ba706df00eda5fad2272662d35c88a36d08870cae64dc5a357ecf584cdeb00ff

General

Target
MEMZ-master/Exe2Bat/exe2bat.py
Size 2KB
Sample240602-cc247afe86
SHA256 9403d047e2c8b47ff80a821c10d7e2ec4ee36d9267b8ed693dad9c5b8c5fc993
MD5 d36aa007ebc8489f62d8de501cde8f2e
SHA1 d64df27d02d9d96f7a47452b38aa3b92d50997a5
SHA512 31da546ca83781cbd6a9f58114116007a8557167a8a4ca402b7e79958d98481698ae0bfd229f655c52ab8cc106cb344fc0c6005b8508d87bc62f6b61f1438d05
MD5 SHA1 SHA512

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 8 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"	Process not Found
/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/MEMZ-master/Exe2Bat/exe2bat.py\""
1⤵
PID:490

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/MEMZ-master/Exe2Bat/exe2bat.py\""
1⤵
PID:490

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/MEMZ-master/Exe2Bat/exe2bat.py
1⤵
PID:490
- /bin/zsh
  /bin/zsh -c /Users/run/MEMZ-master/Exe2Bat/exe2bat.py
  2⤵
  PID:492
- /Users/run/MEMZ-master/Exe2Bat/exe2bat.py
  /Users/run/MEMZ-master/Exe2Bat/exe2bat.py
  2⤵
  PID:492
- /bin/sh
  sh /Users/run/MEMZ-master/Exe2Bat/exe2bat.py
  2⤵
  PID:492
- /bin/bash
  sh /Users/run/MEMZ-master/Exe2Bat/exe2bat.py
  2⤵
  PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:501

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:501

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:502

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterB516C108/OneDrive.app
1⤵
PID:503

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:515

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:516

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:518

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:533

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:535

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.6A72F4B0-2761-44BD-A390-466BC2A7938A 533
1⤵
PID:537

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:543

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.D9D85A8B-0080-4492-AB9C-5098B9F45169 533
1⤵
PID:544

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 533
1⤵
PID:547

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:548

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:552

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 544
1⤵
PID:553

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.D73F4C3D-CD78-465E-9430-B558E10E0715 533
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.C91BF17A-62B2-4D1F-968A-8F290D97C03B 533
1⤵
PID:555

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:554

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:559

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 559
1⤵
PID:560

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:560

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:562

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:563

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:564

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:565

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:567

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:569

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.preferences.softwareupdate.remoteservice 559
1⤵
PID:570

/System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
/System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.softwareupdated
1⤵
PID:571

/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.suhelperd
1⤵
PID:573

/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"
1⤵
PID:573

/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues
/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues -z
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:576

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:579

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:578

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.SoftwareUpdateNotificationManager
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:581

/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager
/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:582

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:582

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8CD3B2672D3E9FEF4743CD64C6512317

Path /Users/run/Library/Safari/Favicon Cache/favicons/8CD3B2672D3E9FEF4743CD64C6512317
Size 5KB
SHA256 aaa3dee76ef9db79aa640a6ce556c041b674ad5d3b59d22d8b4da195c4f24971
MD5 fbdcc92883587f7a5796784e771b2644
SHA1 7f149b1eb036c2de77e9f5d88166e98d6ccf6cb4
SHA512 aa236baabb5b48cb47135f577ef285118519827f4de9461e335d6dc3a03a10641242810ac9bee24828a70503bb19a604557ca65ebeca7b72fa62e790fc760018
SSDEEP 96:8ydKMSB9SuzjBFaCW7SHHpQy63vtPSu9:8y4ZwuHqCZO3Yu9
MD5 SHA1 SHA512 SSDEEP

Submit Download

malware,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Size 219KB
SHA256 5977d9b47f1d9c1624f8bda3d77d1ad3d7ecc705bc052cc0844e89749c3eca85
MD5 e14933dc22736b5a74e7308142449878
SHA1 3dd3d472a4dba3eee82baebaa7bd7a6b82e435f4
SHA512 50d0895d9b176b9cc838bfbdf8e7e53e9f868cfd7829143b11eaafae8a958ca4651bec70ce0e49a172b05221038bc072d16b0d0cc275aa56ff0a39980ed3f840
SSDEEP 6144:U4CP1T7ojL/OHOu+se4Jwl9/NEKvJi35Isb:UN1TCzUOBsLwHOKaesb
MD5 SHA1 SHA512 SSDEEP

Submit Download

social_engineering,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Size 21.9MB
SHA256 d2a0d9ed4fd38bc49acef42e8a726ac881dc62829402d67c64414c5873fe36ff
MD5 ef146aa0a488e31cb9d38651b767a848
SHA1 375bfea84b3f3836f45106587951d9c4e0f64892
SHA512 2d4702fb6319d94e1cdce97f585ecaa5b65621c9ef1943bc9606ae9a58f2f0aeb1f851d0a9c6278236e12cd35d9d408e166fb141c1bbf6ecfc2dea99282720eb
SSDEEP 393216:xM2cP8AHoo/L0VG49BmMQrZT7TaSqv24KyPcwYSEagrYsGO6SSH6C4kK1Bn9v:G2dLO0VL9BmKBUwYSWrYsRGNKzn1
MD5 SHA1 SHA512 SSDEEP

Submit Download

unwanted_software,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Size 130KB
SHA256 c3137083ff030e6272b30b32dc63f7bb00ff86d9f28675fd40fa590080f655e6
MD5 38a35c8b054226b83bfc597aadc5fe08
SHA1 31ff9ccd859870bff85fea53ae60feafc63c2642
SHA512 4a028fff47cc4d6bc3733fd3fc41b1637ec0464c379317e920fdb58613944ceaa92d52ef5be9cfbd414a98fdbb6a42a07ac58402ab8bdfa68c519f806785c13e
SSDEEP 3072:ELT7BbpVzhT5J4ITwD7m0mugsq/MimcXv2Obng96mHOLNXNF:EdbpVdT5Jz8GgcXv2OAWH
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads