31ddf3653d3175d5ea080c39d7b86e5e7a32e6d05a27ca59df6593b3dae0770f

Analysis

max time kernel
150s
max time network
106s
platform
macos-10.15_amd64
resource
macos-20241106-en
resource tags

arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
07/03/2025, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31059bd23ea23f951173448224a234779f7d156af2a3e05ba1ed6ca5969d1449
Size

3.0MB
MD5

2cb9465d048f06d296869452df280d07
SHA1

d0931b1e412d38c061e0a0829d50d24e75bd79c2
SHA256

31059bd23ea23f951173448224a234779f7d156af2a3e05ba1ed6ca5969d1449
SHA512

3ab6a6679cd0f145cd4d671336b66f67ae854960c85452e298926b2f01934256639d3ae6edf21087aa74dfaac88720feaf198d1d9e66b5123156c72545638492
SSDEEP

49152:ZguJx3jLj7BBmM5EW6djOp7b9rZpgcMiw04Zp:px3LEfjA9NHwZZp

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/31059bd23ea23f951173448224a234779f7d156af2a3e05ba1ed6ca5969d1449\""
1⤵
PID:456

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/31059bd23ea23f951173448224a234779f7d156af2a3e05ba1ed6ca5969d1449\""
1⤵
PID:456

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/31059bd23ea23f951173448224a234779f7d156af2a3e05ba1ed6ca5969d1449
1⤵
PID:456
- /bin/zsh
  /bin/zsh -c /Users/run/31059bd23ea23f951173448224a234779f7d156af2a3e05ba1ed6ca5969d1449
  2⤵
  PID:460
- /Users/run/31059bd23ea23f951173448224a234779f7d156af2a3e05ba1ed6ca5969d1449
  /Users/run/31059bd23ea23f951173448224a234779f7d156af2a3e05ba1ed6ca5969d1449
  2⤵
  PID:460

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:447

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:450

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:444

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:442

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:453

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.7676B033-7A1A-48ED-8E53-B0DF598C753B 462
1⤵
PID:463

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:463

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:492

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:497

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:497

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsync.useragent
1⤵
PID:502

/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
1⤵
PID:502

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Logs/DiagnosticReports/31059bd23ea23f951173448224a234779f7d156af2a3e05ba1ed6ca5969d1449_2025-03-07-132733_tests-iMac.wakeups_resource.diag

Filesize
9KB

MD5
ba5262b25676f8f903ce3d94214e6754

SHA1
4bae84affea0fe5d625636e7411f0a025e65b96e

SHA256
75b0b4a2d89e256e469e5963ac0f19ee94c6d9cd055380ed75fbfb3ed545e5ae

SHA512
74f393c16f7a39310e69b7e46a8353319e200d5aa567391cd0125b2acb6daba45b1b421e86a81beb6859676e8b5d7aa842751ae3962b32e4b8912cefcbda30de

Download Submit
/Users/run/Desktop/encrypted_master_key.txt

Filesize
693B

MD5
df2d0bbafb366fd7ac3ab34094058492

SHA1
3178ffed8559f5a6e767fd7e9c230b59880b3058

SHA256
54d3698d36bd76e235b22ffdc8ccc3343593e8258e54652d885e1b0084569a12

SHA512
cfd3fb511947209d68f45ed22253ea196672baaca0415bf58df4c4521d3178fc35446b0f125ba1531620a13f2a75e6c35df61e9f07708dc25d28c76292d4f870

Download Submit
/var/db/nsurlstoraged/dafsaData.bin

Filesize
54KB

MD5
64f469698e53d0c828b7f90acd306082

SHA1
bcc041b3849e1b0b4104ffeb46002207eeac54f3

SHA256
d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

SHA512
a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f

Download Submit