17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f

Analysis

max time kernel
141s
max time network
151s
platform
macos_amd64
resource
macos
submitted
21-02-2022 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
Size

17.5MB
MD5

d07d48d0571f6b7cbfe1771beecf3ba4
SHA1

6f80dabc3c72044faafcd463f822febd75aabdda
SHA256

17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
SHA512

bcc5dcd31d0b4f8b561523152fc3c832f4aab9d3704c0495c697762d5279ca95cafa765a6faae41a641deb036af0a06aa97c8ddcd52845cd77fc60244efc64d3

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

/usr/sbin/spctl
/usr/sbin/spctl --test-devid-status
1⤵
PID:610

/usr/bin/syslog
/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
1⤵
PID:611

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f\""
1⤵
PID:612

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f\""
1⤵
PID:612

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f\""
1⤵
PID:612

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
1⤵
PID:612

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
1⤵
PID:612
- /bin/zsh
  /bin/zsh -c /Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
  2⤵
  PID:613
- /bin/zsh
  /bin/zsh -c /Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
  2⤵
  PID:613
- /Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
  /Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
  2⤵
  PID:613
- /Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
  /Users/run/17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
  2⤵
  PID:613
- - /usr/bin/uname
    uname -srm
    3⤵
    PID:635
- - /usr/bin/uname
    uname -srm
    3⤵
    PID:635
- - /usr/sbin/ioreg
    ioreg -rd1 -c IOPlatformExpertDevice
    3⤵
    PID:636
- - /usr/sbin/ioreg
    ioreg -rd1 -c IOPlatformExpertDevice
    3⤵
    PID:636
- - /usr/sbin/ioreg
    ioreg -rd1 -c IOPlatformExpertDevice
    3⤵
    PID:651
- - /usr/sbin/ioreg
    ioreg -rd1 -c IOPlatformExpertDevice
    3⤵
    PID:651
- - /usr/sbin/ioreg
    ioreg -rd1 -c IOPlatformExpertDevice
    3⤵
    PID:668
- - /usr/sbin/ioreg
    ioreg -rd1 -c IOPlatformExpertDevice
    3⤵
    PID:668
- - /usr/sbin/ioreg
    ioreg -rd1 -c IOPlatformExpertDevice
    3⤵
    PID:669
- - /usr/sbin/ioreg
    ioreg -rd1 -c IOPlatformExpertDevice
    3⤵
    PID:669

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" "-Djdk.disableLastUsageTracking=true" "-Djava.awt.headless=true " -cp "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy.jar" com.sun.deploy.panel.ControlPanel -getSecurityLevel
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:640

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:641

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:642

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:642

/usr/bin/bzip2
/usr/bin/bzip2 -f /var/log/wifi.log.0
1⤵
PID:650

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Application Support/Oracle/Java/Deployment/deployment.properties

MD5
6e77a5b9319497ca3cd994ee94d1d44c

SHA1
32f0eff181e6680be3b26b16d292a19717108674

SHA256
7c558df224a88f35c0d3ac20ea741027887398a45667d6bc9cf3edd1480ae903

SHA512
dd4a4a61713a1d629baddc41b587f6613ea0346ebb9c5f489a93810e2717e3f74365c3d8211947a97a95f5514b72fcd2d718b826ea5e4f6c320d7a77bf0395a0

Download Submit
/Users/run/Library/LaunchAgents/mdworker.plist

MD5
933c51674c6fd6cb1587e6c24bed4b10

SHA1
42029b61040bd15004727803bc998f89f83acfa3

SHA256
de120b1214e405deb83f691e1d82e9f5e775a1b0c7844b2411956fbbdd24f0e9

SHA512
dd87d6a3d945a3638fb50632155596475b5c6fee89b3988f0f143c7b74b2d372e66ed36d477bc8f6d959afebcb3fef44917b63d078f3f16c859be97b9df201cb

Download Submit
/private/tmp/gosxnotifier/terminal-notifier.app/Contents/Info.plist

MD5
306b558093ea547414f5fbe9ebe623c2

SHA1
edfb9a9378bcb90814c5d327beee758d346d18bb

SHA256
27c31f55435439d1a100284410a6426430750ee139f5ff54628dd7b2bc616b9c

SHA512
e9edfca2df7f844c86e4cbba14c3a0f14b03b68f01ad100d57c0ef6fe0f0c42b3061e453a539ee7ecdacb5599242ab8e1211365b06814d0809c095581c862553

Download Submit
/private/tmp/gosxnotifier/terminal-notifier.app/Contents/MacOS/terminal-notifier

MD5
e7e1a2fb2b92bbe6fbc6aa5725a22d8a

SHA1
9ed105998ca69fcdc08c74cc3f300b706cd25b57

SHA256
ca20ab44eb55b7ca82e78b4128df4cb4dc2621ec9f4223b3d955a1bc86b36280

SHA512
618f90960e170935fbad108478557fd4c776e413c202176da40ca8534c3cf0174688b32726041a18110244b103238ca30d51d8eb389f5946bc8f631be5ae9b0f

Download Submit
/private/tmp/gosxnotifier/terminal-notifier.app/Contents/PkgInfo

MD5
23b7d7d024abb0f558420e098800bf27

SHA1
9f9eea0cfe2d65f2c3d6b092e375b40782d08f31

SHA256
82502191c9484b04d685374f9879a0066069c49b8acae7a04b01d38d07e8eca0

SHA512
f77d501528dd0ced155c80406cfbee38d5d3649b64d2a9324f3d6cee39491eb8f54cdebae49c6e21a20d2309d8fae1b01c41631224811e73483db25a2695738c

Download Submit
/private/tmp/gosxnotifier/terminal-notifier.app/Contents/Resources/Terminal.icns

MD5
20c4ead98b17946b21b207c59d9a84af

SHA1
3aaf46b493350ea7061752421e21206f486837a2

SHA256
ccfc0f457dbbed2b164a9f708e1a0000fad8f896b0d5332b376e2b748f3ff525

SHA512
f0e8557e37c3aad01d80c4bbfe36eb506164cfbeb689934b300934a3ec46025559dbaa9d5d725a9b5f0b6a1d0dea2ed8f940fa041bb1756fb0dc7aea717c5435

Download Submit
/private/tmp/gosxnotifier/terminal-notifier.app/Contents/Resources/en.lproj/Credits.rtf

MD5
f0d4a61caf597423ff07c5e9b24a345e

SHA1
60a248148b319de26e36424d25021c2488e23ce8

SHA256
b4386fe1cef65cd91e6c8ecc065d117089083f91b7cadbf0c3e5eae20e8b9640

SHA512
e361011499cf70fc71e247fdda71f49d913654a983aa4ae67d00dc977e53b9cf0d88d4d2ac07efe248261c3ab6e3345e829e22dda3e51dccc221a94c660ace69

Download Submit
/private/tmp/gosxnotifier/terminal-notifier.app/Contents/Resources/en.lproj/InfoPlist.strings

MD5
51ef59b60e5b41b91519cc662a9fe886

SHA1
3222ca0c39eb50aaf8126baf852e55430c4718af

SHA256
39cf2ee07b7b333e7c179d0bf4d798a5b72af6a4e584f51e642703bbfa4fc828

SHA512
3952a908b72d44040f5072f6344f6327fc78981c3aa55e931acae84c0c9bcc0d148991cd564af4803765c328cbf5f7efe9eb558fc56e47e8206b7b706026f30a

Download Submit
/private/tmp/gosxnotifier/terminal-notifier.app/Contents/Resources/en.lproj/MainMenu.nib

MD5
b7815e39b269825513e13df1b9edb489

SHA1
64ce827c176177e5df99440d3ecb75115ce90a16

SHA256
da979ca71729d1c358b0f5763d86b9fe8d2d1af1018afc9d7df5e5e4b9f628e7

SHA512
f8d7eb0967c96a84dd14dea1394ebc6ddc6a179c4ce473698ad89f79b9cd9e102e2de311ae3ad3ce5555e64d6650d83b119d5afa5f467df828ca665c644d407a

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/hsperfdata_run/637

MD5
e48c9680b1054895d9f69de41bea0102

SHA1
1cb28727dc8a3ae1cd17359d64bf3676edddcce8

SHA256
1f11bddf8356087fb980f56b183113c6ef632a41743130236b7dee6d76adf3c1

SHA512
66494ba63c78df96be082d42a9d8c3585f276c4a2d72bc3e25815b05d580cac73dad51ff9bf90ef3a51dc1bf317d4f037da33f572c7214a5b2eb467148e6aa23

Download Submit
/private/var/log/wifi.log.0.bz2

MD5
110a74b27214f8acbf9ef4409a378f57

SHA1
a72a6155b25f596f743cab96858437e32dfdc63c

SHA256
0a2cdd5b9b8b8644dde877ab69a8e2cfcecb8ec2ff70033a85b1c54a97f511b2

SHA512
4309e6e0a9194b58584f047071b0233fce82103ceee1b2ce1a3116e30e09ddcf656c836f97e981fd8250355f9c9cd1bc14ae8fc81b6383fd8ad1736dd98b4b05

Download Submit
/private/var/log/wifi.log.0.bz2

MD5
110a74b27214f8acbf9ef4409a378f57

SHA1
a72a6155b25f596f743cab96858437e32dfdc63c

SHA256
0a2cdd5b9b8b8644dde877ab69a8e2cfcecb8ec2ff70033a85b1c54a97f511b2

SHA512
4309e6e0a9194b58584f047071b0233fce82103ceee1b2ce1a3116e30e09ddcf656c836f97e981fd8250355f9c9cd1bc14ae8fc81b6383fd8ad1736dd98b4b05

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads