eb8915ba0fef2d9f8b8413c83fc8d5ee24ba18cbcc6a896859b99976f25e7331

Analysis

max time kernel
438s
max time network
1547s
platform
macos-10.15_amd64
resource
macos-20240611-en
resource tags

arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
13/06/2024, 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RunApps File Manager.html
Size

121KB
MD5

3ccfc14c7036aaf68d777905815372eb
SHA1

e756de935a53cab267c67d279c55d270cc8a0e6a
SHA256

eb8915ba0fef2d9f8b8413c83fc8d5ee24ba18cbcc6a896859b99976f25e7331
SHA512

82125468aeed3221c3ce3dad3ec545a3170429df2d59e99fd7020bc69d71c359739c5b3be266cc72ad8cfcae4f4ff558e9ed6a454d4d2d4a69da295cea9a748d
SSDEEP

1536:YmtsnAltP+S0R3EapQCcgzpvFWo1WRTJqGFXkU3N3KuFYtm6WmMrRt/1Gug0eKsY:HX+S0x6CcEroYYrRZA0dsdK44CC8E

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/RunApps File Manager.html\""
1⤵
PID:513

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/RunApps File Manager.html\""
1⤵
PID:513

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/RunApps File Manager.html"
1⤵
PID:513
- /bin/zsh
  /bin/zsh -c "/Users/run/RunApps File Manager.html"
  2⤵
  PID:514
- /Users/run/RunApps
  /Users/run/RunApps File Manager.html
  2⤵
  PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:541

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:544

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:551

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:552

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:553

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:556

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:557

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:558

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:561

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:562

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:563

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:563

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:577

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:577

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:580

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:591

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreAuthentication.agent
1⤵
PID:594

/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
1⤵
PID:594

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:595

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:596

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:597

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:597

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
395B

MD5
c7a83f4f13edf946a90396e2203813dd

SHA1
5282ca6a0b8e45b6108337feaf897555716e6d4a

SHA256
c2eb1d058a1be59da36b3ea30784b0b7a9eacc84937f83113f92a0b97d34a623

SHA512
28ddcae711fe0d08bd215b1604766ec1415e453dae79f4d13a0b88ed5012ef1022d7b36ea5e069394aec31813196d4fd0825e340da6902a65278ae084db1e843

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
443B

MD5
95d1f6a479ea836bed553646ebef85c1

SHA1
19da469018294e373c788d888e5c55e0bb18695e

SHA256
fc78047a7293b7fba3abe949497f397804f86e2ff04c29c4a549df60aa877aa2

SHA512
3f9b8aa7efc6cbbcf6672e0d08a630178c653894d800e9125ed18774de105bc564b097120e98b5711cec5d05d95b41fe822019bc10038055eabf341b0c12845d

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
443B

MD5
b5ed1a4aa9f5eb7122af5b836de7cefc

SHA1
50f9e5dbb61125650245824f2bc6b466ede59bf6

SHA256
c81bb42621fd0e666a3863f06db96ab6f5f2631cf135d41e2916c25d973c1056

SHA512
3986a6f6457f3f794a04034f6d905cdb7ab37e67fd3d266a1aa7bf5deaeb544097d0c8668642288f2a6dfb33f343147241d2130abbff33f20140c6608f4a1211

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
c5fbd282c8738497827186225de5422f

SHA1
035a03225419352715be4242b889d4ae9e195f4a

SHA256
a97ec1538386f21b09ebb17c2d2f0c2d9713c65f0ed9fca809941061b385da7e

SHA512
0bfb76bf13e41855ceebe964f2933928cdbb2a5910fb5d4e2c3f1caabbe82785384e51c7c932215a134d7bc25f8d8f87c12321205324846d48a8a29758427e8c

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
4f9a852bce09a902d6163389663b1e15

SHA1
6302e5dae18deec434f7b4e56e7eb93fc4333b51

SHA256
58e2d3a331f8d5db27972e2dd1c63c93d865fe91814030cf6462e9e1497469b7

SHA512
987787b375a60d3bb7ecfb8a7396a7534171fc5abd46fb8c9ca8a4412673769c0106c7c0e165a256ca7d7969337b60a5729788aae529070f0f07872ddc25552d

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1285.xml

Filesize
179KB

MD5
9a43af57707d2fb460832049d1f217d1

SHA1
056d813f8cb5198ca82072f7e3484f38ea5267f8

SHA256
7224f8828694ed74a8353567e4d84da188d15a993a4a75938f8409cb49218e7c

SHA512
1f33175f5d0958c79540a627552f71c6960b6ff19c9b2b0aa604c00bfeff216f6ea2ec3a22ef91ad8d7249597fdf5ad49ddbf5f4aef71b397e785152474954d7

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit