653b5c625dc6f24dcab5aaf33e77fd3c994f4783884c21d0a71b5c1fefbeb4e1

General

Target

[email protected]
Size

31KB
MD5

c261c6e3332d0d515c910bbf3b93aab3
SHA1

ff730b6b2726240df4b2f0db96c424c464c65c17
SHA256

4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9
SHA512

a93bd7b1d809493917e0999d4030cb53ab7789c65f6b87e1bbac27bd8b3ad2aeb92dec0a69369c04541f5572a78f04d8dfba900624cf5bd82d7558f24d0a8e26
SSDEEP

768:Tyc7/ovNV004AjWU3GQelVUlidf+prtbjzjy1QVIibtYcFOKc6K:Tyc2z0ajWTQelzdGDbjzKQVIi7OKcl

Score

5^/10

evasion

Malware Config

Signatures

File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
evasion

File Deletion
T1070.004

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/[email protected]\""
1⤵
PID:553

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/[email protected]\""
1⤵
PID:553

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/[email protected]"
1⤵
PID:553
- /bin/zsh
  /bin/zsh -c "/Users/run/[email protected]"
  2⤵
  PID:556
- /Users/run/[email protected]
  "/Users/run/[email protected]"
  2⤵
  PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:554

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:561

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:562

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:562

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:571

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater66017B75/OneDrive.app
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:593

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:594

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:595

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:597

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:597
- /usr/bin/login
  login -pf run
  2⤵
  PID:600
- - /bin/zsh
    -zsh
    3⤵
    PID:604
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:605
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:606
  - - /bin/rm
      rm -rf /
      4⤵
      PID:611
  - - /usr/bin/sudo
      sudo rm -rf /
      4⤵
      PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:599

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:601

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:602

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:603

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:607

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:608

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:609

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:610

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:614

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.ctkd
1⤵
PID:617

/System/Library/Frameworks/CryptoTokenKit.framework/ctkd
/System/Library/Frameworks/CryptoTokenKit.framework/ctkd -tw
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.ctkd
1⤵
PID:618

/System/Library/Frameworks/CryptoTokenKit.framework/ctkd
/System/Library/Frameworks/CryptoTokenKit.framework/ctkd -s
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:622

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:622

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
50e07abef86d4a0776feb952d0800e34

SHA1
91d17a599f6e1af6c64993ab85afcf20d70344e1

SHA256
5d9aedaa776f07c835e19b00483f7b0e5e31ffb5b0b3ca95b2a4b120f06e487a

SHA512
1492d435dac4bc5ab3395c8453a56e240b9d33a73eaa8040bfa8b542ab94432c6b1f41f9858020c693b936173edd44474537640acff344ac38a660eef1a3b8d8

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
40654b268a47eee60fa7e1337f49e02c

SHA1
c31a486f79826579be802b2d593d56d80f7a3934

SHA256
3b82f9ae0f725a8cfc9d593e4cfeceb4aa3064abb73b74bdf61429ee517c54b4

SHA512
0e8866bf36846b80ecaba045a7a1905d2e5705e8afb43dc3a0d8f25999a981a646a95ee79719d5f399c0b5f603f6d08935e832b0e8b7e7c68c740e09a7c0c518

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit

Resubmissions

Analysis

Sharing