ebc5c0ba3f38019087f62901b921ae150bea39439f0910345f9434a275d21fd0

Analysis

max time kernel
144s
max time network
146s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
11-03-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23-lettre-de-demission-cdi.docx
Size

40KB
MD5

15539fc498819c9f52de840423c44653
SHA1

d11d7df3a4551832134de978aa0146a32b3c2393
SHA256

ebc5c0ba3f38019087f62901b921ae150bea39439f0910345f9434a275d21fd0
SHA512

0be8ed08d0391593594a1d96fb57f259210987380bf964f53527f32c97d422e382963cfe981e025a134eb3a5fc2deff67b30822954a8fb5dc682b16e50ec3598
SSDEEP

768:BLpLa+fyS0qNHaByrUsP00C+QAkTEyCouvahAzAGETgQQmy/zGbm:znKS08ac5M0XQA3JvVAFgQQdyi

Score

5^/10

evasion execution persistence

Malware Config

Signatures

Launch Agent 1 TTPs
persistence

Launch Agent
T1543.001

Resource Forking 1 TTPs 2 IoCs

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found

Launchctl 1 TTPs 1 IoCs

execution

Launchctl

T1569.001

ioc	Process
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:521

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:521

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Users/run/23-lettre-de-demission-cdi.docx\""
1⤵
PID:523

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Users/run/23-lettre-de-demission-cdi.docx\""
1⤵
PID:523

/usr/bin/sudo
sudo /bin/zsh -c "open /Users/run/23-lettre-de-demission-cdi.docx"
1⤵
PID:523
- /bin/zsh
  /bin/zsh -c "open /Users/run/23-lettre-de-demission-cdi.docx"
  2⤵
  PID:524
- /usr/bin/open
  open /Users/run/23-lettre-de-demission-cdi.docx
  2⤵
  PID:524

/usr/libexec/xpcproxy
xpcproxy com.microsoft.Word.2032
1⤵
PID:525

/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
"/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word"
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:553

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:556

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:556

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:560

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterDA6CE80A/OneDrive.app
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:562

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:563

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:566

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.fba.2660
1⤵
PID:568

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant"
1⤵
PID:568

/bin/launchctl
/bin/launchctl list
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.helper
1⤵
PID:570

/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:570

/bin/launchctl
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist
1⤵
PID:571

/usr/bin/codesign
/usr/bin/codesign -v /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:581

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:590

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:597

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:598

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:599

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:601

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:602

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:610

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:610

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:611

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:617

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:618

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
106B

MD5
a60a7bcfc47eacaa66e5e3d701d3ba80

SHA1
7093ffc5beca33187c18461c7ff3259a1781ae35

SHA256
17e96efaf7f2e45e407a3c68fb57b78f09dea6fc1edf3732b888be4a4eadd468

SHA512
58736bd680d6c7a25b8d7db08fd4a258cf761dbaa44a5ece0c2b813ab12c20dc213ab40844dfc780687945cf2459f549f1a38bf3da16c5c332756f3b53e1c3a5

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
126B

MD5
95f24d2f9121654acd5a1c44e572082b

SHA1
ea13b61b35ef396ebe42f09e638a39f13b93fd9b

SHA256
2b7b2a1c679a5a0d2465351f35584f1eb6de22160daefb4cba351838f98f155e

SHA512
d1eaa0bd0b245f98a03d24197e02096400abea41f5a36905a41c777bedba15194f3de256c12b4f038e38267147986e8b9dd543189fdc6d1788d3c012bc63270d

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
167B

MD5
1340033aca269b30874eafa2ec72adfe

SHA1
e1c0e123ffc93a5f22c906c7206a625a149944d1

SHA256
fb10f63de2c68693f4360c0c8cb0dd64e163dde54ffb9c97932d804df4a4f724

SHA512
587feb19b7dcfc422a0feb360fc1a855a766e518d8a16b0e6b1df509706c0b703270449e5688bcc584002f277981d6f1edbed996abdd81b8a402ba968c2d08e6

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
167B

MD5
54ac2dfc3277cc71d095814696c9d295

SHA1
8f0d1dfbdff79cd6d57bc961c6c3fd097ba48893

SHA256
c538c601d32e3052f7b1abeba70b33930f59b71d07abeb63578e4340334fc4da

SHA512
9c6feb5711798bb03f566cfdce44150d28e9ac7cf6b6668aef9e9293b367b91a00d69db06d07198a7e2e3c8ba161ef2238e143bea6b1957cc9298ce8e9e7009b

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
d5a1c4b065956e9a06f0a80dad612977

SHA1
e1edb5456d507099ef0e375beb3ca55cf75062bc

SHA256
7f1c009e236d82763ad3fdacec2028a9725491cfe044154411c28d8d2075ff14

SHA512
34fa0937f83d2bfcff3967de40bcfccc50fcd9928b49e0d4e8642b4fca12fae3124c1578ef2808035030fdf7b38ec872dcc092bec78699bfbb7c6f7b38031e83

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1202.xml

Filesize
157KB

MD5
f627cf4820da06be8e6ff3fdec6ebfee

SHA1
993d8ec88721b9e76c3fe1f5987338a61b452bf8

SHA256
f1d2905b871b9b80172b7c9dc298c1a3dd355e6ae633f77562f4e06ed52a54e7

SHA512
bf698aa0eee296df872b91432670af719bda88be3b6d210a567b500da1cedc0e07055a805c2331ccacea0a8a17396e2e37b4bf70894b9052723049c96083001f

Download Submit
/Users/run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml

Filesize
259KB

MD5
1bb1b2bc3e08dd344117305553e9ad3e

SHA1
2246603992e757039fbb8894abe48d8bc3458210

SHA256
df89913d12186259731ce4c1bd65a45f7def3508d4dad6b98506625f27a9e6fd

SHA512
4fa3e0fc23814ecf4d7b13d59fd17966997250343195f08a0aacb447ef532a640945f360e349197015b09b61fb27a9248e22da99b84f54732f0dddf20fe6c397

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.microsoft.Word/mso00049018

Filesize
663B

MD5
ed3c1c40b68ba4f40db15529d5443dec

SHA1
831af99bb64a04617e0a42ea898756f9e0e0bcca

SHA256
039fe79b74e6d3d561e32d4af570e6ca70db6bb3718395be2bf278b9e601279a

SHA512
c7b765b9afbb9810b6674dbc5c5064ed96a2682e78d5dffab384d81edbc77d01e0004f230d4207f2b7d89cee9008d79d5fbadc5cb486da4bc43293b7aa878041

Download Submit