8d324307b08af033fb998587ab5dfeb292c9859022a8c228ad01e79116091338

Resubmissions

18-02-2024 01:24

240218-bsmtrscc41 8

18-02-2024 01:21

240218-bqyhgscg95 7

Analysis

max time kernel
143s
max time network
144s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
18-02-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Crack Installer.dmg
Size

1.7MB
MD5

19dae69fbd8061a574b1da0141bd7fa8
SHA1

123f4d0555604b937c5bbdc2ba61ee4befafc793
SHA256

28e4127655a68b296ae50cf4e1e6ebc9c4270a659d8b09d51390ae4f431985b3
SHA512

decf23bc3cb433ef14b3dc7d15a3ddee2729533d7e9a82f4cbee88a010e50a057713d03a36a659dc399a64941f35c3f3a804784477a274dd277fea3474dae13f
SSDEEP

49152:6J9/P09GCwvCUc2j8oi2lXekk20nWX7gvkAarN9bi7qDb+c:6//P09twKf31tH8XU8LrN9i+P+c

Score

8^/10

evasion execution

Malware Config

Signatures

Identifies hardware specifics through system_profiler 8 IoCs

Processes:

ioc	process
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType

File Permission 1 TTPs
evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

AppleScript 1 TTPs 8 IoCs

execution

AppleScript

T1059.002

Processes:

ioc	process
sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
osascript -e "display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
osascript -e "tell application \"Terminal\" to close first window"
sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
osascript -e "display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
osascript -e "tell application \"Terminal\" to close first window"

Resource Forking 1 TTPs 2 IoCs

evasion

Resource Forking

T1564.009

Processes:

ioc	process
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper

Command and Scripting Interpreter 1 TTPs
execution

Unix Shell
T1059.004

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Crack\\ Installer\""
1⤵
PID:542

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Crack\\ Installer\""
1⤵
PID:542

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Crack\\ Installer"
1⤵
PID:542

/bin/zsh
/bin/zsh -c "open /Volumes/Crack\\ Installer"
2⤵
PID:544

/usr/bin/open
open "/Volumes/Crack Installer"
2⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:564

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:565

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:569

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:576

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:577

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:578

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:579

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:581

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:582

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:586

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:588

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:589

/usr/bin/login
login -pf run
1⤵
PID:590

/bin/zsh
-zsh
2⤵
PID:594

/usr/libexec/path_helper
/usr/libexec/path_helper -s
3⤵
PID:595

/usr/bin/locale
locale LC_CTYPE
3⤵
PID:596

/Volumes/Crack Installer/Crack Installer
"/Volumes/Crack Installer/Crack Installer"
3⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:591

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:592

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:593

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:593

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
1⤵
PID:600

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
1⤵
PID:600

/usr/bin/osascript
osascript -e "tell application \"Terminal\" to close first window"
2⤵
PID:601

/bin/sh
sh -c "chmod +x /Users/run/exe"
1⤵
PID:602

/bin/bash
sh -c "chmod +x /Users/run/exe"
1⤵
PID:602

/bin/chmod
chmod +x /Users/run/exe
1⤵
PID:602

/bin/sh
sh -c /Users/run/exe
1⤵
PID:603

/bin/bash
sh -c /Users/run/exe
1⤵
PID:603

/Users/run/exe
/Users/run/exe
1⤵
PID:603

/bin/sh
sh -c "dscl . authonly \"run\" \"\""
1⤵
PID:604

/bin/bash
sh -c "dscl . authonly \"run\" \"\""
1⤵
PID:604

/usr/bin/dscl
dscl . authonly run
1⤵
PID:604

/bin/sh
sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
1⤵
PID:605

/bin/bash
sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
1⤵
PID:605

/usr/bin/osascript
osascript -e "display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:606

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:606

/bin/sh
sh -c "dscl . authonly \"run\" \"root\""
1⤵
PID:609

/bin/bash
sh -c "dscl . authonly \"run\" \"root\""
1⤵
PID:609

/usr/bin/dscl
dscl . authonly run root
1⤵
PID:609

/bin/sh
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
1⤵
PID:610

/bin/bash
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
1⤵
PID:610

/usr/sbin/system_profiler
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
1⤵
PID:610

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:612

/bin/sh
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
1⤵
PID:615

/bin/bash
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
1⤵
PID:615

/usr/sbin/system_profiler
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
1⤵
PID:615

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:617

/bin/sh
sh -c "rm /Users/run/exe"
1⤵
PID:620

/bin/bash
sh -c "rm /Users/run/exe"
1⤵
PID:620

/bin/rm
rm /Users/run/exe
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:621

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:622

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:622

/usr/bin/login
login -pf run
1⤵
PID:623

/bin/zsh
-zsh
2⤵
PID:624

/usr/libexec/path_helper
/usr/libexec/path_helper -s
3⤵
PID:625

/usr/bin/locale
locale LC_CTYPE
3⤵
PID:626

/Volumes/Crack Installer/Crack Installer
"/Volumes/Crack Installer/Crack Installer"
3⤵
PID:627

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
1⤵
PID:629

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
1⤵
PID:629

/usr/bin/osascript
osascript -e "tell application \"Terminal\" to close first window"
2⤵
PID:630

/bin/sh
sh -c "chmod +x /Users/run/exe"
1⤵
PID:631

/bin/bash
sh -c "chmod +x /Users/run/exe"
1⤵
PID:631

/bin/chmod
chmod +x /Users/run/exe
1⤵
PID:631

/bin/sh
sh -c /Users/run/exe
1⤵
PID:632

/bin/bash
sh -c /Users/run/exe
1⤵
PID:632

/Users/run/exe
/Users/run/exe
1⤵
PID:632

/bin/sh
sh -c "dscl . authonly \"run\" \"\""
1⤵
PID:633

/bin/bash
sh -c "dscl . authonly \"run\" \"\""
1⤵
PID:633

/usr/bin/dscl
dscl . authonly run
1⤵
PID:633

/bin/sh
sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
1⤵
PID:634

/bin/bash
sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
1⤵
PID:634

/usr/bin/osascript
osascript -e "display dialog \"Required Application Helper. Please enter passphrase for run.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
1⤵
PID:634

/bin/sh
sh -c "dscl . authonly \"run\" \"root\""
1⤵
PID:635

/bin/bash
sh -c "dscl . authonly \"run\" \"root\""
1⤵
PID:635

/usr/bin/dscl
dscl . authonly run root
1⤵
PID:635

/bin/sh
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
1⤵
PID:636

/bin/bash
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
1⤵
PID:636

/usr/sbin/system_profiler
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
1⤵
PID:636

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:638

/bin/sh
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
1⤵
PID:641

/bin/bash
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
1⤵
PID:641

/usr/sbin/system_profiler
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
1⤵
PID:641

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:643

/bin/sh
sh -c "rm /Users/run/exe"
1⤵
PID:646

/bin/bash
sh -c "rm /Users/run/exe"
1⤵
PID:646

/bin/rm
rm /Users/run/exe
1⤵
PID:646

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
355B

MD5
a6ef4856e99c9d8e1d9bb762c5a8503a

SHA1
25d5405ad91791b716ae5a56b37aa2b393854967

SHA256
232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa

SHA512
582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
355B

MD5
2f01f7a00c85e424f82b00b2bf794a7c

SHA1
c75cb52aa31012888dd7c65373d5faba6048c425

SHA256
23d6746cb1c1906c9cfb5c69f7377f7cb68965ac0708ed1d600bfd3d3c34ce32

SHA512
75131e0145182653cef2edbb968853c9cb3c26c37c5821f3cd69c3ecdde7979ae37e74ecea8ad333090a473177c6dad43bc34f94a8fd104cd4c9b16c8f7b54f8

Download Submit
/Users/run/.zsh_history
Filesize
579B

MD5
71ec3ac8e43a0db4d82f42ac9e574919

SHA1
1c5a17dfafbe9531cf0725cfc9a2b770870297fc

SHA256
a0864a18db5cec54897e4f5e71924a4159a01d90c7fa896096cbebab5897b25f

SHA512
f9d78ebc912eaebfc0d2219255295e7da1ca47f511795e2c5f6e79cc2dee495069efa1808dd7d982af70325a577afeeb8b67bdd9c8720838c6fa7cc96514420a

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Filesize
124KB

MD5
76f6ba72d0cec621be2bf07e0f4520df

SHA1
7df0978cdf6fbea9181ae28f2bd53647aab8fc8a

SHA256
3bf1034c3b3e4aae929fba4750c1421b3f9eec8c50ddc8f965cd65ce0a362b46

SHA512
b8a1b1c462a66ee1f25349b62a6d279dd6ad9040323c6b23f5bd520bc663615233fdee3fe67caa0d5cff4483a16519ce6d2e4887b1492ca919a891d3c4144f62

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1168.xml
Filesize
150KB

MD5
76ebb0196d42a294b69ef118cbb301d5

SHA1
61e5ab752d351af1661716bc48c0520f66cd1d1b

SHA256
aaa9febe98e3a75220b4933d1f00f2bef276183491e7d171fa54d03259812759

SHA512
8dde09d72944e8925c5bd64dc3799a44d7c30191d5038939a24f8a45ccf4d66b84990e8be3e0f2ee1d42d1dd6e5ed3673c39f803874fb0840a3232cc1e533663

Download Submit
/Users/run/Library/Saved Application State/com.apple.osascript.savedState/data.data
Filesize
1KB

MD5
d450d344f5f141d6cd647ecb7b4eecde

SHA1
b52bc27eb24c14e92305d880eae48cd520cc0311

SHA256
c27ce4e52e396e0e3158700104b4b79c984efb313ce652d25d882690436701b2

SHA512
3bbe07c62a0272d2b65b85cc261b9dea8c2eacf29d24f983e07a5a1e86a84aff88e1c08b7803d4c6d1a3f38e8d7a3f8470014c48274fa606c16449b77f9143e4

Download Submit
/dev/ttys001
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit