Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 00:50

General

  • Target

    https://bayshoreclubmiami.com/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bayshoreclubmiami.com/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7fff6a1b9758,0x7fff6a1b9768,0x7fff6a1b9778
      2⤵
        PID:4924
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:2
        2⤵
          PID:224
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:8
          2⤵
            PID:4812
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:1
            2⤵
              PID:5108
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:1
              2⤵
                PID:4228
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:8
                2⤵
                  PID:3116
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3780 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:1
                  2⤵
                    PID:1096
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:8
                    2⤵
                      PID:332
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:8
                      2⤵
                        PID:3464
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:8
                        2⤵
                          PID:1188
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:8
                          2⤵
                            PID:2900
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5596 --field-trial-handle=1956,i,17448726552054084035,5319974863104642998,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2496
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:5104

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            816B

                            MD5

                            d9f384544909e1678c935671121f9d58

                            SHA1

                            0303bbeeb55acd3cec3a62e20982bab67550cfa9

                            SHA256

                            ef1386abf54684ef4833b77234d21d7e9abc69c3c3b511b9b0fb3ee710c208f8

                            SHA512

                            f09c41ea2953bb2b0715c88827618c6d2335bd930556d382c8356ce80553e9d6af7def243e41983f11e61a9d85c0fb5d9706273c200211c72e25e59c7eae8c16

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            9aa8c887e792730e239c827e47baaa7d

                            SHA1

                            2c51cab211a69dfc907972c80501c698e93a3c10

                            SHA256

                            18edcd309c79765b0051c72a2d48e8509b5a1162757b2c0b5d5aba481718327d

                            SHA512

                            7bb9813d6def64993cf08a86b009dee9828067f85624c24bae4692fa56378ddf761f6cbbb9a37e2206aeecb4eab910df8f55ab239b19ad3a2178833c56bb6e10

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            2d3d51b3c39eacb6353e1eae1847b422

                            SHA1

                            c2bd4b764f02ecd9488390ffae8f999631f2101b

                            SHA256

                            62364ec6f3c94814b51820f216e256120cd1a70bc55592046ad9d4a1aefece98

                            SHA512

                            89e20179989bd725432d43be3abb55d45cc231c8efae6772b86d036c0bd1004e286f81a74383603a79365d2de18f8edbc0cd9977fda8d761115988c7719d65ac

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            74b5c5c7af1ad7dac38a3a3bcb7ddea1

                            SHA1

                            5b6b21f37324a2e2ac10d5ff9fd11233c5952598

                            SHA256

                            791c2cc01e8f4676049acb83554ec5d3a7fb29b0185bc7fda4f30b5ddb79c1bb

                            SHA512

                            4d97f238c7df595d273cc81ef29e8071d9f0b455b5ce9c0a3de260516ea3ea7b363c46a62d69882a1a9ebc56bcad06f3f0e23a7d0df7903ebdc12ee6b4c70819

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            101KB

                            MD5

                            e64f62652cc5a255ea66332a497ec519

                            SHA1

                            3525583d19660e699c74169a3e5bc8ddc0a582a2

                            SHA256

                            143985062f3a44e267a198b7774d944ec8b009ed7ffd78d0efa9ea3a69dff26d

                            SHA512

                            fe1a5c8c23e7ea02405ef7246ba538043d7537d2ad542f897ecc44cbd5a13fea648435f3ad527dcc0387176f74448126650885bc788fbe3bef80c2c4a0a8170b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            115KB

                            MD5

                            422b0b2b61092bf869342b6e72a69ff7

                            SHA1

                            1a96f1ef4b2a30c45753d5c352942294b1716c39

                            SHA256

                            c7ae0e4ef30078673069cb25d39f4702145a7bc0087ede6931539cdcf8af20d2

                            SHA512

                            ca65762b6dfe183916e65e6eba62e3dcfe60374385b8629cec1faceefafee2e56c09f8385e34133747c2e2f35d317c67bbb3927cbb70eb976043ce2e317d9a6e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            115KB

                            MD5

                            84f32d6fb31ac4caaba15c2935eec267

                            SHA1

                            a64760bba0c14a115e562289118b699cf96c3875

                            SHA256

                            8535eb72945322fc272f35b6f507264c66a7b7757b87ff8aaccc38ebeca6e1e6

                            SHA512

                            72c5863179087cca4f153d51fda3f8e61b9d3697fcb717a7f9a701f0932de8d668529ee42422e75e1466b775d09eec02680c6f9aef771f24b8778f9127ed167d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            116KB

                            MD5

                            2a8326c06ac13a4c1b112eeb6a9b609a

                            SHA1

                            84067972e7ca098efd6fd3bbfb3cc9b566b7b736

                            SHA256

                            1b50ae383916e32d63d1b9a6378c1eb4c9c1a9c8a1605e00ec05f814d5e1a3e3

                            SHA512

                            053c4fa4b91322188f73829484eac4f8cc4b88116ecdd8939001e0f0f5f0f207762c5c0fbeb2196ad4bf9850b71389dc468e61779c26c11c60e6d922be75218e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd