• After that msword.exe file drop files into %AppData%\Microsoft\Office\Excel folder location which contains two different variant of RAT that ran based upon the dot net framework installed on victim machine.
• FinallyRAT start building the communication with C2 controlled by attacker in encrypted form and perform malicious activity based upon command it received from attacker. RAT runs on the victim machine via name as conhost.exe and add it entry at Auto start registry location.

*****************IOC************************
Hashes

8b295dd23cddbe8076f0bd651efe03c8d207823920a5c4dbefa328fda6898d83
94687352179d4f60ddc8a18026da4cf356cc47a56e058b4210e9b4f935231576
a070e0ae6edf52b3d1a393a21d33c8aa0f2a30fe113a973dbae892b3f5cadd28
63517ec73dfa0629d344b6803ed2a4465f9338592d9c64a14c89bb0da849961c

C2 Command and Control Server
xorc-49723.portmap[.]host

*****************IOC END************************

• Users are advised not to open documents from untrusted sources and also disabled the macro in their office by default.
• Restrict execution of Power shell /WSCRIPT in enterprise environment. Ensure installation and use of the latest version (currently v5.0) of PowerShell, with enhanced logging enabled script block logging and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis.
• Enforce application whitelisting on all endpoint workstations. This will prevent droppers or unauthorized software from gaining execution on endpoints.
• Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
• Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization's website directly through browser.