Macro Click on ws-fin-01

Minutes after a.chen reported a wire-instruction email, EDR caught WINWORD spawning mshta on ws-fin-01. Mara needs the process chain and remote script host before Finance keeps working on a live host.

10-15 min40 pts

Case Brief

Treasury analyst a.chen@straylight.finance reported a wire-instruction email minutes before EDR alerted on ws-fin-01.straylight.finance. Outlook and Word were both active. Focus on what Word launched and where it reached out. Isolation is on hold until you prove the chain.

Objective

Confirm whether the macro chain is malicious, save the supporting artifacts, and recommend containment.

Learning Objectives

Walk the process tree from Word to the unexpected child process
Identify the remote host mshta contacted for the script payload
Separate benign Office noise from the macro launch chain
Document process, host, and remote IOCs with a supported containment call

Topics

straylight

payment-fraud

easy