0a2639fac59f2a88510193bc6aa79a6e1af7a7f2c6cb6bc468fb7a30c8a68cc3

Reason

Machine shutdown

General

Target
Apparency.dmg
Size 5.4MB
Sample260804-radq5ssckf
SHA256 0a2639fac59f2a88510193bc6aa79a6e1af7a7f2c6cb6bc468fb7a30c8a68cc3
MD5 f3389099087582a4fb01261de9857447
SHA1 f662e0b85b90b90bfa9b6ae5877a3cb73919fadf
SHA512 87d79b5f3d040fa5155543ac09371759a757d3f63d1d06440a975c0ece854a94ae21273c7fe1d8efb749b2fb2c42e65f41b35cf13827a2fc3ae92098373f4870
SSDEEP 98304:ONGk9RjRKq4nR6WPr3DFlRYqNP2i6DBatzXRo/qHOGvTOMPSy2aPWAgH:vk9RdCR/FlRHF2iwano/qHOCOMPHU
TLSH
T11146333B8748E927E80944BC0560A19B8D67BCD36F76C876E8E3389F3891F595DF1806
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 10 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Apparency\\ 3.2/Apparency.app\""
1⤵
PID:497

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Apparency\\ 3.2/Apparency.app\""
1⤵
PID:497

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Apparency\\ 3.2/Apparency.app"
1⤵
PID:497
- /bin/zsh
  /bin/zsh -c "open /Volumes/Apparency\\ 3.2/Apparency.app"
  2⤵
  PID:498
- /usr/bin/open
  open "/Volumes/Apparency 3.2/Apparency.app"
  2⤵
  PID:498

/usr/bin/sudo
sudo ls
1⤵
PID:499
- /bin/ls
  ls
  2⤵
  PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:504

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:504

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 172
1⤵
PID:505

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.41C936EF-F24F-4264-8FC4-A174B09D2A5C 511
1⤵
PID:512

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:516

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook
1⤵
PID:517

/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.B6CA7BF6-0A10-4B9D-83A5-5F41EBC7A6FC 517
1⤵
PID:518

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.8753B9C6-183D-4FEA-BA45-435FEFC57F13
1⤵
PID:519

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:524

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:523

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:527

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:526

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:528

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 520
1⤵
PID:530

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:530

/usr/bin/uname
uname /a
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:535

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 535
1⤵
PID:536

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:536

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:537

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:538

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:539

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:540

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:542

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:544

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.keyboard.remoteservice 535
1⤵
PID:545

/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.Spotlight
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.languageassetd
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:552

/System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
/System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
1⤵
PID:550

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.sharingd
1⤵
PID:553

/usr/libexec/sharingd
/usr/libexec/sharingd
1⤵
PID:553

/usr/libexec/languageassetd
/usr/libexec/languageassetd
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:555

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.DictionaryServiceHelper
1⤵
PID:556

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:557

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:558

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:558

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.CFUserTextEncoding

Path /Users/run/.CFUserTextEncoding
Size 7B
SHA256 13ba77c55175b70dc67f8bc1d8125ad7f9e3c5b8d2f04c82287251abb22d91fe
MD5 410b8cc83663da85146e2056d1f920ff
SHA1 450f3d9fc7f123cdc4453156f103fa37f3342ccc
SHA512 44a2679a7bf002037a5e00a703e05d21dcfeb0ebfeb08e972d01e7d44e36014259db597a9d2e69923cbf7434b9869d512c507ffe0d50ac1dec9aeada53d4bb45
MD5 SHA1 SHA512

Submit Download

altitude-1426.xml

Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1426.xml
Size 405KB
SHA256 edfb96c2ed3030e39e614ea3e5d716739e9ddc1c3e490c9056ed4df9d13e2198
MD5 d85613141c8704587540afa61f5bdc79
SHA1 5f9ce4144852529db3d6d0f0d3c600e3f73cd919
SHA512 e5002ffbc00954fc2fefc23793f62cab320e220506df82cdfb875de4d27d3c9745a9cb344ab3859eccba338dd8a0be5ad33d777dbdd8220cc38086a7d39f8f83
SSDEEP 6144:l8fW1KAY+vyl7KkUsTuola+RTRZSqtIGXF5WDv3z6:W
TLSH
T190949024923DDFA775684A7C878EF1A113F99F2F400636E8D693D277AD9C5C02A9C384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads