A batch-file malware campaign disguises itself as document viewers (Word/HWP) and uses email distribution to download scripts tailored to the target’s anti-malware software. The operation is attributed to the Kimsuky group, leveraging Google Drive/Docs, registry persistence, LNK modification, and data exfiltration to remote servers. #Kimsuky #AhnLab
Keypoints
- The malware is distributed via email and disguised as viewers for document programs (e.g., Word, HWP).
- It downloads different scripts based on the detected anti-malware process (Kaspersky, Avast, Ahnlab v3) in the infected environment.
- It replaces the default document template (Normal.dotm) with a downloaded dotm containing VBA that executes cmd.exe.
- It uses Run Keys in the registry to achieve persistence (AutoRun for a downloaded VBScript).
- It modifies browser and Outlook shortcuts to trigger malicious commands when opened.
- It transmits gathered data to a remote server and uses web URLs for C2/updates, with multiple dropped scripts (video.vbs, onenote.vbs, asdfg.vbs).
MITRE Techniques
- [T1566.001] Phishing – The malware distribution path appears to be via email. “distribution path of the malware … appears that it is being distributed via email.”
- [T1036] Masquerading – Batch files are disguised to look like viewers for document programs such as Word and HWP. “identified batch files have been disguised to appear as viewers for document programs such as Word and HWP.”
- [T1105] Ingress Tool Transfer – The threat downloads multiple scripts based on the anti-malware process, e.g., “downloads different scripts based on the type of anti-malware process that is running in the user’s environment.”
- [T1547.001] Registry Run Keys/Startup Folder – It uses the registry to ensure persistence, e.g., “Registry: HKEY_CURRENT_USERSoftwareMicrosoftCommand Processor Name: AutoRun Value: wscript.exe c:userspublicvideosvideo.vbs.”
- [T1023] Shortcut Modification – The threat modifies LNK files to execute malicious command when launching browsers or Outlook. “modifies the location or properties of browser and email-related shortcuts (*.lnk files)”
- [T1047] Windows Management Instrumentation – The onenote.vbs file uses WMI to collect system information. “it utilizes WMI to collect the Description of Win32_Battery and Win32_Process.”
- [T1071.001] Web Protocols – C2 / data transmission over web protocols to remote servers (e.g., r.php endpoints). “The transmitted data is as follows” and “URL hxxps://joongang.site/pprb/sec/r.php.”
Indicators of Compromise
- [File Name] context – docview.bat, pdfview.bat, hwp.bat, docxview.bat, pdf.bat, and other batch files (document-viewers masquerading as legitimate tools)
- [MD5] context – 7d79901b01075e29d8505e72d225ff52, 00119ed01689e76cb7f33646693ecd6a, 8536d838dcdd026c57187ec2c3aec0f6, a7ac7d100184078c2aa5645552794c19
- [URL] context – hxxp://joongang.site/pprb/sec/ca.php?na=dot_kasp.gif, hxxp://joongang.site/pprb/sec/ca.php?na=reg0.gif
- [URL] context – hxxp://joongang.site/pprb/sec/ca.php?na=sh_ava.gif, hxxps://joongang.site/pprb/sec/ca.php?na=sh_vb.gif
Read more: https://asec.ahnlab.com/en/55219/