aa005aa63ee286b8d792a27e48c25bdb821324600bdd1136bf404d5bf304b9d4

Analysis

max time kernel
125s
max time network
144s
platform
macos-10.15_amd64
resource
macos-20231201-en
resource tags

arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
22/12/2023, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0e77c619ad9642053743594af72ab11
Size

533KB
MD5

f0e77c619ad9642053743594af72ab11
SHA1

52964e7b21a23494895a5411a91ebade507efede
SHA256

aa005aa63ee286b8d792a27e48c25bdb821324600bdd1136bf404d5bf304b9d4
SHA512

0ad03d21a8b80d35d4a7163d27c080ad4324ea4a8dfd9ea0bb45d4d4f00de8f9e2fa4f0c648f1c4a3432ceaad8a5056e96f99e5b92a7115411ef3ac1d23f60a5
SSDEEP

12288:HagDdYVK3wzCscmUUPq2Y3+V9rv1ImCn2/liKj:HagDdYVK3wzcmUUPq2Y3+V9rvfCn2/lZ

Score

8^/10

discovery

Malware Config

Signatures

Identifies devices as anti-VM 1 IoCs

ioc	Process
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found

Queries the hardware information (I/O Kit registry). 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

ioc	Process
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found

/usr/sbin/spctl
/usr/sbin/spctl --status
1⤵
PID:517

/usr/sbin/spctl
/usr/sbin/spctl --test-devid-status
1⤵
PID:518

/usr/bin/syslog
/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
1⤵
PID:519

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/f0e77c619ad9642053743594af72ab11\""
1⤵
PID:521

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/f0e77c619ad9642053743594af72ab11\""
1⤵
PID:521

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/f0e77c619ad9642053743594af72ab11\""
1⤵
PID:521

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/f0e77c619ad9642053743594af72ab11
1⤵
PID:521

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/f0e77c619ad9642053743594af72ab11
1⤵
PID:521
- /bin/zsh
  /bin/zsh -c /Users/run/f0e77c619ad9642053743594af72ab11
  2⤵
  PID:522
- /bin/zsh
  /bin/zsh -c /Users/run/f0e77c619ad9642053743594af72ab11
  2⤵
  PID:522
- /Users/run/f0e77c619ad9642053743594af72ab11
  /Users/run/f0e77c619ad9642053743594af72ab11
  2⤵
  PID:522
- /Users/run/f0e77c619ad9642053743594af72ab11
  /Users/run/f0e77c619ad9642053743594af72ab11
  2⤵
  PID:522

/bin/cat
/bin/cat
1⤵
PID:523

/bin/bash
/bin/bash
1⤵
PID:524
- /usr/sbin/ioreg
  ioreg -rd1 -c IOPlatformExpertDevice
  2⤵
  PID:525
- /usr/sbin/ioreg
  ioreg -rd1 -c IOPlatformExpertDevice
  2⤵
  PID:525
- /usr/bin/awk
  awk "/IOPlatformUUID/ { split(\$0, line, \"\\\"\"); printf(\"%s\", line[4]); }"
  2⤵
  PID:526
- /usr/bin/awk
  awk "/IOPlatformUUID/ { split(\$0, line, \"\\\"\"); printf(\"%s\", line[4]); }"
  2⤵
  PID:526

/bin/cat
/bin/cat
1⤵
PID:529

/bin/bash
/bin/bash
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:540

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:540

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:541

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:542

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:584

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/.dat.nosync021d.dKN29i

Filesize
12KB

MD5
1c8fffeb7e070eb49921a72321031014

SHA1
93ccc3609127d47e742fb052f1af58cecbc530a4

SHA256
5d98056056bde222323a28a74d8b60b087c278b8d609a0b2bd7a3ead82499e84

SHA512
892e60aa598d7079ad7ad39912cb5ac1d6dbca44b07ce1ee04c8655d6554e0f5abb48aa7c1ce1af787b04d195bc6fa4b896b54957802efc0a94e3c026e783d06

Download Submit