43adf87d5486202112a4bdea368abc46b5fb6f2ae2a6083b8a87e18723b2feee

Resubmissions

22-05-2024 09:47

240522-lses9sba38 4

22-05-2024 09:35

240522-lketasah4t 10

Analysis

max time kernel
155s
max time network
158s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
22-05-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dugga_848274.gz
Size

5KB
MD5

7867d29c88ed216103feb5021f01ebf8
SHA1

543af5ce7d60b6bf66d44d6bc42515d7fc97e796
SHA256

43adf87d5486202112a4bdea368abc46b5fb6f2ae2a6083b8a87e18723b2feee
SHA512

f0a22affd6b56154e0ad15a28fadedbc1977fc1fe72b6280d3d87c72ad8d7df1b3a465d9532869a30c09e88cd35ab0f0f6ed188513a38a5ae090d575797354a9
SSDEEP

96:xUS0wqaXc0hWp9nVRcerCWZIIvj2y/dT2/7HpPotQWtfDmDa:xUncc79VierCW7vj9/Q/7pKQULf

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 9 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool

/usr/libexec/xpcproxy
xpcproxy com.apple.var-db-dslocal-backup
1⤵
PID:477

/usr/bin/xar
/usr/bin/xar -c -f dslocal-backup.xar dslocal
1⤵
PID:477

/usr/libexec/xpcproxy
xpcproxy com.apple.gkreport
1⤵
PID:478

/usr/libexec/gkreport
/usr/libexec/gkreport
1⤵
PID:478

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/dugga_848274.gz\""
1⤵
PID:479

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/dugga_848274.gz\""
1⤵
PID:479

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/dugga_848274.gz
1⤵
PID:479

/bin/zsh
/bin/zsh -c /Users/run/dugga_848274.gz
2⤵
PID:482

/Users/run/dugga_848274.gz
/Users/run/dugga_848274.gz
2⤵
PID:482

/usr/libexec/xpcproxy
xpcproxy com.apple.systemstats.daily
1⤵
PID:480

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
1⤵
PID:481

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:481

/usr/libexec/xpcproxy
xpcproxy com.oracle.java.Java-Updater
1⤵
PID:484

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:484

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:488

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:488

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:489

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:489

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.0F92D8F9-30A8-4158-B173-A6AE445447D9 488
1⤵
PID:491

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:491

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:496

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.E5657E11-7D62-43C7-8C6A-6762B07A42F8 488
1⤵
PID:498

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:498

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:505

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 505
1⤵
PID:506

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:506

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:514

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:515

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:516

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:517

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:520

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:521

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:531

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 488
1⤵
PID:534

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:537

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.7BDD675F-C789-4BAA-AD85-F16E250B6E7C 488
1⤵
PID:538

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.6645CFB7-7A3E-454F-B7F9-FC4B83DE1C9A 488
1⤵
PID:545

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.B2D6D10D-64B6-4D79-BE4C-F5ADCFD214E9 488
1⤵
PID:546

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:546

/System/Applications/TV.app/Contents/MacOS/TV
/System/Applications/TV.app/Contents/MacOS/TV
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.AppStore.1900
1⤵
PID:554

/System/Applications/App Store.app/Contents/MacOS/App Store
"/System/Applications/App Store.app/Contents/MacOS/App Store"
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:555

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:556

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:557

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:560

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.AA027B32-90B3-4FDD-8EC6-BDCFDDC22270 552
1⤵
PID:561

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:564

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 554
1⤵
PID:565

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:566

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:567

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:569

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:569

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:570

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist
Filesize
676B

MD5
eff6a4751e60e723f7fe1716e6b05aa4

SHA1
6284ef0851ee71cc9c09be4cb72ca20308467ab2

SHA256
2040af7e9cd565dda0da72d0bde4d9c317904587a503b5ba2ac5a21bce5cc88c

SHA512
e9603e40e8179fe779f6d90143fe9fe4c3012707bd59930ac7bfc5e27d2efcf227dc64acb3503361f819bf68690b1c57a26df2e716cde9cd24f19add6460f05b

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/04410B0529864BDAD87B7C68AF3A24E1
Filesize
5KB

MD5
a383ed48037cd6d23aba4d9ca5e922a3

SHA1
90adf56648791d2577a20b7a2f9df371ed78a8ba

SHA256
9f9079dda64edfb00e12b02fa9cdb993aaece202b42430a8e8b03860bdf7552c

SHA512
e7b1384ab70d046bd6e6132035668df67f4263bbc066ee4c08915ec8638bb677f8e6635312e086f369e03b462f432bdf63ef7a0aa33cabf1790c762b775d1535

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/2529545429CE075A4E64DE7DAA3D4C27
Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
/private/var/db/spindump/tailspin-trace.2024-05-22_09-49-45.tailspin
Filesize
17.1MB

MD5
098e8a52e0aef1715ab74b2d4deac320

SHA1
890f27912ebcee1712f7239ee7aecfef151321c4

SHA256
f5861d53a24acdc23d7d8b3677aea24a59e7b4a6d9aaf6eafbf386bbe2cc2abd

SHA512
de695b6db475bb6c77e47cfbb60ba1c4c4581e6acadc1538706a01c13b8a703712e21a7562c4b33c7f9d70083290ad27f40dafbb92a7c9742a1f4dc14d1d3ce7

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Filesize
222KB

MD5
d068b70253381ea63eeb1fa159ad59dc

SHA1
1017986f2db6b778c13bf513f3518bd613f64ecb

SHA256
20adac2c5fff4ba74cc9fd5e6351ac0a17b1aee99a369158cce70de6bd35e1dc

SHA512
a656ac27464f2a8fc09ed598841216649163eb747a2fc236b0f50aa158f953639895f9100e1dacf046b22941405510510213b887efed69601ed146caa40fe06b

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Filesize
22.0MB

MD5
6ac90849e4ca2835a2c05ba85cafa75d

SHA1
bcf6e7891a16c1925589658b49f51d87b27c9be0

SHA256
085b18d71450e19f79e846cd53f9db966031aa01560976f804f83bb234f2ce28

SHA512
19624cfd96cb0c3ad72a3e6a9b2f4295117bce0eea4b1b0a8112476b80929ee7272e304b511246f6dadd34f82dc3de89d617021caf70029adbe69baebc8fbd49

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Filesize
126KB

MD5
00e1baa31092523a78c653177e1fd3a6

SHA1
30176b8ccea8f844791a503d837cf2505c9f6478

SHA256
1f2b10141b283933e08242837d109392996cda16290f7927a7746a03b645b068

SHA512
7c626e1df4de215bfae7cc96e9e0d8ec906a9845ce34620eb0f325ea21bd89b10dbdba3d86974870423639aaecd9137807249f25b3d5888f1bdf61151d36848a

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit