d5a29864b193a4e66e9485335c29a8d9d501c95f168644153569bd5c0c167369

General

Target

extra+work.docx
Size

306KB
MD5

1e713427f8e1ab3c16aa944043b4b3d4
SHA1

09d1a2d41f1358d5da4c8049a1dd7045c0cbc491
SHA256

d5a29864b193a4e66e9485335c29a8d9d501c95f168644153569bd5c0c167369
SHA512

d2a5e1906e5cc72d6f289e7772a0d7b0fea25abff73b24c81f5463299426813adb7d9589d5a651eacb6fad56207e671c68299e6d492194bfeda90fc165a04abe
SSDEEP

6144:iCwunrIgPmBYu2jJlnAeNJ+Eo1Y3KguwEhE8/n:0erIpYu2nnAe+Eo1El8/

Score

5^/10

evasion execution persistence

Malware Config

Signatures

Launch Agent 1 TTPs
persistence

Launch Agent
T1543.001

Resource Forking 1 TTPs 2 IoCs

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found

Launchctl 1 TTPs 1 IoCs

execution

Launchctl

T1569.001

ioc	Process
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Users/run/extra+work.docx\""
1⤵
PID:513

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Users/run/extra+work.docx\""
1⤵
PID:513

/usr/bin/sudo
sudo /bin/zsh -c "open /Users/run/extra+work.docx"
1⤵
PID:513
- /bin/zsh
  /bin/zsh -c "open /Users/run/extra+work.docx"
  2⤵
  PID:514
- /usr/bin/open
  open /Users/run/extra+work.docx
  2⤵
  PID:514

/usr/libexec/xpcproxy
xpcproxy com.microsoft.Word.2032
1⤵
PID:515

/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
"/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word"
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:542

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:547

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:548

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:550

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:554

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.fba.2660
1⤵
PID:558

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant"
1⤵
PID:558

/bin/launchctl
/bin/launchctl list
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.helper
1⤵
PID:560

/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:560

/bin/launchctl
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist
1⤵
PID:561

/usr/bin/codesign
/usr/bin/codesign -v /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:563

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:564

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:557

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Launchctl

1

T1569.001

Persistence

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Privilege Escalation

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml

Filesize
295KB

MD5
632a824067462b044cb464776907840e

SHA1
48afb4c9b9f002b9f85457c174ae170023ad1d38

SHA256
c6088e000b60403146810eaeb83d29a6f182459b6fb76f27f2d22821d2dc72ae

SHA512
2c57e76b806e4d5bb5e65dca72dc5bb91191d5b319f2c32fb6d0ac066a5726bab6f38b07102e81d37e276058fca01591d9d5b693b817ea42caee2d8f8b083ad1

Download Submit
/Users/run/Library/Group Containers/UBF8T346G9.Office/FontCache/4/PreviewFont/hier_officeFontsPreview_4_38.ttf

Filesize
445KB

MD5
c6908d6de8f2e3da992b8c7bdfad8555

SHA1
0aac92be836c1e78a8a8f2264ce47deba5a2bbc0

SHA256
7388751498339d6812ed7ec4bbc35d661eefe0b85a627c138e70516a3a831342

SHA512
6febb8679b646270551d227d3149788b1945fdf54e0117736d004f35e1a500e81bede1056d448ad783a78aaac8dd044afde2cc0fca952bd91e4c6a316482ebc7

Download Submit
/Users/run/Library/Group Containers/UBF8T346G9.Office/FontCache/4/PreviewFont/hier_officeFontsPreview_4_38.ttf

Filesize
1.9MB

MD5
30b855ffd865ca6e00e9c99ee891965c

SHA1
e94516edbbdbe57dd8c98427e81becc6813493b4

SHA256
3f125e3959590d190520720458a4412ba903423f3fb19d5935cf2d47b0274172

SHA512
3fd4a83db5c8edfda6505d3265279c701206104254c9cd549d4e13b49b4a75238d34b3d2b9b92642930c28415925c15a3a72646fc82523a10127ca1b13aa69d9

Download Submit
/private/var/db/spindump/tailspin-trace.2024-02-14_06-58-19.tailspin

Filesize
555KB

MD5
e60f2dd8e3da3c1572e395634bf7ba4c

SHA1
a8340a029911cb88b44ee2092cf7b0478f03db4a

SHA256
209321b99e54aec1b0ccf83e1d36a6dc97a2efa46bae08f5fd3a600aaf025fc6

SHA512
09e776a959ce02e735da4efe2a0fe55280e68dc30254d33510798202a0e8f0fdc60bde1408ba55ec37b0db6f393ad99c66b58ca5929728be1f12208f158bee87

Download Submit
/private/var/db/spindump/tailspin-trace.2024-02-14_06-58-19.tailspin

Filesize
17.7MB

MD5
e96be787e2d0a6360a0aa36826409050

SHA1
65825597cffd4474dff6ea97a53822aec7d58040

SHA256
d640bd859e3f992498bba027560b22e26341724524c0eae55e86df1d23be74d3

SHA512
5a50ecf8ca26110a38b17c50b01848e1df5cefea0150a3f53507463d3657b07e71be9b8c2183467c02b1113230452bf4cd367d8aca37e5993615a57a37a25f0e

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit

Analysis

Sharing