More_eggs

The URLs link to a landing page that spoofs a real talent and staffing management company... The landing page initiates a download of a Microsoft Word file.

These campaigns demonstrated considerable variability... Completely benign emails without a malicious attachment or URL attempting to further establish rapport.

Known for targeting human resources (HR) departments, it exploits the trust in job application emails to deliver malicious payloads.

they sent us download URLs that ended up generating a compressed file download that started the whole process

Initially the actor uses a fraudulent, but legitimately created LinkedIn profile to initiate contact with individuals at the targeted company by sending invitations with a short message.

it attempts to create a new regsrv32 process to execute the DLL using Windows Management Instrumentation (WMI) ... Subsequently, it initiates the creation of the MSXSL process using the WMI service.

download and execute a scriptlet from a location stored in the "ie4uinit.inf" file

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

Figure 4: Example malicious Microsoft Word document that uses macros to download More_eggs.

The only thing our colleagues could provide was a jscript execution that launched a txt (which was actually a js)

This execution was usually triggered by an LNK that someone had manually opened (explorer.exe)

The LNK file ( Sebastian Hall.lnk ) is the heart of the More_Eggs malware’s infection chain... executing malicious commands.

The LNK file ( Sebastian Hall.lnk ) is the heart of the More_Eggs malware’s infection chain... executing malicious commands.

The extracted command line argument contains heavily obfuscated batch script code... through variable fragmentation, redundant code, and syntactic manipulation.

The ieuinit.inf file mimics a Windows INF file, complete with fake sections like [version]. In reality, it’s a playbook for ieuinit.exe , packed with encoded data.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

A legitimate Windows binary, ieuinit.exe , is abused by More_Eggs to execute malicious tasks without raising alarms.

it attempts to create a new regsrv32 process to execute the DLL using Windows Management Instrumentation (WMI)

an execution of msxsl launching another txt with a similar pattern was observed, abusing this LOLBAS to execute malicious code

Digging into the JS file proved tricky due to its anti-debugging features...

the DLL employs multiple checks to determine if it is currently being debugged, utilizing the NtQueryInformationProcess function

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.

Digging into the JS file proved tricky due to its anti-debugging features...

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

the DLL employs multiple checks to determine if it is currently being debugged, utilizing the NtQueryInformationProcess function

The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.

The ZIP file includes: Image File ( b.jpg ): Likely a decoy to trick users into believing the ZIP is legitimate. LNK File ( Sebastian Hall.lnk ): A Windows shortcut file...

...a modular payload that steals system info and contacts C2 servers.

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

The ieuinit.exe then downloads a JavaScript (JS) file using the URL.

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.