ac145b761a28dffe061f9df06193e5a054f7429482fd25021f3f49899988be07

General

Target
Keyscape MORiA/Keyscape Software Update MORiA.pkg
Size 66.8MB
Sample261001-pbtsmswsfs
SHA256 ac145b761a28dffe061f9df06193e5a054f7429482fd25021f3f49899988be07
MD5 9758938505fe4a889c48a8b586b7fde7
SHA1 08cd91836064d1874371669789a207083564bed2
SHA512 7f4f077a63958ed208771a4251b8109fa92d2bf3980cd2543575164b291616b473592de3582f927c1653d430985d1d75ecc0c7f2d6e9be4856494e63adf9baaf
SSDEEP 1572864:Y4dWDRZhaXymUEOn7hwPRGmx8AnyY0oBkcEblBiAqsljY7sGvLRMXUSBIi53Uznq:VdAZhag7hw5GmyYynoLEblsAqsNYgzPb
TLSH
T14CE7335590E3A60DFD37447983D409A5E0BB2D7AD1C1CAE6FB96A00F90E3D85C97F20A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
defense_evasion

File Deletion
T1070.004

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/24784410-1919-447F-916F-032F8ACB7CAD.activeSandbox/Root /	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:499

/bin/bash
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:499

/usr/bin/sudo
sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
1⤵
PID:499
- /bin/zsh
  /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
  2⤵
  PID:500
- /usr/sbin/installer
  installer -pkg /Users/run/setup.pkg -target /
  2⤵
  PID:500

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:501

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:501

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:502

/tmp/PKInstallSandbox.TSTZEQ/Scripts/net.spectrasonics.Keyscape.LB45Eo/preinstall
/tmp/PKInstallSandbox.TSTZEQ/Scripts/net.spectrasonics.Keyscape.LB45Eo/preinstall /Users/run/setup.pkg / / /
1⤵
PID:503

/bin/rm
rm -rf "/Library/Application Support/Digidesign/Plug-Ins/KeyscapeWrapper.dpm"
1⤵
PID:505

/bin/rm
rm -rf "/Library/Application Support/Avid/Audio/Plug-Ins/Keyscape.aaxplugin"
1⤵
PID:506

/bin/rm
rm -rf /Library/Audio/Plug-Ins/Components/Keyscape.component
1⤵
PID:507

/bin/rm
rm -rf /Library/Audio/Plug-Ins/VST/Keyscape.vst
1⤵
PID:508

/bin/rm
rm -rf /Library/Audio/Plug-Ins/VST3/Keyscape.vst3
1⤵
PID:509

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/24784410-1919-447F-916F-032F8ACB7CAD.activeSandbox/Root /
1⤵
PID:510

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:518

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:545

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:545

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

net.spectrasonics.Keyscape.bom

Path /Library/InstallerSandboxes/.PKInstallSandboxManager/24784410-1919-447F-916F-032F8ACB7CAD.activeSandbox/Boms/net.spectrasonics.Keyscape.bom
Size 39KB
SHA256 8c59f0a4c30e85f6b8268a36356ec4950f0367e66c1e778b6927f8f148e49662
MD5 1cb51405ad83d3703a3cb6cd390d7612
SHA1 b096a1669a3c5c8e19de2248b22b69b6e8c4273e
SHA512 4bbaa01af9d1f42b5ccbbc09d40bf6d574ada5c2e0599931d120c99975cf2c1855c604ebf32e9c89ef23d5ea0b832f871a63402037240ac21f4b603e57611e7e
SSDEEP 384:AW8k99xMyQuYPRDcEdzaHvyqVCmoXtK8jW6Fs/wBxvQXKL8QbSY7Rvbzsrzxdu:AWuAY7RgQ
TLSH
T1E10300AA67652C12E03E49339A57C9893340F091F9649B6FD4C8564B8CCDAD1BF0FB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installd.commit.pid

Path /private/var/run/installd.commit.pid
Size 3B
SHA256 1158e7e12c5e7362318e5e3c2e1f2f1ab49578ab1d1691e9818a7c3f6b30b528
MD5 5b69b9cb83065d403869739ae7f0995e
SHA1 2c9a62c3748f484690d547c0d707aededf04fbd2
SHA512 3d32b8820cdcb5df4d4044a01f8dcc2aece48fae99398ddb3914b27c8f528ba7f6660a2c7f616e6b3c8ba4faf2d4c930bbc918c49070f5ea5076c345f0f2a22f
MD5 SHA1 SHA512

Submit Download

preinstall

Path /tmp/PKInstallSandbox.TSTZEQ/Scripts/net.spectrasonics.Keyscape.LB45Eo/preinstall
Size 890B
SHA256 979d7483655fe34e3f311e32e7702957f51bf24b0db832d07e729abd84577c6e
MD5 1ce24a1a49e98e0bd9b364f973ba36bf
SHA1 8be12b445caf0a7860c961cbb0f182331423bd9a
SHA512 9dbb1b73dd87538b1c724c36728afa7b937bb89fd7fca74b8530966310b28d2d6070287bde9a782f06d183d6fc9e60cdc2089028cceb0509fa0a9b2913b2a798
TLSH
T15F11230917C170F04EEC2B4F324246D9139F30B88373DE9174D6408E6343DAEA02F9A2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads