3615d31687a6138633066b260caff25efde86890b76d85911a4a927c46d87f8d

Analysis

max time kernel
129s
max time network
151s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
26-04-2024 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wub/Wub.exe
Size

791KB
MD5

82aff8883099cf75462057c4e47e88ac
SHA1

68e2939f59b3869e9bd3ecc4aca3947649631bf8
SHA256

aac1123f17f8569a36bf93876cea30e15103fd2379b401a79129a2a6e7285ac2
SHA512

212ac940a1f8bdd805813c279d471efc53b858bc35c5edad182dfde3c29c37854618a507a0a0839e5a383d1ba4fe317c0b3c8275d023c86ecfa36f221560b96d
SSDEEP

12288:ZaWzgMg7v3qnCiWErQohh0F4YCJ8lnyTQrv2HzAMI3u18:4aHMv6CWrj8nyTQrv2TAMI3ua

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Wub/Wub.exe\""
1⤵
PID:564

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Wub/Wub.exe\""
1⤵
PID:564

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Wub/Wub.exe
1⤵
PID:564

/bin/zsh
/bin/zsh -c /Users/run/Wub/Wub.exe
2⤵
PID:565

/Users/run/Wub/Wub.exe
/Users/run/Wub/Wub.exe
2⤵
PID:565

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:567

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:588

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:589

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:591

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.2255F5E4-B924-457C-9859-0A7607ED4C0D 588
1⤵
PID:593

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:596

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:598

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:599

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:601

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:602

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreAuthentication.agent
1⤵
PID:603

/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:604

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.EA623BE2-F8E8-4160-B8FE-F1677E3ABB6C 588
1⤵
PID:605

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:609

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:610

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:611

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:614

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 588
1⤵
PID:618

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:619

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:620

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.F01DBEFD-88BE-465A-81E6-37B9D2C0255F 588
1⤵
PID:621

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:631

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:632

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.C702004F-4AA2-429B-B7ED-95D1722A9003 588
1⤵
PID:633

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:636

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:637

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.BF29E0A7-6680-4D7F-AD02-2695CD1751EC 588
1⤵
PID:642

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.E0DAA08A-63E8-4836-A7E2-73A54808AF26 588
1⤵
PID:644

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:648

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Filesize
124KB

MD5
a1ccc5cc05dd30246798737145e78111

SHA1
da550b05c7adac9576be8516c2ebbc4a29b79e30

SHA256
c8668966f48f17f81dc6959b1ee2f10b7e1f4efababdd37d9b2e51f00fa33bea

SHA512
21eb44da283c6862a5fe0720bbeb7c5738e95d339c5266af70ff7c681b973f525bd44ad785e9556cb54c1df4a81f1eeb715f47ca97f89ad6deaea597bbef2d64

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/LocalizationStyleAttributes-8.plist
Filesize
6KB

MD5
d7aa7d53d68fd2f1ac03fc79dac41482

SHA1
dd0e8f57cfe73e0dd6738e9369d3e9ed1f64d8fa

SHA256
fa9f615b095101a65a744e353217f5ca7be7ed1bf908475f49efee6867cdfb53

SHA512
bd7e9d315546601c498182cdddf440cc64b1cee4dad6a2b389188e53f932ec8a068cf3fbdb822329ad12b4f30c8aa4fb294dc75243bdb9bc1a4979348c515525

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/default-search-4270.styl
Filesize
3KB

MD5
60f5974b5c0d46fe9c243c8b831ddee8

SHA1
b0cdfd37faa5c5d4d04badb52cd791667f39713c

SHA256
9ab20ddd5ef6a40115c362a4fab4bb163978acb28309b9a0a4a1c4b490ccc939

SHA512
8032fc668f281119321d69e6f2ae79eef2ab6da8a47ce1816542489ead2fb55bbca555dbe94bd78eda92eecc5d86e8aa334633bb797c7512c74c922c6fb4950d

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/supportedCountriesDirections-25.plist
Filesize
3KB

MD5
4d849f17f3bdc8361d9d9d2576bcffc7

SHA1
deb80bbfd72c7a7bcc7a6539a6dff7a070f19d2d

SHA256
46570f20e01d75c7431c85a3b1927963ae49dcf3f8f6c42dc102d8fe08095b57

SHA512
dcac8a979746ad1fad4f94c96b6702d05908d755d154ae4ad473330144f454919b2bb72f279348e15a955dc0671c5212e25f364c9b2bab331e1dc3d12f642584

Download Submit
/Users/run/Library/Caches/GeoServices/SearchAttribution.pbd
Filesize
63KB

MD5
b9b7361b2633f250d9bd9b8b16ed62ea

SHA1
82481bad0b5bd72df6b3dae45efa6c1e75b6777e

SHA256
838089b62287088bbfd20b70c4aed64b721da3c27a44e1090601f190b6af84f2

SHA512
3bb0e4e515cee5da21875585c905551503a121ebfb00ebd2aff1c1f74b2a4a32797c64feb648859b985a4d1b4656204f02620e0187047ad509c70a4d1e27eda5

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/368D7C0B78B9537DA94D7A03318AF418
Filesize
5KB

MD5
dbd2f9fc1096e1941d8d7b8764f45add

SHA1
dea28ddb4e8c79a8214fee87d7d2042ddee41e66

SHA256
3d91ac80e262eb1f66fcd21499d83bbb385b2f68085949c7be5f96b5248d51f2

SHA512
c7ff658a79ac179180790e02bf585db99b0106341f9a575ff6f38721408beacab80c27183f60ace8e2ad2a9c6c3b9ad7a5e1439b143c63b4ce7d201727695802

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/E839CC5D1495081409B4CB0BA52D828C
Filesize
5KB

MD5
f00bfcd8a3fbee0103bfdbde08af861f

SHA1
deaf315f88b0b7224ff7c465bb56b711c2b32c9a

SHA256
cc595de2d8cfa2498260460c94e6762f6f08aea133fd018801fd6ed751fdbf53

SHA512
7a73159af3db249e2ec5faa985fdfffe5beb819492f9ab5deaf65d3375155931198f6effddcb847f489aa796a686bf8f1e622da0eb7c69803341423763c585ed

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/EBE6DCEE7FA21C2ADFAF961F6B05000E
Filesize
5KB

MD5
76b8c28bb51d49c49b0e21501182b237

SHA1
379662d22cbae8b2e0cf618d1eab3daf9e745761

SHA256
9e5020833dc48bba479a345dd92452bfc588b7ee7d530f639e3b6340875e568d

SHA512
45ef4249ef9d2976fbb782a203bc079e1a23aacc82c9d463701634b61c6541eabe930df6cef5f4c2b34762f368a892a2085d136c2c6f95388caa347b75aa6a3a

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml
Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Filesize
220KB

MD5
54ad6f6dc76b991c0c3d368043b51b9b

SHA1
6763ef8618f54639bc3e43d3ed44ce53c9c71630

SHA256
b23602f801fa905c3f9e38e47a0ffa90e4c7c358e92e1fb500b37fb8825e27a7

SHA512
d32595154a50498ac9ac8313d7cdde397d9724257a271223c975c318fd0cdca329e56445a53092a6c4a7d25eb48a8279de0988eab0a709e99a42451b422c482d

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Filesize
22.5MB

MD5
30e0ba67b381ecdf08d46dfd8720452b

SHA1
3644816f6033c7a7d500d452b4ef33cd6e981905

SHA256
5ecca18b721d50a533f75ecb70a14e4ba640b942e8f6b54b7406de016013ee44

SHA512
5388f89044f405c89aa2f91ec28e50a811baf6a7f9442d0b39aeebc4e02d221e6f8f90f548f2e63fafc340ae9d352421ecc598108a0e497ed8ea00783a9aae6c

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Filesize
121KB

MD5
94d7263d3cf115f75af945dc0d03b5cc

SHA1
f486c152b5abf13d59dffc9cea8f3b5e1ea0b635

SHA256
e2b1c095f538b25a90a56ec70c880378be7f717dd901f89e1dd4c9dc8ccae320

SHA512
b43e86c905eb4ec0c0243ad9c42d3c11d4e9a3c69aca8e7accf4cf768a87b22943f69b17825ca8c38023500b90ba1730566cb53a0cd357ffdbc3c1e829b95f5f

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit