28eefba833877e3494bb68e09d250a29c4b6c66e89f1b73e7618b2ddb50b15d1

Analysis

max time kernel
129s
max time network
152s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
07/05/2024, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js
Size

5KB
MD5

4a8a7a2c5aa7ad0c304de54ef266bb74
SHA1

146485e9d64fbeb5ac80affd8a411ea3f6e550ed
SHA256

134f0585f7c665db89f332a379158c6f113274422e42aaf54e0aa9d5ac37f577
SHA512

a28642c67b3f100c2214c6795ce585c8cc623e25e86da53a09bb9041fe850d20f7eac1acbe626a580f6a7a9e9a3a16a8bd93913e338251a0139972f9e8d2c5b8
SSDEEP

96:NMgkSpt/rzQbuRQC5NGK8RG1k+1AMBQitYhhrlWt+Bpek/LpIfTztPBJIUUCrBu:CCt/bQxO9AxbrlFfr/LpuTztZJIUF8

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
sh -c "sudo /bin/zsh -c \"/Users/run/DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js\""	Process not Found
sudo /bin/zsh -c "/Users/run/DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js"	Process not Found
/bin/zsh -c "/Users/run/DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js"	Process not Found
/Users/run/DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js	Process not Found
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js\""
1⤵
PID:543

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js\""
1⤵
PID:543

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js"
1⤵
PID:543
- /bin/zsh
  /bin/zsh -c "/Users/run/DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js"
  2⤵
  PID:544
- /Users/run/DumpMedia
  /Users/run/DumpMedia Apple Music Converter 4.0.10/DumpMedia Apple Music Converter.app/Contents/Resources/app/no.js
  2⤵
  PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:545

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:546

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:547

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:557

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:563

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:564

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:565

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:569

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:573

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:574

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:575

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.gkreport
1⤵
PID:580

/usr/libexec/gkreport
/usr/libexec/gkreport
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:584

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
106B

MD5
a60a7bcfc47eacaa66e5e3d701d3ba80

SHA1
7093ffc5beca33187c18461c7ff3259a1781ae35

SHA256
17e96efaf7f2e45e407a3c68fb57b78f09dea6fc1edf3732b888be4a4eadd468

SHA512
58736bd680d6c7a25b8d7db08fd4a258cf761dbaa44a5ece0c2b813ab12c20dc213ab40844dfc780687945cf2459f549f1a38bf3da16c5c332756f3b53e1c3a5

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
147B

MD5
a6ed424e1135465fac072dc8c30be6a0

SHA1
8cb5811cfe6611074f7e01b8b9a533aa7bed4432

SHA256
c6a15fb293a7994c87cb4665fa076b4804c15a7f17753d267b6e271b036457dc

SHA512
d6dc5f49efacc0bea1d388e490c2e1283f6a6f42829e1ab30ec18b0ad35faf44e21d7780b84b5a2ebaff1e79da6fdc090bc547990b513cb311db82fb54cd8972

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
1da7d102b6646f080f96e07e3f8d8c83

SHA1
699a773457f19bcc345e1bf2d606898982c42a50

SHA256
69daef10688bce12f25d0545c57183f3b1a9692a5bec094c97ea1e79232c930c

SHA512
412911382a97eebe66592581a2e44dd28876c504bcd0980fa172b099a29217a54f2951b6bb7162222b9ce4daf670292047d7abda444779044acd5098b98272ef

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1275.xml

Filesize
172KB

MD5
4cff09cfe57b3e25092d80f57c83305d

SHA1
4c899c294ed84624f3d089b9e97019a6b778cd36

SHA256
e22595b317785f785ecb540e65d6039b50a6fe350937d94b9166b75ea510a35a

SHA512
d5f34140ac063c4739d1df06c59970a9478b37380a82e291017f4fb6444e7451b97e612a4f0c012c9dd2c5b979ff236d953ca1a62d88182f35782b09fc1b58d4

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit