old_contents: # Copyright (C) 2010-2015 Cuckoo Foundation.
  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
  # See the file 'docs/LICENSE' for copying permission.
  
  from _winreg import HKEY_CURRENT_USER
  
  from lib.common.abstracts import Package
  
  class DOC(Package):
      """Word analysis package."""
      PATHS = [
          ("ProgramFiles", "Microsoft Office", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "Office11", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "Office12", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "Office14", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "Office15", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office 15", "root", "office15", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "WORDVIEW.EXE"),
      ]
  
      REGKEYS = [
          [
              HKEY_CURRENT_USER,
              "Software\\Microsoft\\Office\\12.0\\Common\\General",
              {
                  # "Welcome to the 2007 Microsoft Office system"
                  "ShownOptIn": 1,
              },
          ],
      ]
  
      def start(self, path):
          word = self.get_path("Microsoft Office Word")
          return self.execute(word, args=[path])
  
new_contents: # Copyright (C) 2010-2015 Cuckoo Foundation.
  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
  # See the file 'docs/LICENSE' for copying permission.
  
  from _winreg import HKEY_CURRENT_USER
  
  from lib.common.abstracts import Package
  
  class DOC(Package):
      """Word analysis package."""
      PATHS = [
          ("ProgramFiles", "Microsoft Office", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "Office11", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "Office12", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "Office14", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "Office15", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office 15", "root", "office15", "WINWORD.EXE"),
          ("ProgramFiles", "Microsoft Office", "WORDVIEW.EXE"),
      ]
  
      REGKEYS = [
          [
              HKEY_CURRENT_USER,
              "Software\\Microsoft\\Office\\12.0\\Common\\General",
              {
                  # "Welcome to the 2007 Microsoft Office system"
                  "ShownOptIn": 1,
              },
          ],
          [
              HKEY_CURRENT_USER,
              "Software\\Microsoft\\Office\\12.0\\Word\\Security",
              {
                  # Enable VBA macros in Office 2007.
                  # TODO Do this for all Office products.
                  "VBAWarnings": 1,
                  "AccessVBOM": 1,
              },
          ],
      ]
  
      def start(self, path):
          word = self.get_path("Microsoft Office Word")
          return self.execute(word, args=[path])
  
subject: enable macros in word