IOC Report

enjoin,12.27.2021.doc

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Comments: ta, Template: Normal, Last Saved By: Windows, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Dec 27 11:02:00 2021, Last Saved Time/Date: Mon Dec 27 11:02:00 2021, Number of Pages: 1, Number of Words: 116, Number of Characters: 16118, Security: 0

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\enjoin,12.27.2021.doc.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Sep 23 14:11:36 2021, mtime=Fri Dec 31 19:36:10 2021, atime=Fri Dec 31 19:36:06 2021, length=80896, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\i7Gigabyte.hta.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Dec 31 19:36:12 2021, mtime=Fri Dec 31 19:36:13 2021, atime=Fri Dec 31 19:36:13 2021, length=4060, window=hide

modified

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding

C:\Windows\SysWOW64\explorer.exe

explorer i7Gigabyte.hta

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\Documents\i7Gigabyte.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" c:\users\public\gigabyteI7.jpg

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

C:\Windows\explorer.exe

explorer i7Gigabyte.hta

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\Documents\i7Gigabyte.hta"