82c6e66b92a106822693cc8011cc8d99c1b889a8afb01518ff4a0cc163e07094

General

Target
9999.jar
Size 639KB
Sample240316-qa2yasdf22
SHA256 82c6e66b92a106822693cc8011cc8d99c1b889a8afb01518ff4a0cc163e07094
MD5 ef361b460a6060ad383a019016b53008
SHA1 1c2f1587f32ceadbef07513e4f1cfa581d409a0d
SHA512 55fe711144af2625603687deb6a332ebbd4982855bb6604da966ab411c252f25a3ce9f6a87d6314b236156755c842d571eb6d4802484e68728f74d5966f68217
SSDEEP 12288:r/dAQq/Sw6Jcz4zYogH3gA/FR3+96ON+pfggJiRM93Sus2dMSdbDY0:r/uQeaJc40P3gAf2f+p4yvSuRdPdbDY0
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

execution

Malware Config

Signatures

JavaScript 1 TTPs 1 IoCs

Adversaries may abuse various implementations of JavaScript for execution.

execution

JavaScript

T1059.007

ioc	Process
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/9999.jar	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Users/run/9999.jar\""
1⤵
PID:533

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Users/run/9999.jar\""
1⤵
PID:533

/usr/bin/sudo
sudo /bin/zsh -c "open /Users/run/9999.jar"
1⤵
PID:533
- /bin/zsh
  /bin/zsh -c "open /Users/run/9999.jar"
  2⤵
  PID:534
- /usr/bin/open
  open /Users/run/9999.jar
  2⤵
  PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.JarLauncher.1532
1⤵
PID:535

/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
"/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
1⤵
PID:535
- /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
  "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/9999.jar
  2⤵
  PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:541

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:544

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:545

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.secd
1⤵
PID:546

/usr/libexec/secd
/usr/libexec/secd
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:547

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:568

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:569

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:579

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:580

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:581

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:582

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:586

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:587

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:588

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:595

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreAuthentication.agent
1⤵
PID:601

/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:602

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:603

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:603

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 439B
SHA256 1b2c817978649cad70d67be41215a663790d97707b7512cfc156b488438cbec8
MD5 c05b619361d2cac0288befbdef519546
SHA1 634e507971e2bd2697df0cdbbe8772e6fbec276e
SHA512 86308ab30375670ff5eb886d50e3b5be5f3b7d60e0de53458e0372c0c67cbfd1c58450acb201c7d21a5f351c2b0e796d1777dbaa1e2b83ef7f69a83dac26ba20
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 487B
SHA256 2e8a5e8288abdb773269792173899a3261c3a04c2a4d07c119988542d1978b49
MD5 e251c94fc14a772dbd695b0919d4f53a
SHA1 63c2eaa2aae3f097a6ad8952064d4764fe8295e0
SHA512 92222001d9e6f4bebf5abfc02f4a0b379b33c4f7dc4e9b27170e8b2d43f7c7e017632f893619d04f01eeaa48cfd79f77c7b910cc47d74d5b81f69ea83bd69a5d
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 487B
SHA256 273fc7ecbe78aaf71d4692bc0c939735d1d6b02e48b9b7b503e9554bf54980b7
MD5 7d3535f2750c80fb5549715a6eb18997
SHA1 e4c3448aa704f5a1c3e3dc8c6362ec9238e38ef9
SHA512 a3344e01a57099e812e88cd83577f43e0dc756a06460ceb3177dae23a15a09a77a6175d99f7704eef66dc0edbf3539afa7982686703d7a0f2cd0a729be59fe83
MD5 SHA1 SHA512

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 124KB
SHA256 39e8329e2152cce5f0f81d34c808b90ab072f716462dba994381270e59e55d4c
MD5 451dc79c9eacd744edec9dbefdff0b26
SHA1 b77289589ea3a30029456ba317d59be18f57cbad
SHA512 e8d423eff01c5ae95efa7292f5f83b8bea52c1c9cf34719d4d4dbda6a00386f73599c52849a27959db62d94be900c73b84234ae3b1bc18302c6d4f40abd6f595
SSDEEP 3072:WG1qWmGLOceVwEJcrhslHsj0YgN0fT7V/CEF7tPGqpyqA7icNCRqcO:WGqWmGLOcbralMj0Ze7tOiHO
MD5 SHA1 SHA512 SSDEEP

Submit Download

altitude-1214.xml

Path /var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1214.xml
Size 158KB
SHA256 032673ebc61db6f46d76d507b19b1b0136a3f7e766a311f38921d2ee7fe450be
MD5 3beb34e02eb9bd01714f9926b3ebfc96
SHA1 d558e451b1b1ea9f8a7a29449fe1d2985abbd96c
SHA512 f882c6dc232cc24367e6a83117a8f358860fe8cc9b5d67fa2255645a43658e1cf72af44fa3708ec03c24a788c78abea2a268214adcfcb52aa7dce207102627ff
SSDEEP 768:SmSaD5wrMhcpPXOqMyuwnW8arz4DZKrj45vJq2ZW/gt8VxtaxU3B4c4lWDSr/g2/:SmSsJbyXba6lU6CDTwlHEkmXCIA
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsDirectory.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads