237711b3823b87a4b4e26963fe5576ebed08ba9efbf9b8cdb5d9762eaf01ff1f

Analysis

max time kernel
149s
max time network
155s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
22/02/2024, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

563B
MD5

6971f594a8d84022b2b6199b9e52fdc1
SHA1

2f5c25f2b53d35078bdb7e28006590adf7e701a2
SHA256

237711b3823b87a4b4e26963fe5576ebed08ba9efbf9b8cdb5d9762eaf01ff1f
SHA512

062385b3fc12382d7a2ad68f8aa3b581fc1f2786cb80ea13df15aca73c082f2ca4d868c503837d1e175474d25fcf5bcd898628d8535c430a1b2e2a59ba8e6604

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs

evasion

Resource Forking

T1564.009

ioc	Process
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:516

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.oracle.java.Java-Updater
1⤵
PID:517

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:517

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/sample.html\""
1⤵
PID:522

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/sample.html\""
1⤵
PID:522

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/sample.html
1⤵
PID:522
- /bin/zsh
  /bin/zsh -c /Users/run/sample.html
  2⤵
  PID:523
- /Users/run/sample.html
  /Users/run/sample.html
  2⤵
  PID:523
- /bin/sh
  sh /Users/run/sample.html
  2⤵
  PID:523
- /bin/bash
  sh /Users/run/sample.html
  2⤵
  PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:525

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:528

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:528

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:553

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterDA6CE80A/OneDrive.app
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:564

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:567

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:568

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:569

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:573

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:574

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:575

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:586

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:586

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
288B

MD5
c92127f7ee48ad5e3c8b165ef0dcba1c

SHA1
7fabbe716497efc2de185429b40127cdd58f59b7

SHA256
04fefbaa058a5c300a90a50be6894dde2138fa47239dd93e7b9265352a96e4eb

SHA512
29d6c275b4337e642dfc183316969acbc345c0cfae53f94a103192e56fbf73499cc05cbf8076788191434162ba75275adfbbe0bf31ade37be0c76954570b1ccc

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
288B

MD5
180d9b3949b39ff1f5c85cecb6d6785c

SHA1
c0d976708fd5a19728d7f0f275e93e19b7558eba

SHA256
87a9a1a2c137609da7808452aa71478cca04d1b0a778b1d1f559446bd8178d19

SHA512
68ee36c2cf3ab0699358181e5027b9cc69adb9847de0206fe0dd46d3a06155b0f5557bd39863f6e1cfde3698f7abd873e57bd41398983fbbdf07a02e97b5ff43

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
d0e4c62a12fe10255f90d44e687a20d4

SHA1
18fb3ac2967c34612c3af9356a63762a25ce6d87

SHA256
adf160f8f840e828cbc7e73f5279e53edb15bb7019bcd3b4434a9d61a40fa506

SHA512
4c7b0b789736f87cbba52fb141ac2168094882518359f3a44292c4a2fc6a5353b2bc9c61aefea7195f40f7d1b66b1ea38353c890c44c3412f21a9cd2347ec26c

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1168.xml

Filesize
150KB

MD5
76ebb0196d42a294b69ef118cbb301d5

SHA1
61e5ab752d351af1661716bc48c0520f66cd1d1b

SHA256
aaa9febe98e3a75220b4933d1f00f2bef276183491e7d171fa54d03259812759

SHA512
8dde09d72944e8925c5bd64dc3799a44d7c30191d5038939a24f8a45ccf4d66b84990e8be3e0f2ee1d42d1dd6e5ed3673c39f803874fb0840a3232cc1e533663

Download Submit