6e57bb596364c81bf41dacb2950c75f763071747ca522c4a826d74669aa7d0b0

General

Target
brave_2wMZMHWbkf.png
Size 853KB
Sample260910-v2cjyashrd
SHA256 6e57bb596364c81bf41dacb2950c75f763071747ca522c4a826d74669aa7d0b0
MD5 56f97060f75e4d337a48bfdedf7e2c5a
SHA1 cb860ffba61a3eb323feec49db5cdb0a4f1a6ff5
SHA512 c485586ccc78461a69563dae49fa6908342672613b82bd3311ae110bf0838ad09ea1b8651684c18c7cffb506c27194fa71aeb42f146d3810a672cc89a905cc59
SSDEEP 12288:Xg8+4KU29/+L09bTCZs74fE44kXVTWNULQ4I2tj28PGhD4nwzq/4aa4zm8mcge:Xg8fKP9/+L0ZTAE4jVi2x1xeh5SzjmcZ
TLSH
T1C8052316421D7D4AF0AFF935BD68A9C83BC26695CC564020FCB97A39733886F12987D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Resource Forking 1 TTPs 28 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c	Process not Found
/System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd	Process not Found
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/4A61535D-A4C5-4927-9C15-A87691C5F407.activeSandbox/Root /	Process not Found
/System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/activateSettings	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/brave_2wMZMHWbkf.png\""
1⤵
PID:471

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/brave_2wMZMHWbkf.png\""
1⤵
PID:471

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/brave_2wMZMHWbkf.png
1⤵
PID:471
- /bin/zsh
  /bin/zsh -c /Users/run/brave_2wMZMHWbkf.png
  2⤵
  PID:472
- /Users/run/brave_2wMZMHWbkf.png
  /Users/run/brave_2wMZMHWbkf.png
  2⤵
  PID:472

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:499

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:505

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 505
1⤵
PID:507

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:507

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:509

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:510

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:511

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:512

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:516

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:517

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:519

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:522

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:523

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:528

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:528

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:529

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 520
1⤵
PID:531

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:534

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:534

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:537

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:540

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:540

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 540
1⤵
PID:542

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:542

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:543

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:544

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:545

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:546

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:548

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 172
1⤵
PID:549

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:550

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.messages.StorageManagementExtension 519
1⤵
PID:552

/System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
/System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
1⤵
PID:551

/System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension
"/System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension"
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.Photos.StorageManagementExtension 519
1⤵
PID:553

/System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
/System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.OtherUsers 519
1⤵
PID:554

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Applications 519
1⤵
PID:555

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.iBooksX.DiskSpaceEfficiency
1⤵
PID:556

/System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
/System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.AppleInternal 519
1⤵
PID:557

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
1⤵
PID:557

/System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
/System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.CloudDocsDaemon.StorageManagement 519
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.CloudFiles 519
1⤵
PID:561

/System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
/System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
1⤵
PID:559

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
1⤵
PID:560

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Mail 519
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.GarageBand 519
1⤵
PID:563

/System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
/System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
1⤵
PID:562

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Trash 519
1⤵
PID:564

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.iOSFiles 519
1⤵
PID:565

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.CloudPhotosConfiguration
1⤵
PID:566

/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.automountd
1⤵
PID:572

/usr/libexec/automountd
automountd
1⤵
PID:572
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:574
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.installandsetup.systemmigrationd
1⤵
PID:576

/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.storagekitd
1⤵
PID:577

/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesagent
1⤵
PID:578

/System/Library/CoreServices/iconservicesagent
/System/Library/CoreServices/iconservicesagent runAsRoot
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:580

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:580

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:582

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:583

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:584

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:585

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 580
1⤵
PID:587

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.softwareupdated
1⤵
PID:588

/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.suhelperd
1⤵
PID:589

/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"
1⤵
PID:589

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:592

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/4A61535D-A4C5-4927-9C15-A87691C5F407.activeSandbox/Root /
1⤵
PID:593

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:595

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:596

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.255DB8DC-98D7-4718-84EB-FA66B620F34E
1⤵
PID:597

/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow console
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.imklaunchagent
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.UserEventAgent-LoginWindow
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.universalaccessd
1⤵
PID:600

/System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent
/System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent
1⤵
PID:598

/usr/sbin/universalaccessd
/usr/sbin/universalaccessd launchd -s
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:601

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:601

/usr/libexec/UserEventAgent
/usr/libexec/UserEventAgent "(LoginWindow)"
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:602

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:603

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.security.agent.login.00000000-0000-0000-0000-0000000186BE
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:605

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:606

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:606

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:608

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.LoginUserService 279
1⤵
PID:609

/System/Library/PrivateFrameworks/login.framework/Versions/A/XPCServices/LoginUserService.xpc/Contents/MacOS/LoginUserService
/System/Library/PrivateFrameworks/login.framework/Versions/A/XPCServices/LoginUserService.xpc/Contents/MacOS/LoginUserService
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 604
1⤵
PID:610

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:611

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreAuthentication.daemon
1⤵
PID:612

/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.CryptoTokenKit.ahp.agent
1⤵
PID:613

/System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp
/System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000001.activateSettings
1⤵
PID:614

/System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/activateSettings
/System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/activateSettings
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.AmbientDisplayAgent
1⤵
PID:615

/System/Library/PrivateFrameworks/AmbientDisplay.framework/Versions/A/XPCServices/com.apple.AmbientDisplayAgent.xpc/Contents/MacOS/com.apple.AmbientDisplayAgent
/System/Library/PrivateFrameworks/AmbientDisplay.framework/Versions/A/XPCServices/com.apple.AmbientDisplayAgent.xpc/Contents/MacOS/com.apple.AmbientDisplayAgent
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:617

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.ctkd
1⤵
PID:618

/System/Library/Frameworks/CryptoTokenKit.framework/ctkd
/System/Library/Frameworks/CryptoTokenKit.framework/ctkd -tw
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.ctkd
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:621

/System/Library/Frameworks/CryptoTokenKit.framework/ctkd
/System/Library/Frameworks/CryptoTokenKit.framework/ctkd -s
1⤵
PID:619

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.CryptoTokenKit.setoken 618
1⤵
PID:623

/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authhost.00000000-0000-0000-0000-0000000186BE
1⤵
PID:625

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.Kerberos.kcm
1⤵
PID:626

/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kcm
/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kcm --launchd
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.GSSCred
1⤵
PID:627

/System/Library/Frameworks/GSS.framework/Helpers/GSSCred
/System/Library/Frameworks/GSS.framework/Helpers/GSSCred
1⤵
PID:627

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.pkg.IncompatibleAppList.10_15.16U1923.bom

Path /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/4A61535D-A4C5-4927-9C15-A87691C5F407.activeSandbox/Boms/com.apple.pkg.IncompatibleAppList.10_15.16U1923.bom
Size 61KB
SHA256 4bde0dc120c8239b758f62e655e23be5f09b41f32f666bffa05e0104e8109d46
MD5 2f0f49de9ad6128f83b55002ddc0c733
SHA1 348b668dd78199b508fa73253568f3024a03410f
SHA512 6ed163e207886dd7661e67944197ef84c663eb129ca8c988d2fade90fa7e626b581627165521b3e9a8be77c04c12936ac40e1311750c2ad0aae4f6707910a4aa
SSDEEP 192:RG40du9VtrdQ5BvtrMJ/Jm45/6LprMJ/Jm45/6L:RG2Tri5ZGF65GF6
TLSH
T16753ED8155916C0BD17A09774FE3ACC83F65B1807C85BAFFA1C6C28BC8C99921F9D25E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.apple.systempreferences.imageCache

Path /Users/run/Library/Caches/com.apple.systempreferences.imageCache
Size 294KB
SHA256 26edde0ba0f8c21cb00c1f682c43386eeb687b89d5393e0299b6d84357df93cd
MD5 fcfd229b84c2453506d9adc0a2ab06bc
SHA1 4e2caf951443c3d4624948f99ab84a422ea1fac7
SHA512 c6e85f2174f9bd4432cfd7910dbc100ff404f6e1435aeef980a7290f4ed6db4ebd1db7942eb00ba0b6b220e9340e1d362e1e4cd99ad3c87e0f741b8105b95027
SSDEEP 192:MKekqPKxCizGVnS1b46oej8HLPHHs7vhKrwpJf/FnbXH5j+g3u2YNMtKwPi:MKe5KMiYGb9oejQG2w1bh+gxYNg7a
TLSH
T1E054B61EDE0BD269C82B797D15D666BC73B35DC0BBA5CB41A21279DC0FF03420D9128A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.apple.systempreferences.imageCache

Path /Users/run/Library/Caches/com.apple.systempreferences.imageCache
Size 288KB
SHA256 7bff5dd79349e4e42419a9f1720119cc19767df0ec1bedd6fada6a28a8be3749
MD5 ce9032fc27dc24f38c40c4116b2aec09
SHA1 617bf0e6e5838af3740393cedbf38307b7248371
SHA512 a1883e330fd3483da59388e16da1f392af2174170700093f213a1b218f3d04ae9b1d3f6d3bc9ebeb69324440de414f7a92b92739e98e5880f3b7b078b9676af1
SSDEEP 192:MK5MQ6KxwEznM4SIMb46oDhwsoV6fhU9wp8PddojmbX3vfPms9HUTzPjPwK:MK5OKtzob9oD6Ciwq7PTUTzLPF
TLSH
T10B54833ED726C04DC8352BFC6A925FBA1FA92FD23B55D3968051B4D05EF47023E8618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installd.commit.pid

Path /private/var/run/installd.commit.pid
Size 3B
SHA256 8920a14a7f6469b955b114111564cb9736440238d220fc9fd525efdb9a056d3e
MD5 37f0e884fbad9667e38940169d0a3c95
SHA1 945335a6aaa02e8642218d06ddbb9073cb1e3d69
SHA512 0d9644d4343a61d259e61f380888142ebaecac451f732cbe67bf73a62489c8fa0c4ddc97a64860d66298a926ada5b4c9b4ed7f40e4cb16edbe25f957480fb866
MD5 SHA1 SHA512

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.CloudPhotosConfiguration//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.CloudPhotosConfiguration//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFNetworkDownload_1qA4sI.tmp

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/SMIncompatibleAppUpdate/CFNetworkDownload_1qA4sI.tmp
Size 324KB
SHA256 a0ee16e403dd8609ce56b56a111b2926b591d368b6e99a41c836beb280dcf687
MD5 8ac8e766276bb799857b359b3a4f2347
SHA1 075fe1052e1e6de0a38aaa7711a54e8a77bb65f8
SHA512 60f88aacc4d89e7a52aa30a469b430f781006fac52b320c2acd05d8f3ace9638a042fa0b0000885293cf6ee391915e7d68ffc656f4056fcb6de3b638d52a6439
SSDEEP 6144:SxT4GpoTuKqxr8Y3arWLsN+iPkGm7fuoBdMHeDM3ccghAOfTCTMN4QQWAOfG:SxTxyur181WZTfuoQHZ3cRA3gNvQWA7
TLSH
T1A764236A25DE61C69E4EE3F164CC69C3B9129F3068F0494EF4C689E1077B235B61D8E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads