maksrat | hxxps://github[.]com/00asdklf/Ct-rat-builder/releases/tag/Rat

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Ct.builder.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
39	4152	chrome.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	Ct.builder.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ct.builder.exe

Executes dropped EXE 4 IoCs

pid	Process
4688	Ct.builder.exe
4764	Ct.builder.exe
4684	Ct.builder.exe
4272	Ct.builder.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
101	discord.com
102	discord.com
105	discord.com
106	discord.com
108	discord.com
109	discord.com
100	discord.com

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
98	ip-api.com
52	ip4.seeip.org
53	ip4.seeip.org
71	ip4.seeip.org
72	ip4.seeip.org
73	ip4.seeip.org

Maps connected drives based on registry 3 TTPs 8 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Ct.builder.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4152	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	Ct.builder.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Ct.builder.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Ct.builder.exe

Enumerates system info in registry 2 TTPs 22 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Ct.builder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	Ct.builder.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134217159089210805"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1556	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3620	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
5900	chrome.exe
5900	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
624	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeDebugPrivilege	4688	Ct.builder.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
624	OpenWith.exe
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4016	3960	chrome.exe	86
PID 3960 wrote to memory of 4152	3960	chrome.exe	87
PID 3960 wrote to memory of 632	3960	chrome.exe	88
PID 3960 wrote to memory of 632	3960	chrome.exe	88
PID 3960 wrote to memory of 4240	3960	chrome.exe	90
PID 3960 wrote to memory of 4240	3960	chrome.exe	90
PID 3960 wrote to memory of 1660	3960	chrome.exe	91
PID 3960 wrote to memory of 1660	3960	chrome.exe	91
PID 3960 wrote to memory of 2328	3960	chrome.exe	92
PID 3960 wrote to memory of 2328	3960	chrome.exe	92
PID 3960 wrote to memory of 2184	3960	chrome.exe	93
PID 3960 wrote to memory of 2184	3960	chrome.exe	93
PID 3960 wrote to memory of 4640	3960	chrome.exe	95
PID 3960 wrote to memory of 976	3960	chrome.exe	102
PID 3960 wrote to memory of 1576	3960	chrome.exe	105
PID 3960 wrote to memory of 4688	3960	chrome.exe	106
PID 3960 wrote to memory of 5084	3960	chrome.exe	109
PID 3960 wrote to memory of 3684	3960	chrome.exe	111
PID 3960 wrote to memory of 3080	3960	chrome.exe	112
PID 3960 wrote to memory of 1796	3960	chrome.exe	113
PID 3960 wrote to memory of 4176	3960	chrome.exe	114
PID 624 wrote to memory of 1556	624	OpenWith.exe	118
PID 3960 wrote to memory of 5900	3960	chrome.exe	129
PID 3960 wrote to memory of 4476	3960	chrome.exe	137
PID 3960 wrote to memory of 4476	3960	chrome.exe	137

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/00asdklf/Ct-rat-builder/releases/tag/Rat
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa64adc728,0x7ffa64adc734,0x7ffa64adc740
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,12931901962267417351,14407922899340782319,524288 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,16680806347589137787,3797703544521524200,262144 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,3238982725135224858,8390149543652665731,524288 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,16482532061566488056,8355326571731336959,2097152 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,10244068217882343366,13450840181511256233,2097152 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,17342747754155887097,6319920143444144557,2097152 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,11883206807975840865,17928779287327319049,524288 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,4048124646485359896,8537813043831502310,524288 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,4389250442083891913,6543660510567978412,524288 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:1576
- C:\Users\Admin\Downloads\Ct.builder.exe
  "C:\Users\Admin\Downloads\Ct.builder.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\CTRatBuilder.jar"
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,3557670640929189451,6679531853693359262,524288 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,12148112180007600349,7674668323716042454,524288 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,6710145083277994544,18223634505838327344,524288 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\CTRatBuilder.jar"
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6192,i,16675246068731094049,14575475173582919890,262144 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1196,i,12418101112951058924,15348360015778669940,524288 --field-trial-handle=2032,i,632066382658389986,16139437647082329878,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  PID:4476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\CTRatBuilder.jar
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1556

C:\Users\Admin\Downloads\Ct.builder.exe
"C:\Users\Admin\Downloads\Ct.builder.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:4764

C:\Users\Admin\Downloads\Ct.builder.exe
"C:\Users\Admin\Downloads\Ct.builder.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:4684

C:\Users\Admin\Downloads\Ct.builder.exe
"C:\Users\Admin\Downloads\Ct.builder.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:4272

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Downloads\PopFormat.xltx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Time Discovery

T1124

Virtualization/Sandbox Evasion