hxxps://drive[.]google[.]com/file/d/16j_LjZGSh4SlR1Wx3o_vEueccePkSBKU/view?usp=sharing

Analysis

max time kernel
111s
max time network
114s
platform
macos-10.15_amd64
resource
macos-20240711.1-en
resource tags

arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
14-09-2024 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/16j_LjZGSh4SlR1Wx3o_vEueccePkSBKU/view?usp=sharing

Score

6^/10

evasion

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
30	drive.google.com
31	drive.google.com
190	drive.google.com

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://drive.google.com/file/d/16j_LjZGSh4SlR1Wx3o_vEueccePkSBKU/view?usp=sharing\""
1⤵
PID:487

/bin/bash
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://drive.google.com/file/d/16j_LjZGSh4SlR1Wx3o_vEueccePkSBKU/view?usp=sharing\""
1⤵
PID:487

/usr/bin/sudo
sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://drive.google.com/file/d/16j_LjZGSh4SlR1Wx3o_vEueccePkSBKU/view?usp=sharing"
1⤵
PID:487
- /bin/zsh
  /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://drive.google.com/file/d/16j_LjZGSh4SlR1Wx3o_vEueccePkSBKU/view?usp=sharing"
  2⤵
  PID:490

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:518

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:519

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.1F1FA0D6-B269-4DF5-BE01-1BE5E48C049D 518
1⤵
PID:521

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:526

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.312B3443-6F66-4665-8B7F-CE3AE36CE79F 518
1⤵
PID:527

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 518
1⤵
PID:529

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:530

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.615D4188-9F70-485D-8CEE-27B1F709659A 518
1⤵
PID:531

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:539

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:539

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:540

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.EA2519EF-F2C6-43CB-A394-FB762C11524B 518
1⤵
PID:544

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:545

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 545
1⤵
PID:546

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:546

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:548

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:549

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:550

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:551

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:553

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:554

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.keyboard.remoteservice 545
1⤵
PID:555

/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:557

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:558

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:559

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.Spotlight
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.languageassetd
1⤵
PID:564

/System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
/System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
1⤵
PID:562

/usr/libexec/languageassetd
/usr/libexec/languageassetd
1⤵
PID:564

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.sharingd
1⤵
PID:565

/usr/libexec/sharingd
/usr/libexec/sharingd
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:566

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.DictionaryServiceHelper
1⤵
PID:568

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:571

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 185
1⤵
PID:573

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:579

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:580

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.dmd
1⤵
PID:581

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.05FA4754-0DCD-4DEB-B56E-2DEDCD6687FF 518
1⤵
PID:582

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.C48CE1B3-2D5E-47E5-824A-39FD8734F958 518
1⤵
PID:584

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/.CFUserTextEncoding

Filesize
7B

MD5
410b8cc83663da85146e2056d1f920ff

SHA1
450f3d9fc7f123cdc4453156f103fa37f3342ccc

SHA256
13ba77c55175b70dc67f8bc1d8125ad7f9e3c5b8d2f04c82287251abb22d91fe

SHA512
44a2679a7bf002037a5e00a703e05d21dcfeb0ebfeb08e972d01e7d44e36014259db597a9d2e69923cbf7434b9869d512c507ffe0d50ac1dec9aeada53d4bb45

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
125KB

MD5
95f36074a8df8bc568d2c9d0f28ae1ca

SHA1
b0bd0c4e07c1a7946d77c40b22bdee10b8bc2912

SHA256
86f8034029d0f4f6703e550d83ca32c823c1ff6d5af6889814385d133f2675cb

SHA512
20e7310b92a7cfe8be577b78a4d73d59fce274e32639b158ae0b7d656f81c6600d5a927cb41b1de562e460c9bc3295daec33a661373f50957afd48dd18cde6c8

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1302.xml

Filesize
179KB

MD5
ee320783748abe54c670d5185cd9a6b0

SHA1
e4ae20dce986e85c7a0931b4648c693564937010

SHA256
2707a9339814acc5ea91a6484ce4a938c2ac6a741ea799447b72509599540f7c

SHA512
fc93145d8321b38f1cb74b75f88a70074bab6984eb9703a55c597c4e9505a8440168ce07b01a12fe0bfcaeb421011989ac9f53ff7ab93a6c39c97e33943ea4a0

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/3B8C90CECB109AEFB8FB2E23882154C5

Filesize
5KB

MD5
62e9f4598ff57b16fb032c4cca7d53e5

SHA1
d8e0f1ef84b1206f436b4e27fa3bfeca240eac94

SHA256
87787e8ed3303d1b0c3299c68f14e08ccdb4fb5751da05bd854fb3da5eb60f3f

SHA512
807ce3c813f9ac1a1d5e870a852ee64fdef908baafa5e96ed5fbf07564dc4d6d5e4daa29e24276a4ec30a4f5d3ba48fd5258a11195f17b3f934eb2906dba836c

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression

Filesize
222KB

MD5
3d3b196f33a5f74c239f3cde5ecd46fd

SHA1
703fc219174c83b7e11d70b95cd0a49165bfa00d

SHA256
907ed28b6caf787b6ad4b3dee1c08f2eb3127001928789f5be4fbb98c105ed24

SHA512
b41326d5d6fd499229960296be64b448bbd1b7e7ae13cf75fe4e15c6cc09e766c6e4afd5418771f6638ff9f0a28edf08b564b51ede0458309594736b03a0171a

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression

Filesize
16.4MB

MD5
25b7ec178ad5d69344cb9b03201793c3

SHA1
32d0c885e93ffb094b6788b2322db465fa7a6bf3

SHA256
5576e0949eabdcbb6643042c2c58a058fb9d1a6a704811ce7ff4887007486cfc

SHA512
352223efc2d0b9ee5e9964e9391335fb7388ffff3712af0075b304b4c46ced16eb92de9e14d1fe53334e2b4366429932b7072fe520ab01da24d2c0fe1a9671fb

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression

Filesize
126KB

MD5
e6bf29ba5790de59728463f37b6dfe13

SHA1
b1c4edcfc179e69c4c6917837f816026da019d86

SHA256
0235b03d988fa867e98b328828f54ea8add6ae5f17e00c1b34613f8aff4311ab

SHA512
4c24b28b87cbbe1fbb228da556db31bc0946d52e4c86aa199dc58bcfc225275cdbfab0297d196db9665124ff082ebaa056ea672c0d115d895ed944a3252a678a

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit