Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
21/03/2024, 09:23
240321-lcmtyahf8z 404/03/2023, 13:00
230304-p8mqladd81 103/03/2023, 08:16
230303-j6lsmagg34 803/03/2023, 08:05
230303-jy8bnagb5x 103/03/2023, 05:14
230303-fw642agc68 103/03/2023, 05:05
230303-frb34afg5z 1Analysis
-
max time kernel
959s -
max time network
1112s -
platform
macos_amd64 -
resource
macos-20220504-en -
resource tags
arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
03/03/2023, 05:14
Static task
static1
Behavioral task
behavioral1
Sample
PureLand Launcher.pkg
Resource
macos-20220504-en
General
-
Target
PureLand Launcher.pkg
-
Size
236KB
-
MD5
c977b2cf2ac615586b9f53342f70b0ec
-
SHA1
59219512ddf4fb388a23b20e679af8567fb81cdc
-
SHA256
845ef90acc34abfce89e3e630265f23c03581918d30256c9e3c3d65250464933
-
SHA512
192adf43b9211dbbafd73097300aa597f5627cb2c1a15d9f14b08c5ed5d4dee559c5e386ee7e2c09131fd137c197b7f38b0c86b9cea3c7dd0aad762e7cdfd692
-
SSDEEP
6144:1yIZ7zBzswTzzO3Kt6wfJ01iZLM3ZsNLH1lQ5jL+oWhF:1179zO3GfJ04ZLg2m8F
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""1⤵PID:513
-
/bin/bashsh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""1⤵PID:513
-
/bin/bashsh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""1⤵PID:513
-
/usr/bin/sudosudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"1⤵PID:513
-
/usr/bin/sudosudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"1⤵PID:513
-
/bin/zsh/bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"2⤵PID:514
-
-
/bin/zsh/bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"2⤵PID:514
-
-
/usr/sbin/installerinstaller -pkg /Users/run/setup.pkg -target /2⤵PID:514
-
-
/usr/sbin/installerinstaller -pkg /Users/run/setup.pkg -target /2⤵PID:514
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.installd1⤵PID:525
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd1⤵PID:525
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update /Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Root/Applications/Installer.app1⤵PID:526
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid1⤵PID:527
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Root /1⤵PID:528
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c1⤵PID:529
-
/usr/libexec/xpcproxyxpcproxy com.apple.quicklook.satellite.75E7C481-9EE0-4DA1-8066-F2ADF54A44FA 5481⤵PID:549
-
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite1⤵PID:549
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:558
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:558
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵PID:561
-
/usr/sbin/spindump/usr/sbin/spindump1⤵PID:561
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump_agent1⤵PID:562
-
/usr/libexec/spindump_agent/usr/libexec/spindump_agent1⤵PID:562
-
/usr/libexec/xpcproxyxpcproxy com.apple.quicklook.ui.helper1⤵PID:564
-
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper1⤵PID:564
-
/usr/libexec/xpcproxyxpcproxy com.apple.installer.21241⤵PID:565
-
/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer1⤵PID:565
-
/usr/libexec/xpcproxyxpcproxy com.apple.metadata.mdwrite1⤵PID:566
-
/usr/libexec/xpcproxyxpcproxy com.apple.replayd1⤵PID:569
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵PID:570
-
/usr/libexec/xpcproxyxpcproxy com.apple.system_installd1⤵PID:571
-
/usr/libexec/xpcproxyxpcproxy com.apple.storedownloadd1⤵PID:572
-
/usr/libexec/replayd/usr/libexec/replayd1⤵PID:569
-
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd1⤵PID:572
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.CacheDeleteExtension 5671⤵PID:577
-
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension1⤵PID:577
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd1⤵PID:571
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵PID:570
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.agent1⤵PID:579
-
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent1⤵PID:579
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.authhost.00000000-0000-0000-0000-0000000186A61⤵PID:580
-
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost1⤵PID:580
-
/usr/libexec/xpcproxyxpcproxy com.apple.newsyslog1⤵PID:595
-
/usr/sbin/newsyslog/usr/sbin/newsyslog1⤵PID:595
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Boms/com.example.www.bom
Filesize35KB
MD55e0e3a35209eead35a7c195a81d5953d
SHA178325415e59ad2e490db847a2317e4fc58206fcd
SHA256345900eb08785ba73f46d074bf2c55439f1c74f3e75f4fd759a72af61efd0453
SHA5122a285e0820d8f8e36f940feef5497bce171b8e7ca0012d7866edceb91aaac00d6ca3dae1a778c68e909771e0cd8e8e4e2392e4ba47f45d3fa4e57bec4b098a51
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Boms/com.example.www.bom
Filesize35KB
MD55e0e3a35209eead35a7c195a81d5953d
SHA178325415e59ad2e490db847a2317e4fc58206fcd
SHA256345900eb08785ba73f46d074bf2c55439f1c74f3e75f4fd759a72af61efd0453
SHA5122a285e0820d8f8e36f940feef5497bce171b8e7ca0012d7866edceb91aaac00d6ca3dae1a778c68e909771e0cd8e8e4e2392e4ba47f45d3fa4e57bec4b098a51
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Root/Applications/.BC.T_5J50Tz
Filesize220B
MD55b4d806d060f9371c39eacdc43dd9307
SHA1442068bb85ebea9c73f7774aa5e96d9575f5a4a6
SHA256e86c36f224b065e1dec162a2e350a641477b6e655119f12808b514cceac71443
SHA51255763e4281aaace635d5c2ac2ccc92247b3973ec7e170c49ced4d62f5ad7769bbd091d54744789ba784147cd336f41eb670a3b68b4826fb585ebc6110021cbc8
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Root/Applications/._Installer.app__
Filesize220B
MD55b4d806d060f9371c39eacdc43dd9307
SHA1442068bb85ebea9c73f7774aa5e96d9575f5a4a6
SHA256e86c36f224b065e1dec162a2e350a641477b6e655119f12808b514cceac71443
SHA51255763e4281aaace635d5c2ac2ccc92247b3973ec7e170c49ced4d62f5ad7769bbd091d54744789ba784147cd336f41eb670a3b68b4826fb585ebc6110021cbc8
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Root/Applications/Installer.app/Contents/.BC.T_n2tGMi
Filesize893B
MD59971094a989829c3117cf9f49c8f3838
SHA1a9ffa3e9ce78a6e62454e39b1782084440cf6bb4
SHA256cfdbc506f6900444d628892bc98f65f678fb68ac64c65b798fb42dde30e2d367
SHA512463a3152962bcb39161b0bd9db13fce2f8935d4b2c0314135e878dab78c3462b32389d905447a4f769c48ac478cfceb43a17b43ae5ea3205ddaaac518ccfd090
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Root/Applications/Installer.app/Contents/Info.plist
Filesize893B
MD59971094a989829c3117cf9f49c8f3838
SHA1a9ffa3e9ce78a6e62454e39b1782084440cf6bb4
SHA256cfdbc506f6900444d628892bc98f65f678fb68ac64c65b798fb42dde30e2d367
SHA512463a3152962bcb39161b0bd9db13fce2f8935d4b2c0314135e878dab78c3462b32389d905447a4f769c48ac478cfceb43a17b43ae5ea3205ddaaac518ccfd090
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Root/Applications/Installer.app/Contents/MacOS/.BC.T_9YBspx
Filesize448KB
MD54c5b0e5ef61c699c1522ce45eb0171e2
SHA1aa033e9f102bc8d98360e6079da3c8b4d7e2d3c8
SHA25682633f6fec78560d657f6eda76d11a57c5747030847b3bc14766cec7d33d42be
SHA512f39309bfb3181aa602215307b02f449250ff290c677e2e9b810441842987087876acdbcfc2066f6143f41310adc70c1e1a447d7ed7cb2ef05f234e1ea93971b7
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Root/Applications/Installer.app/Contents/Resources/.BC.T_uooMwp
Filesize184KB
MD5ddc657eea2315b4cbd5d449e4b960f03
SHA1fa915f46fa636a0ee29b98d941c4a2d4576b5168
SHA256c948aa3e048497e6ef57c42df90e9f906d35aeca991c46d9e07cf3e83fe5e5ca
SHA512505661f9b0709d9b525a6dbb0de6c83d6cd5645e3ba7f685d651e611c8a460a87330943829fb054acfe3b3ac9d5d1785ff37f17e0060fadf17838a1c77d9464f
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.activeSandbox/Root/Applications/Installer.app/Contents/_CodeSignature/.BC.T_2FyBC8
Filesize2KB
MD5ede0dcbf9ab1e1db3c00543f58d6a411
SHA107791da8b46425cf5cdec2a1838537e46d0f1080
SHA25671b361a232a401ebb8697d9c9d30645d4230d9baf8e1f644328fc42ef64fccc9
SHA51247276573abb0a2eaff25a87cd8abe2eebc22307e7952df4c24479f49952ecb5025fb2e85fe6f18133a863719204d73a1d9d4e8e1eb0cb062266436548ac9ea90
-
/Library/InstallerSandboxes/.PKInstallSandboxManager/CC767715-48AD-480F-A80E-0B5979FD10C1.sandbox/.dat.nosync020d.hyBDEJ
Filesize36B
MD52a3ece33ad3ba73225f5e5e79c6e78a0
SHA1e935dc78a923c6f3f17d1bd2f63dedc69ba8e6f2
SHA2564c48c9a958cadc3dbd75968c8fa8572671571c23dab190830112d131e0b3b364
SHA512b92bc76e391abea38b77cf1fa0f6bbf551d17437098e78fa5c91ffc198c7626ac170183a6b8a00827c99e5b6e18fb8ea92261865d0c0643c806f0970c741dbbc
-
Filesize
7KB
MD56233f70b7025d6338290df41cc00e13b
SHA1f7da3b91a56345d8214b688158727185086d57e0
SHA256700d2536983d234bcc75dd4b33ebc9c306b87acd0adff9718b72aee04c2d36fb
SHA5124ebe6f119a04c6271f442393246082ab295978646e3f75693bcae706bb2b3ea90fa945eb7ea7ca99c3b91b7b80101af784778e533954d9936a4f845c990c4ce4
-
Filesize
372B
MD51759fc0756a06f64fb0a04eeb5a15c55
SHA1f7efd9d46f441cbfab640428f50f99fa4412049c
SHA25697ecce72e2d582806bb7852ff846dbf7b881112870c9b9ea43f8c31cd16529a8
SHA5127552d8995140727c6c20cc691735ef5271dbbbb3e2cad295ae500d5acc9e60d0237601f89ab4843dd287a2bc0848a665cb0b6ae2ac002569ec40d59464365180
-
Filesize
35KB
MD55e0e3a35209eead35a7c195a81d5953d
SHA178325415e59ad2e490db847a2317e4fc58206fcd
SHA256345900eb08785ba73f46d074bf2c55439f1c74f3e75f4fd759a72af61efd0453
SHA5122a285e0820d8f8e36f940feef5497bce171b8e7ca0012d7866edceb91aaac00d6ca3dae1a778c68e909771e0cd8e8e4e2392e4ba47f45d3fa4e57bec4b098a51
-
Filesize
250B
MD5cbb1a113e39f98cf16484ffc23d713f2
SHA11310ad696a850f401dab1b246adfbbb40ce0aa52
SHA2565726369354fa0df29215827be6306c4c89c46ba5abc3ac418b84bf09898517ac
SHA51249417596385c723a4a07bdc4b60ce84ef00cd23ab59ee23a02c98f40d128768baa9934c941e07cce5d52faab1737c8cbf904a03f72c281a7f258151a15c0224d
-
Filesize
250B
MD5cbb1a113e39f98cf16484ffc23d713f2
SHA11310ad696a850f401dab1b246adfbbb40ce0aa52
SHA2565726369354fa0df29215827be6306c4c89c46ba5abc3ac418b84bf09898517ac
SHA51249417596385c723a4a07bdc4b60ce84ef00cd23ab59ee23a02c98f40d128768baa9934c941e07cce5d52faab1737c8cbf904a03f72c281a7f258151a15c0224d
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
Filesize
3B
MD569421f032498c97020180038fddb8e24
SHA100a8a5c3f7bac086c6df1a59b7da7e26eee029a1
SHA256c32ffef1ae0cabc0576614cb4d2064cea5bd9c0fa13c7b8bb9fb9b4e8ba950a9
SHA512190430d9de4a918dd3315e07f7ff8260408b313c4cc5425ec0f9c1fc305ebfcc6b199d10fc3bb1f79a2558ba686bf582a3ebbfe30cfae268063911be0fa3677c