Resubmissions
13/09/2023, 22:43
230913-2m9pfsaa44 113/09/2023, 22:41
230913-2l99lafc9v 113/09/2023, 22:41
230913-2l7hpsaa35 113/09/2023, 22:41
230913-2l43ksfc9t 1Analysis
-
max time kernel
70s -
max time network
72s -
platform
macos-10.15_amd64 -
resource
macos-20230831-en -
resource tags
arch:amd64arch:i386image:macos-20230831-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
13/09/2023, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
feed.html
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
feed.html
Resource
macos-20230831-en
General
-
Target
feed.html
-
Size
288B
-
MD5
9034bab8201ca968dabc204d43d19963
-
SHA1
c813a10a8654aa3d888e8c95e509836eb6ac387a
-
SHA256
28b777e7ed5b8c789d3396bb5c0340641558bccf2a9ea352863a1835c5ef27d1
-
SHA512
5e4a57214f55613e4c5c2c9e5c252b9065df497f71b2213fa0033ff958b21e8ba2e54b7b4f189b6291e3d8f2f4b795df9425c0a027fae2de0532747c7dbcaa10
Malware Config
Signatures
Processes
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵PID:672
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/feed.html\""1⤵PID:673
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/feed.html\""1⤵PID:673
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/feed.html\""1⤵PID:673
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/feed.html1⤵PID:673
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/feed.html1⤵PID:673
-
/bin/zsh/bin/zsh -c /Users/run/feed.html2⤵PID:674
-
-
/bin/zsh/bin/zsh -c /Users/run/feed.html2⤵PID:674
-
-
/Users/run/feed.html/Users/run/feed.html2⤵PID:674
-
-
/Users/run/feed.html/Users/run/feed.html2⤵PID:674
-
-
/bin/shsh /Users/run/feed.html2⤵PID:674
-
-
/bin/shsh /Users/run/feed.html2⤵PID:674
-
-
/bin/bashsh /Users/run/feed.html2⤵PID:674
-
-
/bin/bashsh /Users/run/feed.html2⤵PID:674
-
-
/sbin/mount_msdos/sbin/mount_msdos -o perm -o nobrowse /dev/disk1s1 /Volumes/firmwaresyncd.izH3qi1⤵PID:697
-
/sbin/kextload/sbin/kextload /System/Library/Extensions/msdosfs.kext1⤵PID:698
-
/usr/bin/rsyncrsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/tmp/KSInstallAction.vrCD0vwhm8/m/Google Chrome.app/" "/Applications/Google Chrome.app"1⤵PID:699
-
/usr/bin/rsyncrsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/tmp/KSInstallAction.vrCD0vwhm8/m/Google Chrome.app/" "/Applications/Google Chrome.app"1⤵PID:699
-
/bin/rmrm -f "/Applications/Google Chrome.app/.want_full_installer"1⤵PID:702
-
/bin/rmrm -f "/Applications/Google Chrome.app/.want_full_installer"1⤵PID:702
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString1⤵PID:704
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString1⤵PID:704
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion1⤵PID:706
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion1⤵PID:706
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL1⤵PID:708
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL1⤵PID:708
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID1⤵PID:710
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID1⤵PID:710
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName1⤵PID:712
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName1⤵PID:712
-
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"1⤵PID:713
-
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"1⤵PID:713
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadminksadmin --register --productid com.google.Chrome --version 116.0.5845.110 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion1⤵PID:718
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadminksadmin --register --productid com.google.Chrome --version 116.0.5845.110 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion1⤵PID:718
-
/bin/psps -ewwo "comm="1⤵PID:720
-
/bin/psps -ewwo "comm="1⤵PID:720
-
/usr/bin/grepgrep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"1⤵PID:722
-
/usr/bin/grepgrep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"1⤵PID:722
-
/usr/bin/cutcut -c 1-1081⤵PID:721
-
/usr/bin/cutcut -c 1-1081⤵PID:721
-
/usr/sbin/lsoflsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"1⤵PID:724
-
/usr/sbin/lsoflsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"1⤵PID:724
-
/bin/rmrm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"1⤵PID:727
-
/bin/rmrm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"1⤵PID:727
-
/usr/sbin/chownchown -Rh root:wheel "/Applications/Google Chrome.app"1⤵PID:730
-
/usr/sbin/chownchown -Rh root:wheel "/Applications/Google Chrome.app"1⤵PID:730
-
/bin/chmodchmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"1⤵PID:731
-
/bin/chmodchmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"1⤵PID:731
-
/usr/bin/findfind "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +1⤵PID:732
-
/usr/bin/findfind "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +1⤵PID:732
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/chmodchmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"2⤵PID:733
-
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/chmodchmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"2⤵PID:733
-
-
/bin/chmodchmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"2⤵PID:733
-
-
/bin/chmodchmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"2⤵PID:733
-
-
/usr/bin/xattrxattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"1⤵PID:734
-
/usr/bin/xattrxattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"1⤵PID:734
-
/usr/bin/hdiutil/usr/bin/hdiutil detach /tmp/KSInstallAction.vrCD0vwhm8/m1⤵PID:736
-
/sbin/umount/sbin/umount /private/tmp/KSInstallAction.vrCD0vwhm8/m1⤵PID:737
-
/sbin/umount/sbin/umount /private/tmp/KSInstallAction.vrCD0vwhm8/m1⤵PID:737
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch1⤵PID:740
-
/usr/libexec/xpcproxyxpcproxy com.apple.mediaremoteagent1⤵PID:749
-
/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoteagent/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoteagent1⤵PID:749
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 5001⤵PID:752
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵PID:752
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportCrash.Root1⤵PID:758
-
/System/Library/CoreServices/ReportCrash/System/Library/CoreServices/ReportCrash daemon1⤵PID:758
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵PID:760
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵PID:760
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportCrash1⤵PID:780
-
/System/Library/CoreServices/ReportCrash/System/Library/CoreServices/ReportCrash agent1⤵PID:780
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵PID:781
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD589b8d39274ab843763802b1bab057355
SHA1ecbd29c0aecef8dde1d3c63d24fcf0c52ada6f4b
SHA256ce282b49b174defe931185ce29d236a9a9abcd635591e9b190287aa58ae18a49
SHA5126e2ed7f0a1111dd6d80e0a7c770e7d187e607ee04108d057e45e1fbaf9f361f6f03cc13a04fa193e8044745ce4c3ddba8a27a9345419de2f3aca4a84f0f4d6cb