04fdf6f2fd7245d56073ee2aa41f451dced73b329d62764f9d66b4bcbddb1f6e

General

Target
WinDiskWriter.v1.3_Tahoe_26.0+.Apple_Silicon.zip
Size 715KB
Sample260916-ryhd8swt7q
SHA256 04fdf6f2fd7245d56073ee2aa41f451dced73b329d62764f9d66b4bcbddb1f6e
MD5 cf5b0963da7b6aed649dea22e28f86c4
SHA1 7ccd6f6373e9b574f8bcf23b9286abefe07d2b8e
SHA512 949bc2c46b2676cb72452950f3a98e0a818ba2e62bd3d220d6e5c3c30f18aa90d73509495f6d82546ec0d0b630acdbc7cabce35bb13f12dbaa8d9adb382ec95a
SSDEEP 12288:t7iRjxbqL92Vvhx3AH72+mAaSUAIitUXkTpv0WeO+0szv8EXfSu4V:kRjxbqLq67iAa99iOkTpcqsDElV
TLSH
T187F4331025CD201FD6EFA6374351B6084E23DF90D9ED4654FDBC286C9A7B24EEA0B8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion execution persistence

Malware Config

Signatures

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

Resource Forking 1 TTPs 3 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found

Launchctl 1 TTPs 1 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/WinDiskWriter.v1.3_Tahoe_26.0+.Apple_Silicon.zip\""
1⤵
PID:455

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/WinDiskWriter.v1.3_Tahoe_26.0+.Apple_Silicon.zip\""
1⤵
PID:455

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/WinDiskWriter.v1.3_Tahoe_26.0+.Apple_Silicon.zip
1⤵
PID:455
- /bin/zsh
  /bin/zsh -c /Users/run/WinDiskWriter.v1.3_Tahoe_26.0+.Apple_Silicon.zip
  2⤵
  PID:458
- /Users/run/WinDiskWriter.v1.3_Tahoe_26.0+.Apple_Silicon.zip
  /Users/run/WinDiskWriter.v1.3_Tahoe_26.0+.Apple_Silicon.zip
  2⤵
  PID:458

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.49E16949-CFE4-4188-ACFC-407BECDE42D8 483
1⤵
PID:492

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:499

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000001.Microsoft Word"
1⤵
PID:500

/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
"/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word" -psn_0_155686
1⤵
PID:500

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 470
1⤵
PID:503

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:503

/usr/libexec/xpcproxy
xpcproxy com.apple.JarLauncher.2128
1⤵
PID:504

/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
"/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
1⤵
PID:504
- /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
  "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/tmp/hello.jar
  2⤵
  PID:507

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:509

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:513

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.fba.2660
1⤵
PID:514

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant"
1⤵
PID:514

/bin/launchctl
/bin/launchctl list
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.helper
1⤵
PID:516

/bin/launchctl
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist
1⤵
PID:517

/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:516

/usr/bin/codesign
/usr/bin/codesign -v /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:523

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:523

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Launchctl

1

T1569.001

Persistence

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Privilege Escalation

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsoft word_Rules.xml

Path /Users/run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml
Size 1.0MB
SHA256 27a087184215fc08e20d0e9bd744458b69670b353ae97cf4029f8ac96cebc099
MD5 1840ac583843cb5f6426d284d62fbae0
SHA1 02ab7168144e69f5d6f88005bc58327d8ea01331
SHA512 6589c63afe42d761505b236cc8e5996c2b91c12848590eea141b9c42fd1ba2240205d45ac430d8608fc7c077e1686d399c032794c938816e850729d3adb99ac0
SSDEEP 3072:XWqfYPgaFSZjTFODup4tBWBVfEukLrY3Rz9ykSPnRIfl8pz+oB:XWqfYPbFSZjTFODup4BWB6LEfoB
TLSH
T194350084E0D355136B79E61193A28EEEEFA541A39AC4B150305E37BB9F37C850D0BA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads