Analysis
-
max time kernel
1s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 00:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bayshoreclubmiami.com/
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://bayshoreclubmiami.com/
Resource
win10v2004-20231215-en
General
-
Target
https://bayshoreclubmiami.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2532 chrome.exe 2532 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2540 2532 chrome.exe 18 PID 2532 wrote to memory of 2540 2532 chrome.exe 18 PID 2532 wrote to memory of 2540 2532 chrome.exe 18 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2920 2532 chrome.exe 30 PID 2532 wrote to memory of 2096 2532 chrome.exe 31 PID 2532 wrote to memory of 2096 2532 chrome.exe 31 PID 2532 wrote to memory of 2096 2532 chrome.exe 31 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32 PID 2532 wrote to memory of 2524 2532 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef71d9758,0x7fef71d9768,0x7fef71d97781⤵PID:2540
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bayshoreclubmiami.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1248,i,5031272930491498723,16036445134958878869,131072 /prefetch:22⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1248,i,5031272930491498723,16036445134958878869,131072 /prefetch:82⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1248,i,5031272930491498723,16036445134958878869,131072 /prefetch:82⤵PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2152 --field-trial-handle=1248,i,5031272930491498723,16036445134958878869,131072 /prefetch:12⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2160 --field-trial-handle=1248,i,5031272930491498723,16036445134958878869,131072 /prefetch:12⤵PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2496 --field-trial-handle=1248,i,5031272930491498723,16036445134958878869,131072 /prefetch:22⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3548 --field-trial-handle=1248,i,5031272930491498723,16036445134958878869,131072 /prefetch:12⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 --field-trial-handle=1248,i,5031272930491498723,16036445134958878869,131072 /prefetch:82⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD5751f41fcd11fa824269c09f8f94037ab
SHA13717f9980cbcb468a6fceb1c7b9f2ee0c357be1c
SHA256082de8ec8cb417fd116c0f3fe7043e1778dd9ddb90c7f5d753d72622a7e112a7
SHA512b8280662edd267be92732d96f13f3e69f9a081de9eb0cd178b731f2559e30c684ad4ae637f700d07df1c3c8d94f7267c213dc00ff0ddceb8279c1aefa20475b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5101a55ba7b78fdf09e5f20e6254637da
SHA14964eeef2406e425d0f2b195bcf5578987a82c94
SHA2568cf4a1ffe298e14050de464c8bc81143f1109f128340e384640da16f2fcce02f
SHA512240ea6266581efc2c6a996de09704e420da99b2fe6522458819abea486d01e9e94b7941fb60ab63a4e26aa2228a38c8d664cde14cbc500214a27b41755e7f76a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fa926f04f808f61b30385e55f0c1d78
SHA1755ca5940ba939b5839a9e00647f8f14f6b6ec2d
SHA256f731ee53f560a4d3a4009f697d3e0f9f1a465fed420b3e35acdf31c6f5257700
SHA512e13904aae62421d35b548535fbd0ed20c647aa708f22a5c8a5414617b559f730287353b275f03706aa4806ea16937cb3afecb6a0d4d0107f34eb1494568fa64c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e9c88b7186a82f106a873ec3dd5d48f
SHA1c35451b0bd993e3106e265813a8d41befd29dab0
SHA256450f0190d80572e62bfe2a6cf62c1c0324ca675b2bd5b7182daa222ea65d663a
SHA512d0619dbab6a7b8d0db0de60e2791a686886d82aecc6f3bfd97d418a102ddb3520050256d5f3afa772d8553577759a9fe06005d6e7d7152e510d190b3496f5f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5957623105cd5131a07ee397b27325d7f
SHA1579f15444490c34b100af7be9b1d78b95b1e420b
SHA256fbf3d07839773041f32bebd8abb7cddf3d127a91d5fc66dbad1c606150c71df2
SHA5122a0bab42aa0c2dea36b9d62999c8082be9c0f3fca1ea981e66e5138f335612510079bfeb7ad819ef099d427991bdc206e330be517807ec3aeb2a6f5bfb0a486a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e498b10cd7f762242fff9f151ad765a
SHA134dd26c883851ceac880a7dd22a7648cf171c8ba
SHA256b0c1b00b8acb532db4f131fd8aaac2fe06392979f9bd1d4f077cbfc5c88a14dd
SHA5121b65ebc1b5517b422d57347687098f3a275deb04e7122c7b70987d84b3c0578515d4d3dd925533ca1f659d6b58d30e9332804b2a96e03e3b03a9417c058af064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c2244e872077b660a99a56288a26b5c
SHA1502d53e2f5e28e315cf9724952b9a2a71b2a21b1
SHA256d890e3424c2eb6356acb919f335257a05b4dbc1b2556b870b2c03548d6939298
SHA512f6d7733b0955b09d564746eaeaf4fdfd891b40f3807879d9c0d93b748ba57be4753d1f8c1a668eaa7036bb82073176b5cc698a59cb2bebdb527877499ca8b2b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5477cd84541a5f13d5e700b301db1c7c5
SHA100c62ea827feac4ea60e7f4fabb3e7c2462cb992
SHA256800a86eb13dd2b487d96b12e94271b136bafe7ae64add560d23e93e523b5cfd1
SHA5122c5bdcc08c3bfa15f4e39cf61a12c7e5485ea127753e6d2cf650de7745d0f70ebef07e3bca55f15c7ebc12b12d22ef927801cf027d8d84e0362a0787493a3060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52499b689474e0ae3a93a8c41c039369f
SHA1d6446b502dc01050a9ce5b8bf5f67e0c97561e37
SHA256e10b62a8f2d419b160084350b5a6be4097c4b85fb7e5be228fe4ccefc4a21869
SHA512085dd69bf4439f6cce13775902bd0b21bb0810c5776f98c5657986ad2dd43f7d906d57b47edb536280cb8de291fc21f9bc5033c8c6637a5c2f0d7f99eed3c398
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c3a04632d37e12015fede06cc7bf46d
SHA1f0fe5b5bddf27d560d142f3a36e827527833329c
SHA256872f438ad3601ef2edab7a475c388fe802bf64e9c5fb518db7b98dc05e0ce203
SHA5126fbfffe7c1d30eb81dfde0f2008b97a69d8b87a415c543917815ec3c3dd5be466d412a896a1257a94fcf4748185ccdb6e3c4e43c5e24cd1f371735e09ac8c802
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5deae2c8d98b59d12aeda7f626c649219
SHA1662924917e99bb49524596c241e7340facff0956
SHA256b75765931945ecee9f6923d724038d5d28379fb9351ced6730644942a83eed25
SHA5120bca45c958d7fad65ffbee931bcc84223723f1f892624dc56821dde5d20d4736022d5f9beb3c8ed6f51edd12d7088883ea41e6842fd1c959bced88d161476bb7
-
Filesize
5KB
MD560e832af50b9481a2d52e67e40cd9460
SHA13d40879233717094daef1711e039ad28478890b6
SHA2562f93e98392c5b56e92ae96f54f58a3b3d5af831ab9eff9826e7261b7dd85a87a
SHA51233a3f23f29337ebc122e3aecfa097b1798a1499506886a6ae7383e7aacd4043bf87afc2bffc66b017f4ef0fbf2bce9b92a118c80acd07d8a3a6d0ee22f38a2d7
-
Filesize
6KB
MD51e11f105411c63b06636e9a83a7398c0
SHA18bf21de34424255d0336c158a1dda95ab9bc20f3
SHA25660ab6769c93b29501be620c3e90a42f336be112f4968ba8950cebdc095fe4cdf
SHA512ec064d79dedbe46159cf0a2d56cac7a59a1984c1ab2dee1a8d0b2d91b951d1301bd4200703e12ea9915e32e9244ac504b853848a5d4f4f3a0395e977130d19c7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06