Analysis
-
max time kernel
33s -
max time network
35s -
platform
macos_amd64 -
resource
macos-20220504-en -
submitted
09-05-2022 17:39
Behavioral task
behavioral1
Sample
Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf
Resource
macos-20220504-en
General
-
Target
Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf
-
Size
5.3MB
-
MD5
3bbc35fb5b757b9fcca3c741125691fa
-
SHA1
d6d5f9be930b3a1b37abfab556a39e077e771c7a
-
SHA256
6efa8d1e149d93c9239e4460b80faf949726e3913f7c0c62d4ec1ceba3da3e43
-
SHA512
be4790bb4f6ad998645985b810da44272fb9cc339f586d917e47a0c7e8021ea81ed51590bd830ec10effc257160d5dadea31823e1a097c58839a08576bc47098
Malware Config
Signatures
Processes
-
/usr/sbin/spctl/usr/sbin/spctl --test-devid-status1⤵
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf"1⤵
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf"1⤵
-
/bin/zsh/bin/zsh -c "/Users/run/Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf"2⤵
-
/bin/zsh/bin/zsh -c "/Users/run/Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf"2⤵
-
/Users/run/Workstation/Users/run/Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf2⤵
-
/Users/run/Workstation/Users/run/Workstation Precision 3660 Tower_ workstation per computer _ Dell Italia.pdf2⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.systempreferences.21401⤵
-
/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountProfileRemoteViewService 5231⤵
-
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService1⤵
-
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool1⤵
-
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool1⤵
-
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck1⤵
-
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref1⤵
-
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.studentd1⤵
-
/usr/libexec/studentd/usr/libexec/studentd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.preference.general.remoteservice 5231⤵
-
/System/Library/PreferencePanes/Appearance.prefPane/Contents/XPCServices/com.apple.preference.general.remoteservice.xpc/Contents/MacOS/com.apple.preference.general.remoteservice/System/Library/PreferencePanes/Appearance.prefPane/Contents/XPCServices/com.apple.preference.general.remoteservice.xpc/Contents/MacOS/com.apple.preference.general.remoteservice1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.metadata.mdwrite1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.systemprofiler1⤵
-
/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.replayd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.storedownloadd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.installd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.system_installd1⤵
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd1⤵
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd1⤵
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵
-
/usr/libexec/replayd/usr/libexec/replayd1⤵
-
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.CacheDeleteExtension 5371⤵
-
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/Users/run/Library/Caches/.dat.nosync020b.0EM7BDFilesize
294KB
MD554a6415f0ccd912e6ef418df31566b14
SHA14b00b5adc45cf789c2d3464c184c1f782a73b2dd
SHA2565703d526d31fb16982bafaab18e698b2bc9c10f5bdb690ad216ea0e09db16633
SHA5120672d0c9a787f76fedb254202c669cb0553a9f7f99ba9b2e2511005d883a308db5850822fefc4b4dde4e24b0337aae5b215a34c9bb1fa7a0934199fce86613af
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.studentd/TemporaryItems/(A Document Being Saved By studentd)/isConnectedFilesize
9B
MD52ec0d16e4ca169baedb9b2d50ec5c6d7
SHA1c2f9b7b4897f03f94abf92294c9ca46fea62360b
SHA25622965568d22a14ee17af055d2870b50afcfe9fd94a83eec3196e266932297bb2
SHA51222f8e80d23c6110fb42017d8f48db768acb5ed4c1a9153bdfc50f8fb0561dd4dc9267efcb9b88bf772200d7fb46c4c19bd86aec41432c12b52ba286729339334