Overview

overview

9

Static

static

3

Arctic Rob...er.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    Arctic Roblox Spoofer.exe
  • Size 170KB
  • Sample261006-2vnrysxt9j
  • SHA256 90cfaa1cbd432d8f1c7e535bcd123db3ca7e9429cb2f75811fd03903ebd924ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target
      Arctic Roblox Spoofer.exe
    • Size 170KB
    • SHA256 90cfaa1cbd432d8f1c7e535bcd123db3ca7e9429cb2f75811fd03903ebd924ff
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

    • Clears Windows event logs

      defense_evasionransomware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Windows Management Instrumentation

2
T1047

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Indicator Removal

1
T1070

Clear Windows Event Logs

1
T1070.001

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

3
T1012

Remote System Discovery

1
T1018

System Information Discovery

4
T1082

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks