d7e1e1d5a33f0bf51d04a282b0832b4032818b3844103ce39f2bc33eb62723ba

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
95s
max time network
246s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
10/07/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mac clickfix.txt
Size 168B
Sample260710-tmpqaacx2r
SHA256 d7e1e1d5a33f0bf51d04a282b0832b4032818b3844103ce39f2bc33eb62723ba
MD5 9a084c720ff0a56032ae5734fec1c9e6
SHA1 34f3e8a537840c2bf6936fe19c5c12a44f82ef37
SHA512 60f161f7210cd2557432b9e0b2dded0a4e46174efb57297bdab5d441d44bec81da4340edf3dddc8df432e95c44c6e01b88e859cac8cec6b218b18b1d9e8a0d36
TLSH
T15CC08CCB6C35AA203B4597382451EE1ACFBB4EBF4EBE7E5841C4658665062BA0947730
MD5 SHA1 SHA512 TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/mac clickfix.txt\""
1⤵
PID:470

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/mac clickfix.txt\""
1⤵
PID:470

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/mac clickfix.txt"
1⤵
PID:470
- /bin/zsh
  /bin/zsh -c "/Users/run/mac clickfix.txt"
  2⤵
  PID:473
- /Users/run/mac
  /Users/run/mac clickfix.txt
  2⤵
  PID:473

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:464

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:458

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:455

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:461

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:467

/usr/libexec/xpcproxy
xpcproxy com.apple.TextEdit.2092
1⤵
PID:503

/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
1⤵
PID:503

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:513

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:513
- /usr/bin/login
  login -pf run
  2⤵
  PID:514
- - /bin/zsh
    -zsh
    3⤵
    PID:518
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:519
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:515

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:516

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:517

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:523

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:523

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads