b0bf8c685e50d5a8e3443dd169a066fc516360828782442f8889bcd90f7dcc46

Analysis

max time kernel
248s
max time network
153s
platform
macos-10.15_amd64
resource
macos-20240711.1-en
resource tags

arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
15/07/2024, 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

184KB
MD5

b97d1934c1594daef4967a61b501d145
SHA1

5db6702bea8fd56250f59b3923ea0ab10be1f163
SHA256

b0bf8c685e50d5a8e3443dd169a066fc516360828782442f8889bcd90f7dcc46
SHA512

75547264367a2e8fbeae421202254e905279b2c646f201bb27a76b92386997ec4fb3346797d18c28176ba80e81782a846531b805f710da66b3c5e4d7af2845f9
SSDEEP

3072:sJ00spsbtozk6o6yfgevYiTljZfrXF3ft72297CKJas9Qj+y8aE90jY5XX:sJ00sCJozk64fjrTljZTXF3ft17CKgst

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
1⤵
PID:482

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:483

/usr/libexec/xpcproxy
xpcproxy com.oracle.java.Java-Updater
1⤵
PID:484

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/sample.html\""
1⤵
PID:485

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/sample.html\""
1⤵
PID:485

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/sample.html
1⤵
PID:485
- /bin/zsh
  /bin/zsh -c /Users/run/sample.html
  2⤵
  PID:488
- /Users/run/sample.html
  /Users/run/sample.html
  2⤵
  PID:488
- /bin/sh
  sh /Users/run/sample.html
  2⤵
  PID:488
- /bin/bash
  sh /Users/run/sample.html
  2⤵
  PID:488

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:476

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:480

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:482

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:484

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:483

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:515

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:515

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:524

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:528

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads