Purchase Order, Poisoned

A finance workstation lit up the endpoint console this morning, and the trail starts in the mailbox. One inbound message carried a weaponized purchase-order attachment that failed sender authentication. Establish who sent it.

The attachment did not rely on macros. Opening it kicked off a process that has no legitimate reason to run from a document. Identify the executable whose launch marks the moment of compromise.

After the exploit fired, execution was proxied through a trusted system utility that loaded attacker code from the user's profile. Recover the file it loaded.

To survive inspection, the loader did not run its payload openly, it hid the malware inside a legitimate, signed Windows process. Identify the process it took over.

The disguised process reached out to attacker infrastructure to take orders and ship stolen data. To contain the host and block the channel, identify the command-and-control host it contacted.

For the report, classify how the malware ensured it would run again after reboot. Map that persistence mechanism to its MITRE ATT&CK technique.