Overview

overview

4

Static

static

1

URLScan

urlscan

1

http://sex.com

macos-10.15-amd64

4

http://sex.com

macos-10.15-amd64

4

Analysis

  • max time kernel
    5s
  • max time network
    7s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    12-10-2024 20:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://sex.com

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 2 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://sex.com\""
    1⤵
      PID:484
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://sex.com\""
      1⤵
        PID:484
      • /usr/bin/sudo
        sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://sex.com"
        1⤵
          PID:484
          • /bin/zsh
            /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://sex.com"
            2⤵
              PID:486
            • /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
              "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window http://sex.com
              2⤵
                PID:486
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.GameController.gamecontrollerd
              1⤵
                PID:491
              • /usr/libexec/gamecontrollerd
                /usr/libexec/gamecontrollerd
                1⤵
                  PID:491
                • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
                  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/var/root/Library/Application Support/Google/Chrome/Crashpad" "--metrics-dir=/var/root/Library/Application Support/Google/Chrome" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
                  1⤵
                    PID:493
                  • /usr/bin/profiles
                    /usr/bin/profiles status -type enrollment
                    1⤵
                      PID:495
                    • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
                      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
                      1⤵
                        PID:497
                      • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
                        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
                        1⤵
                          PID:498
                        • /usr/bin/tar
                          /usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
                          1⤵
                            PID:499
                          • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
                            "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,8278650768495630386,15688064686036155366,131072" "--seatbelt-client=20"
                            1⤵
                              PID:500
                            • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
                              "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,8278650768495630386,15688064686036155366,131072" "--seatbelt-client=21"
                              1⤵
                                PID:501
                              • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
                                "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,8278650768495630386,15688064686036155366,131072" "--seatbelt-client=21"
                                1⤵
                                  PID:502
                                • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
                                  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,8278650768495630386,15688064686036155366,131072"
                                  1⤵
                                    PID:503

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • /Users/run/Library/Keychains/login.keychain-db
                                    Filesize

                                    114KB

                                    MD5

                                    d99218be0159ef1061c2a764f976b6e0

                                    SHA1

                                    66422ddea9157a395c70a6405ac1025cc34f3f51

                                    SHA256

                                    1394be7cc9ab86425d5e550471cb45751646e11f0608b315395c057788ed7d13

                                    SHA512

                                    6ddecc6f3e5411d86a742b42939636e1a40ef565e75c9d3fa675e3ec9a65207b305472e6de9686fdfe8c229b1fae92879ef868297bad2cfffd58d81c8b4a2994

                                    Download Submit

                                  • /Users/run/Library/Keychains/login.keychain-db
                                    Filesize

                                    114KB

                                    MD5

                                    22446cb3cc8eda6a798626842c9bf9ee

                                    SHA1

                                    3d6423c094df87b2410d49e602e7a5c58d3667b2

                                    SHA256

                                    acd70b90805dffc659fdf8d6d4ce27cba81d99f027a7e3983e5afe3cbc0a6536

                                    SHA512

                                    1ae4fd001811a3054f34d25df75f2a6b1dc293dd790f50e573f71414b66aad394bdef7c148823bb0b75100eed8cf34c4e57ee07184744f8b481094fe4643d7ba

                                    Download Submit

                                  • /Users/run/Library/Keychains/login.keychain-db
                                    Filesize

                                    112KB

                                    MD5

                                    63dd0165e18a4a8ef726dc17c2909652

                                    SHA1

                                    16f141ef249a7bcaeace04f1278ddf15af145b98

                                    SHA256

                                    02409674e00daf3ed2ac0b8c938b8a2a1d3b9189ceedf124603091a00eaa7b7b

                                    SHA512

                                    589efa80e400ffefc09a9715f31effb4bc49d0cb86466f5282475b6ec0fdcd64894518f6652798d4eb555d43788de56ca8532cd18d1ddb7b7a15b71ce97ea927

                                    Download Submit

                                  • /Users/run/Library/Keychains/login.keychain-db
                                    Filesize

                                    114KB

                                    MD5

                                    6da8bdb1c2c833b580e408acdae18416

                                    SHA1

                                    1bfbaa393cbf536c07616578e9b4651a1a9b228e

                                    SHA256

                                    b52b381d3ef40eafa426ec8a026ab4a9db621ccc49127d9b9b6bdc2f315be3a9

                                    SHA512

                                    e38e7b5ecc3fca204b364f8abfa982e9bbb660f89ea76634537a6df3f4d8b10c418d9c7260bed88aacafd0e4fb641d3d2a96c4e29e2adf9f09826ee0879b90fe

                                    Download Submit

                                  • /Users/run/Library/Keychains/login.keychain-db
                                    Filesize

                                    114KB

                                    MD5

                                    dc83ec626c4dbe0666971d1803b0c09b

                                    SHA1

                                    b6c7ee1f10d44089c7a143c410b188d28f7a78bd

                                    SHA256

                                    b212036c195f94c0e63e4d410255f09b8329476d5127adebdaf9ae413a61d6d1

                                    SHA512

                                    98ea2b1443f91bb72b85e79b3a02776fad5b761c3fb8ea7c0463eca56f25fd0aea675b32249e441145c2a1d87969cf679b97a823e14d0c7ee21454dd8a04340e

                                    Download Submit

                                  • /Users/run/Library/Keychains/login.keychain-db
                                    Filesize

                                    112KB

                                    MD5

                                    a0377ab3ac395113c610d92343c67ef3

                                    SHA1

                                    dc50faeb115d9f8d18058755a06acd325167fbd1

                                    SHA256

                                    5b80b7cae6c9da572619cb1813f3a88931d9d926434d8b90b7f20352f29d1d3f

                                    SHA512

                                    495076e19bb56596453e566cb63fcac3171c5917e9f4a340b29c2d2a0d741e55a7431da7bfc37abd10f2fb5f9ca340d165af67b82480194e7e9b29bd55a5c4c7

                                    Download Submit

                                  • /var/root/Library/Application Support/Google/Chrome/Crashpad/settings.dat
                                    Filesize

                                    40B

                                    MD5

                                    c6db1caaee0095f017c09113d53ed054

                                    SHA1

                                    cc37e2b3948325a0eeb51080f45b17ebf52a7035

                                    SHA256

                                    ca3252b297284a87de2ee1688585f7c37d26b98c05d7ed04bd7d6df10c0d1476

                                    SHA512

                                    3013340ee4157dfef7dcacd690b840f12b876e8241d4e8bc419016d5336810ab77023cdbbeaa896544e4c29f386d21296649542ef2b0fc6b58c49e2ad0337d85

                                    Download Submit

                                  • /var/root/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
                                    Filesize

                                    312B

                                    MD5

                                    5c4e7ade5753ab7de2c42c04111fa42e

                                    SHA1

                                    fb577b8c07d9617f507a3f2950df0a6dcfebe4e2

                                    SHA256

                                    d3979fd2d9ecfdb05498d79d1f24998c38cfd107e321f6810d8b7f9f12affd82

                                    SHA512

                                    7a7452bcd22e66190e36ff0036f21d854fa57bdcbaebf637aa3a6d932a385a7c90525ede0c124853c218445d583c0edcf45d12159ca452732f31d16c3901929b

                                    Download Submit

                                  • /var/root/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb
                                    Filesize

                                    136B

                                    MD5

                                    fe382e791274914bee5950777e4f1fd3

                                    SHA1

                                    53b523b5fc87e66f2520a0b5f9ea080072668f4d

                                    SHA256

                                    935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132

                                    SHA512

                                    a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67

                                    Download Submit