IOC Report
INVOICE.doc

INVOICE.doc

Rich Text Format data, version 1, unknown character set

initial sample

C:\Users\user\AppData\Local\Temp\Client.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\Client.exe:Zone.Identifier

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\INVOICE.doc.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:31:48 2022, mtime=Fri May 27 23:50:46 2022, atime=Fri May 27 23:50:35 2022, length=4073082, window=hide

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{E5C71654-C0CA-4182-8CA2-6F1C92DC7362}.tmp

Composite Document File V2 Document, Cannot read section info

dropped

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Windows\SysWOW64\cmd.exe

CmD.exe /C %tmp%\Client.exe A C

C:\Users\user\AppData\Local\Temp\Client.exe

C:\Users\user\AppData\Local\Temp\Client.exe A C

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

www.bense003.xyz/s3s3/