An ASEC analysis highlights a password-protected Word document disguised as a CNA Singapore interview (filename CNA[Q].doc) used to target North Korea-related information and leak credentials via FTP. The embedded VBA macro auto-executes, creates and runs a VBScript payload, and later stages browser data collection and exfiltration to attacker-controlled servers using a chain of artifacts such as Defender.log, DefenderUpdate.lba, and Ahnlab.lnk. #DefenderUpdate #AhnLab
Keypoints
- The Word document CNA[Q].doc is password-protected and distributed as an email attachment with the password.
- Malicious VBA macro uses Document_Open to automatically run and is obfuscated to hide its payload.
- The macro creates and executes a VBScript (tmp.pip) in the user’s %APPDATA% folder.
- Created files Defender.log, DefenderUpdate.lba (renamed to DefenderUpdate.bat), and Ahnlab.lnk are used to chain further actions via PowerShell.
- Defender.log retrieves and executes a script from okihs.mypressonline.com/bb/bb.txt, which downloads bb.down and a related script.
- bb.down reads and steals browser data (Login Data, Cookies) from Chrome and Edge, and uploads encrypted data back to jojoa.mypressonline.com via FTP.
- The attack emphasizes credential and browser data exfiltration and includes measures to avoid detection (e.g., deleting PSReadLine history).
MITRE Techniques
- [T1566.001] Spearphishing Attachment – The Word document is distributed as an email attachment with the password. ‘The file is password-protected and is deemed to be distributed as an attachment in emails alongside the password.’
- [T1059.005] Command and Scripting Interpreter: Visual Basic – Malicious VBA macro is embedded and used to execute payloads; ‘The VBA macro includes the Document_Open function, enabling the malicious macro to be executed automatically.’
- [T1027] Obfuscated/Compressed Files and Information – The macro code is obfuscated to hinder analysis; ‘The executed macro code is obfuscated with a similar method as the previous versions.’
- [T1059.001] PowerShell – Ahnlab.lnk executes Defender.log with PowerShell to run additional scripts; ‘Executes Defender.log with PowerShell.’
- [T1023] Shortcut Modification – The malware creates and uses Ahnlab.lnk to trigger further actions; ‘Ahnlab.lnk (has a Ahnlab.lnk path within the file)’.
- [T1041] Exfiltration Over C2 Channel – Collected data is uploaded to attacker-controlled servers; ‘Collected information is saved as %APPDATA%Ahnlab.hwp before being transmitted to hxxp://okihs.mypressonline[.]com/bb/post.php’ and via FTP to jojoa.mypressonline[.]com/kmas.txt
- [T1555.003] Credentials from Web Browsers – Browser data (Login Data, Cookies) is collected from Chrome/Edge profiles and saved to the local appdata before exfiltration; ‘Files containing ‘Login Data’ within %LOCALAPPDATA%GoogleChromeUser Data’ and similar entries for Edge.
- [T1070.004] Indicator Removal on Host: Clear Command History – The attacker deletes the PowerShell history file to avoid detection; ‘code to delete %APPDATA%MicrosoftWindowsPowerShellPSReadLineConsoleHost_history.txt’.
- [T1059.001] PowerShell (repeated context) – The delivered scripts eventually rely on PowerShell-based execution paths; ‘Executes Defender.log with PowerShell’.
Indicators of Compromise
- [Hash] 59be2b9a3e33057b3d80574764ab0952 – introduced as a file-related artifact in the sample set.
- [Hash] 89d972f89b336ee07733c72f6f89edc5 – introduced as a file-related artifact in the sample set.
- [Hash] 8785b8e882eef125dc527736bb1c5704 – introduced as a file-related artifact in the sample set.
- [Domain] okihs.mypressonline.com – used for hosting bb.txt and bb.down scripts and for data exfiltration.
- [Domain] jojoa.mypressonline.com – used as FTP/HTTP exfiltration target for collected data (e.g., KLoginData, KCookie).
- [File Name] CNA[Q].doc – malicious document filename used for initial delivery.
- [File Name] DefenderUpdate.lba/DefenderUpdate.bat – part of the payload execution chain.
- [File Name] Defender.log – used to trigger the next stage via PowerShell.
Read more: https://asec.ahnlab.com/en/42529/