ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

max time kernel
36s
max time network
33s
platform
macos-10.15_amd64
resource
macos-20241101-en
resource tags

arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
22-01-2025 12:48

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

WannaCry.exe
Size

3.4MB
MD5

84c82835a5d21bbcf75a61706d8ab549
SHA1

5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA512

90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
SSDEEP

98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/WannaCry.exe\""
1⤵
PID:449

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/WannaCry.exe\""
1⤵
PID:449

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/WannaCry.exe
1⤵
PID:449
- /bin/zsh
  /bin/zsh -c /Users/run/WannaCry.exe
  2⤵
  PID:451
- /Users/run/WannaCry.exe
  /Users/run/WannaCry.exe
  2⤵
  PID:451

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:431

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:433

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:442

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:440

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:436

/usr/libexec/xpcproxy
xpcproxy com.apple.PackageKit.InstallStatus
1⤵
PID:482

/usr/libexec/xpcproxy
xpcproxy com.apple.warmd_agent
1⤵
PID:483

/usr/libexec/warmd_agent
/usr/libexec/warmd_agent
1⤵
PID:483

/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
"/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
1⤵
PID:482

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:484

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:484

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 125
1⤵
PID:485

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:485

/usr/libexec/xpcproxy
xpcproxy com.apple.sessionlogoutd
1⤵
PID:486

/System/Library/CoreServices/sessionlogoutd
/System/Library/CoreServices/sessionlogoutd
1⤵
PID:486

/sbin/shutdown
/sbin/shutdown -h now
1⤵
PID:1.8446744073709552e+19

/bin/sh
sh -c "/usr/bin/wall -n"
1⤵
PID:491

/bin/bash
sh -c "/usr/bin/wall -n"
1⤵
PID:491

/usr/bin/wall
/usr/bin/wall -n
1⤵
PID:491

/System/Library/Extensions/IOGraphicsFamily.kext/iogdiagnose
iogdiagnose -b /var/log/displaypolicy/iogdiagnose-last.bin
1⤵
PID:0
- /usr/sbin/spindump
  spindump -shutdownstall 2 -timelimit 5
  2⤵
  PID:493
- /bin/sh
  sh -c /usr/sbin/kextstat
  2⤵
  PID:494
- /bin/bash
  sh -c /usr/sbin/kextstat
  2⤵
  PID:494
- /usr/sbin/kextstat
  /usr/sbin/kextstat
  2⤵
  PID:494
- /bin/bash
  bash /private/var/install/shutdown_installer_tasks
  2⤵
  PID:495
- /bin/bash
  bash /private/var/install/deferred_install
  2⤵
  PID:496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

Filesize
180KB

MD5
aef0f18a05ce636aff2677e9e89b6f5b

SHA1
a063fde1b2cc07f25db1b29965d45a9c037b462b

SHA256
2cdd0fbb07a5546925f8ea705ab97364c6044eafe2c0f398f4110806cd73720a

SHA512
ed57acb545c3e71992ac9fcc48298246204445c7ef4fd245a8695325fe31f643f098e131fe4a1e3b359f419458715b37098a0a5133291dcca4b4a4fc5a2cfb5a

Download Submit

Resubmissions

Analysis