014d7f7f1691ef845c280e9f0e492649e27ab0d258e2818a90b84015d0b8346e

General

Target
watch.html
Size 1.3MB
Sample261003-t11ppssekh
SHA256 014d7f7f1691ef845c280e9f0e492649e27ab0d258e2818a90b84015d0b8346e
MD5 1cb24537cb818586ad66bb4b2c9346c1
SHA1 2dc1a81c431ac8155eddb0ff19fc9f4243521d70
SHA512 2f3e9c8af069a3f004293c17a5d9bf3373fcd2605a1fa033c6f39b8b9293056e34d85f7b969df2afbb38c3ca14f40ee8edd0ffe633024df810055b72915f1dae
SSDEEP 12288:K8PjsPjXPj2PjBPjRPjqPjaPjBPjrPjNPj8Pji2fmc5JmE8w5te7IU:Kaamc5k1wq
TLSH
T1CD55B3151868B8BA4997E143DDF5EE3F59F017284BC8D95EBCF6EB9C02DD9080CAE421
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/watch.html\""
1⤵
PID:462

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/watch.html\""
1⤵
PID:462

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/watch.html
1⤵
PID:462
- /bin/zsh
  /bin/zsh -c /Users/run/watch.html
  2⤵
  PID:465
- /Users/run/watch.html
  /Users/run/watch.html
  2⤵
  PID:465
- /bin/sh
  sh /Users/run/watch.html
  2⤵
  PID:465
- /bin/bash
  sh /Users/run/watch.html
  2⤵
  PID:465

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:451

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:454

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:457

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:449

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:459

/System/Applications/TV.app/Contents/MacOS/TV
/System/Applications/TV.app/Contents/MacOS/TV
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:499

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.4EBE8DD0-A0A3-431C-A8A5-9E0896EADF84 496
1⤵
PID:503

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:503

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:505

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:505

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

malware,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Size 243KB
SHA256 9649cdb7a280dd00da3db2a606f71aefd4046592c44b4ac46c94989a38cfc896
MD5 b454624080e3de7a812de8d744a70a48
SHA1 7c1016a754f1e3d56078e490ab78331ceefecc1c
SHA512 7c0095850889355365b59a853de734dde9386235963479f564d024efa18abfe2be0dd6c70fb48dd0b9bc9adcc3a915c3f232f136058001dd419b09ddc8bd9447
SSDEEP 6144:baJp/eKpABI1DBjHKW/WXaosAIZkfDCgf5Kfb:bI9ejBG1Hl+KoTFrC8Qfb
TLSH
T13D3423BD88712FD80CB917DFAE67CD144DBC6AEC32A6427D3DCA89315E425E3490BA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

social_engineering,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Size 15.9MB
SHA256 4785c2112c825e50282f9f56843b4098bd000077aed37888a44e7b9adfbc3032
MD5 ad623566fbda9677a094cda9b41f283f
SHA1 d04b864f0e8ba3272a6074f83e271f5811b0c0ed
SHA512 8c13d2767b65a42dd78ea444c6f1c7db848866acab523ef2f62ef0ce5e1910a34432b4baea865230b5f447aa3daedd574f5f9caf69a6b431f747b97da50840b7
SSDEEP 393216:hL7kYgIuHxw81DqkpmRQ+YBUzF1gpklzSrGIwSqcxqYd4Zo9yQmNO3VzmQ:Z7kYJ0pWQ+YBPuSr4SrxqYuO3V6Q
TLSH
T19DF6337F4BD417FBBD5731EE6909E9345222C8061638DED82F46923A40EA4ACCDF0697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unwanted_software,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Size 107KB
SHA256 7b432d79426da4f6d17b8bc1fe4cebcace67cf4700e187919c0dd46aa64f3d07
MD5 ae11ef9fdc77fa1a4aff234e835ca20f
SHA1 4be5566952e58f64e0d26f06374a3fec0453a8af
SHA512 fc88597ae57dfafeda96748f74b7bd0f4bbeb2fa89043b8632a6d064afa6d0b73e05cc91c1ffd24c5fabb0815d5a091b264aae1b37c282436a4837570909b99a
SSDEEP 1536:IxNAiA3kb5MOB1Esj/n+5PzgOLrH/f19j6eBJ7yb9Rg3FjJHbXvJJYDjgDVx:IxGo5LSSnCbgmieuXwtJbvJygDVx
TLSH
T121B312B4F9983753B3AFB29909C3D10B572ED2B51BE10825238A365479C62FF45353B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads