Overview

overview

4

Static

static

1

sample.html

macos-10.15-amd64

4

sample.html

macos-10.15-amd64

4

sample.html

ubuntu-20.04-amd64

Resubmissions

02/05/2024, 19:24

240502-x4p9xsec8w 4

02/05/2024, 19:18

240502-x1d3gsgc23 10

Analysis

  • max time kernel
    336s
  • max time network
    1565s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    02/05/2024, 19:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sample.html

  • Size

    19KB

  • MD5

    254a49b8e340c86d345b3613bc6427b1

  • SHA1

    881475b7753f560b181e3a02072af552d257e3c0

  • SHA256

    a635bcbe92a0ce6e34d87e8e8685b2b193a5f9f9ef57d52380464add95d511f3

  • SHA512

    6ab6fa4994a7b46c3f09aabab4c62960e1abe1ad3efbf627a33b1e4822a2c187d8021508e8f8e07936d0d5f4b15cac12a74679852ba2584554de3ca1304b2cd0

  • SSDEEP

    384:raN579vDpmReVoOs4ni9ylKeGMpU8Hhhb1DM7DS2LjMrSA+xzIJCgMmVn:raD9vBVoOs4nmyI1M9BhbJ6TMrSfsJ2Y

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /usr/libexec/xpcproxy
    xpcproxy com.apple.var-db-dslocal-backup
    1⤵
      PID:483
    • /bin/sh
      sh -c "sudo /bin/zsh -c \"/Users/run/sample.html\""
      1⤵
        PID:484
      • /bin/bash
        sh -c "sudo /bin/zsh -c \"/Users/run/sample.html\""
        1⤵
          PID:484
        • /usr/bin/xar
          /usr/bin/xar -c -f dslocal-backup.xar dslocal
          1⤵
            PID:483
          • /usr/bin/sudo
            sudo /bin/zsh -c /Users/run/sample.html
            1⤵
              PID:484
              • /bin/zsh
                /bin/zsh -c /Users/run/sample.html
                2⤵
                  PID:486
                • /Users/run/sample.html
                  /Users/run/sample.html
                  2⤵
                    PID:486
                  • /bin/sh
                    sh /Users/run/sample.html
                    2⤵
                      PID:486
                    • /bin/bash
                      sh /Users/run/sample.html
                      2⤵
                        PID:486
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.gkreport
                      1⤵
                        PID:485
                      • /usr/libexec/gkreport
                        /usr/libexec/gkreport
                        1⤵
                          PID:485
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.systemstats.daily
                          1⤵
                            PID:487
                          • /usr/libexec/xpcproxy
                            xpcproxy com.apple.newsyslog
                            1⤵
                              PID:488
                            • /usr/sbin/newsyslog
                              /usr/sbin/newsyslog
                              1⤵
                                PID:488
                              • /usr/bin/pluginkit
                                /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                                1⤵
                                  PID:492
                                • /usr/sbin/spctl
                                  /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterB516C108/OneDrive.app
                                  1⤵
                                    PID:493
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.sysmond
                                    1⤵
                                      PID:517
                                    • /usr/libexec/sysmond
                                      /usr/libexec/sysmond
                                      1⤵
                                        PID:517
                                      • /usr/libexec/xpcproxy
                                        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                        1⤵
                                          PID:543
                                        • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                          /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                          1⤵
                                            PID:543
                                          • /usr/libexec/xpcproxy
                                            xpcproxy com.apple.newsyslog
                                            1⤵
                                              PID:545
                                            • /usr/sbin/newsyslog
                                              /usr/sbin/newsyslog
                                              1⤵
                                                PID:545
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.security.cloudkeychainproxy3
                                                1⤵
                                                  PID:547
                                                • /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                                                  /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                                                  1⤵
                                                    PID:547
                                                  • /usr/libexec/xpcproxy
                                                    xpcproxy com.apple.AccountPolicyHelper
                                                    1⤵
                                                      PID:548
                                                    • /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
                                                      /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
                                                      1⤵
                                                        PID:548
                                                      • /usr/libexec/xpcproxy
                                                        xpcproxy com.apple.spindump
                                                        1⤵
                                                          PID:550
                                                        • /usr/sbin/spindump
                                                          /usr/sbin/spindump
                                                          1⤵
                                                            PID:550
                                                          • /usr/libexec/xpcproxy
                                                            xpcproxy com.apple.diagnosticd
                                                            1⤵
                                                              PID:551
                                                            • /usr/libexec/diagnosticd
                                                              /usr/libexec/diagnosticd
                                                              1⤵
                                                                PID:551

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads