Analysis
-
max time kernel
1624s -
max time network
1799s -
platform
macos-10.15_amd64 -
resource
macos-20240711.1-en -
resource tags
-
submitted
13/08/2024, 21:37
General
-
Target
mlk.png
-
Size
37KB
-
MD5
df41f6c673785be2c786138072079dab
-
SHA1
cf586d4a8529f8d446893ae752b94020e47d6d0e
-
SHA256
a78fb5cab07c4fedd9dbdfa46f055ac4a2708769e45823b27fa839ee09e97347
-
SHA512
cbe61426911df696ace324a54ce7a1f0d6dc0c612e2272d90388d26cc0ca45267abb146bc1281393649a4a06ea3d3b49f037e26eed68393b093ef654fef2905d
-
SSDEEP
768:Jg3EHduMHLvRtOVHxJBlP7d+sbmOGIrVgKS6Pm+Bn3cog17Bk8q:Jg3q/rpgVRHVR/64hPBs1drq
Malware Config
Signatures
-
Resource Forking 1 TTPs 2 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes
-
/usr/libexec/xpcproxyxpcproxy com.apple.var-db-dslocal-backup1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.pluginkit.pkreporter1⤵
-
/usr/bin/xar/usr/bin/xar -c -f dslocal-backup.xar dslocal1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.gkreport1⤵
-
/usr/libexec/gkreport/usr/libexec/gkreport1⤵
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/mlk.png\""1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.systemstats.daily1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.loginwindow.LWWeeklyMessageTracer1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/mlk.png\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/mlk.png1⤵
-
/bin/zsh/bin/zsh -c /Users/run/mlk.png2⤵
-
-
/Users/run/mlk.png/Users/run/mlk.png2⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.newsyslog1⤵
-
/usr/libexec/xpcproxyxpcproxy com.oracle.java.Java-Updater1⤵
-
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd1⤵
-
/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"1⤵
-
/usr/libexec/pkreporter/usr/libexec/pkreporter1⤵
-
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer1⤵
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck1⤵
-
/usr/sbin/newsyslog/usr/sbin/newsyslog1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.20281⤵
-
/Applications/Safari.app/Contents/MacOS/Safari/Applications/Safari.app/Contents/MacOS/Safari1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.History1⤵
-
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.383CB72F-6433-44D1-B381-C5E3902A3DA5 5231⤵
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.SafariLaunchAgent1⤵
-
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.83892683-A813-43CE-BF57-CE9DB0FFD124 5231⤵
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵
-
/usr/sbin/spindump/usr/sbin/spindump1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.diagnosticd1⤵
-
/usr/libexec/diagnosticd/usr/libexec/diagnosticd1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818