642b5cf74025c31fe5f004c7e5acba11ed246ffd30dceee57857f2bf8abbeb13

Analysis

max time kernel
121s
max time network
164s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02/06/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

premiereprocc2018/Adobe+CC+2017+MAC+Po解工具Adobe+Zii+2.2.1+amtemu.v0.8.1.dmg
Size

8.9MB
MD5

eb28b484244db8457bf54ac1f706d38f
SHA1

522d21b24e9eba8f9314a07893453d44a35d9fff
SHA256

e601652d6d5e6e007a051eefbc116a3c827015af093f67069c3b54106acf7a5f
SHA512

9ea096ce0452b90db8eec2bbb97f76b7d1d731209b5a89631ae982cefcc7a436a7e2fff23a949d0c0a5c1817f0d45549c6ee17b34cdb246cd79371d841dbbcb6
SSDEEP

196608:G12/B/IV8IXWhfh4oHzAaA4kfFaCT0g924w7Zb+:G12p/IV8AwfhfzAaZkfFfYg9vwVb

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Adobe\\ CC\\ 2017\\ MAC\\ 破解补丁工具\""
1⤵
PID:610

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Adobe\\ CC\\ 2017\\ MAC\\ 破解补丁工具\""
1⤵
PID:610

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Adobe\\ CC\\ 2017\\ MAC\\ 破解补丁工具"
1⤵
PID:610
- /bin/zsh
  /bin/zsh -c "open /Volumes/Adobe\\ CC\\ 2017\\ MAC\\ 破解补丁工具"
  2⤵
  PID:613
- /usr/bin/open
  open "/Volumes/Adobe CC 2017 MAC 破解补丁工具"
  2⤵
  PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.320074FC-6FB2-4C30-9ED8-00219743F61F 611
1⤵
PID:612

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:614

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:614

/usr/bin/bzip2
/usr/bin/bzip2 -f /var/log/wifi.log.0
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:626

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:626

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:636

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:637

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:638

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:640

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:648

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:649

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:650

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:652

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:654

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:655

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:656

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:656

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:659

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
74b074f4bbdb85cdbcb9e69f26a55d1c

SHA1
5775a77ced857f60110b65d90481dfef6be80a25

SHA256
a54da50a0e981d6dcff6c60cdb34bfd274ec8116964318569a6199416a1e70af

SHA512
0a15d31a8b7d4b7f918b9e1f098b1c24ddf64770a5f7cf74881f4d888a63857f4e3c2b4a4e5faaf34956f62c6ba64985c8cc3976d2635da0a62865b6247c9ece

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1285.xml

Filesize
179KB

MD5
9a43af57707d2fb460832049d1f217d1

SHA1
056d813f8cb5198ca82072f7e3484f38ea5267f8

SHA256
7224f8828694ed74a8353567e4d84da188d15a993a4a75938f8409cb49218e7c

SHA512
1f33175f5d0958c79540a627552f71c6960b6ff19c9b2b0aa604c00bfeff216f6ea2ec3a22ef91ad8d7249597fdf5ad49ddbf5f4aef71b397e785152474954d7

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit