Analysis

  • max time kernel
    40s
  • max time network
    46s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240611-en
  • resource tags

    arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    17-06-2024 09:26

Errors

Reason
Task went missing from backend

General

  • Target

    https://fs4.fastupload.io/d84d7c9ee2c50425/FAMalHashDatabase.txt?download_token=01cbe50de76696e151437e662d246bc7b2454c84a197b0c2b5c4f57bec5a26f2

Score
4/10

Malware Config

Signatures

  • Resource Forking 1 TTPs 2 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

Processes

  • /usr/libexec/xpcproxy
    xpcproxy com.apple.pluginkit.pkreporter
    1⤵
      PID:525
    • /usr/libexec/xpcproxy
      xpcproxy com.apple.gkreport
      1⤵
        PID:527
      • /bin/sh
        sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://fs4.fastupload.io/d84d7c9ee2c50425/FAMalHashDatabase.txt?download_token=01cbe50de76696e151437e662d246bc7b2454c84a197b0c2b5c4f57bec5a26f2\""
        1⤵
          PID:526
        • /bin/bash
          sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://fs4.fastupload.io/d84d7c9ee2c50425/FAMalHashDatabase.txt?download_token=01cbe50de76696e151437e662d246bc7b2454c84a197b0c2b5c4f57bec5a26f2\""
          1⤵
            PID:526
          • /usr/libexec/gkreport
            /usr/libexec/gkreport
            1⤵
              PID:527
            • /usr/bin/sudo
              sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://fs4.fastupload.io/d84d7c9ee2c50425/FAMalHashDatabase.txt?download_token=01cbe50de76696e151437e662d246bc7b2454c84a197b0c2b5c4f57bec5a26f2"
              1⤵
                PID:526
                • /bin/zsh
                  /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://fs4.fastupload.io/d84d7c9ee2c50425/FAMalHashDatabase.txt?download_token=01cbe50de76696e151437e662d246bc7b2454c84a197b0c2b5c4f57bec5a26f2"
                  2⤵
                    PID:531
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.systemstats.daily
                  1⤵
                    PID:528
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
                    1⤵
                      PID:530
                    • /usr/libexec/pkreporter
                      /usr/libexec/pkreporter
                      1⤵
                        PID:525
                      • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                        /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                        1⤵
                          PID:530
                        • /usr/libexec/xpcproxy
                          xpcproxy com.oracle.java.Java-Updater
                          1⤵
                            PID:532
                          • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                            "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                            1⤵
                              PID:532
                            • /usr/bin/pluginkit
                              /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                              1⤵
                                PID:557
                              • /usr/sbin/spctl
                                /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterBCBF2C69/OneDrive.app
                                1⤵
                                  PID:558

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads