Overview

overview

4

Static

static

1

URLScan

urlscan

http://javascript:vo...

windows10-2004-x64

3

http://javascript:vo...

macos-10.15-amd64

4

Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    14-09-2024 20:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://javascript:void(0)

Score
4/10
evasionexecution

Malware Config

Signatures

  • JavaScript 1 TTPs 1 IoCs

    Adversaries may abuse various implementations of JavaScript for execution.

    execution
  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://javascript:void(0)\""
    1⤵
      PID:489
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://javascript:void(0)\""
      1⤵
        PID:489
      • /usr/bin/sudo
        sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://javascript:void(0)"
        1⤵
          PID:489
          • /bin/zsh
            /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://javascript:void(0)"
            2⤵
              PID:491
          • /usr/libexec/xpcproxy
            xpcproxy com.apple.audio.AudioComponentRegistrar
            1⤵
              PID:511
            • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
              /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
              1⤵
                PID:511
              • /usr/libexec/xpcproxy
                xpcproxy com.apple.quicklook.ui.helper
                1⤵
                  PID:520
                • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                  /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                  1⤵
                    PID:520
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.JarLauncher.2128
                    1⤵
                      PID:521
                    • /System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
                      "/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
                      1⤵
                        PID:521
                        • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
                          "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/tmp/hello.jar
                          2⤵
                            PID:523
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.metadata.mdwrite
                          1⤵
                            PID:522

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads