Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/05/2024, 09:31
240508-lg4m9adg9x 108/05/2024, 09:29
240508-lfyevagc83 408/05/2024, 09:27
240508-le2qwagc55 108/05/2024, 09:26
240508-lep23sgc42 108/05/2024, 09:26
240508-leabmagc26 408/05/2024, 09:22
240508-lcdk9sde2s 108/05/2024, 09:19
240508-lancpaga26 1Analysis
-
max time kernel
21s -
max time network
22s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
08/05/2024, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
Material.pptx
Resource
macos-20240410-en
General
-
Target
Material.pptx
-
Size
927KB
-
MD5
2cbb0e2816f9c3ec8881272d6b088df4
-
SHA1
07aedc1298c5e5540a03cf40c3a284b238606fbf
-
SHA256
07aa835f47f75648d4c8cc618ce1aef63b52a2ddad6d51779470be906f3a9e7c
-
SHA512
5b9fa6ac27495c1346bd81a3f32fd51f66641ad713acabb224c04fef891cf2f0bc94b4cd59844f321324ba8b371891d0a455129d6dcc5e2cb7d1bc9cc8e11934
-
SSDEEP
12288:Ze7Q5Bvvkx7vjOoYuGWk1iGjWx7izqe2UOsKm4oP7Aqu/wkRxuuDl5685Hferoui:MUq//rkZAibXEPaYx5LfeUuVuGqRRcM
Malware Config
Signatures
-
Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
ioc Process /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Material.pptx\""1⤵PID:518
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Material.pptx\""1⤵PID:518
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Material.pptx1⤵PID:518
-
/bin/zsh/bin/zsh -c /Users/run/Material.pptx2⤵PID:519
-
-
/Users/run/Material.pptx/Users/run/Material.pptx2⤵PID:519
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:527
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:527
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.cloudkeychainproxy31⤵PID:548
-
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy1⤵PID:548
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:557
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:557
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:558
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:558
-
/usr/libexec/xpcproxyxpcproxy com.apple.secinitd1⤵PID:559
-
/usr/libexec/secinitd/usr/libexec/secinitd1⤵PID:559
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵PID:561
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵PID:561
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵PID:562
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵PID:562
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵PID:563
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵PID:563
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5357be82dd63bc10869e62abf3a80a0cb
SHA10c6d180701337cfd3546a8eaa0c832d37baf3e12
SHA256c68b792bd56b20df3b3b996baeb3d9840135efe047cbbd348af1d30c7ac7a049
SHA512b489f862c17860ccbd39397ebadb5adc8480973a4205ef5ee2362432bb986362d09891aceeccbbd44a2733ae788ce3260b6f3e5e7325dc97c6ddbcf431049328
-
Filesize
175KB
MD5509c1503893c30b5ae9c47985a0cc522
SHA1acf93878ff94ddcf079ddccc972fb938d3fd6012
SHA256e1f6a012eaab67d4c4326c0e23c322c0e9556eeed3993ef3ddcf47b257c61d94
SHA5129efbb6b51cd9cc48108e7142c33ec5597c2b0f83df761713c9f68201e8f94ee7fe50e5436091d75d5e5cd684a8a33bfb1c12babc706fa827e6c944e37be3a08c
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818