c5ddcb8bc85040bc9090e01a44c406b6fec9a345945af840095bec2a103ff3e1

Analysis

max time kernel
150s
max time network
151s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
30/04/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pokemon-fire-red-version-v11.html
Size

15KB
MD5

7c6e053f82676d9426dbdf9fd11e332e
SHA1

f88fc6b75ef87373a4c1efe84e24b696dc904bff
SHA256

c5ddcb8bc85040bc9090e01a44c406b6fec9a345945af840095bec2a103ff3e1
SHA512

020aee5f978e20d07266b3717562a1d9c881d0e744f4b74b670b6090f9e469d4ccceb987221c03f1013dd9ee366a62a1569d2c788a5e43a2cb0227d282a4d045
SSDEEP

192:PNx5Ssv99qXoqTJkNr423h0svoGqsjIiOUBdtPMvR+LhXXAbC9KmaWkSy9N:5Ssl9qYoJkNcatvoGPIfUBdtjsCUCkXN

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/pokemon-fire-red-version-v11.html\""
1⤵
PID:484

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/pokemon-fire-red-version-v11.html\""
1⤵
PID:484

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/pokemon-fire-red-version-v11.html
1⤵
PID:484
- /bin/zsh
  /bin/zsh -c /Users/run/pokemon-fire-red-version-v11.html
  2⤵
  PID:485
- /Users/run/pokemon-fire-red-version-v11.html
  /Users/run/pokemon-fire-red-version-v11.html
  2⤵
  PID:485
- /bin/sh
  sh /Users/run/pokemon-fire-red-version-v11.html
  2⤵
  PID:485
- /bin/bash
  sh /Users/run/pokemon-fire-red-version-v11.html
  2⤵
  PID:485

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:519

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:522

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:523

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.FE332163-4B98-4EF5-AEC2-83BF0B67C708 522
1⤵
PID:524

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:529

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.DAD7B557-D57A-4A7A-96BD-B9F20900E676 522
1⤵
PID:530

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 522
1⤵
PID:533

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:534

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.99915E55-44EE-4DAE-A5F7-49F88941FC4F 522
1⤵
PID:535

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:536

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.A90FB155-66C5-4DB2-8A4E-C614CF73A1CC 522
1⤵
PID:544

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.speech.speechsynthesisd
1⤵
PID:545

/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SandboxBroker 522
1⤵
PID:547

/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker
/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:551

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000001.Archive Utility"
1⤵
PID:554

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_180268
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 512
1⤵
PID:555

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:555

/usr/bin/macbinary
/usr/bin/macbinary probe --verbose /Users/run/Downloads/mGBA-0.5.0-win32.7z
1⤵
PID:556

/usr/bin/file
/usr/bin/file -b /Users/run/Downloads/mGBA-0.5.0-win32.7z
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.archiveutility.auhelperservice 554
1⤵
PID:558

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
1⤵
PID:558

/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 554
1⤵
PID:560

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:562

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:563

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000002.TextEdit
1⤵
PID:564

/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
/System/Applications/TextEdit.app/Contents/MacOS/TextEdit -psn_0_188462
1⤵
PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Downloads/Pokemon - Fire Red Version (U) (V1.1).gba

Filesize
16.0MB

MD5
51901a6e40661b3914aa333c802e24e8

SHA1
dd5945db9b930750cb39d00c84da8571feebf417

SHA256
729041b940afe031302d630fdbe57c0c145f3f7b6d9b8eca5e98678d0ca4d059

SHA512
f179163ebb7611faca5dde27cc1c4dba354b597bf2f780328894a47f8c7d87dee5b7b522f3b7e5f3871cf4ec4908e427a93bec064fda96ec0e1f26b0c8adf57b

Download Submit
/Users/run/Downloads/mGBA-0.5.0-2016-09-20-win32/CHANGES.txt

Filesize
29KB

MD5
dcf3fa94847fce318c76a42432b1f1d2

SHA1
745c7496a6c899dc3336175ec613d2e7332657e8

SHA256
e580cb6ec837d0f496bdb80a0d211aa884160f2909cadbe60c7ce80792b951ab

SHA512
d706dc15b68ea59abff9dbb0aeea489ce4bb265736346fe05edc48b9cc7ed4d3f1965c49b2f9e474ed01ead884dac02fa688ad899c6af165843a2d310beb57e7

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/2529545429CE075A4E64DE7DAA3D4C27

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/C377A373F781FB4AE1EF06B0397E8BD6

Filesize
5KB

MD5
ed7a9a0225d8a90be8c2f5576dfb1637

SHA1
e4bda957bd00cb09cdeee7bc99297e8cb000abe2

SHA256
c485903ddfcb4c0618800713bc9535bc38572d53266c24039d9bc40fd9eaf778

SHA512
7ca08fbcff71bf4e29efd4b1d31945a3fcdb29bc199539215a9ecf7cd8fb95e8d0f2a418d466479168f39e13ea2b2babad1751d457886b809fe3ec50ad8f47e2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression

Filesize
220KB

MD5
6c54cb1f78afe74d4f45650783871105

SHA1
40313f87a28e40bcaac2d93a2d5379eb35e84969

SHA256
747478dad59aaa8c0db283a2ad8f2f2d01e0c7bde10489586fd84da1886c83c5

SHA512
293c6d972f54aee31c312c169cddefc5741c98694256f5188ad5958f0d75769298fe49d6972af41c97ecb17404d7acf943dd4115ee2fe75e7f5a91738ef7fcab

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression

Filesize
22.4MB

MD5
65b9cab0856e2aa154e5e2712a3ace0c

SHA1
3f88e58639538346997fc1a21351d66fb4b8f64f

SHA256
4deb050e1ed4bb5803b3fd624f8bda298cf7783d8c15868d1097c6f8843bb384

SHA512
8f856fdf21ee3a89fafe2bb51396f06ad8af9daea12dac65b9ab3e09f9164effd313f81feca7a78f1c67f1cb45d22ed76c6fdf08c044cb1d81083d4cc4551d32

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression

Filesize
122KB

MD5
a4fd575fc5037029faa080b0b6e5f8f7

SHA1
d2f3ddb303cbf218ddd06e643826a26070de2520

SHA256
2b98d13cd6977e1e5cbd4a92831d928737ad0a2534af4129a76ce0532262914a

SHA512
c5923700dec509472d21c4f375ba8831256be2f9401a813af12b864b1195ae4a465282899891841c7ea0282356dbf877ff109994894565bc5cc024ee7668a18c

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit