Analysis
-
max time kernel
14s -
max time network
16s -
platform
macos-10.15_amd64 -
resource
macos-20240711.1-en -
resource tags
arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
05-10-2024 10:26
Behavioral task
behavioral1
Sample
primordial-cracked.exe
Resource
macos-20240711.1-en
General
-
Target
primordial-cracked.exe
-
Size
8.2MB
-
MD5
9ae3bffcc517a7082e29e37f5786bd33
-
SHA1
e8b39fe8e75329a5366bb205216803a67595872d
-
SHA256
d1f6950fa815d4be5431b4bdbfe240354103e1d73811a7d211748cecf1efa976
-
SHA512
fae7b69c15dfd12b8c59b8dc2cb85bea6c15af6df0af08cbcbd2f7682a643b126d97e2a016cd220c74a6e38f0343d209dc554771029b38c1d71d16b30eb12baa
-
SSDEEP
196608:LxtQ008urErvI9pWjgN3ZdahF0pbH1AYSEp6GrUniC+ICz0faxF:durEUWjqeWxQFGrgSzxF
Malware Config
Signatures
-
Resource Forking 1 TTPs 8 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
ioc Process /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck Process not Found /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref Process not Found /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool Process not Found "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" Process not Found /usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist Process not Found /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded Process not Found /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool Process not Found /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/primordial-cracked.exe\""1⤵PID:484
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/primordial-cracked.exe\""1⤵PID:484
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/primordial-cracked.exe1⤵PID:484
-
/bin/zsh/bin/zsh -c /Users/run/primordial-cracked.exe2⤵PID:485
-
-
/Users/run/primordial-cracked.exe/Users/run/primordial-cracked.exe2⤵PID:485
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.systempreferences.21401⤵PID:512
-
/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"1⤵PID:512
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountProfileRemoteViewService 5121⤵PID:513
-
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService1⤵PID:513
-
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool1⤵PID:515
-
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool1⤵PID:516
-
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck1⤵PID:517
-
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref1⤵PID:518
-
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool1⤵PID:519
-
/usr/libexec/xpcproxyxpcproxy com.apple.nfcd1⤵PID:520
-
/usr/libexec/nfcd/usr/libexec/nfcd1⤵PID:520
-
/usr/libexec/xpcproxyxpcproxy com.apple.studentd1⤵PID:522
-
/usr/libexec/studentd/usr/libexec/studentd1⤵PID:522
-
/usr/libexec/xpcproxyxpcproxy com.apple.preference.screentime.remoteservice 5121⤵PID:523
-
/System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice/System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice1⤵PID:523
-
/usr/libexec/xpcproxyxpcproxy com.google.Chrome.30561⤵PID:524
-
/usr/libexec/xpcproxyxpcproxy com.apple.metadata.mdwrite1⤵PID:526
-
/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"1⤵PID:524
-
/usr/libexec/xpcproxyxpcproxy com.apple.GameController.gamecontrollerd1⤵PID:527
-
/usr/libexec/gamecontrollerd/usr/libexec/gamecontrollerd1⤵PID:527
-
/usr/libexec/xpcproxyxpcproxy com.apple.colorsync.useragent1⤵PID:528
-
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent1⤵PID:528
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"1⤵PID:530
-
/usr/bin/profiles/usr/bin/profiles status -type enrollment1⤵PID:532
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"1⤵PID:534
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome1⤵PID:535
-
/usr/bin/tar/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist1⤵PID:536
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,1541402414317651800,16393746967636622570,131072" "--seatbelt-client=22"1⤵PID:537
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,1541402414317651800,16393746967636622570,131072" "--seatbelt-client=22"1⤵PID:538
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,1541402414317651800,16393746967636622570,131072" "--seatbelt-client=22"1⤵PID:539
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,1541402414317651800,16393746967636622570,131072"1⤵PID:540
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded1⤵PID:541
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD5fcb4024c6dc53a5b72c492fd960762d7
SHA182c43024d9e274bf2b8a5d1e505d65cf3873fb92
SHA2565cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6
SHA5125373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
/Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
Filesize269B
MD56487e04972ecffd0aabf7b61bdda8119
SHA126f0b11a2529a35f6970a914deadfcf2e2d23286
SHA256241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172
SHA51244db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae
-
Filesize
136B
MD5fe382e791274914bee5950777e4f1fd3
SHA153b523b5fc87e66f2520a0b5f9ea080072668f4d
SHA256935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132
SHA512a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67
-
Filesize
114KB
MD5e383a00b99967b2a662faa425a5ebb11
SHA1676ceb1ef61b3cfce8b132afa57da0cc4d4a7d94
SHA25658cb80577abb831d7e10e9a0498d56b1ac6c0637272656a9a780413e40804573
SHA51227bf62e5c46283fd20b049157dae229b1585eb66957c05f63292d26736ccdf579f00379f4a83d45a8882e234f0e5b961b6fe172fb63ce41874499202fea04c22
-
Filesize
114KB
MD53d87141c3c5c0584b2ad6f3229b5bc7b
SHA1921d517f5d5e4f9612e150d410d341f8a901d147
SHA256d5e75438e067ce4efc697fbcb8e5efee6471983f5b365132ac930f62ad4b0766
SHA512a86220e4ff73a3dde24107933d9e34fc7dac07886d73d8c9ef26b6f62922a3f4471803287ccbc837e7553dac14df1f59f06b85feab237448b8a1bbc2e4d64d34
-
Filesize
112KB
MD5166d63afdfe87b2388ac538bf9e03b7b
SHA1e97dbec4cb6b0dfbb86e7099e42724bfb6744ef2
SHA256851682bf98de3d184cb58dfa47e87e466f998c6a161728b944fee483f1917e77
SHA5121fb18314ba16d4e42a21bb17d576e9a6e73f9d56b28c2139a92ef7ffde3833d7caa61b8ddd7300663a515add8d68c2943ee6bd3d3cc0da2cf01ce6bd15490768
-
Filesize
114KB
MD5f9c891e0d660bdb2eef78039c11a9af9
SHA13d3661febbfc8cac3a824ed578c7620ef83cbfd8
SHA2561c5e4004f35b58cb30f1f0143aa92954276870ad6e426b496feb7d94c586ae75
SHA51250e3612ba6ba8dca3f5933b3941a511c03c0d0dd9cbf3f1799b296e8665830f88e6568071b6e4561a4f32af1f01628eb3f65d55e143938ec1c79a89b0d500309
-
Filesize
114KB
MD5ee58a443a587f3b2780b80edd7114139
SHA124e258dd836613feab91f2ced075b2f769fba3cd
SHA2560fce19cd88b446f89394ec315d11f636493705fdb82e8c22b24cc70f7bb0e590
SHA512de60ce95b62a42ceb088002ec088b8e7c74b31e549015d639b03b852fd2a5614ac8f8cdde3a4c723fbf74835a04ed5ce4ee08e1d3c63bcada7dd5e94f0f4b486
-
Filesize
112KB
MD51c008c41ae03bdad80c3879fbcb11234
SHA1684e78fd610c03910d3f3fde797abdc06c391098
SHA256353ebd06f0476479c3c2217172be15a793de71e95f126ca84696633ba3147d37
SHA512149d871ec7229e2a176b696d9764aeb32140adc3308401c781651cc206eea723cade50786b8321afdd9dd2d439a7050eebc868e4e1d742025b75be37ccb3bdfd
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
Filesize
21KB
MD51f8f4a587e2306e5f55d10a788b6c2af
SHA160fb84e53021bd93a0c357f840b65109513d4a80
SHA256d941861804da4a5eff4dbeb666345272c6619075be449fb7097b31abf1d5bcf4
SHA51245523e8404728d30f2f9e54ec0df9d81d9942f1a32ffa4d8e296a62f4c9445f7ccc6957d6e67a5d3518926f2fadf9d3a962acf46b6487f3e05a906f68c84453d