Analysis
-
max time kernel
142s -
max time network
147s -
platform
macos-10.15_amd64 -
resource
macos-20240611-en -
resource tags
-
submitted
10/07/2024, 18:38
General
-
Target
malware.html
-
Size
1KB
-
MD5
84238dfc8092e5d9c0dac8ef93371a07
-
SHA1
4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047
-
SHA256
ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9
-
SHA512
d06b93c883f8126a04589937a884032df031b05518eed9d433efb6447834df2596aebd500d69b8283e5702d988ed49655ae654c1683c7a4ae58bfa6b92f2b73a
Score
4/10
Malware Config
Signatures
-
Resource Forking 1 TTPs 6 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes
-
/usr/libexec/xpcproxyxpcproxy com.apple.pluginkit.pkd1⤵
-
/usr/libexec/pkd/usr/libexec/pkd1⤵
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/malware.html\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/malware.html\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/malware.html1⤵
-
/bin/zsh/bin/zsh -c /Users/run/malware.html2⤵
-
-
/Users/run/malware.html/Users/run/malware.html2⤵
-
-
/bin/shsh /Users/run/malware.html2⤵
-
-
/bin/bashsh /Users/run/malware.html2⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.systemsoundserverd1⤵
-
/usr/sbin/systemsoundserverd/usr/sbin/systemsoundserverd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater66017B75/OneDrive.app1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.cloudkeychainproxy31⤵
-
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.systempreferences.21401⤵
-
/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.siri.context.service1⤵
-
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountProfileRemoteViewService 5991⤵
-
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService1⤵
-
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool1⤵
-
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool1⤵
-
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck1⤵
-
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref1⤵
-
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.nfcd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.CoreAuthentication.agent1⤵
-
/usr/libexec/nfcd/usr/libexec/nfcd1⤵
-
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.studentd1⤵
-
/usr/libexec/studentd/usr/libexec/studentd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.preference.screentime.remoteservice 5991⤵
-
/System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice/System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.metadata.mdwrite1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.colorsync.useragent1⤵
-
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.colorsyncd1⤵
-
/usr/libexec/colorsyncd/usr/libexec/colorsyncd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.akd1⤵
-
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.adid1⤵
-
/System/Library/PrivateFrameworks/CoreADI.framework/adid/System/Library/PrivateFrameworks/CoreADI.framework/adid1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵
-
/usr/sbin/spindump/usr/sbin/spindump1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump_agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.tailspind1⤵
-
/usr/libexec/tailspind/usr/libexec/tailspind1⤵
-
/usr/libexec/spindump_agent/usr/libexec/spindump_agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.assistantd1⤵
-
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.secinitd1⤵
-
/usr/libexec/secinitd/usr/libexec/secinitd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵
-
/usr/libexec/neagent/usr/libexec/neagent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportCrash1⤵
-
/System/Library/CoreServices/ReportCrash/System/Library/CoreServices/ReportCrash agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5a4a2455e2d11d8de077360b5172d9dcd
SHA176623886f28312d68cc8d29f2b7065b75cbeaa96
SHA25630b608c1c072dfe53de53e5e8fcfa923a19fb0fc68943a761de590b522b4696c
SHA5123abf72d3f8c7b38ecf66280ae781ca7b9315e831cea0c6efd4c78a34e4041b27112253706622e3776598eabae2bbe8ffcbee085fe1e65331ea8a3a88e92ed495
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
Filesize
21KB
MD5de3804276cb42be1094ebb63af91f04b
SHA19595d89846cea1a6eb698f5966069b22fb8ad549
SHA256c7b1f13a0e15a11da65afa3edcd670b6f3b050c31401f12797ff3151fa724e9b
SHA512547adf50df224c4b3749bab9f55c27ebe2d28ca8e50211de7ac74a42967ffe25b2b6d37134cd0ca9c2df468280e94b9e81d20ae423628ccb2f7462b02d643184