Kim Sooki again? This time, it was disguised as a request for seafood ingredients

A request to review the purchase of seafood ingredients arrived. When the file is opened, a normal hwp document appears, but while the user is reviewing the contents, a malicious script runs in the background and even registers a scheduled task. It then extracts system information to an external location, downloads and executes additional commands, and wipes all traces. Let’s examine the tactics used by a malicious LNK file linked to Kimsuky, which disguises the attack by masquerading as a legitimate business document.

Malicious LNK disguised as a request for purchase of
seafood ingredients

AhnLab recently confirmed evidence of a malicious LNK file disguised as a seafood ingredient purchase review request being distributed to users in Korea. The confirmed file name is [Royal Hotel Seoul] Request for Review of Seafood Ingredient Purchases.LNK, designed to look like a document users might actually receive in a business setting to trick them into opening it.

When a user runs the LNK file, it uses PowerShell to extract internal data. During this process, a legitimate hwp document—identical to the original LNK file—is created in the same Path and displayed to the user. Simultaneously, ZIP data encrypted using the XOR encryption method is saved to the Path C:\ProgramData\systmp\sunshine.

The ZIP file contains a PowerShell script named `termsvc.Ps1` and a JavaScript file named `poc.Js`. After decompression, it creates related files in the C:\ProgramData\video Path and saves poc.Js separately in the format C:\ProgramData\systmp\ping\_<FIRST 4 digits of UUID>.Js.

In other words, while a normal hwp document appears on the screen, the structure ensures that the scripts and files necessary for subsequent attacks are prepared simultaneously in the background.

[Figure 1] Legitimate decoy document

 

Malicious Script That Repeats Every 14 Minutes

The threat actor also registers a scheduled task to ensure the generated JavaScript runs continuously. The task name is formatted as MicrosoftOffice2016\_<FIRST 4 digits of UUID>, and it is configured to execute ping\_<FIRST 4 digits of UUID>.Js approximately every 14 minutes via wscript.Exe.

This JavaScript is subject to obfuscation; it checks for the existence of the file C:\ProgramData\video\termsvc.Ps1 and then bypasses the PowerShell execution policy to run the script in hidden mode. Termsvc.Ps1 subsequently collects information from the infected system, transmits it externally, and downloads and executes additional commands.

[Figure 2] ping\_<FIRST 4 digits of UUID>.Js file

 

During the attack process, the malware was observed concealing relevant paths and deleting the LNK file used for initial distribution as well as the “sunshine” file created during an intermediate stage. This approach involves leaving behind components necessary for execution while removing certain traces.

[Figure 3] termsvc.Ps1 file

Collection and Transmission of
Infected System Information

Once executed, termsvc.Ps1 collects various pieces of information from the infected system. The confirmed items are as follows:

• Operating system name and architecture
• System time zone
• Public IP address
• Username and domain
• List of running processes
• Computer Name

 

The public IP address is verified by querying api.Ipify.Org, and the list of running processes is collected using the `tasklist` command.

The script then authenticates with the Backblaze B2 API to retrieve bucket information. After creating a Path to distinguish infected systems based on their BIOS serial numbers, it converts the collected data into UTF-8 text data and uploads it to that Path.

In this attack, Backblaze B2 was used not merely as a file storage space but as a C2 infrastructure to exfiltrate information from infected PCs and relay follow-up commands.

 

Command Execution After Information Theft

The attack does not end with the transmission of system information. Once the data exfiltration is complete, `termsvc.Ps1` downloads an additional command file named `aaa` from the same Backblaze B2 Path specific to each system.

The downloaded data is saved as a .Cmd file with an arbitrary name in the %TEMP% directory and is executed in hidden mode using the `cmd.Exe /c` command. This allows the threat actor to deliver and execute additional commands required on the infected system.

After command execution, the script waits for approximately 120 seconds before deleting the locally stored .Cmd file. This minimizes traces by removing the relevant files after receiving and executing commands from an external source.

 

Confirmation of a Link to Past Kim Sukki Attacks

In this attack, numerous code segments and operational patterns similar to those observed in past Kim Sukki-related malicious LNK attacks were discovered.

Similarities to previous cases included not only the PowerShell execution syntax but also the method of identifying the original LNK based on file size, the structure for extracting data from within the LNK using a fixed offset, and the method of registering the Task Scheduler to repeatedly execute malicious scripts.

Based on such similarities in code and behavior, AhnLab determined that this malicious LNK is also linked to the Kim Sukki group.
 

Things to Check if You Executed a Seafood Ingredient Purchase Request Form

If you suspect an infection similar to this attack, you should check the following items.

1. Check
whether a malicious LNK file was received or executed: Verify whether you have a history of receiving, saving, or executing an LNK file with the same or a similar name as [Royal Hotel Seoul] Request for Review of Seafood Ingredient Purchases.LNK.

2. Check
for abnormal scheduled tasks: Verify whether any scheduled tasks in the format “MicrosoftOffice2016\_” are registered. In particular, check for items where JavaScript files are repeatedly executed at approximately 14-minute intervals using wscript.Exe.

3. Verify
Related Files and Paths Check for the existence of the paths and files as follows:

• C:\ProgramData\systmp\sunshine
• C:\ProgramData\systmp\ping\_.Js
• C:\ProgramData\video\termsvc.Ps1
• C:\ProgramData\video\poc.Js

Since the initial LNK files and some other files are deleted during the attack process, you must also check for traces of file creation and deletion in these paths.

4. Check for traces of additional command execution: Check the %TEMP%
Path for any .Cmd files with arbitrary file names that were created or for any history of commands executed in the cmd.Exe /c EXE Type. Also check for traces indicating that these files were subsequently deleted.

5. Verify Information Gathering and External Communication

Examine traces of communication and authentication related to Backblaze B2, and verify whether public IP addresses were queried through api.Ipify.Org or if the `tasklist` command was executed. It is also necessary to check for traces indicating that operating system information, user and domain information, computer name, and a list of running processes were collected.

Even if a file appears to be a work document, exercise caution when executing it if it is in LNK format or has an unclear source. In particular, do not assume a file is safe simply because a legitimate hwp document opened successfully. Verify the file format and execution path, and continuously monitor for abnormal behavior, such as links to LNK files, PowerShell, wscript.Exe, cmd.Exe, or communication with external cloud services.