Stage and launch a malicious Word document
Tactic: Initial-access
Stages and opens a macro-enabled Word document. The macro loads Operator network config facts from a previously staged file, then executes mshta.exe to run a malicious HTA file hosted on Operator. The HTA then downloads and executes a seconardy Pneuma agent.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chainsStage and execute APT37.Emulating APT40's multi-stage macro-enabled documents.
Is my host protected against APT37?
2022-12-19
APT40 defense industry
2022-04-12
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github