Malware Analysis Report

2024-10-10 07:27

Sample ID 240613-r31flsxdmr
Target 4_pillars_record_-_for_SMHW.docx
SHA256 b238f21e7e200ac3c5d608d97ddaa480e5de534adf5282619529f9ef9d38adaf
Tags
evasion execution persistence
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

SHA256

b238f21e7e200ac3c5d608d97ddaa480e5de534adf5282619529f9ef9d38adaf

Threat Level: Likely benign

The file 4_pillars_record_-_for_SMHW.docx was found to be: Likely benign.

Malicious Activity Summary

evasion execution persistence

Launch Agent

Resource Forking

Launchctl

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 14:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 14:43

Reported

2024-06-14 17:29

Platform

macos-20240611-en

Max time kernel

943s

Max time network

1416s

Command Line

[sh -c sudo /bin/zsh -c "open /Users/run/4_pillars_record_-_for_SMHW.docx"]

Signatures

Launch Agent

persistence

Resource Forking

evasion
Description Indicator Process Target
N/A /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid N/A N/A
N/A /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd N/A N/A
N/A /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy N/A N/A

Launchctl

execution
Description Indicator Process Target
N/A /bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist N/A N/A

Processes

/bin/sh

[sh -c sudo /bin/zsh -c "open /Users/run/4_pillars_record_-_for_SMHW.docx"]

/bin/bash

[sh -c sudo /bin/zsh -c "open /Users/run/4_pillars_record_-_for_SMHW.docx"]

/usr/bin/sudo

[sudo /bin/zsh -c open /Users/run/4_pillars_record_-_for_SMHW.docx]

/bin/zsh

[/bin/zsh -c open /Users/run/4_pillars_record_-_for_SMHW.docx]

/usr/bin/open

[open /Users/run/4_pillars_record_-_for_SMHW.docx]

/usr/libexec/xpcproxy

[xpcproxy com.microsoft.Word.2032]

/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word

[/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word]

/usr/libexec/xpcproxy

[xpcproxy com.apple.siri.context.service]

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService

[/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService]

/usr/libexec/xpcproxy

[xpcproxy com.apple.metadata.mdwrite]

/usr/libexec/xpcproxy

[xpcproxy com.apple.storeuid]

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid

[/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid]

/usr/libexec/xpcproxy

[xpcproxy com.apple.pbs]

/System/Library/CoreServices/pbs

[/System/Library/CoreServices/pbs]

/usr/libexec/xpcproxy

[xpcproxy com.apple.storedownloadd]

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd

[/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.sysmond]

/usr/libexec/xpcproxy

[xpcproxy com.microsoft.autoupdate.fba.2660]

/usr/libexec/sysmond

[/usr/libexec/sysmond]

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant

[/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant]

/bin/launchctl

[/bin/launchctl list]

/usr/libexec/xpcproxy

[xpcproxy com.microsoft.autoupdate.helper]

/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper

[/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper]

/bin/launchctl

[/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist]

/usr/bin/codesign

[/usr/bin/codesign -v /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper]

/usr/libexec/xpcproxy

[xpcproxy com.apple.security.cloudkeychainproxy3]

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

[/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy]

/usr/bin/pluginkit

[/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync]

/usr/sbin/spctl

[/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater66017B75/OneDrive.app]

/usr/libexec/xpcproxy

[xpcproxy com.apple.pluginkit.pkd]

/usr/libexec/pkd

[/usr/libexec/pkd]

/usr/sbin/spctl

[/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app]

/usr/libexec/xpcproxy

[xpcproxy com.apple.assistantd]

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd

[/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.geod]

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

[/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod]

/usr/libexec/xpcproxy

[xpcproxy com.apple.geod]

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

[/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod]

/usr/libexec/xpcproxy

[xpcproxy com.apple.secinitd]

/usr/libexec/secinitd

[/usr/libexec/secinitd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.AddressBook.ContactsAccountsService]

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService

[/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService]

/usr/libexec/xpcproxy

[xpcproxy com.apple.routined]

/usr/libexec/routined

[/usr/libexec/routined LAUNCHED_BY_LAUNCHD]

/usr/libexec/xpcproxy

[xpcproxy com.apple.Maps.mapspushd]

/System/Library/CoreServices/mapspushd

[/System/Library/CoreServices/mapspushd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A]

/usr/libexec/neagent

[/usr/libexec/neagent]

/bin/launchctl

[/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon]

/bin/launchctl

[/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon]

/usr/libexec/xpcproxy

[xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E]

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService

[/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService]

/usr/libexec/xpcproxy

[xpcproxy com.apple.CoreAuthentication.agent]

/usr/libexec/xpcproxy

[xpcproxy com.apple.akd]

/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd

[/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd]

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd

[/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.AccountPolicyHelper]

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper

[/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper]

/usr/libexec/xpcproxy

[xpcproxy com.apple.spindump]

/usr/sbin/spindump

[/usr/sbin/spindump]

/usr/libexec/xpcproxy

[xpcproxy com.apple.diagnosticd]

/usr/libexec/diagnosticd

[/usr/libexec/diagnosticd]

Network

Country Destination Domain Proto
US 8.8.8.8:53 lb._dns-sd._udp.0.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 ecs.office.com udp
US 52.113.194.132:443 ecs.office.com tcp
US 8.8.8.8:53 odc.officeapps.live.com udp
FR 52.109.68.130:443 odc.officeapps.live.com tcp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.32.7:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 messaging.engagement.office.com udp
NL 52.111.243.8:443 messaging.engagement.office.com tcp
US 8.8.8.8:53 h3.apis.apple.map.fastly.net udp
US 8.8.8.8:53 mobile.events.data.trafficmanager.net udp
US 20.189.173.6:443 tcp
US 8.8.8.8:53 api.apple-cloudkit.fe2.apple-dns.net udp
US 8.8.8.8:53 h3.apis.apple.map.fastly.net udp
US 8.8.8.8:53 gspe1-ssl.ls.apple.com.edgesuite.net udp
US 8.8.8.8:53 e4686.dsce9.akamaiedge.net udp
NL 23.209.125.28:443 gspe1-ssl.ls.apple.com.edgesuite.net tcp
NL 23.209.125.6:443 gspe1-ssl.ls.apple.com.edgesuite.net tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 gsp64-ssl.ls-apple.com.akadns.net udp
US 8.8.8.8:53 cds.apple.com udp
BE 104.68.86.71:443 cds.apple.com tcp
US 8.8.8.8:53 help.apple.com udp
GB 2.21.189.171:443 help.apple.com tcp
GB 2.21.189.171:443 help.apple.com tcp
GB 17.57.146.151:5223 tcp
US 8.8.8.8:53 8-courier.push.apple.com udp
GB 17.57.146.153:5223 8-courier.push.apple.com tcp

Files

/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsObject.db

MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsDirectory.db

MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.microsoft.Word/mso00047B08

MD5 ed3c1c40b68ba4f40db15529d5443dec
SHA1 831af99bb64a04617e0a42ea898756f9e0e0bcca
SHA256 039fe79b74e6d3d561e32d4af570e6ca70db6bb3718395be2bf278b9e601279a
SHA512 c7b765b9afbb9810b6674dbc5c5064ed96a2682e78d5dffab384d81edbc77d01e0004f230d4207f2b7d89cee9008d79d5fbadc5cb486da4bc43293b7aa878041

/Users/run/Library/Group Containers/UBF8T346G9.Office/FontCache/4/PreviewFont/hier_officeFontsPreview_4_39.ttf

MD5 e5223ac9cb2716d1c490cb0e41a954b6
SHA1 e370e858bac68d8ab6e9363ee4516aad1ee3ebf3
SHA256 096791f1856261c77f26b7e21fc308928b3b4408f8b65cfb75ae2ee531a7da30
SHA512 2aa2c3b894a3dd8b296d6e386b53f3b12d5afe0d32e69f68f2beac0d6d639474cf0c6de85550475ab537abb2d9dc714300009b8da1e2528aa61377408c851952

/Users/run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml

MD5 a98417637f615e1d9ae2c2c480f85f2e
SHA1 501bd22bddeea1caded9716d69c927ed05960328
SHA256 e992d0cba50a2a01836e44a92aff3bfa7909d91c3697609a7cadb10c38cbb122
SHA512 36ae742c2c2c4a3a61b01ad521b39fb4c0881656b1b0090081b4055fdc1ad8075296e2d3878068a4ae9d53af65660c43c1c13309a58739eeec49494962700b25

/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/TelemetryUploadFilecom.microsoft.autoupdate.fba.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

MD5 58e51b9bda0d9974aec3ce2a9704ae29
SHA1 1b4190bad6a9c99392b6fe980093a9faee357345
SHA256 e4f7154e807607c0d3046493774ac51eb102ed10bc464b33aaed78664f4d91f4
SHA512 b3497e366772e3d17ddfdaa7ae00e9a1b08b8d9ba0655fddc8f514d901673b6efa54dca7a33e9550813a78c42ac8e371086289526b2555d7229bcfc1a048ac12