Malicious Word Documents Using MS Media Player (Impersonating AhnLab) – ASEC BLOG

MITRE Techniques

• [T1566.001] Phishing – The attacker distributes malicious Word files impersonating AhnLab to prompt macros. “document … impersonates AhnLab” and “download another Word file containing malicious VBA macro via the external URL and run it.”
• [T1204.002] User Execution – Malicious File – The Word document prompts users to press Enable Content to execute the macro. “The attacker inserted an image and text to prompt users to press Enable Content.”
• [T1059.005] Visual Basic – The downloaded file contains a macro written in VBA, using WindowsMediaPlayer1_OpenStateChange to trigger actions. “The macro is written using the WindowsMediaPlayer1_OpenStateChange() function …”
• [T1105] Ingress Tool Transfer – The macro downloads and runs additional malware from an external URL. “downloads additional malware that suits the user’s PC environment and runs it”
• [T1055.001] Process Injection – The malware runs after injecting it into the Word process. “…injecting it into the Word process.”
• [T1547.001] Registry Run Keys/Startup Folder – The dropped payload adds a Run entry so it can be continuously executed. “HKCUSoftwareMicrosoftWindowsCurrentVersionRunWUService registry so that it can be continuously run.”