ee9ea896a3e1436a292a1974d19bcf6685cdc7ddab625d371e7db7e155c15b81

Analysis

max time kernel
26s
max time network
30s
platform
macos-10.15_amd64
resource
macos-20240611-en
resource tags

arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
04-07-2024 14:53

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Scanned SharedDoc.eml
Size

21KB
MD5

a05ba6e539c353be838def162be90d12
SHA1

3b4eea507901a2123024e12da4c205d3558fed8e
SHA256

ee9ea896a3e1436a292a1974d19bcf6685cdc7ddab625d371e7db7e155c15b81
SHA512

96d58ec3cbc2f1a86c377f10830fc6bc1b0292132786e8d0ad11be399dfb02bbab48a456f82d9349fe9ede852df6d0381fe17dae007ce26237c1056676445a5a
SSDEEP

384:uctdaqASgV81+MXxnMZ/gHy8VuTIYYezJerdOh6siNY:sqASKS/6/gS8YIYY2odOQe

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Scanned SharedDoc.eml\""
1⤵
PID:558

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Scanned SharedDoc.eml\""
1⤵
PID:558

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Scanned SharedDoc.eml"
1⤵
PID:558

/bin/zsh
/bin/zsh -c "/Users/run/Scanned SharedDoc.eml"
2⤵
PID:560

/Users/run/Scanned
/Users/run/Scanned SharedDoc.eml
2⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:564

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:565

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:566

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:567

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:568

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:568

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:589

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater66017B75/OneDrive.app
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:601

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:602

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:603

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:605

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:606

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:607

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:608

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Filesize
124KB

MD5
f4fc6deda47ea73478d655ad5765e54c

SHA1
506bc1cd7f701fda8e4d5edef68ba035a30a8f9f

SHA256
8cc4acaa39c6f72e2982d556860a89e91062b897def34d60173c85fd8cd3a0ae

SHA512
13e0aac2a01ddd2ea790e1fe66b2a78a50bfcef648a6c4e7123fe62ac903de0aa387b83a670a0a8579cf7aea37c955870dd23d2061cdd2bf5c5ab7ba2f4fdd32

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit