37c49983dfd813e67d898b4088ea29e2146674aeba37059944db194a004dc2af

General

Target

1.jar
Size

1.1MB
MD5

a5483a74a3cbf726d2ebf659247ec9c7
SHA1

a9b28e22845934adff30ad44b293d714230344ea
SHA256

37c49983dfd813e67d898b4088ea29e2146674aeba37059944db194a004dc2af
SHA512

a651326628acade8adebeeec9c974d087f22cb8d868c98432c8f967ab4180c6beb7186c7b0b31e6428240017f360270d6ce90f31953c8fafe5dc4e5e0ecc9ad7
SSDEEP

24576:dzhTX3kLlzYc4lMTboiqSr9xZXfRCUOutEUKIzWG:dzSLlUpSbYIn/Cl8zWG

Score

4^/10

evasion execution

Malware Config

Signatures

JavaScript 1 TTPs 1 IoCs

Adversaries may abuse various implementations of JavaScript for execution.

execution

JavaScript

T1059.007

ioc	Process
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/1.jar	Process not Found

Resource Forking 1 TTPs 8 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found
/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/universalAccessAuthWarn.app/Contents/MacOS/universalAccessAuthWarn launchd -s	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.gkreport
1⤵
PID:483

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
1⤵
PID:484

/usr/libexec/gkreport
/usr/libexec/gkreport
1⤵
PID:483

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Users/run/1.jar\""
1⤵
PID:485

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Users/run/1.jar\""
1⤵
PID:485

/usr/libexec/xpcproxy
xpcproxy com.apple.systemstats.daily
1⤵
PID:486

/usr/bin/sudo
sudo /bin/zsh -c "open /Users/run/1.jar"
1⤵
PID:485
- /bin/zsh
  /bin/zsh -c "open /Users/run/1.jar"
  2⤵
  PID:490
- /usr/bin/open
  open /Users/run/1.jar
  2⤵
  PID:490

/usr/libexec/xpcproxy
xpcproxy com.oracle.java.Java-Updater
1⤵
PID:488

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:489

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:478

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:484

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:481

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:475

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:488

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:489

/usr/libexec/xpcproxy
xpcproxy com.apple.JarLauncher.1532
1⤵
PID:491

/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
"/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
1⤵
PID:491
- /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
  "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/1.jar
  2⤵
  PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:495

/usr/libexec/xpcproxy
xpcproxy com.apple.universalaccessAuthWarn
1⤵
PID:518

/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/universalAccessAuthWarn.app/Contents/MacOS/universalAccessAuthWarn
/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/universalAccessAuthWarn.app/Contents/MacOS/universalAccessAuthWarn launchd -s
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.sysextd
1⤵
PID:519

/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:526

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:527

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:527

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 527
1⤵
PID:529

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:530

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:529

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:531

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:532

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:536

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:537

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.security.remoteservice 527
1⤵
PID:538

/System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
/System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.preferencepane.security.AdvertisingExtension 538
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.preferencepane.security.PrivacyAnalytics 538
1⤵
PID:540

/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/AdvertisingExtension.appex/Contents/MacOS/AdvertisingExtension
/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/AdvertisingExtension.appex/Contents/MacOS/AdvertisingExtension
1⤵
PID:539

/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/PrivacyAnalytics.appex/Contents/MacOS/PrivacyAnalytics
/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/PrivacyAnalytics.appex/Contents/MacOS/PrivacyAnalytics
1⤵
PID:540

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:544

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:544

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:546

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:554

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:559

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:559

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/libJNativeHook-CC808FCE6A937064D1FAABC310084DDD592E50A.dylib

Filesize
54KB

MD5
51629c2c7ecf08d26bfd34f4b01dfd1a

SHA1
0cc808fce6a937064d1faabc310084ddd592e50a

SHA256
6a17e78118cbc66f4710908dcce75efae1e5419fcc47020316eae2ed47757227

SHA512
8fd368524b7767f78fa3815838fa0963244a6805f36c0169096fb2c8c727a7f03388f86d750daeae2158d6f135f73e3811a4f938c572b16554d359654469473f

Download Submit

Resubmissions

Analysis

Sharing