d707db59ccd23c20df462edcedb2b82b66e3d38571a0a1a3fc359659c704a1e1

Analysis

max time kernel
840s
max time network
1799s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
25-04-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

18KB
MD5

86119928b18504c6471ca2f3e75ed1eb
SHA1

ffe7e90c3b3672c2856df7df884524c31850075f
SHA256

d707db59ccd23c20df462edcedb2b82b66e3d38571a0a1a3fc359659c704a1e1
SHA512

8f4dced674edad5b139b627afb1ee9efd5b16284d66073610b0657acf8f3a6aa1c0ff4977ed9368939ea9b24c933d0d9bfbb072a5779d6621c3359aa6a275ee5
SSDEEP

384:ri7mDpmReVoOs4Ui9ylKeGM9U8HhhbxpU7VZS2LjFrSX++VJCBXQL:ri7mBVoOs4UmyI1MRBhbDCLFrSFJQQL

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/sample.html\""
1⤵
PID:487

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/sample.html\""
1⤵
PID:487

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/sample.html
1⤵
PID:487
- /bin/zsh
  /bin/zsh -c /Users/run/sample.html
  2⤵
  PID:489
- /Users/run/sample.html
  /Users/run/sample.html
  2⤵
  PID:489
- /bin/sh
  sh /Users/run/sample.html
  2⤵
  PID:489
- /bin/bash
  sh /Users/run/sample.html
  2⤵
  PID:489

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:495

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterB516C108/OneDrive.app
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:518

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:520

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:521

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:522

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:539

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:545

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:546

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:547

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:549

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:552

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:552

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:551

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads