Shares tag: CVE-2021-40444 • Shares 1 IOC • Published within a week
CVE-2021-40444 취약점을 이용한 대북 관련 악성 문서
2021-11-17 • Ahnlab • Malicious documents related to North Korea using the vulnerability of CVE-2021-40444 •
AhnLab ASEC reports malicious Office documents using CVE-2021-40444 with North Korea-related lure filenames, showing attackers quickly adopting the MSHTML remote-code-execution vulnerability after its disclosure. The documents used external links and the MHTML protocol to reach a malicious URL, execute JavaScript through the Office/Internet Explorer rendering engine, download a CAB archive, and load a malicious INF-based DLL. The lure content referenced a reunification-related seminar scheduled for November 18, making the documents appear relevant to users interested in North Korea policy issues. AhnLab observed both documents contacting the same infrastructure and published representative hashes plus a defanged officeversion.mywebcommunity.org URL for detection and follow-up.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| HASH | 809c4c40537c60e224363b94296fbbf2 | 2021-11-17 | 2021-11-17 |
| HASH | 1132d2a12b6fd6cbbc8046df3612d725 | 2021-11-17 | 2021-11-17 |
| HASH | 2edbab4834a1315b476278fb6ed2592f | 2021-11-17 | 2021-11-17 |
| URL | http://officeversion.mywebcommu… | 2021-11-17 | 2021-11-17 |
| DOMAIN | officeversion.mywebcommunity.org | 2021-11-11 | 2021-11-17 |
Related Reports
Shares tag: CVE-2021-40444 • Published within a month
2023-09-27 •
40% Match
#CVE-2021-40444
#MataDoor
#DarkRiver
#T1082
#T1059.003
#T1140
#T1005
#T1041
#T1046
#T1112
#T1083
#T1071
#T1124
#T1057
#T1566.001
#T1620
#T1129
#T1622
#T1135
#T1027.002
#T1090.003
#T1008
#T1571
#T1049
#T1016
#T1018
#T1074.001
#T1218.011
#T1036.004
#T1218.010
#T1106
#T1090.001
#T1095
#T1033
#T1543.003
#T1090.002
#T1560.002
#T1132
#T1030
#T1572
#T1572.001
#T1572.002
Shares tag: CVE-2021-40444