However, as can be seen in figure 2, it has another sheet inconspicuously named with a “ ” or a blank space.įigure 3. This cover was likely used to further push users to enable content so that they can access confidential information.Īt first glance, the excel file seems to only have one filled sheet.

The attached excel file is titled “Foreign Military Financing (FMF),” named after a program of the U.S.

Attack chain starting with the arrival of the email with the malicious attachment The Excel File However, it can download and execute other script files depending on the command it receives from the C&C server.įigure 1. In our observation, it lastly downloaded and executed TeamViewer to gain remote control over the system. Once the AutoHotkey loads the malicious script file, it connects to its C&C server to download and execute additional script files in response to commands from the server.

If the user enables macro to open the xlsm file, it will then drop the legitimate script engine AutoHotkey along with a malicious script file. It will then enable the threat actors to steal certain information and even download TeamViewer to gain remote access to the system. This file is distributed as an email attachment and disguised as a legitimate document with the filename “Military Financing.xlsm.” The user would need to enable macro for it to open fully, which would use AutoHotkey in loading the malicious script file to avoid detection. We discovered a potential targeted attack that makes use of legitimate script engine AutoHotkey, in combination with malicious script files.

Autohotkey scripts download