AhnLab analyzed a malicious Word document disguised as a reward-payment request that combined an external template connection with embedded VBA macro code. The document contacted ftcpark59.getenjoyment.net over external and macro URLs, used a deliberately renamed settings.yml macro component, and attempted to weaken Microsoft Office macro security by modifying VBAWarnings registry values across multiple Office versions. When triggered by user input, the macro collected running service and process names and sent them to the C2 endpoint, with AhnLab assessing that additional payload delivery could occur if the server responded.