hxxps://resourcebank1-my[.]sharepoint[.]com/[:]o[:]/g/personal/keri_hill_resourcebank_co_uk/EuqjJ0v-svtJkZqUOXB2GCYBoI8mxEzJDYNa_Sp_rIRqYA?e=5%3aLM9T1h&at=9&xsdata=MDV8MDJ8b2NyYW1tb25AY2Fsb3IuY28udWt8NjdkMjgzMWFiODk3NGYxM2RmOGIwOGRjOTlkZDYzMzF8N2I4MWNjYzViYTM1NGJmODg1NGY0OWY5YzAyZDNmYjF8MHwwfDYzODU1NDQyMzMzODk5NTI2MnxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=Yi8vVXZNd2k1ZHUxZ1gySExMK0JhQnRYUzVzelY5cURWNkoxdmlzS295az0%3d

Resubmissions

01/07/2024, 18:16

240701-wwtfyawcmn 8

01/07/2024, 18:15

240701-wv4khssbmb 8

Analysis

max time kernel
237s
max time network
289s
platform
macos-10.15_amd64
resource
macos-20240611-en
resource tags

arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
01/07/2024, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://resourcebank1-my.sharepoint.com/:o:/g/personal/keri_hill_resourcebank_co_uk/EuqjJ0v-svtJkZqUOXB2GCYBoI8mxEzJDYNa_Sp_rIRqYA?e=5%3aLM9T1h&at=9&xsdata=MDV8MDJ8b2NyYW1tb25AY2Fsb3IuY28udWt8NjdkMjgzMWFiODk3NGYxM2RmOGIwOGRjOTlkZDYzMzF8N2I4MWNjYzViYTM1NGJmODg1NGY0OWY5YzAyZDNmYjF8MHwwfDYzODU1NDQyMzMzODk5NTI2MnxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=Yi8vVXZNd2k1ZHUxZ1gySExMK0JhQnRYUzVzelY5cURWNkoxdmlzS295az0%3d

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://resourcebank1-my.sharepoint.com/:o:/g/personal/keri_hill_resourcebank_co_uk/EuqjJ0v-svtJkZqUOXB2GCYBoI8mxEzJDYNa_Sp_rIRqYA?e=5%3aLM9T1h&at=9&xsdata=MDV8MDJ8b2NyYW1tb25AY2Fsb3IuY28udWt8NjdkMjgzMWFiODk3NGYxM2RmOGIwOGRjOTlkZDYzMzF8N2I4MWNjYzViYTM1NGJmODg1NGY0OWY5YzAyZDNmYjF8MHwwfDYzODU1NDQyMzMzODk5NTI2MnxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=Yi8vVXZNd2k1ZHUxZ1gySExMK0JhQnRYUzVzelY5cURWNkoxdmlzS295az0%3d\""
1⤵
PID:521

/bin/bash
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://resourcebank1-my.sharepoint.com/:o:/g/personal/keri_hill_resourcebank_co_uk/EuqjJ0v-svtJkZqUOXB2GCYBoI8mxEzJDYNa_Sp_rIRqYA?e=5%3aLM9T1h&at=9&xsdata=MDV8MDJ8b2NyYW1tb25AY2Fsb3IuY28udWt8NjdkMjgzMWFiODk3NGYxM2RmOGIwOGRjOTlkZDYzMzF8N2I4MWNjYzViYTM1NGJmODg1NGY0OWY5YzAyZDNmYjF8MHwwfDYzODU1NDQyMzMzODk5NTI2MnxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=Yi8vVXZNd2k1ZHUxZ1gySExMK0JhQnRYUzVzelY5cURWNkoxdmlzS295az0%3d\""
1⤵
PID:521

/usr/bin/sudo
sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://resourcebank1-my.sharepoint.com/:o:/g/personal/keri_hill_resourcebank_co_uk/EuqjJ0v-svtJkZqUOXB2GCYBoI8mxEzJDYNa_Sp_rIRqYA?e=5%3aLM9T1h&at=9&xsdata=MDV8MDJ8b2NyYW1tb25AY2Fsb3IuY28udWt8NjdkMjgzMWFiODk3NGYxM2RmOGIwOGRjOTlkZDYzMzF8N2I4MWNjYzViYTM1NGJmODg1NGY0OWY5YzAyZDNmYjF8MHwwfDYzODU1NDQyMzMzODk5NTI2MnxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=Yi8vVXZNd2k1ZHUxZ1gySExMK0JhQnRYUzVzelY5cURWNkoxdmlzS295az0%3d"
1⤵
PID:521
- /bin/zsh
  /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://resourcebank1-my.sharepoint.com/:o:/g/personal/keri_hill_resourcebank_co_uk/EuqjJ0v-svtJkZqUOXB2GCYBoI8mxEzJDYNa_Sp_rIRqYA?e=5%3aLM9T1h&at=9&xsdata=MDV8MDJ8b2NyYW1tb25AY2Fsb3IuY28udWt8NjdkMjgzMWFiODk3NGYxM2RmOGIwOGRjOTlkZDYzMzF8N2I4MWNjYzViYTM1NGJmODg1NGY0OWY5YzAyZDNmYjF8MHwwfDYzODU1NDQyMzMzODk5NTI2MnxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=Yi8vVXZNd2k1ZHUxZ1gySExMK0JhQnRYUzVzelY5cURWNkoxdmlzS295az0%3d"
  2⤵
  PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:548

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:549

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:550

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:551

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:552

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:559

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:560

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:561

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:563

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:565

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:566

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:568

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:569

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:569

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:577

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:577

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:584

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:594

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:594

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
395B

MD5
c7a83f4f13edf946a90396e2203813dd

SHA1
5282ca6a0b8e45b6108337feaf897555716e6d4a

SHA256
c2eb1d058a1be59da36b3ea30784b0b7a9eacc84937f83113f92a0b97d34a623

SHA512
28ddcae711fe0d08bd215b1604766ec1415e453dae79f4d13a0b88ed5012ef1022d7b36ea5e069394aec31813196d4fd0825e340da6902a65278ae084db1e843

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
443B

MD5
95d1f6a479ea836bed553646ebef85c1

SHA1
19da469018294e373c788d888e5c55e0bb18695e

SHA256
fc78047a7293b7fba3abe949497f397804f86e2ff04c29c4a549df60aa877aa2

SHA512
3f9b8aa7efc6cbbcf6672e0d08a630178c653894d800e9125ed18774de105bc564b097120e98b5711cec5d05d95b41fe822019bc10038055eabf341b0c12845d

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
81B

MD5
520bb9b65b89f03050030e5a985b9cd1

SHA1
91defba6d4540d4c8ede177730d104d747e8f57b

SHA256
6bb23965fd46b9ffe67a1cdb2144943543894e063c05db3a4de54e94b84968a0

SHA512
81eebb3eda761a9ecc94aa9564deab4d476522d94025ec19e002e91b12b7fbf2bffda23e7c393c09cb91b6ecd953ec1bf39ef5f787058b70289a5a5d777f0cf6

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
8f507de2fc5f0d8dacaedb88f119ade4

SHA1
5c3d5f634610904290f4304a72aefb1b8b9ac38a

SHA256
42238d7791ba0643b9734afad3b4d37bf22c6086e0e91b874f2f65fdd998f589

SHA512
715522cd785bb4dd45b480a7d97d67dce01de9ea4f855471ee57769ccdeca75c0a779edc55a5e62357388cfed1f36f9c2c6a009ef1d4095aa48a0e2074778208

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
ceed1b8ecd8dfc41d67f31028d024d71

SHA1
46fc124402eaee1faf89890ca36199e434d1adfc

SHA256
de06ce6f76602a8be624aaaf7a699f2f5323c231297d1dfeffaa828748addb34

SHA512
38e3710c13a8a8ccbd96f9ca15f1e1cf8822d723f09e92db0ea1bf4b308d457c2ff9ebcb3c61d4d8ff59146908a4ce7bf4c9e59fc3cbb3b26f75f527b5576403

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1285.xml

Filesize
179KB

MD5
9a43af57707d2fb460832049d1f217d1

SHA1
056d813f8cb5198ca82072f7e3484f38ea5267f8

SHA256
7224f8828694ed74a8353567e4d84da188d15a993a4a75938f8409cb49218e7c

SHA512
1f33175f5d0958c79540a627552f71c6960b6ff19c9b2b0aa604c00bfeff216f6ea2ec3a22ef91ad8d7249597fdf5ad49ddbf5f4aef71b397e785152474954d7

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit