492183967bfb7525e875333217e13095c369984892743a1ed47379a93e29a5d6

Analysis

max time kernel
1622s
max time network
2262s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
04/05/2024, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bussin GriddyCode.x86_64asdasd
Size 94.0MB
Sample240504-tg1wcsde65
SHA256 492183967bfb7525e875333217e13095c369984892743a1ed47379a93e29a5d6
MD5 bcde2680067c7a53b4bfda56f997817d
SHA1 a9e5410b894938f3b72d3b7d6d2707ca9ac5df88
SHA512 9dd3ed11f2717998a687956dcf2e533b828de8ab3b25b3f4cbdf3ec221806604a980fdb0aedb6d5f0484869d124f5fb25e503834011f9086bc808c61fff21bb0
SSDEEP 1572864:OTsfdxMUIv9lqP1Q6SNlc8yvUFLicloBBKO+4vgn9zg:E4d2hK+HN+82UFLoBBS4X
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Bussin GriddyCode.x86_64asdasd\""
1⤵
PID:518

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Bussin GriddyCode.x86_64asdasd\""
1⤵
PID:518

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Bussin GriddyCode.x86_64asdasd"
1⤵
PID:518
- /bin/zsh
  /bin/zsh -c "/Users/run/Bussin GriddyCode.x86_64asdasd"
  2⤵
  PID:520
- /Users/run/Bussin
  /Users/run/Bussin GriddyCode.x86_64asdasd
  2⤵
  PID:520

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:526

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:548

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:555

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:556

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:557

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:559

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:560

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:561

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:565

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:566

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:573

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:574

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreAuthentication.agent
1⤵
PID:585

/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
1⤵
PID:585

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:586

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:587

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:588

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.CalendarNotification.CalNCService 341
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:590

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:590

/System/Library/PrivateFrameworks/CalendarNotification.framework/Versions/A/XPCServices/CalNCService.xpc/Contents/MacOS/CalNCService
/System/Library/PrivateFrameworks/CalendarNotification.framework/Versions/A/XPCServices/CalNCService.xpc/Contents/MacOS/CalNCService
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:593

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:608

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:611

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:611

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 355B
SHA256 232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa
MD5 a6ef4856e99c9d8e1d9bb762c5a8503a
SHA1 25d5405ad91791b716ae5a56b37aa2b393854967
SHA512 582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 355B
SHA256 23d6746cb1c1906c9cfb5c69f7377f7cb68965ac0708ed1d600bfd3d3c34ce32
MD5 2f01f7a00c85e424f82b00b2bf794a7c
SHA1 c75cb52aa31012888dd7c65373d5faba6048c425
SHA512 75131e0145182653cef2edbb968853c9cb3c26c37c5821f3cd69c3ecdde7979ae37e74ecea8ad333090a473177c6dad43bc34f94a8fd104cd4c9b16c8f7b54f8
MD5 SHA1 SHA512

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 124KB
SHA256 24035368c4c5a58a44a71bc4bca4f7907384e0d6b60526cf10caf35f90a58a15
MD5 73b8dd3e430ff068d9a802b47317d2d3
SHA1 b28f5aa6b61dfb8a7270aa03737806c40cd08a67
SHA512 8f1b9483432110a2e492bfc01cd5386bce237534ad1ae760757cf1e3f217a609aca4b8bd8ef22aaa2413df5395aa69c9254d35b2ce15f6eede51325c90f3f7dd
SSDEEP 3072:q7GpG1qcO3uVwEJc3hslHsj0YgN0fT7V8IEZ7tP2qzyUv7icNCx2Jco:q7GpGqcO3L3alMj0Zt7tNSvo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Experiments.pbd

Path /Users/run/Library/Caches/GeoServices/Experiments.pbd
Size 137B
SHA256 9c679a95a1633fbb4f6c427c4213f5f9efddc17ca6439271d5f0d8d42a1c36ad
MD5 ccb3533a4999999480bb7bd1f0d26fe5
SHA1 cd372c74ba3a1e68bef875e1fd21bae756b8bdca
SHA512 632bbed3d7b0a79c613c7e0d6f7913a00c772b253ed77db7e28127161519cff405d580e8b699b1be2bc52035226aee30475f02aff46f1c65c5d524b48a91ce3b
MD5 SHA1 SHA512

Submit Download

altitude-1271.xml

Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1271.xml
Size 171KB
SHA256 780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e
MD5 fc82f60979c70408eead10c3a17cb8a1
SHA1 733136626039ac73ef4033453d53d8ca250cca75
SHA512 62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2
SSDEEP 768:SGSaD5wrMhcpPXOqZhyzi6+tLr2Q4DTKNJ65vYZW//tE+xt6xn+BMijWDSr/gmOv:SGSsJchyDoVobziQi+j+EkmpHvhAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsDirectory.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

NRM_Events_2024-05-04-16-12-23.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2024-05-04-16-12-23.event
Size 5KB
SHA256 d9c9a063b38a632d3eccb87fbee49c548466056d1e08d900ea68c2ba3dd20039
MD5 1b02d865bc698aac2b1887c23c1bf22d
SHA1 f8e94f80fc6c8c1b1c4794523f3f46baa7278881
SHA512 d50e3135b88b51a24a80c3230098965dcf9078aca85fa18dcf93197bd87d3fb76515fef379a5180d528a87f24b9989a87c6286c669dac451f811e2be362e7699
SSDEEP 96:yulGEoqtZk3CZxmTD+0BQ46s4xXwh4aIhYVTdNkhgjD2adTnpzjZv:XFsAaXBQPRhQoCF7pzjV
MD5 SHA1 SHA512 SSDEEP

Submit Download

NRM_Events_2024-05-04-16-12-23.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2024-05-04-16-12-23.event
Size 9KB
SHA256 d54fe6d6678aaac3fddf265be691874b36caae4b2ec27c7b8436c19e78dbf777
MD5 d62786184f6327c5b8885f0cbee02f2f
SHA1 e91e9d852e5429a8b9d8b73c53fd41aae49bc073
SHA512 3842b18c480463127720d1cb430ea9a11ed91cb8d941fd46398e8421da34b49d8d57d2e4d58630abf9f0c387e98ec89041627e5e938eca3d8b543e3d5898f2cb
SSDEEP 96:yulGEoqtZk3CZxmTD+0BQ46s4xXwh4aIhYVTdNkhgjD2adTnpzjZDul6yEoqtZkp:XFsAaXBQPRhQoCF7pzj4usovfppzjC
MD5 SHA1 SHA512 SSDEEP

Submit Download

NRM_Events_2024-05-04-16-12-23.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2024-05-04-16-12-23.event
Size 9KB
SHA256 5842f6bc5851b809347150a44fbf95bdfb9f6092043eddb48db95687396889a3
MD5 deea3d92e0527300fff52734614c818c
SHA1 4cd83bb80a413ff543ae418ec3f5526ef94bba47
SHA512 3cd48b3320fa3ec844f305c8ddfb64ad7ec1675f6bda25ae1ea6e333659ffaf5670dea1bdd04787d80ba043d67f51c8afb6c8ce538d35891d71391ce46a8dc4c
SSDEEP 96:zulGEoqtZk3CZxmTD+0BQ46s4xXwh4aIhYVTdNkhgjD2adTnpzjZDul6yEoqtZkp:6FsAaXBQPRhQoCF7pzj4usovfppzjC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads