hxxps://app4sicurezza[.]info/mavenbuilt?=RE569003571

General

Target

https://app4sicurezza.info/mavenbuilt?=RE569003571

Score

6^/10

evasion

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
60	drive.google.com
59	drive.google.com

Resource Forking 1 TTPs 6 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/DFRHUD.app/Contents/MacOS/DFRHUD launchd	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://app4sicurezza.info/mavenbuilt?=RE569003571\""
1⤵
PID:483

/bin/bash
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://app4sicurezza.info/mavenbuilt?=RE569003571\""
1⤵
PID:483

/usr/bin/sudo
sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://app4sicurezza.info/mavenbuilt?=RE569003571"
1⤵
PID:483
- /bin/zsh
  /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://app4sicurezza.info/mavenbuilt?=RE569003571"
  2⤵
  PID:485

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:509

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 509
1⤵
PID:510

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:510

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:512

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:513

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:514

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:515

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:518

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:519

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.keyboard.remoteservice 509
1⤵
PID:520

/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:522

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:523

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.30F4C1FB-6D10-45A1-AC13-CDC2477B2944 522
1⤵
PID:525

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:530

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.42748549-ACBA-4BC0-B5CD-0B9B1D561B9B 522
1⤵
PID:533

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:533

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:545

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 522
1⤵
PID:547

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:548

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.AssistiveControl
1⤵
PID:553

/System/Library/Input Methods/Assistive Control.app/Contents/MacOS/Assistive Control
"/System/Library/Input Methods/Assistive Control.app/Contents/MacOS/Assistive Control" launchd -s
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.69341992-ED85-4914-89C2-FF9594FA19C5 522
1⤵
PID:554

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.9DFBCBDA-D313-4A6B-A65A-EADB1148DEDC 522
1⤵
PID:555

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:560

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.dfrhud
1⤵
PID:561

/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/DFRHUD.app/Contents/MacOS/DFRHUD
/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/DFRHUD.app/Contents/MacOS/DFRHUD launchd
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.0D3ECCB9-E182-4F60-840C-8922BE2EF6AE 522
1⤵
PID:562

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.6DA2D7A6-E9B6-4957-9EDB-EC2CE0D23EB1 522
1⤵
PID:571

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:571

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Application Support/com.apple.AssistiveControl/dwellControlUserPanels1.ascconfig/Contents/Info.plist

Filesize
936B

MD5
c0a449cb4627ec66597cb65b661d7ecc

SHA1
a732395f929d41beae89bd5b0eb0877012f128d6

SHA256
a57e05acb1d4b0719fd0d9ce3688cfbb735acff01dc3fc91f2f9e0fa4e2a2742

SHA512
5c426a5c70d274c55a6817a6f8663fed90e862f4dd6b09376c5d967c51acdc2a264bbd6faa8a61dcff5bc71b66fffc86a68152b6b984d61058fb14f61f7448f9

Download Submit
/Users/run/Library/Application Support/com.apple.AssistiveControl/dwellControlUserPanels1.ascconfig/Contents/Resources/AssetIndex.plist

Filesize
181B

MD5
2de6a04cdba79ed13580c47dfd70cc5f

SHA1
bcefe0558555914d731c16b1778c49e77fe06b99

SHA256
97704a8960b4facceef54397a08fb5d0a456247c3627359215aa2a27df22656c

SHA512
605dc81b28c530fc8ebcf3c5a28486af8bbd3303ee5df53b5424e492e5dbe01baa0468fa4da1398451a62dff4d45067a2bf765f7def9ca0890883484de38a13b

Download Submit
/Users/run/Library/Application Support/com.apple.AssistiveControl/dwellControlUserPanels1.ascconfig/Contents/Resources/PanelDefinitions.plist

Filesize
1KB

MD5
94034605ebdc08b92f48f4db8a6bcd96

SHA1
a40cbf1f2e67bea10e39fe24204e325153bbe46f

SHA256
8fcd1d1339c4881cc1e74a9ea6637abb3884f338dd7a1b936b76e70aaecdc578

SHA512
99613c1d3a699692a4ce86615552b8db63b700729eaa5a0ec675986b5c413f4b61e5c3957e9833d1d617c54bff78d11fbd791b8ce57edbab09ea94bec6949fb5

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit

Resubmissions

Analysis

Sharing