hxxps://www[.]youtube[.]com/watch?v=2dthCcDtjpY

Analysis

max time kernel
135s
max time network
151s
platform
macos-10.15_amd64
resource
macos-20240611-en
resource tags

arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
21-06-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/watch?v=2dthCcDtjpY

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid

ioc	process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid

/bin/sh
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.youtube.com/watch?v=2dthCcDtjpY\""
1⤵
PID:493

/bin/bash
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.youtube.com/watch?v=2dthCcDtjpY\""
1⤵
PID:493

/usr/bin/sudo
sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.youtube.com/watch?v=2dthCcDtjpY"
1⤵
PID:493
- /bin/zsh
  /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.youtube.com/watch?v=2dthCcDtjpY"
  2⤵
  PID:494

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:498

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:498

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:501

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:502

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:501

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:502

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:522

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0B4C966A/OneDrive.app
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:524

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:525

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:526

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputMenuAgent
1⤵
PID:540

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
1⤵
PID:540

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputSwitcher
1⤵
PID:542

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
1⤵
PID:542

/System/Applications/Music.app/Contents/MacOS/Music
/System/Applications/Music.app/Contents/MacOS/Music
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:547

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
1⤵
PID:547

/System/Applications/Music.app/Contents/XPCServices/VisualizerService.xpc/Contents/MacOS/VisualizerService
/System/Applications/Music.app/Contents/XPCServices/VisualizerService.xpc/Contents/MacOS/VisualizerService
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.D77F5F77-3A88-46D0-BB5D-55DF3816FBBF 544
1⤵
PID:553

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:555

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:556

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:559

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:561

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:562

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:563

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.AppStore.1900
1⤵
PID:564

/System/Applications/App Store.app/Contents/MacOS/App Store
"/System/Applications/App Store.app/Contents/MacOS/App Store"
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:565

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:568

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 564
1⤵
PID:569

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:570

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:570

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression

Filesize
218KB

MD5
2b0e3482473edaa98ded6925de9a4a7c

SHA1
44dc9eff88fab0f2b663072e1cfee6e058a99fe6

SHA256
ad8f706367522e696d7de9cc8a31540e74e1c90f0b348cb5b897c36cb1e69291

SHA512
027dcb3d0b68412f4bacdb9b119fe8d21c1d4639b4d46a257f901259daa6ca3fd160cba4e1dc09881ca581721300ae534e080ffcb19513de7e27278a2772caaf

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression

Filesize
21.9MB

MD5
bdce65def01e8ee4c280cb179e7828e3

SHA1
bd51c7c61550ee293e2aa1a9d683f756ac2c445e

SHA256
21306ef149a99d2032122b5771872a3e8cf11e467e9c9d16b1801d92113587a3

SHA512
eaf6f3e69c4c98ed98517a2ba51da04e0eb8f9446328ebcb510c3f2b32f3d93ced1fe2b2132c68ba6ef4b412efa24782015d098996cfc44c7a4d3f9750c74ca2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression

Filesize
121KB

MD5
5551510313cf8b96048d0237bc757a1c

SHA1
23264e14c3b1fa978cf580783db0a79ea9bacc95

SHA256
dc57be539c0f1eb2c708accfd3a55372351198b13b6458cd5a9bbce7a87646e3

SHA512
08d4c4df1d482f48df8de90c1f15d4c723ac444ed537350b0de98be40dd2e01faa90487e8ec16ea94a84c5f87d1b647ed6c5f6c606a872c65cd5660e234eeaa2

Download Submit
/var/root/Library/Caches/rtcreportingd/events/NRM_Events_2024-06-21-09-12-59.event

Filesize
3KB

MD5
fefd5c00d83b0622d4e611eedf1afb14

SHA1
16e02c151b2ad969d4425002b444f05e84e28021

SHA256
03dbfc0ec44cb5c8890e0de6f3a37b4b8455f7abea7a360c1853176fc9af6513

SHA512
0e41e1d8ace9128ca3a4642aef92c9a1c0badfc39c584e4c4d8be65008bfcaa1fc19d85ab50d87eb6c2f397e737dd6d4f3e796bba03fa625cfdc911cd3cf6a0a

Download Submit
/var/root/Library/Caches/rtcreportingd/events/NRM_Events_2024-06-21-09-12-59.event

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit