Analysis

  • max time kernel
    37s
  • max time network
    54s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240611-en
  • resource tags

    arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    19-06-2024 13:27

Errors

Reason
Machine shutdown

General

  • Target

    maccddvdlabelmaker.dmg

  • Size

    125.6MB

  • MD5

    b89a943332e2186c98c7c109b33f8d62

  • SHA1

    76c6f3f6a734e9722975038e7917fb55454c0eae

  • SHA256

    9e865b95b3094d935237a5ec7faa31a80ffbe7e1e131867814fb39fe796b82f8

  • SHA512

    de68c4483b8fe99345432888d6d985c576593a6f03caa3dec01f060046e6ce06f30fd2478fab9b8773bfe3409fa238e1fc04f051e8dd4c4244fbc9b329c970ed

  • SSDEEP

    3145728:yQ4JBVHwfWzI5caTBfbNxghTI/5nOb/DxG9kVJ6rPwEe21/3rOctARx:oBRqOixfbTgpK8lSk36rYE5vtAj

Score
4/10

Malware Config

Signatures

  • Resource Forking 1 TTPs 4 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"open /Volumes/Mac\\ CD:DVD\\ Label\\ Maker/.com.apple.timemachine.supported\""
    1⤵
      PID:552
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"open /Volumes/Mac\\ CD:DVD\\ Label\\ Maker/.com.apple.timemachine.supported\""
      1⤵
        PID:552
      • /usr/bin/sudo
        sudo /bin/zsh -c "open /Volumes/Mac\\ CD:DVD\\ Label\\ Maker/.com.apple.timemachine.supported"
        1⤵
          PID:552
          • /bin/zsh
            /bin/zsh -c "open /Volumes/Mac\\ CD:DVD\\ Label\\ Maker/.com.apple.timemachine.supported"
            2⤵
              PID:553
            • /usr/bin/open
              open "/Volumes/Mac CD:DVD Label Maker/.com.apple.timemachine.supported"
              2⤵
                PID:553
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.replayd
              1⤵
                PID:554
              • /usr/libexec/xpcproxy
                xpcproxy com.apple.ReportMemoryException
                1⤵
                  PID:555
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.bird
                  1⤵
                    PID:556
                  • /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
                    /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
                    1⤵
                      PID:556
                    • /usr/libexec/replayd
                      /usr/libexec/replayd
                      1⤵
                        PID:554
                      • /usr/libexec/ReportMemoryException
                        /usr/libexec/ReportMemoryException
                        1⤵
                          PID:555
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.audio.systemsoundserverd
                          1⤵
                            PID:561
                          • /usr/sbin/systemsoundserverd
                            /usr/sbin/systemsoundserverd
                            1⤵
                              PID:561
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.pbs
                              1⤵
                                PID:562
                              • /System/Library/CoreServices/pbs
                                /System/Library/CoreServices/pbs
                                1⤵
                                  PID:562
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.audio.AudioComponentRegistrar
                                  1⤵
                                    PID:563
                                  • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                                    /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                                    1⤵
                                      PID:563
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.nehelper
                                      1⤵
                                        PID:564
                                      • /usr/libexec/nehelper
                                        /usr/libexec/nehelper
                                        1⤵
                                          PID:564
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.installd
                                          1⤵
                                            PID:567
                                          • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                            /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                            1⤵
                                              PID:567
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.storedownloadd
                                              1⤵
                                                PID:571
                                              • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                                /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                                1⤵
                                                  PID:571
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy com.apple.system_installd
                                                  1⤵
                                                    PID:573
                                                  • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                                    /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                                    1⤵
                                                      PID:573
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.quicklook.ui.helper
                                                      1⤵
                                                        PID:577
                                                      • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                        1⤵
                                                          PID:577
                                                        • /usr/libexec/xpcproxy
                                                          xpcproxy com.apple.TextEdit.2092
                                                          1⤵
                                                            PID:578
                                                          • /System/Applications/TextEdit.app/Contents/MacOS/TextEdit
                                                            /System/Applications/TextEdit.app/Contents/MacOS/TextEdit
                                                            1⤵
                                                              PID:578
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.metadata.mdwrite
                                                              1⤵
                                                                PID:579
                                                              • /usr/libexec/xpcproxy
                                                                xpcproxy com.apple.printtool.agent
                                                                1⤵
                                                                  PID:582
                                                                • /System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
                                                                  /System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
                                                                  1⤵
                                                                    PID:582
                                                                  • /usr/libexec/xpcproxy
                                                                    xpcproxy com.apple.geod
                                                                    1⤵
                                                                      PID:588
                                                                    • /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                                                      /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                                                      1⤵
                                                                        PID:588
                                                                      • /usr/libexec/xpcproxy
                                                                        xpcproxy com.apple.Safari.CacheDeleteExtension 546
                                                                        1⤵
                                                                          PID:589
                                                                        • /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                                          /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                                          1⤵
                                                                            PID:589
                                                                          • /usr/libexec/xpcproxy
                                                                            xpcproxy com.apple.routined
                                                                            1⤵
                                                                              PID:591
                                                                            • /usr/libexec/routined
                                                                              /usr/libexec/routined LAUNCHED_BY_LAUNCHD
                                                                              1⤵
                                                                                PID:591
                                                                              • /usr/libexec/xpcproxy
                                                                                xpcproxy com.apple.Maps.mapspushd
                                                                                1⤵
                                                                                  PID:594
                                                                                • /System/Library/CoreServices/mapspushd
                                                                                  /System/Library/CoreServices/mapspushd
                                                                                  1⤵
                                                                                    PID:594

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • /Library/Preferences/com.apple.networkextension.uuidcache.plist

                                                                                    Filesize

                                                                                    355B

                                                                                    MD5

                                                                                    a6ef4856e99c9d8e1d9bb762c5a8503a

                                                                                    SHA1

                                                                                    25d5405ad91791b716ae5a56b37aa2b393854967

                                                                                    SHA256

                                                                                    232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa

                                                                                    SHA512

                                                                                    582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489