dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

Resubmissions

14/04/2025, 04:20

250414-ex92msynx2 10

14/04/2025, 03:24

14/04/2025, 02:53

13/04/2025, 19:39

13/04/2025, 01:50

13/04/2025, 01:45

12/04/2025, 16:37

Analysis

max time kernel
141s
max time network
143s
platform
macos-10.15_amd64
resource
macos-20250410-en
resource tags

arch:amd64arch:i386image:macos-20250410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
12/04/2025, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Size

658KB
MD5

3178fcad2d2c2f3c0f4f70aecfb18db7
SHA1

0ecad6522214f9bef4dd8f2f8eb927827bc4971c
SHA256

dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9
SHA512

57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985
SSDEEP

12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hV:KZ1xuVVjfFoynPaVBUR8f+kN10EBP

Score

5^/10

defense_evasion execution persistence

Malware Config

Signatures

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found

Launchctl 1 TTPs 1 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist	Process not Found

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:455

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:453

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe\""
1⤵
PID:463

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe\""
1⤵
PID:463

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
1⤵
PID:463
- /bin/zsh
  /bin/zsh -c /Users/run/3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
  2⤵
  PID:465
- /Users/run/3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
  /Users/run/3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
  2⤵
  PID:465

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:496

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:500

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:500
- /usr/bin/login
  login -pf run
  2⤵
  PID:502
- - /bin/zsh
    -zsh
    3⤵
    PID:503
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:504
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:505
  - - /sbin/ifconfig
      ifconfig
      4⤵
      PID:506
  - - /usr/local/bin/ip
      ip
      4⤵
      PID:508
  - - /usr/bin/ip
      ip
      4⤵
      PID:508
  - - /bin/ip
      ip
      4⤵
      PID:508
  - - /usr/sbin/ip
      ip
      4⤵
      PID:508
  - - /sbin/ip
      ip
      4⤵
      PID:508
- /usr/bin/login
  login -pf run
  2⤵
  PID:526
- - /bin/zsh
    -zsh
    3⤵
    PID:527
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:528
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:529
- /usr/bin/login
  login -pf run
  2⤵
  PID:548
- - /bin/zsh
    -zsh
    3⤵
    PID:549
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:550
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:507

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:507

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook
1⤵
PID:512

/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.940D88B8-D54C-42DE-B0C3-E41B6D0F75C5 512
1⤵
PID:513

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:514

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:515

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariServices 280
1⤵
PID:516

/Library/Apple/System/Library/Frameworks/SafariServices.framework/Versions/A/XPCServices/com.apple.SafariServices.xpc/Contents/MacOS/com.apple.SafariServices
/Library/Apple/System/Library/Frameworks/SafariServices.framework/Versions/A/XPCServices/com.apple.SafariServices.xpc/Contents/MacOS/com.apple.SafariServices
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.C06D69DB-384F-4F14-875C-59AA0B63E9CA 280
1⤵
PID:518

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:519

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:520

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:521

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000001.Microsoft Word"
1⤵
PID:522

/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
"/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word" -psn_0_159783
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 406
1⤵
PID:525

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:532

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:534

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.fba.2660
1⤵
PID:537

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant"
1⤵
PID:537

/bin/launchctl
/bin/launchctl list
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.helper
1⤵
PID:539

/bin/launchctl
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist
1⤵
PID:540

/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:539

/usr/bin/codesign
/usr/bin/codesign -v /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:541

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/.zsh_history

Filesize
540B

MD5
c8fedcc4185f89db203db2138755e28a

SHA1
0744790441a8ac721fd41231a42a9e0ecb633d85

SHA256
bdf2cd8a99adf24723395d84c841a56c9b0fdb57a3a53ea2dabfc5f6741a50d4

SHA512
9f785a4ff86fec07a263158e915437f0a86dff555f0ddc33ace55c4de8c6954a05545da984610134a902e5a50b0746ddc12a4496d5be3f915b68e5cb704ec59b

Download Submit
/Users/run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/SurveyEventActivityStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
/Users/run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml

Filesize
258KB

MD5
5a33211bed7be6cc385ae7fbef44e01a

SHA1
a0b3b3ed558bb4efec995b2173645123667a9945

SHA256
fae19f0f726a3973bd8e7ae5b3fe7afaedacda3cbe0f9642526e710c58a485d4

SHA512
e469ce16cbc7ba515a0b2d9e2785d186b7ed30b88c1546f655182d85578a9df7e13c174eeb9ccfa0f971676fb39e35e0621dabdb34ad848da8e6552c9654aa97

Download Submit
/Users/run/Library/Group Containers/UBF8T346G9.Office/FontCache/4/PreviewFont/hier_officeFontsPreview_4_41.ttf

Filesize
1.9MB

MD5
de65f7de0dd4806a43ec87b135606b42

SHA1
3d1024ed8584daecc05b69fefa5b1fb74b299e21

SHA256
fc9a2b1c778b512099dbb8b1dd83fe2d5a2416754eecbf0ffb6b5434e97f8b2a

SHA512
7c61d471c431087e1a258516d3d0e420a7d3894e26b6f9b4ff12acb3352e3749e1c2044b23488cdad5b06cf1d9d3a8387cc70bd2f9a73470342cd4fc66075ea8

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression

Filesize
430KB

MD5
c1b93478b7324d17081fc5685270a370

SHA1
57557e9b1b07715de6e57dd0256177496694c775

SHA256
848db2e86bfe6e0f39ec1f98ab15d4471c037c2b3b5ae4277f0abcee2727365a

SHA512
7007fcf3a0dbb80bca9e0ebeb7d7c36714c5a387bca4580e76c1dbbf1eeca5a8dd34844df716431805bd600ae38a40a0a4789654991db7227b73c479fc1d7f4f

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression

Filesize
17.3MB

MD5
356ccaac827761898b6d2eb78953eb82

SHA1
2a0772dd6238cfa56e603f9d4c806337b6c430ff

SHA256
de41945017c8eac87c3d99ec5295e104081a25b2902332281cca28289ce3c037

SHA512
9159433cf5f99b435a532810ac2d021641dbdf3a1727893f9a48442683f6dfd558984b0b02ee68052351261f251bd95da68602dee264094e674d869a453a58e0

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression

Filesize
124KB

MD5
be8775f0d8010edc4083a4f4443917f2

SHA1
c5fc4a48bf264e66954b42d9410b81a87a8835a7

SHA256
35463da66100f690af44ddb3ba355492591215b19cdacde5a8b09addbff01f23

SHA512
f2a73cdbb6c5b2e445d960eab2c45aeba850346560d04dbbc2a756c7757394c64138384b34895bbf4b5893f1ea99375c2635fa7d9cc0934484428034179ed989

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit