Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 00:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bayshoreclubmiami.com/
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://bayshoreclubmiami.com/
Resource
win10v2004-20231215-en
General
-
Target
https://bayshoreclubmiami.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133500990653575871" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 2496 chrome.exe 2496 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe Token: SeShutdownPrivilege 1660 chrome.exe Token: SeCreatePagefilePrivilege 1660 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 4924 1660 chrome.exe 16 PID 1660 wrote to memory of 4924 1660 chrome.exe 16 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 224 1660 chrome.exe 88 PID 1660 wrote to memory of 3116 1660 chrome.exe 92 PID 1660 wrote to memory of 3116 1660 chrome.exe 92 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89 PID 1660 wrote to memory of 4812 1660 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bayshoreclubmiami.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7fff6a1b9758,0x7fff6a1b9768,0x7fff6a1b97782⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:22⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:82⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:12⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:12⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:82⤵PID:3116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3780 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:12⤵PID:1096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:82⤵PID:332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:82⤵PID:3464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:82⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:82⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5596 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816B
MD5d9f384544909e1678c935671121f9d58
SHA10303bbeeb55acd3cec3a62e20982bab67550cfa9
SHA256ef1386abf54684ef4833b77234d21d7e9abc69c3c3b511b9b0fb3ee710c208f8
SHA512f09c41ea2953bb2b0715c88827618c6d2335bd930556d382c8356ce80553e9d6af7def243e41983f11e61a9d85c0fb5d9706273c200211c72e25e59c7eae8c16
-
Filesize
3KB
MD59aa8c887e792730e239c827e47baaa7d
SHA12c51cab211a69dfc907972c80501c698e93a3c10
SHA25618edcd309c79765b0051c72a2d48e8509b5a1162757b2c0b5d5aba481718327d
SHA5127bb9813d6def64993cf08a86b009dee9828067f85624c24bae4692fa56378ddf761f6cbbb9a37e2206aeecb4eab910df8f55ab239b19ad3a2178833c56bb6e10
-
Filesize
1KB
MD52d3d51b3c39eacb6353e1eae1847b422
SHA1c2bd4b764f02ecd9488390ffae8f999631f2101b
SHA25662364ec6f3c94814b51820f216e256120cd1a70bc55592046ad9d4a1aefece98
SHA51289e20179989bd725432d43be3abb55d45cc231c8efae6772b86d036c0bd1004e286f81a74383603a79365d2de18f8edbc0cd9977fda8d761115988c7719d65ac
-
Filesize
6KB
MD574b5c5c7af1ad7dac38a3a3bcb7ddea1
SHA15b6b21f37324a2e2ac10d5ff9fd11233c5952598
SHA256791c2cc01e8f4676049acb83554ec5d3a7fb29b0185bc7fda4f30b5ddb79c1bb
SHA5124d97f238c7df595d273cc81ef29e8071d9f0b455b5ce9c0a3de260516ea3ea7b363c46a62d69882a1a9ebc56bcad06f3f0e23a7d0df7903ebdc12ee6b4c70819
-
Filesize
101KB
MD5e64f62652cc5a255ea66332a497ec519
SHA13525583d19660e699c74169a3e5bc8ddc0a582a2
SHA256143985062f3a44e267a198b7774d944ec8b009ed7ffd78d0efa9ea3a69dff26d
SHA512fe1a5c8c23e7ea02405ef7246ba538043d7537d2ad542f897ecc44cbd5a13fea648435f3ad527dcc0387176f74448126650885bc788fbe3bef80c2c4a0a8170b
-
Filesize
115KB
MD5422b0b2b61092bf869342b6e72a69ff7
SHA11a96f1ef4b2a30c45753d5c352942294b1716c39
SHA256c7ae0e4ef30078673069cb25d39f4702145a7bc0087ede6931539cdcf8af20d2
SHA512ca65762b6dfe183916e65e6eba62e3dcfe60374385b8629cec1faceefafee2e56c09f8385e34133747c2e2f35d317c67bbb3927cbb70eb976043ce2e317d9a6e
-
Filesize
115KB
MD584f32d6fb31ac4caaba15c2935eec267
SHA1a64760bba0c14a115e562289118b699cf96c3875
SHA2568535eb72945322fc272f35b6f507264c66a7b7757b87ff8aaccc38ebeca6e1e6
SHA51272c5863179087cca4f153d51fda3f8e61b9d3697fcb717a7f9a701f0932de8d668529ee42422e75e1466b775d09eec02680c6f9aef771f24b8778f9127ed167d
-
Filesize
116KB
MD52a8326c06ac13a4c1b112eeb6a9b609a
SHA184067972e7ca098efd6fd3bbfb3cc9b566b7b736
SHA2561b50ae383916e32d63d1b9a6378c1eb4c9c1a9c8a1605e00ec05f814d5e1a3e3
SHA512053c4fa4b91322188f73829484eac4f8cc4b88116ecdd8939001e0f0f5f0f207762c5c0fbeb2196ad4bf9850b71389dc468e61779c26c11c60e6d922be75218e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd