A chain that uses a multi-stage malicious Word document to evade defenses and exfiltrate data. The macro enabled document will first load a previously staged C2 config file and execute mshta.exe to run a second stage HTA payload which downloads a secondary Pneuma Agent as the third stage. This chain will also execute and collect keystrokes and exfiltrate data using OneDrive. Similar behaviours were observed in APT37 when targetting South Korean users, North Korean defectors, policy makers, journalists and human rights activists.


Is my host protected against APT37?

Load custom PowerShell module to capture keystrokes for 15 seconds.

Collect keystroke/keyboard data

Authors

Tags

Tactic

Test this TTP