36d0a662079e9678440f9c46396479284755ee8a0ddbec52bb8a4b77ec98c619

General

Target

OZNAMENI_PRAVNI_PROCES.pdf
Size

185KB
MD5

9dca7d8d389f370546e9b2d575ca328f
SHA1

0fc542ff19263213d48e491a47dd907dd044f4b7
SHA256

36d0a662079e9678440f9c46396479284755ee8a0ddbec52bb8a4b77ec98c619
SHA512

e7fa9671ec95eeb1fb605e58022d7c9863893d4df60f0f52beef94b0ca8a375e9176419d97c7f8dd112b297698fbb8eafa84f4f4daa620b7098e061c57886ba2
SSDEEP

3072:dGL8VrGsCmULp7LRmnxE2SKGNakMeaKzspHijLxRUk/qhjOsSN8ql0ra14+QEqBf:dQAdULdLu/EakMf4FLxRUkMjulya14iE

Score

5^/10

evasion execution persistence

Malware Config

Signatures

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

JavaScript 1 TTPs 1 IoCs

Adversaries may abuse various implementations of JavaScript for execution.

execution

JavaScript

T1059.007

ioc	Process
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/tmp/hello.jar	Process not Found

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found

Launchctl 1 TTPs 1 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/OZNAMENI_PRAVNI_PROCES.pdf\""
1⤵
PID:485

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/OZNAMENI_PRAVNI_PROCES.pdf\""
1⤵
PID:485

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/OZNAMENI_PRAVNI_PROCES.pdf
1⤵
PID:485
- /bin/zsh
  /bin/zsh -c /Users/run/OZNAMENI_PRAVNI_PROCES.pdf
  2⤵
  PID:487
- /Users/run/OZNAMENI_PRAVNI_PROCES.pdf
  /Users/run/OZNAMENI_PRAVNI_PROCES.pdf
  2⤵
  PID:487
- /bin/sh
  sh /Users/run/OZNAMENI_PRAVNI_PROCES.pdf
  2⤵
  PID:487
- /bin/bash
  sh /Users/run/OZNAMENI_PRAVNI_PROCES.pdf
  2⤵
  PID:487

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:515

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.43F14EB1-29A7-4DCE-8D57-1168E6B949D7 516
1⤵
PID:517

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:527

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000001.Microsoft Word"
1⤵
PID:528

/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
"/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word" -psn_0_155686
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 506
1⤵
PID:531

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:535

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:537

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:536

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:538

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:540

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:541

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.fba.2660
1⤵
PID:542

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant"
1⤵
PID:542

/bin/launchctl
/bin/launchctl list
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.helper
1⤵
PID:544

/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:544

/bin/launchctl
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist
1⤵
PID:545

/usr/bin/codesign
/usr/bin/codesign -v /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:548

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.JarLauncher.2128
1⤵
PID:549

/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
"/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
1⤵
PID:549
- /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
  "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/tmp/hello.jar
  2⤵
  PID:550

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

System Services

1

T1569

Launchctl

1

T1569.001

Persistence

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Privilege Escalation

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml

Filesize
259KB

MD5
82ca8c7a1d9f4f3e1a208377caf9c5cf

SHA1
2c55ed1d662dc6c94564fa7d73a4acd838af6fa9

SHA256
f172fff588a760bd0036ddb76516f059b0f62c301386cf593cdacc8d2f42eb20

SHA512
c211cc286a679cd61039ab07764f108e1d6715caf4946f252c44094b3434431fd4843403816d280b1cf85854b5008db108d713b3d3fa7e4d203ea9cb8a6d7908

Download Submit
/Users/run/Library/Group Containers/UBF8T346G9.Office/FontCache/4/PreviewFont/hier_officeFontsPreview_4_40.ttf

Filesize
1.9MB

MD5
8c638d09eea80c9b1963af8cc35870a5

SHA1
f67fc7503e05b99f232945bc1bbb7d50bc70f88d

SHA256
4bcfa32557e0bfffd5766cf6057b9e04ac9af9c101033fd305fba7190305a385

SHA512
b1cee1f2e0f2cdd2611c1af18d5cd3b481da6c7c761cc74f2fc9c99025215a8c03f117bd1f8cdd3fa01210c542ba9e1c7246954e43ce100c84b1ea4082000c07

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit

Analysis

Sharing