a997d2e17a012e432d92db0de69ef7780413f9d8c5125e13b161506a19382cda

General

Target

e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac
Size

3.0MB
MD5

8b26b29569c5d912d1d46e0de6a84edc
SHA1

367362b4ab6384833752b6936c296f3746859b82
SHA256

e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac
SHA512

66d31cb407e9b784cef915fdb5ca9d10d1e071b94708f5f09966fb2b2f829f85bcc6fe760693bddd5485169016adf172910c77df27b99709422f1f060712ba56
SSDEEP

49152:ZguJx3jLj7BBmM5EW6djOp7b9rZpgcMiw04Z:px3LEfjA9NHwZZ

Score

5^/10

evasion execution persistence

Malware Config

Signatures

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found

Launchctl 1 TTPs 1 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac\""
1⤵
PID:457

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac\""
1⤵
PID:457

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac
1⤵
PID:457
- /bin/zsh
  /bin/zsh -c /Users/run/e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac
  2⤵
  PID:460
- /Users/run/e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac
  /Users/run/e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac
  2⤵
  PID:460

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.4FCF5451-5C3A-4D3E-AD4B-0D65E046E446 463
1⤵
PID:464

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:464

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:491

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:491

/usr/libexec/xpcproxy
xpcproxy com.apple.TextEdit.2092
1⤵
PID:492

/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
1⤵
PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:493

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:496

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:502

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:502

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:505

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000001.Microsoft Word"
1⤵
PID:506

/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
"/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word" -psn_0_159783
1⤵
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 405
1⤵
PID:508

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:509

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:511

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:512

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.fba.2660
1⤵
PID:515

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant"
1⤵
PID:515

/bin/launchctl
/bin/launchctl list
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.helper
1⤵
PID:517

/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:517

/bin/launchctl
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist
1⤵
PID:518

/usr/bin/codesign
/usr/bin/codesign -v /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsync.useragent
1⤵
PID:524

/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
1⤵
PID:524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Launchctl

1

T1569.001

Persistence

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Privilege Escalation

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Desktop/encrypted_master_key.txt

Filesize
693B

MD5
a48ac660a15b743e504bf9dc4174679e

SHA1
14a4eca8571d76a72bcef153711f8f1d9ecc1db2

SHA256
da73ec8a373d7898ccdc83322fa32e6dcd47bf3b1b63e31461a8119f53b4133e

SHA512
2cddb09baf716a1183705cfc78a55c797454548071c31eefd43f7cc7b3f6128554e2066704b14efdd630a127b364821228080667f84de7a5a2201ad40126d0a5

Download Submit
/Users/run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml

Filesize
258KB

MD5
5a1dafd88abea7d33af1cfa5a7876950

SHA1
0f75bd3756324860d1e354099a133cd3fa10ac69

SHA256
ece2540855d8e06e48930cbdba0506dd8d2315af1fdc431ca1e194ad2d51fccf

SHA512
4e3f022c1b03cbf80cce2c73e33f656b74ff0759854eff296c79ba6b0ab190d57c5ca20c89a5005edb7cdbf6085016b1c445b7bcc421c194fc7426a0f34b45ed

Download Submit
/Users/run/Library/Group Containers/UBF8T346G9.Office/FontCache/4/PreviewFont/hier_officeFontsPreview_4_40.ttf

Filesize
1.9MB

MD5
8c638d09eea80c9b1963af8cc35870a5

SHA1
f67fc7503e05b99f232945bc1bbb7d50bc70f88d

SHA256
4bcfa32557e0bfffd5766cf6057b9e04ac9af9c101033fd305fba7190305a385

SHA512
b1cee1f2e0f2cdd2611c1af18d5cd3b481da6c7c761cc74f2fc9c99025215a8c03f117bd1f8cdd3fa01210c542ba9e1c7246954e43ce100c84b1ea4082000c07

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit

Resubmissions

Analysis

Sharing