Nice write-up, consistent with the messages that I'm seeing. Additional, indicators from my samples ...

Word Attachment
ec224b5e78d3b5e68df6eb7d0a783732
073ef6a7256203eec590395e7ca91c5b

Malware fetched from ...
ehrenforth[.]com
akcnet[.]com

Malware
e637eef61be540030c1d393e1b0013d1