OneNote Attachment to RAT: A Guided First Investigation

A logistics contracts employee at Glacierline Freight opens a phishing email carrying a malicious OneNote notebook. Clicking a fake Open button runs an embedded batch file that chains through cmd.exe and a hidden, encoded PowerShell cradle to download an IcedID loader disguised as an image. Walk the email gateway, file artifacts, and endpoint process tree step by step from the spoofed sender to the C2 beacon.