ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d

Resubmissions

25/07/2024, 17:09

240725-vpjsgstanm 10

25/07/2024, 17:06

240725-vmp7gsshnn 10

25/07/2024, 17:05

240725-vlyggashkj 7

25/07/2024, 17:00

240725-vjf5eawdle 10

Analysis

max time kernel
59s
max time network
57s
platform
macos-10.15_amd64
resource
macos-20240711.1-en
resource tags

arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
25/07/2024, 17:05

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

MalwareBazaar.exe
Size

583KB
MD5

e44f18c0c7c0ef5103adb70ea9797794
SHA1

e96882549e5ca1bc3cbedf276a3b0dc2e74b7c1c
SHA256

ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d
SHA512

3facc779735f5132569dd413191add13333a28d476c9adf3119773af3f6f5a36f1a5a1f768bb2c40c563c10c6574a4556a97755ec36eacb8e5d471341a067277
SSDEEP

12288:LsHzOUNUSB/o5LsI1uwajJ5yvv1l2WmynaFDoml:6iUmSB/o5d1ubcvnA5oo

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/MalwareBazaar.exe\""
1⤵
PID:484

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/MalwareBazaar.exe\""
1⤵
PID:484

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/MalwareBazaar.exe
1⤵
PID:484
- /bin/zsh
  /bin/zsh -c /Users/run/MalwareBazaar.exe
  2⤵
  PID:485
- /Users/run/MalwareBazaar.exe
  /Users/run/MalwareBazaar.exe
  2⤵
  PID:485

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:471

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:468

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:477

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:481

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:474

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:524

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:526

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:528

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.PackageKit.InstallStatus
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.warmd_agent
1⤵
PID:534

/usr/libexec/warmd_agent
/usr/libexec/warmd_agent
1⤵
PID:534

/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
"/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.sessionlogoutd
1⤵
PID:535

/System/Library/CoreServices/sessionlogoutd
/System/Library/CoreServices/sessionlogoutd
1⤵
PID:535

/sbin/shutdown
/sbin/shutdown -h now
1⤵
PID:1.8446744073709552e+19

/bin/sh
sh -c "/usr/bin/wall -n"
1⤵
PID:537

/bin/bash
sh -c "/usr/bin/wall -n"
1⤵
PID:537

/usr/bin/wall
/usr/bin/wall -n
1⤵
PID:537

/System/Library/Extensions/IOGraphicsFamily.kext/iogdiagnose
iogdiagnose -b /var/log/displaypolicy/iogdiagnose-last.bin
1⤵
PID:0
- /usr/sbin/spindump
  spindump -shutdownstall 2 -timelimit 5
  2⤵
  PID:539
- /bin/sh
  sh -c /usr/sbin/kextstat
  2⤵
  PID:540
- /bin/bash
  sh -c /usr/sbin/kextstat
  2⤵
  PID:540
- /usr/sbin/kextstat
  /usr/sbin/kextstat
  2⤵
  PID:540
- /bin/bash
  bash /private/var/install/shutdown_installer_tasks
  2⤵
  PID:541
- /bin/bash
  bash /private/var/install/deferred_install
  2⤵
  PID:542

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

Filesize
136KB

MD5
41a1c77eec6cd75708c43f787aca9cec

SHA1
35f342ea63ae303bac537401f6ca87fe17333365

SHA256
b711b06b64b71339b5e26ae1abc7baf71f09dd8082256d23b09e6673bd8c9fe6

SHA512
0961da4a575bbf5fe66cdfc14f23ec82cc8b6a1ff25ad574b38936dd527eb2d593ff14f9c71d7f03cdbbfe5788d034ac6c04a4a3c5d603c481908d636b8edb03

Download Submit