Resubmissions
26-02-2024 16:09
240226-tmaalaaf7v 126-02-2024 16:09
240226-tl1fdsaf6x 126-02-2024 16:05
240226-tjq4yaae9t 126-02-2024 16:03
240226-thjcpsae6v 426-02-2024 16:02
240226-tg87qsab27 126-02-2024 16:02
240226-tg31qaae5w 126-02-2024 15:54
240226-tcnegaad4t 626-02-2024 15:51
240226-tay37ahh68 126-02-2024 15:51
240226-tal4maac7z 126-02-2024 15:50
240226-taaqlahh56 1Analysis
-
max time kernel
74s -
max time network
90s -
platform
macos-10.15_amd64 -
resource
macos-20240214-en -
resource tags
arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
26-02-2024 16:03
Static task
static1
Behavioral task
behavioral1
Sample
New Compressed (zipped) Folder.zip
Resource
macos-20240214-en
General
-
Target
New Compressed (zipped) Folder.zip
-
Size
22B
-
MD5
76cdb2bad9582d23c1f6f4d868218d6c
-
SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
-
SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
-
SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
Malware Config
Signatures
-
Resource Forking 1 TTPs 2 IoCs
Processes:
ioc process /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
Processes
-
/usr/libexec/xpcproxyxpcproxy com.apple.pluginkit.pkd1⤵
-
/usr/libexec/pkd/usr/libexec/pkd1⤵
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/New Compressed (zipped) Folder.zip\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/New Compressed (zipped) Folder.zip\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/New Compressed (zipped) Folder.zip"1⤵
-
/bin/zsh/bin/zsh -c "/Users/run/New Compressed (zipped) Folder.zip"2⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2481EFE7/OneDrive.app1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.icloud.findmydeviced1⤵
-
/usr/libexec/findmydeviced/usr/libexec/findmydeviced1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.secinitd1⤵
-
/usr/libexec/secinitd/usr/libexec/secinitd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.cfprefsd.xpc.agent1⤵
-
/usr/sbin/cfprefsd/usr/sbin/cfprefsd agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.suggestd1⤵
-
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AppStore.19001⤵
-
/System/Applications/App Store.app/Contents/MacOS/App Store"/System/Applications/App Store.app/Contents/MacOS/App Store"1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.siri.context.service1⤵
-
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.storeuid1⤵
-
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.adid1⤵
-
/System/Library/PrivateFrameworks/CoreADI.framework/adid/System/Library/PrivateFrameworks/CoreADI.framework/adid1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵
-
/usr/libexec/neagent/usr/libexec/neagent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.cloudkeychainproxy31⤵
-
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.knowledge-agent1⤵
-
/usr/libexec/knowledge-agent/usr/libexec/knowledge-agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.coremedia.videodecoder 6181⤵
-
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.FaceTime.18601⤵
-
/System/Applications/FaceTime.app/Contents/MacOS/FaceTime/System/Applications/FaceTime.app/Contents/MacOS/FaceTime1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.videoconference.camera1⤵
-
/usr/libexec/avconferenced/usr/libexec/avconferenced1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.FaceTime.FaceTimeNotificationCenterService 6361⤵
-
/System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService/System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.mediaremoted1⤵
-
/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 6361⤵
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 6371⤵
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵
-
/usr/sbin/spindump/usr/sbin/spindump1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.TextInputMenuAgent1⤵
-
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.TextInputSwitcher1⤵
-
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher1⤵
-
/usr/local/bin/helphelp1⤵
-
/usr/bin/helphelp1⤵
-
/bin/helphelp1⤵
-
/usr/sbin/helphelp1⤵
-
/sbin/helphelp1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.tailspind1⤵
-
/usr/libexec/tailspind/usr/libexec/tailspind1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbdFilesize
124KB
MD5a8571c3c39d72043b4c76c06892b5754
SHA158cc5ec1953933a25db1b17f412ed320149c1840
SHA256b4b70d22836c52dddab342a41988bad305854e27cd1bbf9dac670d8f7a5ba7f8
SHA5122f408972ef089cb9cff3b3c4129938878dbb368d4346efbb40932e878d97e895b88425b0a6e0e02dd04fc5229481ff22a6f2e5fb47fd7f7f3b0694a7468e8bc2
-
/Users/run/Library/Caches/GeoServices/Resources/altitude-1184.xmlFilesize
157KB
MD5de0d1de3897d152e34fad38ac8384188
SHA18783a7701c14576789a2316e0f3f9c3d5acd660a
SHA256fd449596e4bb21c338a5102cd749ba1c87debfe62d1c161deb0cc7d8d74e8226
SHA5125fd1734e6289fa80752c4c583875577e87d7f58b01c5d14445d7888c172acd94ab0c4d3332660e1d92706678e1611515393c7c3d28be0d0e735028e1f5d16de5
-
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.dbFilesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.dbFilesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818