9e221f45649bdd5d7fdd77949083b1d37ac34f8cf3cbf91b686edb1c6b2262f6

General

Target
zeb8cgwmkkpvu7pc
Size 706KB
Sample260812-wtpd7seb49
SHA256 9e221f45649bdd5d7fdd77949083b1d37ac34f8cf3cbf91b686edb1c6b2262f6
MD5 39dffdbdd1cdfd93ee47ed072ce99e23
SHA1 4cf731db11600769bed47a4b785cfb970654fa4f
SHA512 1c62c6192616ce7eca57d2c896eb58aa69b05fc9c7dea32784e75908d3b6815f96e64fce770ee4326c56396af6b8855235e7f1fc693459bba1b0ec5b955bf9f9
SSDEEP 12288:tU7wAcpxXAIIETE1UWLwJrr1nuwySJPUcyvmByHaRR1L+:tU7RyAOTt9EvPaRW
TLSH
T147F42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution

Malware Config

Signatures

Identifies hardware specifics through system_profiler 2 IoCs

ioc	Process
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"	Process not Found
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType	Process not Found

Prompts the user for their password using a hidden input dialog 1 TTPs 2 IoCs

Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.

credential_access collection

GUI Input Capture

T1056.002

ioc	Process
osascript -e "display dialog \"Please enter your password to continue\" default answer \"\" with icon 2 buttons {\"Continue\"} default button \"Continue\" with title \"System Settings\" with hidden answer"	Process not Found
sh -c "osascript -e 'display dialog \"Please enter your password to continue\" default answer \"\" with icon 2 buttons {\"Continue\"} default button \"Continue\" with title \"System Settings\" with hidden answer' 2>/dev/null"	Process not Found

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e 'display dialog \"Please enter your password to continue\" default answer \"\" with icon 2 buttons {\"Continue\"} default button \"Continue\" with title \"System Settings\" with hidden answer' 2>/dev/null"	Process not Found
osascript -e "display dialog \"Please enter your password to continue\" default answer \"\" with icon 2 buttons {\"Continue\"} default button \"Continue\" with title \"System Settings\" with hidden answer"	Process not Found

Checks the status of system security protections 1 TTPs 1 IoCs

System utilities were executed to query the status of System Integrity Protection or FileVault encryption. This can be abused to discover local security settings.

discovery

Security Software Discovery

T1518.001

ioc	Process
/usr/bin/csrutil status	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/zeb8cgwmkkpvu7pc\""
1⤵
PID:461

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/zeb8cgwmkkpvu7pc\""
1⤵
PID:461

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/zeb8cgwmkkpvu7pc
1⤵
PID:461
- /bin/zsh
  /bin/zsh -c /Users/run/zeb8cgwmkkpvu7pc
  2⤵
  PID:462
- /Users/run/zeb8cgwmkkpvu7pc
  /Users/run/zeb8cgwmkkpvu7pc
  2⤵
  PID:462

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:451

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:446

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:448

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:454

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:456

/bin/sh
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:464

/bin/bash
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:464
- /usr/bin/killall
  killall Terminal
  2⤵
  PID:465

/bin/sh
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:466

/bin/bash
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:466
- /usr/sbin/system_profiler
  system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
  2⤵
  PID:467

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:470

/bin/sh
sh -c "osascript -e 'display dialog \"Please enter your password to continue\" default answer \"\" with icon 2 buttons {\"Continue\"} default button \"Continue\" with title \"System Settings\" with hidden answer' 2>/dev/null"
1⤵
PID:474

/bin/bash
sh -c "osascript -e 'display dialog \"Please enter your password to continue\" default answer \"\" with icon 2 buttons {\"Continue\"} default button \"Continue\" with title \"System Settings\" with hidden answer' 2>/dev/null"
1⤵
PID:474
- /usr/bin/osascript
  osascript -e "display dialog \"Please enter your password to continue\" default answer \"\" with icon 2 buttons {\"Continue\"} default button \"Continue\" with title \"System Settings\" with hidden answer"
  2⤵
  PID:475

/usr/sbin/kextcache
/usr/sbin/kextcache -F -system-prelinked-kernel
1⤵
PID:477

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:504

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:504

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 197
1⤵
PID:505

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:505