480a3f3407eaf5088f7cea9afe3ef96d968a4e571687a33adee57740ce39b673

Analysis

max time kernel
108s
max time network
163s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
03-04-2024 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper
Size

89KB
MD5

cc22ebc9278c47ec0b4d6da8db7ce52b
SHA1

04e8d0b7cf154a7a38f6ec05408f180decd4096b
SHA256

6f51aa00ab19543b812649b457e5830725dee27ed13181b42ddf5f97a555b522
SHA512

f23b3ec0a6a3b26c6aa19d17578a2794f3f485fd7827c61f47e6eea5b3c8f5fe30a5dbc89a68a88dfe07e6136ebf45cfc999142452ab1355ac4dbe81ac3b5c00
SSDEEP

768:qumv3WhEunCrAEmopqIRENO0l6ZcN1r91EugKOb2ISIRIkIX7wECZCrCgzK8LcaY:e1uCrDmop9R0xJENhkwEC3OcK

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	process
sh -c "sudo /bin/zsh -c \"/Users/run/SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper\""
sudo /bin/zsh -c "/Users/run/SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper"
/bin/zsh -c "/Users/run/SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper"
/Users/run/SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper\""
1⤵
PID:595

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper\""
1⤵
PID:595

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper"
1⤵
PID:595

/bin/zsh
/bin/zsh -c "/Users/run/SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper"
2⤵
PID:596

/Users/run/SyncBird
/Users/run/SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/MCPrivilege.app/Contents/Library/LaunchServices/com.minicreo.privilegeshelper
2⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:597

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:606

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:610

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:612

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:613

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:615

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:622

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:624

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:627

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:629

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:631

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:632

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:633

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:633

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:635

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2481EFE7/OneDrive.app
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:645

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:645

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Filesize
124KB

MD5
c7132811e18bead719d549b0c904d14a

SHA1
ffe3772ad85c9b90f7c91cb4a705f5fdc2ccc4df

SHA256
79d413e7a8a13a8a296040d41d593d103fe58da11f517c7c0d2412537bd9fda1

SHA512
edcc9241951d796c3165bae606c04fd5e4690715ca4b0eb9cb63093b6c2dc1a9c7e4757a61098463c6057b65d044a1dbda8bc64869e77b6920ff94b78330b5e8

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1261.xml
Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit