c7d2fda303d9928f804d3269d128b216844d9afcb2f533054c8d87e1c6fd4aeb

Analysis

max time kernel
436s
max time network
440s
platform
windows11-21h2_x64
resource
win11-20250210-en
resource tags

arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system
submitted
10-02-2025 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data-Setup/data/libbrotlicommon.js
Size

131KB
MD5

f6f075717726d400c4303f20d8ec6af3
SHA1

82faf929e85d99589be8d006f7c5f2563ea29f6b
SHA256

1c6a6ff41a2a1ec0bfe8bdfe8e27127fce59e16df88e0b9060e63b11e0a9ddaf
SHA512

06fefab5a9b8e1e08ee5fd2c359f191e924896593ac70a093765844ebe9218e652f9ec172419e5dbafc4766cabce9aea8d7e5ef4634da3a777f85d9aceca5e4a
SSDEEP

3072:O4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBX91HU:O4AhdNorGvHdbi09GJR910

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3808	MicrosoftEdgeUpdate.exe
3808	MicrosoftEdgeUpdate.exe
3808	MicrosoftEdgeUpdate.exe
3808	MicrosoftEdgeUpdate.exe
4832	MicrosoftEdgeUpdate.exe
4832	MicrosoftEdgeUpdate.exe
4832	MicrosoftEdgeUpdate.exe
4832	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3808	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4832	MicrosoftEdgeUpdate.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\data-Setup\data\libbrotlicommon.js
1⤵
PID:4296

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
275KB

MD5
ae75596b7077d57e5740de73cfe558b0

SHA1
81140aa180631312a894981b2254bc3153b8aa75

SHA256
61100f3fa27ccd85721a4e15b5e3bbe1d4260ffb552a73df3a95de0afa776868

SHA512
a0afa62be61c002a5fd514d1cecb80afc5d42a185540ca1f9483a6a66fede4b309f88e367493fe2306afae7158472ea709ad01bc45b2d6311677db9356e54460

Download Submit