3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

Analysis

max time kernel
137s
max time network
142s
platform
macos-10.15_amd64
resource
macos-20240611-en
resource tags

arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
25/06/2024, 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ.exe
Size

12KB
MD5

a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1

761168201520c199dba68add3a607922d8d4a86e
SHA256

3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA512

89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
SSDEEP

192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/MEMZ.exe\""
1⤵
PID:521

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/MEMZ.exe\""
1⤵
PID:521

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/MEMZ.exe
1⤵
PID:521
- /bin/zsh
  /bin/zsh -c /Users/run/MEMZ.exe
  2⤵
  PID:523
- /Users/run/MEMZ.exe
  /Users/run/MEMZ.exe
  2⤵
  PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:547

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:550

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:551

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:552

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:553

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:561

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:562

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:563

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:565

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:566

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:567

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:571

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:572

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:572

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:583

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:583

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:587

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:589

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:589

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
395B

MD5
c7a83f4f13edf946a90396e2203813dd

SHA1
5282ca6a0b8e45b6108337feaf897555716e6d4a

SHA256
c2eb1d058a1be59da36b3ea30784b0b7a9eacc84937f83113f92a0b97d34a623

SHA512
28ddcae711fe0d08bd215b1604766ec1415e453dae79f4d13a0b88ed5012ef1022d7b36ea5e069394aec31813196d4fd0825e340da6902a65278ae084db1e843

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
443B

MD5
95d1f6a479ea836bed553646ebef85c1

SHA1
19da469018294e373c788d888e5c55e0bb18695e

SHA256
fc78047a7293b7fba3abe949497f397804f86e2ff04c29c4a549df60aa877aa2

SHA512
3f9b8aa7efc6cbbcf6672e0d08a630178c653894d800e9125ed18774de105bc564b097120e98b5711cec5d05d95b41fe822019bc10038055eabf341b0c12845d

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
443B

MD5
b5ed1a4aa9f5eb7122af5b836de7cefc

SHA1
50f9e5dbb61125650245824f2bc6b466ede59bf6

SHA256
c81bb42621fd0e666a3863f06db96ab6f5f2631cf135d41e2916c25d973c1056

SHA512
3986a6f6457f3f794a04034f6d905cdb7ab37e67fd3d266a1aa7bf5deaeb544097d0c8668642288f2a6dfb33f343147241d2130abbff33f20140c6608f4a1211

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
dbc0a3c2717df7a75b8f0e55199b04e9

SHA1
52fe8f024f80c10d7a51a2f2f7d4794f48331f15

SHA256
2ef9b5055c202fcf7112133017fc4bf1281d4bfd1a9fe12fad99d0e32befdd21

SHA512
465bbc187f5665f0960f3c6bf23aa26f3fce745c6ed432ebd04ed196128c2ea9f3582d44a2ed312c79793bb2b9827b620c47543a2b0a36e55645c813398d8622

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
e329630ba7ceff2311b8c313b9cdb156

SHA1
7cb35ae0c1747601c6fa93f94fecc811a65a870a

SHA256
a5ff6323a8129f6039b3c545e95e15af79b2223a59d336f90022c4651ac995ea

SHA512
532c0e34cc3757d3f38c1575fc027b1f9892ed855da92157dca55286a3fff5152e1ca6c82768a836993ee42cfda653157dd1a22b196a68a30c6fdab16b684f04

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1285.xml

Filesize
179KB

MD5
9a43af57707d2fb460832049d1f217d1

SHA1
056d813f8cb5198ca82072f7e3484f38ea5267f8

SHA256
7224f8828694ed74a8353567e4d84da188d15a993a4a75938f8409cb49218e7c

SHA512
1f33175f5d0958c79540a627552f71c6960b6ff19c9b2b0aa604c00bfeff216f6ea2ec3a22ef91ad8d7249597fdf5ad49ddbf5f4aef71b397e785152474954d7

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit