IOCReport

order_07.21.doc

XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\order_07.21.doc.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:40 2020, mtime=Thu Jul 22 17:07:25 2021, atime=Thu Jul 22 17:07:22 2021, length=89257, window=hide

dropped

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\programdata\captionEx.hta

C:\Windows\SysWOW64\mshta.exe

'C:\Windows\SysWOW64\mshta.exe' 'C:\programdata\captionEx.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\regsvr32.exe

'C:\Windows\System32\regsvr32.exe' c:\users\public\captionEx.jpg

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding

C:\Windows\System32\cmd.exe

cmd /c c:\programdata\captionEx.hta

C:\Windows\SysWOW64\mshta.exe

'C:\Windows\SysWOW64\mshta.exe' 'C:\programdata\captionEx.hta'

http://airloweryd.com/adda/CzJsZLz8s7e1PAiOuESLghxyuWpr1A46cHBNR/dmIczx3VCKJVxOIM45tzrpZTl8IQ06/ryme

unknown