07db3e70c1155910f33b698ab4a17382b4cbcc865b5bc65a21256adfa09dcd30

Analysis

max time kernel
341s
max time network
391s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
06/03/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Notion-3-2-0-universal/Notion-3-2-0-universal
Size 188KB
Sample240306-b455gsfd8v
SHA256 a63ddbdd6b135c93b5058cb34f53dadae7737596fdf835535788528dcc1e379d
MD5 b35218cc2b2f5f0bd6b454276f99e15e
SHA1 8f66b42d9c5febe81eab8f3324865fd1c797d5c2
SHA512 53298b43fac1c8ba06f0eef56c48a435a7e3d4fe00a7767e2a782e2f4a17e6f4c5a9f1e1370757d288657d7a72beb7965f1a0c60b593dc49fd2ecb6c533f82e6
SSDEEP 1536:3PyAH/QAMxGx6jrPMGTK7LVRQIcD/QAMx/eIpMTTV:/yAH/bSAGTD/+KTT
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

evasion execution

Malware Config

Signatures

AppleScript 1 TTPs 6 IoCs

execution

AppleScript

T1059.002

ioc	Process
osascript -e "tell application \"Terminal\" to close first window"	Process not Found
osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""	Process not Found
osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""	Process not Found
osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""	Process not Found
osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""	Process not Found
sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"	Process not Found

Resource Forking 1 TTPs 1 IoCs

evasion

Resource Forking

T1564.009

ioc	Process
/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.7/Resources/Python.app/Contents/MacOS/Python /var/tmp/olx	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal\""
1⤵
PID:524

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal\""
1⤵
PID:524

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
1⤵
PID:524
- /bin/zsh
  /bin/zsh -c /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
  2⤵
  PID:525
- /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
  /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
  2⤵
  PID:525

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
1⤵
PID:527

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
1⤵
PID:527
- /usr/bin/osascript
  osascript -e "tell application \"Terminal\" to close first window"
  2⤵
  PID:528

/bin/sh
sh -c "python3 /var/tmp/olx"
1⤵
PID:529

/bin/bash
sh -c "python3 /var/tmp/olx"
1⤵
PID:529

/usr/bin/python3
python3 /var/tmp/olx
1⤵
PID:529

/Library/Developer/CommandLineTools/usr/bin/python3
/Library/Developer/CommandLineTools/usr/bin/python3 /var/tmp/olx
1⤵
PID:529

/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.7/Resources/Python.app/Contents/MacOS/Python
/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.7/Resources/Python.app/Contents/MacOS/Python /var/tmp/olx
1⤵
PID:529
- /usr/bin/osascript
  osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""
  2⤵
  PID:531
- /usr/bin/dscl
  dscl . authonly root topu
  2⤵
  PID:574
- /usr/bin/osascript
  osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""
  2⤵
  PID:575
- /usr/bin/dscl
  dscl . authonly root
  2⤵
  PID:610
- /usr/bin/osascript
  osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""
  2⤵
  PID:611
- /usr/bin/dscl
  dscl . authonly root
  2⤵
  PID:613
- /usr/bin/osascript
  osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""
  2⤵
  PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:533

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:554

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:554

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:560

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterDA6CE80A/OneDrive.app
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:566

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:568

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:569

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:570

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:571

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:572

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:573

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:581

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:581

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:582

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:582

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:599

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:601

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:601

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:605

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:612

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 288B
SHA256 04fefbaa058a5c300a90a50be6894dde2138fa47239dd93e7b9265352a96e4eb
MD5 c92127f7ee48ad5e3c8b165ef0dcba1c
SHA1 7fabbe716497efc2de185429b40127cdd58f59b7
SHA512 29d6c275b4337e642dfc183316969acbc345c0cfae53f94a103192e56fbf73499cc05cbf8076788191434162ba75275adfbbe0bf31ade37be0c76954570b1ccc
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 288B
SHA256 87a9a1a2c137609da7808452aa71478cca04d1b0a778b1d1f559446bd8178d19
MD5 180d9b3949b39ff1f5c85cecb6d6785c
SHA1 c0d976708fd5a19728d7f0f275e93e19b7558eba
SHA512 68ee36c2cf3ab0699358181e5027b9cc69adb9847de0206fe0dd46d3a06155b0f5557bd39863f6e1cfde3698f7abd873e57bd41398983fbbdf07a02e97b5ff43
MD5 SHA1 SHA512

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 124KB
SHA256 e8d8bbd464056485900817697412d305de6d014f277043a5001e6c6f85ac4a5b
MD5 d028b65b8934505addc8455e624157cb
SHA1 589d55227b91ce45489cc089f238fb27e94f1c80
SHA512 64073d8bea492d0a80f0107926c7583bd026ccad33f8fcc2ef5712c1ce2e5fe152328690025722eefe35423639186782e33cc357d5a0a8fda78fa12180c23e6c
SSDEEP 3072:dG1qCMGJOUrVwEJcrhslHsj0YgN0fT7V/CEF7tPGqpyqA7icNCRqcX:dGqCMGJOUeralMj0Ze7tOiHX
MD5 SHA1 SHA512 SSDEEP

Submit Download

altitude-1188.xml

Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1188.xml
Size 157KB
SHA256 95e4aa9570e1acd3de701ac19c395d80a710275d6e052c598c09cc1ed710c398
MD5 3e6423b24f263da56088a101653606cd
SHA1 7c43adc6c23442858bf0dcdf84b5a08323fba317
SHA512 3f85d2f77102790e8ee82c1f8797c754167a79af91dfdd5377e7681370f01540234017eb24be89cc7a4da5e70005bf35b069d21f5bf70cc59efe1abd6dd8c255
SSDEEP 768:SmSaD5wrMhciPVOqMyDwnW8bz4DZKrj4zvJq2ZZgt8VxtaxU3B4c4lWDSr/g2Oq/:SmSs0byobX6TUtCDTwlHEAhXCm
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.data

Path /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 fa3593fb3145ad9d831d997019d56e8d6a1746e4a142485efe21a8766360ba41
MD5 1e4c3c248f5c3422dd7d00b48675f7cd
SHA1 bf61d49152b577a0add7428000bdd690496312ba
SHA512 c441c666d3c6c32db013fed44fa78e7751368d8847c9672545c5e4d37cfa3de48bd832f053bd02942d30855dd4485d469ff9d24a2e7903e05c49ae3a937261d3
MD5 SHA1 SHA512

Submit Download

data.data

Path /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 40a769a659a8f1deca7070712c22b70e69f4b889da060dcea9cd0181c5bd1fda
MD5 c8c3e34678021dd3e70dea71c0077a6b
SHA1 a02c0e6b5aa85e5e1b2af5562f34b2fa600ca669
SHA512 ef984e48fa95ce0ca72e783a51a9f1ed3b7a4429ba3ec058a0d3739460e4d70569fda402656d9607223e3bb1d54fbd91a27bba734f63b1171d25972f720d480d
MD5 SHA1 SHA512

Submit Download

data.data

Path /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 7bb68abd7d4774e252167e575be41c30db31cb181cd27a2875d066dbf73b39a8
MD5 b369a130bcb80e6908894db58d0ee282
SHA1 ae5eadfd7e9d3ca7e9259f38dc62730f4552c15d
SHA512 84a1343abf053b38a2db428d9172a5b782244e6bd03146ccfe81d98805b80a1cdd895726281d1c05d4e47b003e49f7e563ad25a711a86b698094d921067885e5
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads