b4b7ccaf9c79cbedbce42273d701e468c423d5a9c6d175f0a47ec8eb97d8c109

Reason

Machine shutdown

General

Target
cc5881eb57b7fcdcca4ce8e4d3dd8e20N.exe
Size 926KB
Sample240813-sts6ls1eld
SHA256 b4b7ccaf9c79cbedbce42273d701e468c423d5a9c6d175f0a47ec8eb97d8c109
MD5 cc5881eb57b7fcdcca4ce8e4d3dd8e20
SHA1 26265ef01f129f75ad2f6e9cccedcf836f09a835
SHA512 10c85317d92d8b609cb182413bbe392d65ba82d32c704b65eecf6e90e92bd419cd3a82d0b0a4eae65f5d0b9e6e7736352232686fc68b989a152952256f84ab1d
SSDEEP 24576:Hrl6kD68JmloLQfgqu4Dij/f7HcAdmjKt0OkhgL:Ll328U2kfc4Kf7HlFTL
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 12 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/cc5881eb57b7fcdcca4ce8e4d3dd8e20N.exe\""
1⤵
PID:486

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/cc5881eb57b7fcdcca4ce8e4d3dd8e20N.exe\""
1⤵
PID:486

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/cc5881eb57b7fcdcca4ce8e4d3dd8e20N.exe
1⤵
PID:486
- /bin/zsh
  /bin/zsh -c /Users/run/cc5881eb57b7fcdcca4ce8e4d3dd8e20N.exe
  2⤵
  PID:491
- /Users/run/cc5881eb57b7fcdcca4ce8e4d3dd8e20N.exe
  /Users/run/cc5881eb57b7fcdcca4ce8e4d3dd8e20N.exe
  2⤵
  PID:491

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:480

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:481

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:482

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:479

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:483

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:513

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:516

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 516
1⤵
PID:517

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:517

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:520

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:522

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:523

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:524

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:527

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:528

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.screentime.remoteservice 516
1⤵
PID:529

/System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice
/System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsync.useragent
1⤵
PID:531

/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:534

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.keyboard.remoteservice 516
1⤵
PID:540

/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
1⤵
PID:540

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:541

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:542

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:543

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:544

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.universalaccess.remoteservice 516
1⤵
PID:546

/System/Library/PreferencePanes/UniversalAccessPref.prefPane/Contents/XPCServices/com.apple.preference.universalaccess.remoteservice.xpc/Contents/MacOS/com.apple.preference.universalaccess.remoteservice
/System/Library/PreferencePanes/UniversalAccessPref.prefPane/Contents/XPCServices/com.apple.preference.universalaccess.remoteservice.xpc/Contents/MacOS/com.apple.preference.universalaccess.remoteservice
1⤵
PID:546

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:547

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:548

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:549

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:550

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.AssistiveControl
1⤵
PID:554

/System/Library/Input Methods/Assistive Control.app/Contents/MacOS/Assistive Control
"/System/Library/Input Methods/Assistive Control.app/Contents/MacOS/Assistive Control" launchd -s
1⤵
PID:554

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Info.plist

Path /Users/run/Library/Application Support/com.apple.AssistiveControl/dwellControlUserPanels1.ascconfig/Contents/Info.plist
Size 936B
SHA256 a57e05acb1d4b0719fd0d9ce3688cfbb735acff01dc3fc91f2f9e0fa4e2a2742
MD5 c0a449cb4627ec66597cb65b661d7ecc
SHA1 a732395f929d41beae89bd5b0eb0877012f128d6
SHA512 5c426a5c70d274c55a6817a6f8663fed90e862f4dd6b09376c5d967c51acdc2a264bbd6faa8a61dcff5bc71b66fffc86a68152b6b984d61058fb14f61f7448f9
MD5 SHA1 SHA512

Submit Download

AssetIndex.plist

Path /Users/run/Library/Application Support/com.apple.AssistiveControl/dwellControlUserPanels1.ascconfig/Contents/Resources/AssetIndex.plist
Size 181B
SHA256 97704a8960b4facceef54397a08fb5d0a456247c3627359215aa2a27df22656c
MD5 2de6a04cdba79ed13580c47dfd70cc5f
SHA1 bcefe0558555914d731c16b1778c49e77fe06b99
SHA512 605dc81b28c530fc8ebcf3c5a28486af8bbd3303ee5df53b5424e492e5dbe01baa0468fa4da1398451a62dff4d45067a2bf765f7def9ca0890883484de38a13b
MD5 SHA1 SHA512

Submit Download

PanelDefinitions.plist

Path /Users/run/Library/Application Support/com.apple.AssistiveControl/dwellControlUserPanels1.ascconfig/Contents/Resources/PanelDefinitions.plist
Size 1KB
SHA256 10968b38b9a8fbe285c982cc26ee85dea31641607d600a3b79cd4956804fea69
MD5 b38d0580641c737613ccd6374cc4ca66
SHA1 58d0cfdd59db36fa5a83149cc9d292c53ff60143
SHA512 631a6042dd00c7ac3ad88fdd2d144c9a51926162de5369928df48fe5ceb9c96c5e3b3f8711ce10fb40f85e1532e76c7c0bd3bda9c97a7ebfc441b9a774c18a9d
MD5 SHA1 SHA512

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.apple.colorsync.profiles.502

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.colorsync.profiles.502
Size 21KB
SHA256 d941861804da4a5eff4dbeb666345272c6619075be449fb7097b31abf1d5bcf4
MD5 1f8f4a587e2306e5f55d10a788b6c2af
SHA1 60fb84e53021bd93a0c357f840b65109513d4a80
SHA512 45523e8404728d30f2f9e54ec0df9d81d9942f1a32ffa4d8e296a62f4c9445f7ccc6957d6e67a5d3518926f2fadf9d3a962acf46b6487f3e05a906f68c84453d
SSDEEP 48:sB07+EorluafSDojes6GVYxpWQClwje+d3elNVrJfZi1w8E5j9554bCBkYpdwhqP:sZplfSDCeZG+QFrfic59ZU96AeB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads