bd260b292f54825f2e216f4d19f8c989104fc06eebdef6befa86632e581d6541

General

Target
Firefox.exe
Size 392KB
Sample260922-trmfqaac24
SHA256 bd260b292f54825f2e216f4d19f8c989104fc06eebdef6befa86632e581d6541
MD5 87cbe9bd5f3d044b4c1f3ad0e41c8ec8
SHA1 6aad9e350d6b5066a2ed1c1d1d0f7d1b1570d6c9
SHA512 30d9b069bd062753581634e5b29f780a3840f8438d292edd46f1d9e78cd63337bb8653738ced6ead4b9b7c99bb71a57961d5a06c15feead9999ab4f41a9bf5c3
SSDEEP 6144:yJ+okLWj3jS/q97frT2uQUHqER70E9P0qW25PvsXDsBRHJeqr:yJ9j34q97fVRzR70E9P06Z0zwHJek
TLSH
T14384AF55F3D500FAE167C17889424516EA72BC164B60B6DF33A42E9A3F23BE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Resource Forking 1 TTPs 12 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Firefox.exe\""
1⤵
PID:462

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Firefox.exe\""
1⤵
PID:462

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Firefox.exe
1⤵
PID:462
- /bin/zsh
  /bin/zsh -c /Users/run/Firefox.exe
  2⤵
  PID:463
- /Users/run/Firefox.exe
  /Users/run/Firefox.exe
  2⤵
  PID:463

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:450

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:456

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:453

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:448

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:458

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:496

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 496
1⤵
PID:497

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:497

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:499

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:500

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:501

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:502

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:503

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:505

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:506

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:507

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:508

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:509

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:511

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.keyboard.remoteservice 496
1⤵
PID:522

/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:523

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 523
1⤵
PID:524

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:524

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:525

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:526

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:527

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:528

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:531

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:531

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.systempreferences.imageCache

Path /Users/run/Library/Caches/com.apple.systempreferences.imageCache
Size 294KB
SHA256 9c68e6b933d2ce714d726259d0befe48c0ef4e3e612fbaaccc64c90bfa7d7841
MD5 a9454a5209985cad2feea9c14f834a0b
SHA1 aa891a274687c70fe4d9a36c953f482394e632a1
SHA512 76c4446667898fbcb6201652f0708963026c3e2f5d6cb9cc1705f5ad59bf73a21901fb5e4529828b1d446dd30370fa12887e081fa19ffe0aac503735aca363dd
SSDEEP 192:MKekqPKxCizGVnS1b46oej8HLPHHs7vhKrwpJf/FnbXH5j+gbuXYNMtKwPi:MKe5KMiYGb9oejQG2w1bh+g4YNg7a
TLSH
T1EF54B61EDE0BD269C82B797D16D666BC73B35DC0BBA5CB41A21279DC0FF03420D9168A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.data

Path /Users/run/Library/Saved Application State/com.apple.systempreferences.savedState/data.data
Size 3KB
SHA256 0a4c7f88ce84f16581c9d258f4087ffd91dcb9a3cade274f5cfc47b5e2bbaf4e
MD5 d49c2efa400e9772ccc177c7720692b2
SHA1 91741a8cfe18dfb2a653466a42fa77f262a67417
SHA512 30e4339c51f4c2ff2564931d0f5e793db5f038a180f70d244194a67d8807c364c8ff27c505aac016d30bb52da1203160b48f5860094708ccdc263e04252b03d1
TLSH
T1A9513BE66F9DF32A901DE97A5E7E242B74047DFD02B7815220D117B062227939F4D405
MD5 SHA1 SHA512 TLSH