Analysis
-
max time kernel
141s -
max time network
147s -
platform
macos-10.15_amd64 -
resource
macos-20240611-en -
resource tags
arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
19-06-2024 11:25
Static task
static1
General
-
Target
-
Size
578KB
-
MD5
533d78fdd538bbeee31fb0b72a8cfb7c
-
SHA1
cb0e46804e784525f5bece40d51772bbdd9a5dc4
-
SHA256
b7a4fcc7f474c091edc09349af5e53915d23f14071d78a3026c92c49d2467989
-
SHA512
85e393cbdd2b20da8892173c7951ddf8e75dbfa29cf81fa725a2da56e606b848ea8a6636528d4fe26eca5e6b251406ec870242fe0d44e7863bf22c739d7759d5
-
SSDEEP
12288:BE6fwX07rBFHkzeG54YEp0l87vVGt+mj9kvoTvI8S:BE6QG9FqGp0M0D9kvo9S
Malware Config
Signatures
-
Resource Forking 1 TTPs 6 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes:
ioc process /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
Processes
-
/bin/shPID:551
-
/bin/bashPID:551
-
/usr/bin/sudoPID:551
-
/bin/zshPID:553
-
/Users/run/[email protected]PID:553
-
/usr/libexec/xpcproxyxpcproxy com.apple.pluginkit.pkd1⤵PID:554
-
/usr/libexec/pkd/usr/libexec/pkd1⤵PID:554
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:576
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:576
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.cloudkeychainproxy31⤵PID:580
-
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy1⤵PID:580
-
/usr/libexec/xpcproxyxpcproxy com.apple.TextInputMenuAgent1⤵PID:582
-
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent1⤵PID:582
-
/usr/libexec/xpcproxyxpcproxy com.apple.TextInputSwitcher1⤵PID:583
-
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher1⤵PID:583
-
/usr/libexec/xpcproxyxpcproxy com.apple.systempreferences.21401⤵PID:584
-
/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"1⤵PID:584
-
/usr/libexec/xpcproxyxpcproxy com.apple.siri.context.service1⤵PID:586
-
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService1⤵PID:586
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountProfileRemoteViewService 5841⤵PID:587
-
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService1⤵PID:587
-
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool1⤵PID:589
-
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool1⤵PID:590
-
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck1⤵PID:592
-
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref1⤵PID:593
-
/usr/libexec/xpcproxyxpcproxy com.apple.CoreAuthentication.agent1⤵PID:594
-
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd1⤵PID:594
-
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool1⤵PID:595
-
/usr/libexec/xpcproxyxpcproxy com.apple.nfcd1⤵PID:596
-
/usr/libexec/nfcd/usr/libexec/nfcd1⤵PID:596
-
/usr/libexec/xpcproxyxpcproxy com.apple.studentd1⤵PID:597
-
/usr/libexec/studentd/usr/libexec/studentd1⤵PID:597
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵PID:598
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵PID:598
-
/usr/libexec/xpcproxyxpcproxy com.apple.preference.notifications.remoteservice 5841⤵PID:599
-
/System/Library/PreferencePanes/Notifications.prefPane/Contents/XPCServices/com.apple.preference.notifications.remoteservice.xpc/Contents/MacOS/com.apple.preference.notifications.remoteservice/System/Library/PreferencePanes/Notifications.prefPane/Contents/XPCServices/com.apple.preference.notifications.remoteservice.xpc/Contents/MacOS/com.apple.preference.notifications.remoteservice1⤵PID:599
-
/usr/libexec/xpcproxyxpcproxy com.apple.metadata.mdwrite1⤵PID:600
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.20281⤵PID:602
-
/Applications/Safari.app/Contents/MacOS/Safari/Applications/Safari.app/Contents/MacOS/Safari1⤵PID:602
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.History1⤵PID:603
-
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History1⤵PID:603
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.4AC59705-C5F6-4C4A-957C-638CB3BE17E9 6021⤵PID:604
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵PID:604
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵PID:606
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2E18A62F/OneDrive.app1⤵PID:607
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:609
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:609
-
/usr/libexec/xpcproxyxpcproxy com.apple.SafariLaunchAgent1⤵PID:612
-
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent1⤵PID:612
-
/usr/libexec/xpcproxyxpcproxy com.apple.suggestd1⤵PID:613
-
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd1⤵PID:613
-
/usr/libexec/xpcproxyxpcproxy com.apple.akd1⤵PID:614
-
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd1⤵PID:614
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.E3FE4471-B760-400A-8E16-6E4DD8B5C0D0 6021⤵PID:615
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵PID:615
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵PID:617
-
/usr/libexec/neagent/usr/libexec/neagent1⤵PID:617
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.SearchHelper 6021⤵PID:618
-
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper1⤵PID:618
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵PID:619
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵PID:619
-
/usr/libexec/xpcproxyxpcproxy com.apple.knowledge-agent1⤵PID:621
-
/usr/libexec/knowledge-agent/usr/libexec/knowledge-agent1⤵PID:621
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.SafeBrowsing.Service1⤵PID:623
-
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service1⤵PID:623
-
/usr/libexec/xpcproxyxpcproxy com.apple.bird1⤵PID:626
-
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird1⤵PID:626
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.1954643C-C568-4402-A6A2-B8EA075A3685 6021⤵PID:627
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵PID:627
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportCrash1⤵PID:628
-
/System/Library/CoreServices/ReportCrash/System/Library/CoreServices/ReportCrash agent1⤵PID:628
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵PID:629
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵PID:629
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵PID:635
-
/usr/libexec/xpcproxyxpcproxy com.apple.assistantd1⤵PID:637
-
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd1⤵PID:637
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:647
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5e528863522ec78e22d41392c18c81054
SHA109689eb0fc8e0e2f2f6c1bae2c0fac7d24983f62
SHA256d5beb39e6137d1fbe62dcfaa559174116c5400e3b2786f174ce21b33bcd2322c
SHA51220a3298fe4b09e1c606c24807e40f15a4d8694b31796a0dd276b63586c4f56563e95fec1e121b85a288a2d8c270e8fafad4f2d66908af25202f05bf051b7ac26
-
Filesize
137B
MD5238cdc1eff71b3ffe981fb800693d92a
SHA1b32975a0b39e5cf278bf63eecd470fe29a382f88
SHA256e180ec518e18fbaeeeb95f52f811bc195ccf01f1cc33bcf4defca5b180f93733
SHA5125fef385d53a6e88051d05d4ff32f12282e5fdcb267a26f0b3da08324e4230d4cce89517a77ee1650115b23d226f41541e586cd6ea6c68fa0c5b42c11bb127d7a
-
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Filesize218KB
MD5dec2646aaab452a09beeb50e96041a0c
SHA1c4c9feee39b406affe0cc40bb3b6a57e7901bfe4
SHA25663a9c72dc0d8b61009917e37928e15268e4dcaaf7ee311f808cd2fb696ba0a1d
SHA51266f57e8a9f321c7f0b1a6cdb967ece18bd0197558703c7b309418432a63f97cb45d0954ccc6347be51515edbfac61335285e72ee85a332f1b8e55d422ea45892
-
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Filesize21.9MB
MD5cb876e758d093eddb6e936804fd0e1b6
SHA1a1dca144abc68c4778934d6bcd93aa742fa691c2
SHA256b2c133ac9a9d0ad99cee3e28f1c4a6e4d07581b08ee45eca3332276e69c153f0
SHA5124498a19849f50928463ef14f6f438265340948fb921247bdd9003876340cb03dd38e2bc18cfb5b09d4bbf46c4fbdfca655b09b2c6637e026848fea015e6740b3
-
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Filesize125KB
MD5129ed8c78aa8bd7155ad1cc611e4bfbf
SHA1a737130d37dcdbaa725d4423b3b38af3a260b22e
SHA2568e7df638fa57b55f5bc8cf3b74d4ef72db4fbe3d82a1aae93c1abca5dde29be6
SHA512ea441fbab61b2df8f6977894cb228087e8680593872cbfa043db092d3067461f1d882008ac0041da9d7949bfb6243095863b5bad0a76e8b7d20b31858878d2bc
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818