post Posted: Nov 11, 19 08:04

Hi,
we had an incident, where a user opened a compromised excel file and activated excel-macros beforehand to do so.
Now, we've found screenshots which documented the "macro-activation-process" (timestamp matches 100%).
The screenshots where found in "/Users/Username/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/...."
-
Now the question is, who created those screenshots and why ?
Windows ? Office ?


Best regards  
 
  

Rich2005
Senior Member
 

Re: Excel Macro Screenshots (Author?)

Post Posted: Nov 11, 19 12:03

Your post doesn't really give enough information to answer your question but some malware actively captures screenshots of user activity (although the ones I've seen put it in a specific folder rather than the internet history files).  
 
  

keydet89
Senior Member
 

Re: Excel Macro Screenshots (Author?)

Post Posted: Nov 12, 19 12:26

Have you considered creating a timeline, in order to 'see' what was 'going on' around the time that the files were created?  
 

Page 1 of 1