Analysis
-
max time kernel
149s -
max time network
131s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
10-06-2024 14:27
Static task
static1
Behavioral task
behavioral1
Sample
image.png
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
image.png
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
image.png
Resource
macos-20240410-en
General
-
Target
image.png
-
Size
94KB
-
MD5
1af2358fa1ee87b359660a7c14497081
-
SHA1
4b2ba3a8b5a68d7deace644639579d31986885c8
-
SHA256
0ed1b5bee0261bf97c9fccb3c80217388c0b12936b2626bb3eda630acfb76268
-
SHA512
9dd0c509b358b5cc3d2ba92c43b42ac4fb0b0947a8f99824f4044717de6363f6848488a45a12576cb20692c72d4996ca6bd7fa06f492ae8219febb284f87855d
-
SSDEEP
1536:IZyFSQ/tpEDLzA07dpAK65cs+eXgpVXqYnqRV7OV1FrotlgIMJz0qP4QoazN9Jhu:9FNQ3UrK6dxgWk1+t+fJz0qUunu
Malware Config
Signatures
-
Resource Forking 1 TTPs 2 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes:
ioc process /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/image.png\""1⤵PID:482
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/image.png\""1⤵PID:482
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/image.png1⤵PID:482
-
/bin/zsh/bin/zsh -c /Users/run/image.png2⤵PID:490
-
/Users/run/image.png/Users/run/image.png2⤵PID:490
-
/usr/libexec/xpcproxyxpcproxy com.apple.loginwindow.LWWeeklyMessageTracer1⤵PID:483
-
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer1⤵PID:483
-
/usr/libexec/xpcproxyxpcproxy com.oracle.java.Java-Updater1⤵PID:484
-
/usr/libexec/xpcproxyxpcproxy com.apple.gkreport1⤵PID:485
-
/usr/libexec/gkreport/usr/libexec/gkreport1⤵PID:485
-
/usr/libexec/xpcproxyxpcproxy com.apple.systemstats.daily1⤵PID:486
-
/usr/libexec/xpcproxyxpcproxy com.apple.newsyslog1⤵PID:488
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck1⤵PID:484
-
/usr/sbin/newsyslog/usr/sbin/newsyslog1⤵PID:488
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵PID:492
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterB516C108/OneDrive.app1⤵PID:493
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:507
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:507
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.systemsoundserverd1⤵PID:518
-
/usr/sbin/systemsoundserverd/usr/sbin/systemsoundserverd1⤵PID:518
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵PID:519
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵PID:519
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵PID:520
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵PID:520
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵PID:538
-
/usr/libexec/xpcproxyxpcproxy com.apple.newsyslog1⤵PID:545
-
/usr/sbin/newsyslog/usr/sbin/newsyslog1⤵PID:545