Resubmissions
02-06-2024 02:37
240602-c4kdfsge88 402-06-2024 02:36
240602-c3plsage64 302-06-2024 02:35
240602-c3d52sge55 1Analysis
-
max time kernel
87s -
max time network
90s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
02-06-2024 02:37
Static task
static1
Behavioral task
behavioral1
Sample
unnamed.jpg
Resource
macos-20240410-en
General
-
Target
unnamed.jpg
-
Size
25KB
-
MD5
fc9a55f8132a6f2f7ed8c1503a00b392
-
SHA1
5c55602dbb0c080c05847a1c523253f12edb4b63
-
SHA256
45683ff4823552cd4bc962fe26d16f7cb9aea1b607f8962042151e5a6d55465c
-
SHA512
eb113b8e39d28ddb949e1ee18562c7127f24091376e51d3a07fb4e7e76b3d9147f250ab561310de7094114fa8eac3604d201c42df913f079a8fc2febd6783995
-
SSDEEP
384:U3/TcJR+qoXgGWObD2W78o9MxftTFbJdho08iSbmA+A7tgO0cVvbTu:M4C11g5Jd5h8eiBTu
Malware Config
Signatures
-
Resource Forking 1 TTPs 6 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
ioc Process /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck Process not Found /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref Process not Found /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool Process not Found /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy Process not Found /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool Process not Found /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/unnamed.jpg\""1⤵PID:519
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/unnamed.jpg\""1⤵PID:519
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/unnamed.jpg1⤵PID:519
-
/bin/zsh/bin/zsh -c /Users/run/unnamed.jpg2⤵PID:520
-
-
/Users/run/unnamed.jpg/Users/run/unnamed.jpg2⤵PID:520
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:544
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:544
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.cloudkeychainproxy31⤵PID:545
-
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy1⤵PID:545
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:555
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:555
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.20281⤵PID:556
-
/Applications/Safari.app/Contents/MacOS/Safari/Applications/Safari.app/Contents/MacOS/Safari1⤵PID:556
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.History1⤵PID:557
-
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History1⤵PID:557
-
/usr/libexec/xpcproxyxpcproxy com.apple.siri.context.service1⤵PID:559
-
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService1⤵PID:559
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.BD8341C6-3088-4A8F-8F3D-76A9A0BBAFBC 5561⤵PID:560
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵PID:560
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:563
-
/usr/libexec/xpcproxyxpcproxy com.apple.SafariLaunchAgent1⤵PID:565
-
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent1⤵PID:565
-
/usr/libexec/xpcproxyxpcproxy com.apple.akd1⤵PID:566
-
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd1⤵PID:566
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.C2135116-B5AF-4080-9F02-F164E669F86D 5561⤵PID:567
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵PID:567
-
/usr/libexec/xpcproxyxpcproxy com.apple.CoreAuthentication.agent1⤵PID:568
-
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd1⤵PID:568
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:563
-
/usr/libexec/xpcproxyxpcproxy com.apple.nehelper1⤵PID:569
-
/usr/libexec/nehelper/usr/libexec/nehelper1⤵PID:569
-
/usr/libexec/xpcproxyxpcproxy com.apple.secinitd1⤵PID:571
-
/usr/libexec/secinitd/usr/libexec/secinitd1⤵PID:571
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵PID:572
-
/usr/libexec/neagent/usr/libexec/neagent1⤵PID:572
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵PID:576
-
/usr/libexec/xpcproxyxpcproxy com.apple.assistantd1⤵PID:578
-
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd1⤵PID:578
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵PID:581
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵PID:581
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵PID:582
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵PID:582
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵PID:583
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵PID:583
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵PID:588
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵PID:588
-
/usr/libexec/xpcproxyxpcproxy com.apple.systempreferences.21401⤵PID:590
-
/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"1⤵PID:590
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountProfileRemoteViewService 5901⤵PID:591
-
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService1⤵PID:591
-
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool1⤵PID:593
-
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool1⤵PID:594
-
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck1⤵PID:595
-
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref1⤵PID:596
-
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool1⤵PID:597
-
/usr/libexec/xpcproxyxpcproxy com.apple.nfcd1⤵PID:598
-
/usr/libexec/nfcd/usr/libexec/nfcd1⤵PID:598
-
/usr/libexec/xpcproxyxpcproxy com.apple.studentd1⤵PID:599
-
/usr/libexec/studentd/usr/libexec/studentd1⤵PID:599
-
/usr/libexec/xpcproxyxpcproxy com.apple.preference.startupdisk.remoteservice 5901⤵PID:600
-
/System/Library/PreferencePanes/StartupDisk.prefPane/Contents/XPCServices/com.apple.preference.startupdisk.remoteservice.xpc/Contents/MacOS/com.apple.preference.startupdisk.remoteservice/System/Library/PreferencePanes/StartupDisk.prefPane/Contents/XPCServices/com.apple.preference.startupdisk.remoteservice.xpc/Contents/MacOS/com.apple.preference.startupdisk.remoteservice1⤵PID:600
-
/usr/libexec/xpcproxyxpcproxy com.apple.metadata.mdwrite1⤵PID:601
-
/usr/sbin/bless/usr/sbin/bless -getBoot1⤵PID:602
-
/usr/libexec/xpcproxyxpcproxy com.apple.TextInputMenuAgent1⤵PID:603
-
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent1⤵PID:603
-
/usr/sbin/bless/usr/sbin/bless -getBoot1⤵PID:604
-
/usr/libexec/xpcproxyxpcproxy com.apple.startupdiskhelper1⤵PID:605
-
/usr/libexec/startupdiskhelper/usr/libexec/startupdiskhelper1⤵PID:605
-
/usr/sbin/bless/usr/sbin/bless -getBoot1⤵PID:606
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵PID:607
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵PID:607
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:609
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:610
-
/usr/libexec/xpcproxyxpcproxy com.apple.localAuthenticationRemoteService 6001⤵PID:611
-
/System/Library/PrivateFrameworks/LocalAuthenticationUI.framework/Versions/A/XPCServices/localAuthenticationRemoteService.xpc/Contents/MacOS/localAuthenticationRemoteService/System/Library/PrivateFrameworks/LocalAuthenticationUI.framework/Versions/A/XPCServices/localAuthenticationRemoteService.xpc/Contents/MacOS/localAuthenticationRemoteService1⤵PID:611
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
351B
MD590d8ac6b9328f8e785b3f68dbffb86a6
SHA1919a0ab0896a4078f90e1aed665851661aac9018
SHA25637e1e9d0fd2756cbbd9c88881fc4772b2dc5c3c29569a76ff78aecc6abce13fc
SHA51288189d7c591d02e0a5339e4ed52b90f3c46abc9249b726e0e840bc93631a8a1df6aeb49566e54553ab20e52a7a5e63582562342f45379f0ed38d9192d35f7a37
-
Filesize
42B
MD5ce7f5b3d4bfc7b4b0da6a06dccc515f2
SHA1ce657a52a052a3aaf534ecfbf7cbdde4ee334c10
SHA2569261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1
SHA512db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb
-
Filesize
106B
MD5a60a7bcfc47eacaa66e5e3d701d3ba80
SHA17093ffc5beca33187c18461c7ff3259a1781ae35
SHA25617e96efaf7f2e45e407a3c68fb57b78f09dea6fc1edf3732b888be4a4eadd468
SHA51258736bd680d6c7a25b8d7db08fd4a258cf761dbaa44a5ece0c2b813ab12c20dc213ab40844dfc780687945cf2459f549f1a38bf3da16c5c332756f3b53e1c3a5
-
Filesize
147B
MD5a6ed424e1135465fac072dc8c30be6a0
SHA18cb5811cfe6611074f7e01b8b9a533aa7bed4432
SHA256c6a15fb293a7994c87cb4665fa076b4804c15a7f17753d267b6e271b036457dc
SHA512d6dc5f49efacc0bea1d388e490c2e1283f6a6f42829e1ab30ec18b0ad35faf44e21d7780b84b5a2ebaff1e79da6fdc090bc547990b513cb311db82fb54cd8972
-
Filesize
124KB
MD5e5e810fa73cbc9c9d437e6dc7de9ac2b
SHA1755de807b5d36030f98fd1b7fcdabdee691480d0
SHA2569778fd3055056f01df6dbcc74b2771799729038ee1623144cd89d1550cc9fbfa
SHA5128f6cf9480faf938acc6a73639ae3dfec0b8669263c9d10bc3714236a2c15484eb44c3c05632685484e720bbfdbefeb754311fb220816019f31e1b0916ec53b7c
-
Filesize
179KB
MD59a43af57707d2fb460832049d1f217d1
SHA1056d813f8cb5198ca82072f7e3484f38ea5267f8
SHA2567224f8828694ed74a8353567e4d84da188d15a993a4a75938f8409cb49218e7c
SHA5121f33175f5d0958c79540a627552f71c6960b6ff19c9b2b0aa604c00bfeff216f6ea2ec3a22ef91ad8d7249597fdf5ad49ddbf5f4aef71b397e785152474954d7
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818