IOC Report
airequipmentcorp-doc-08.11.2022.doc

airequipmentcorp-doc-08.11.2022.doc

Zip archive data, at least v2.0 to extract

initial sample

C:\Users\user\AppData\Local\Temp\rECA2.tmp.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\yE9E2.tmp.dll

HTML document, ASCII text

dropped

C:\Users\user\AppData\Local\Temp\~DF32F8B01FD4175FF7.TMP

Composite Document File V2 Document, Cannot read section info

modified

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\airequipmentcorp-doc-08.11.2022.doc.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:31:45 2022, mtime=Fri Aug 12 00:08:24 2022, atime=Fri Aug 12 00:08:17 2022, length=2203070, window=hide

dropped

C:\Users\user\AppData\Local\Temp\y6CDC.tmp.dll

HTML document, ASCII text

modified

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding

C:\Users\user\AppData\Local\Temp\rECA2.tmp.exe

"C:\Users\user\AppData\Local\Temp\rECA2.tmp.exe" "C:\Users\user\AppData\Local\Temp\yE9E2.tmp.dll",#1

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding