5c6ea309b17df6c83dc64921a40013da6d7b78886e92c0309ae2eb88c435c423

Analysis

user interaction
yes
max time kernel
48s
max time network
51s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arctic.exe
Size 7.6MB
Sample260922-3t7dcaab76
SHA256 5c6ea309b17df6c83dc64921a40013da6d7b78886e92c0309ae2eb88c435c423
MD5 5d59a6a7911c5710f0a8b528281a10bc
SHA1 762f1ec6f597b10657103e27695e1eb76567ec19
SHA512 7c78f9623aeb3f23a1796ba2c56d98d804c2908bed9b75642fde4ec3059bca3cf343d952773bf794dcb380839b6e5f780c79ba7aefd5ef21d0bf60cdfb0f057b
SSDEEP 98304:0OyF7BPVhyhMy5E9rHcU1Zp1ZkCLa95qDtaqkZKDYgU:0vFpz8U5LNa96r5Dk
TLSH
T1FB86AD43F65281E9C0AEC274D31A9733E772B88D092476EB17E41B212FA6F50AF5D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	arctic.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5632	powershell.exe
1744	powershell.exe
2016	powershell.exe
2760	powershell.exe
3288	powershell.exe
5384	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
1744	powershell.exe
1744	powershell.exe
1744	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2760	powershell.exe
2760	powershell.exe
2760	powershell.exe
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe
5384	powershell.exe
5384	powershell.exe
5384	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5052	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5632	powershell.exe
Token: SeIncreaseQuotaPrivilege	5632	powershell.exe
Token: SeSecurityPrivilege	5632	powershell.exe
Token: SeTakeOwnershipPrivilege	5632	powershell.exe
Token: SeLoadDriverPrivilege	5632	powershell.exe
Token: SeSystemProfilePrivilege	5632	powershell.exe
Token: SeSystemtimePrivilege	5632	powershell.exe
Token: SeProfSingleProcessPrivilege	5632	powershell.exe
Token: SeIncBasePriorityPrivilege	5632	powershell.exe
Token: SeCreatePagefilePrivilege	5632	powershell.exe
Token: SeBackupPrivilege	5632	powershell.exe
Token: SeRestorePrivilege	5632	powershell.exe
Token: SeShutdownPrivilege	5632	powershell.exe
Token: SeDebugPrivilege	5632	powershell.exe
Token: SeSystemEnvironmentPrivilege	5632	powershell.exe
Token: SeRemoteShutdownPrivilege	5632	powershell.exe
Token: SeUndockPrivilege	5632	powershell.exe
Token: SeManageVolumePrivilege	5632	powershell.exe
Token: 33	5632	powershell.exe
Token: 34	5632	powershell.exe
Token: 35	5632	powershell.exe
Token: 36	5632	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeIncreaseQuotaPrivilege	1744	powershell.exe
Token: SeSecurityPrivilege	1744	powershell.exe
Token: SeTakeOwnershipPrivilege	1744	powershell.exe
Token: SeLoadDriverPrivilege	1744	powershell.exe
Token: SeSystemProfilePrivilege	1744	powershell.exe
Token: SeSystemtimePrivilege	1744	powershell.exe
Token: SeProfSingleProcessPrivilege	1744	powershell.exe
Token: SeIncBasePriorityPrivilege	1744	powershell.exe
Token: SeCreatePagefilePrivilege	1744	powershell.exe
Token: SeBackupPrivilege	1744	powershell.exe
Token: SeRestorePrivilege	1744	powershell.exe
Token: SeShutdownPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeSystemEnvironmentPrivilege	1744	powershell.exe
Token: SeRemoteShutdownPrivilege	1744	powershell.exe
Token: SeUndockPrivilege	1744	powershell.exe
Token: SeManageVolumePrivilege	1744	powershell.exe
Token: 33	1744	powershell.exe
Token: 34	1744	powershell.exe
Token: 35	1744	powershell.exe
Token: 36	1744	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeIncreaseQuotaPrivilege	2016	powershell.exe
Token: SeSecurityPrivilege	2016	powershell.exe
Token: SeTakeOwnershipPrivilege	2016	powershell.exe
Token: SeLoadDriverPrivilege	2016	powershell.exe
Token: SeSystemProfilePrivilege	2016	powershell.exe
Token: SeSystemtimePrivilege	2016	powershell.exe
Token: SeProfSingleProcessPrivilege	2016	powershell.exe
Token: SeIncBasePriorityPrivilege	2016	powershell.exe
Token: SeCreatePagefilePrivilege	2016	powershell.exe
Token: SeBackupPrivilege	2016	powershell.exe
Token: SeRestorePrivilege	2016	powershell.exe
Token: SeShutdownPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeSystemEnvironmentPrivilege	2016	powershell.exe
Token: SeRemoteShutdownPrivilege	2016	powershell.exe
Token: SeUndockPrivilege	2016	powershell.exe
Token: SeManageVolumePrivilege	2016	powershell.exe
Token: 33	2016	powershell.exe
Token: 34	2016	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4576	arctic.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 5052	4576	arctic.exe	89
PID 5052 wrote to memory of 5764	5052	msedgewebview2.exe	90
PID 5052 wrote to memory of 3188	5052	msedgewebview2.exe	91
PID 5052 wrote to memory of 3188	5052	msedgewebview2.exe	91
PID 5052 wrote to memory of 3188	5052	msedgewebview2.exe	91
PID 5052 wrote to memory of 3188	5052	msedgewebview2.exe	91
PID 5052 wrote to memory of 6112	5052	msedgewebview2.exe	92
PID 5052 wrote to memory of 3512	5052	msedgewebview2.exe	93
PID 5052 wrote to memory of 3512	5052	msedgewebview2.exe	93
PID 5052 wrote to memory of 3512	5052	msedgewebview2.exe	93
PID 5052 wrote to memory of 1360	5052	msedgewebview2.exe	94
PID 5052 wrote to memory of 1360	5052	msedgewebview2.exe	94
PID 5052 wrote to memory of 1360	5052	msedgewebview2.exe	94
PID 5052 wrote to memory of 1360	5052	msedgewebview2.exe	94
PID 5052 wrote to memory of 1360	5052	msedgewebview2.exe	94
PID 4576 wrote to memory of 5632	4576	arctic.exe	95
PID 4576 wrote to memory of 1744	4576	arctic.exe	98
PID 4576 wrote to memory of 2016	4576	arctic.exe	100
PID 4576 wrote to memory of 2760	4576	arctic.exe	102
PID 4576 wrote to memory of 3288	4576	arctic.exe	105
PID 4576 wrote to memory of 5384	4576	arctic.exe	107

C:\Users\Admin\AppData\Local\Temp\arctic.exe
"C:\Users\Admin\AppData\Local\Temp\arctic.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=arctic.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.arctic.interface\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4576.4496.17076499656289876480 /pfhostedapp:7d84fe1d16d98dac28ae826f9cff9f732c76aaed
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.arctic.interface\EBWebView /prefetch:4 /pfhostedapp:7d84fe1d16d98dac28ae826f9cff9f732c76aaed --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.arctic.interface\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ff8c6e35fd8,0x7ff8c6e35fe4,0x7ff8c6e35ff0
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.arctic.interface\EBWebView" --webview-exe-name=arctic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1600 --field-trial-handle=1756,i,17857149321829035507,7748773852731395053,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7d84fe1d16d98dac28ae826f9cff9f732c76aaed
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.arctic.interface\EBWebView" --webview-exe-name=arctic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1756,i,17857149321829035507,7748773852731395053,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7d84fe1d16d98dac28ae826f9cff9f732c76aaed
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.arctic.interface\EBWebView" --webview-exe-name=arctic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1756,i,17857149321829035507,7748773852731395053,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7d84fe1d16d98dac28ae826f9cff9f732c76aaed
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.arctic.interface\EBWebView" --webview-exe-name=arctic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1756,i,17857149321829035507,7748773852731395053,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7d84fe1d16d98dac28ae826f9cff9f732c76aaed /prefetch:1
    3⤵
    PID:1360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BaseBoard).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BaseBoard).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BaseBoard).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact