6b9da80d8877b04e5aa3a04790d3cbed8cf47cad2871997755f198ba674aa026

Resubmissions

02/11/2024, 23:11

241102-26kjnsxnhz7

02/11/2024, 23:06

02/11/2024, 23:06

02/11/2024, 23:02

02/11/2024, 22:58

Analysis

max time kernel
85s
max time network
86s
platform
macos-10.15_amd64
resource
macos-20241101-en
resource tags

arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02/11/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZoraraUI.exe
Size 254KB
Sample241102-23pdfsyajf
SHA256 6b9da80d8877b04e5aa3a04790d3cbed8cf47cad2871997755f198ba674aa026
MD5 aeb703ddf25377135af6e4675793a1c9
SHA1 e9f43283ba04a9c30d045ca064d2935d053114ba
SHA512 191de5176cf7efbc0a8cf1b0f79c49754874ce48d7415615d484e9c7ba26d3184580309afd013cc437b239885f2c2a758846e27bec2d59a542a9647bcd7cd739
SSDEEP 3072:hhK4Uay3XrQ8habqgp9pC9Z6p5uf3CzA0xuZ04ntfxehBuRmYwSKgIwe:hhK4XycqgpfCup5sKxuZ04mhARN
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 3 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/ZoraraUI.exe\""
1⤵
PID:464

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/ZoraraUI.exe\""
1⤵
PID:464

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/ZoraraUI.exe
1⤵
PID:464
- /bin/zsh
  /bin/zsh -c /Users/run/ZoraraUI.exe
  2⤵
  PID:465
- /Users/run/ZoraraUI.exe
  /Users/run/ZoraraUI.exe
  2⤵
  PID:465

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:489

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:489

/System/Applications/TV.app/Contents/MacOS/TV
/System/Applications/TV.app/Contents/MacOS/TV
1⤵
PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:494

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:494

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.1A09397A-883C-4DA5-B7F7-762D4EE5AAE8 492
1⤵
PID:497

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:497

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:499

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.iChat.1880
1⤵
PID:500

/System/Applications/Messages.app/Contents/MacOS/Messages
/System/Applications/Messages.app/Contents/MacOS/Messages
1⤵
PID:500

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.toolbox.reporting.service
1⤵
PID:504

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
1⤵
PID:504

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:505

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:506

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:508

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 500
1⤵
PID:510

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:511

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.CharacterPicker.FileService
1⤵
PID:513

/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService
/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:514

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.google.Chrome.3056
1⤵
PID:516

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:519

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:519

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:521

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:522

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:524

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:525

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:526

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:528

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=27"
1⤵
PID:529

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=19"
1⤵
PID:530

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=19"
1⤵
PID:531

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072"
1⤵
PID:532

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
1⤵
PID:533

/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
1⤵
PID:534

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
1⤵
PID:0
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
  2⤵
  PID:537
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
  2⤵
  PID:0
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
    3⤵
    PID:540
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=403534981" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=56"
    3⤵
    PID:541
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=403855281" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=56"
    3⤵
    PID:542
- - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
    3⤵
    PID:543
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.SafariLaunchAgent
    3⤵
    PID:544
- - /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    3⤵
    PID:544
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:545
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=407032984" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=70"
    3⤵
    PID:546
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=407270244" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=70"
    3⤵
    PID:547
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=407955439" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=75"
    3⤵
    PID:548
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=408155894" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=75"
    3⤵
    PID:549
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,8929847521388079117,11885207346755465403,131072" "--seatbelt-client=90"
    3⤵
    PID:550

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path /Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat
Size 40B
SHA256 5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6
MD5 fcb4024c6dc53a5b72c492fd960762d7
SHA1 82c43024d9e274bf2b8a5d1e505d65cf3873fb92
SHA512 5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb
Size 339B
SHA256 9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5
MD5 61a867b6e4a24cfcfd32ddef25ac3229
SHA1 87cc4516fbce1700174d8ea27c9d2cb70a60a1fd
SHA512 3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc
MD5 SHA1 SHA512

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb
Size 569B
SHA256 b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e
MD5 b5db1f091948de93d7fc96e14aef6da3
SHA1 74745f991e3dfe45037366e55c2e6df47d8e6593
SHA512 d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34
MD5 SHA1 SHA512

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
Size 269B
SHA256 241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172
MD5 6487e04972ecffd0aabf7b61bdda8119
SHA1 26f0b11a2529a35f6970a914deadfcf2e2d23286
SHA512 44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae
MD5 SHA1 SHA512

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb
Size 136B
SHA256 935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132
MD5 fe382e791274914bee5950777e4f1fd3
SHA1 53b523b5fc87e66f2520a0b5f9ea080072668f4d
SHA512 a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67
MD5 SHA1 SHA512

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb
Size 2KB
SHA256 18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8
MD5 e0f65ad85a40a32fa91e551005e193ce
SHA1 a145766d5df23ae5fcd23dbb6937606f280f3502
SHA512 bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425
MD5 SHA1 SHA512

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb
Size 288B
SHA256 79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06
MD5 b47a44bdd1b765b6af56b347447fd1b7
SHA1 8599a1870656af91e432bb35e3497863e34ddfbb
SHA512 bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0
MD5 SHA1 SHA512

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 dfa4f815284f7c9e12e02994b6678b6c27e58da90d055087cb7344403c4b8b6d
MD5 6c821d774694e66740e51c6720e723a6
SHA1 168b3a055ef95b9ec11b7057c0ccfe46fa9643a1
SHA512 a94130345fc65a939c4f8ed273868fc69d90771cb927267987f6dce51a0566e5d0632e31d9ee1d0717170b9e3df3c187a962b44d0f18f3adf96e9a106b750392
SSDEEP 3072:UZr6c0dcHHyr8NuJVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXml:Uop/Q14Qk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 d5249c9c9bc4d5dbb35be11dcfffbaaaf001bae685cbd3e7fff6712048b76d1f
MD5 faea6a135c27c70eedaf921de546eb21
SHA1 ff3ac23af4e28d152f703bcd987b8cd5ccdb82bf
SHA512 9f4bfac9a643e8e9d15f2be8daff2b7ef8aa767275dc2579590d1850643317953b035004304b44f13ccdaaf2824af44d21e9131c25fd00b92624a8f81206d0a5
SSDEEP 3072:EZr6c0dcHHyr8NuJVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXma:Eop/Qcw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 b8d3c60346ea83cd0189ba6c3cd01d88ece7454dd4824a9c38905c3237f4bdce
MD5 0207b37bc05c2e46989cf4871d013e1e
SHA1 03047201a80921696de0018081f5fd76b2decca7
SHA512 2dd3f00d996a06199bce5455bd360b3e33f1a9943d8cf29a06031686afbf745ba6011b926ff1e1cb1b2905c4aeda7972917bceb047ba3c8aeaa8831af19906d4
SSDEEP 3072:RZr6c0dcHHyr8Nu8VB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmq:Rop/Bjx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 805a236d7d7d5450eee25f9dfdc1c0e1388a75fcb780484857a250fd106d4605
MD5 70e845a8ae8cc219c52a7522d4b23595
SHA1 aef8fe074684f6954cf1ed7c54d190fbfcac77c3
SHA512 1da27a19ad2480adcf0e8b9b1db700fec2ccd7369527a35ca1dbedb8d028ac7402532df0d0c73f599530cc4fb2b6819fe653b7e3b75240143ddc5fb29199eb5c
SSDEEP 3072:FZr6c0dcHHyr8NudVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXm3:Fop/0ljQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 881d760cfa817ab1f4a82fe8ce35b40e00b28cbd3eaf043c65f9125f7f23e0f0
MD5 3514d371391e2350819f16e20d1daa94
SHA1 a7d60c5fb09e321f937b45f2c923c74841619697
SHA512 f36ddd816f20bbc0f0a6f77178b938267a7fa8fd6700265aac507d64853d083740b5b969914e354a5a7c449209ea0efae06ea5fb3cf42638abc9336e06799b58
SSDEEP 3072:eZr6c0dcHHyr8NudVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmN:eop/0hY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 715196b6b2bebde627e7f0415128f8fbb268fba013c72c7d7f2c646340639441
MD5 0c0bfdbf17c581e9453cac453bac3bfc
SHA1 ae40a9cff06b6c87aae4529d5615aa2096315cb4
SHA512 474e9b38f82e2eb7a0323914bd25c0b72ffcaab05f9257039b9003dd90cc69e6325951665a9ea51727a7bd2b2d40d1c36d710bebdc46e6a22bb0a16fd6bf1227
SSDEEP 3072:5Zr6c0dcHHyr8NuMVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmZ:5op/BQb
MD5 SHA1 SHA512 SSDEEP

Submit Download

dafsaData.bin

Path /var/db/nsurlstoraged/dafsaData.bin
Size 54KB
SHA256 d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd
MD5 64f469698e53d0c828b7f90acd306082
SHA1 bcc041b3849e1b0b4104ffeb46002207eeac54f3
SHA512 a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f
SSDEEP 1536:aqR8qmuCC1x0Ksqvg6wxElfcskLlLf2OsM:3RxmNKOy67sM
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

malware,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Size 299KB
SHA256 2edb38e824d873e2b9421e765814469ad015e8b09a19e914bc19257b864c8475
MD5 fc9b0b4dd3f3ced727b100585c17b796
SHA1 efca78346aec475b7285e2c9ee8aa1123f36f875
SHA512 d05d97b8ec20a2f543338924895749ce0ebc046c546700c1ede0c9ca344f8f10ae011fa33ebce88d1b1b8b6759614cd1ca4605d1b15b225f20ab2fe04e693b5f
SSDEEP 6144:v5jkqImNlCPhNMEmgR/tEPNBFgoR3RAhMidwAIZN2gXO8+Cte3TWuG0:vlk2l8NMcc1BFDR6/dXywWOHjWuG0
MD5 SHA1 SHA512 SSDEEP

Submit Download

social_engineering,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Size 17.1MB
SHA256 97fe19154978e6890f95c4d4c8a4292e20e080f78bac62224a7076e89bc72f22
MD5 64712a67f83561c184b47171e2771c6d
SHA1 be0f12fda4911effaac0d5e8875e6fbd084e755d
SHA512 9b3d625571134e8a82e81f7c8356e751d8ed0d5b1de2620971eac20928e08c1e1677772694f38956918e33096830e310de2d1c42f6edbd7867e5df99ca2f2311
SSDEEP 393216:dC4NXg8uiNLOujrSUUhb2/MJPggV+DORbIZU4vXWtXuXgpCr:dC4J7HjrSp8MJoDcIZU4lX0Cr
MD5 SHA1 SHA512 SSDEEP

Submit Download

unwanted_software,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Size 122KB
SHA256 27f1cbb1e8f4ae104a1e0f511406ee4b745f26a19f039fc76c127ef63a5fee22
MD5 dbbd534f86b296707df7aa020666bfa0
SHA1 9300138e52f6e7ce0ef7b772bc1c0e3ddedccbb0
SHA512 786bd0d2bfdf6db8196a3837840a3ed3a7215fb1367f0135d62bc1d63e8477f5bad9ccbc00aacd858db4ce693539d61e0275119ecc3d1273d1e79cb3a173cbca
SSDEEP 3072:43njZ2fOqU52VHDnzY9UqSg4Qw3DhprkiDfh/e1oKgb/L402k6LAxX:43njZEOqw2VHbzYx4FDhprkAaoT4uX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads