4feb8141a764bcafeb3aeed7be29dfe8bf62c31957c42ba0e3fcad2f0d77fff3

Analysis

max time kernel
146s
max time network
152s
platform
macos_amd64
resource
macos-20220504-en
resource tags

arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
18-04-2023 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho
Size

84KB
MD5

98638d7cd7fe750b6eab5b46ff102abd
SHA1

efc9cfa76c2780bb6cab373c93dbcb22718faf9e
SHA256

d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31
SHA512

dcafdb17d76ab7773482ee2f3988ad0e752f680e95a66d2735f4bc1dc43fdd37ad0406ae625fe7d29afbbf49e27c309dbb244fbc29f463b255333c0acbb231e5
SSDEEP

768:c8V27RaSy6ISKpHnDzuJs0MdiqNi9cjHl3NI6/WQonko3BIDvUSynA234+hV4lYY:Za1y6Wy05/WQe3BIDmMVj5Snfn4yfns

Score

1^/10

Malware Config

Signatures

/usr/sbin/spctl
/usr/sbin/spctl --test-devid-status
1⤵
PID:502

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho\""
1⤵
PID:503

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho\""
1⤵
PID:503

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho\""
1⤵
PID:503

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho
1⤵
PID:503

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho
1⤵
PID:503
- /bin/zsh
  /bin/zsh -c /Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho
  2⤵
  PID:505
- /bin/zsh
  /bin/zsh -c /Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho
  2⤵
  PID:505
- /Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho
  /Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho
  2⤵
  PID:505
- /Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho
  /Users/run/d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31.macho
  2⤵
  PID:505

/usr/bin/syslog
/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
1⤵
PID:504

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:535

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000002.Archive Utility"
1⤵
PID:536

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_172074
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 517
1⤵
PID:537

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:537

/usr/bin/macbinary
/usr/bin/macbinary probe --verbose /Users/run/Desktop/payload.zip
1⤵
PID:539

/usr/bin/file
/usr/bin/file -b /Users/run/Desktop/payload.zip
1⤵
PID:540

/usr/libexec/xpcproxy
xpcproxy com.apple.archiveutility.auhelperservice 536
1⤵
PID:541

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
1⤵
PID:541

/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 536
1⤵
PID:544

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.806F2EDA-136B-476C-A693-3F9E1E7F9159 546
1⤵
PID:547

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:548

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000003.TextEdit
1⤵
PID:549

/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
/System/Applications/TextEdit.app/Contents/MacOS/TextEdit -psn_0_180268
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:550

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:552

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000004.TextEdit
1⤵
PID:553

/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
/System/Applications/TextEdit.app/Contents/MacOS/TextEdit -psn_0_188462
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:556

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Desktop/payload/happymeal

Filesize
3.4MB

MD5
176fd682841c1bf121d5d31ed4e79ff6

SHA1
4cef56665caa85e9ea0c6cea82b1bd7fb3c93392

SHA256
9660253445f7637d98d663c855a9c18a59e921de127df607e1781d2b57486431

SHA512
34bcdc43bf91af165df72f49f73cbdaedf0e02daa272ce4e19cbf2db00ad203879c02f90626d75299d4d87628bf8a8d3c5ea8ffb013e43f1a8070e107c16e068

Download Submit
/Users/run/Desktop/payload/happymeal

Filesize
3.4MB

MD5
176fd682841c1bf121d5d31ed4e79ff6

SHA1
4cef56665caa85e9ea0c6cea82b1bd7fb3c93392

SHA256
9660253445f7637d98d663c855a9c18a59e921de127df607e1781d2b57486431

SHA512
34bcdc43bf91af165df72f49f73cbdaedf0e02daa272ce4e19cbf2db00ad203879c02f90626d75299d4d87628bf8a8d3c5ea8ffb013e43f1a8070e107c16e068

Download Submit
/Users/run/Desktop/payload/happymeal

Filesize
3.4MB

MD5
176fd682841c1bf121d5d31ed4e79ff6

SHA1
4cef56665caa85e9ea0c6cea82b1bd7fb3c93392

SHA256
9660253445f7637d98d663c855a9c18a59e921de127df607e1781d2b57486431

SHA512
34bcdc43bf91af165df72f49f73cbdaedf0e02daa272ce4e19cbf2db00ad203879c02f90626d75299d4d87628bf8a8d3c5ea8ffb013e43f1a8070e107c16e068

Download Submit
/Users/run/Desktop/payload/happymeal

Filesize
3.4MB

MD5
176fd682841c1bf121d5d31ed4e79ff6

SHA1
4cef56665caa85e9ea0c6cea82b1bd7fb3c93392

SHA256
9660253445f7637d98d663c855a9c18a59e921de127df607e1781d2b57486431

SHA512
34bcdc43bf91af165df72f49f73cbdaedf0e02daa272ce4e19cbf2db00ad203879c02f90626d75299d4d87628bf8a8d3c5ea8ffb013e43f1a8070e107c16e068

Download Submit
/Users/run/Desktop/payload/happymeal

Filesize
3.4MB

MD5
176fd682841c1bf121d5d31ed4e79ff6

SHA1
4cef56665caa85e9ea0c6cea82b1bd7fb3c93392

SHA256
9660253445f7637d98d663c855a9c18a59e921de127df607e1781d2b57486431

SHA512
34bcdc43bf91af165df72f49f73cbdaedf0e02daa272ce4e19cbf2db00ad203879c02f90626d75299d4d87628bf8a8d3c5ea8ffb013e43f1a8070e107c16e068

Download Submit
/Users/run/Desktop/payload/happymeal

Filesize
3.4MB

MD5
176fd682841c1bf121d5d31ed4e79ff6

SHA1
4cef56665caa85e9ea0c6cea82b1bd7fb3c93392

SHA256
9660253445f7637d98d663c855a9c18a59e921de127df607e1781d2b57486431

SHA512
34bcdc43bf91af165df72f49f73cbdaedf0e02daa272ce4e19cbf2db00ad203879c02f90626d75299d4d87628bf8a8d3c5ea8ffb013e43f1a8070e107c16e068

Download Submit
/Users/run/Desktop/payload/settings.json

Filesize
478B

MD5
b35182a5d0722d6f81654bbf9755bb77

SHA1
05203798855cfdf6f32161189ee340efe27386fb

SHA256
f9169b9b0d3706f8622513a6be8a722cdcef97826f1e71476439cb387792416c

SHA512
584f5d1afd86c2492a344447039c34b2239903af5b27590371226a13bc8668afa106af8bbefcfd75ed61a247ab251c93c51ce8192347b6d5ac53bf2b44bf89f9

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/happymeal

Filesize
3.4MB

MD5
176fd682841c1bf121d5d31ed4e79ff6

SHA1
4cef56665caa85e9ea0c6cea82b1bd7fb3c93392

SHA256
9660253445f7637d98d663c855a9c18a59e921de127df607e1781d2b57486431

SHA512
34bcdc43bf91af165df72f49f73cbdaedf0e02daa272ce4e19cbf2db00ad203879c02f90626d75299d4d87628bf8a8d3c5ea8ffb013e43f1a8070e107c16e068

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/helloworld.elf

Filesize
3.1MB

MD5
1320f30e54fde2a12bb026ee71aebced

SHA1
cce4aed2c45bc53839c7f45486b64ac34d8980fb

SHA256
b0e492430d6d2f70735093395176ee8b6bc62d7cd2a9513ad631ad089174e689

SHA512
79b9288b2984ad423d17b2ad735dfc68499fcd8a8996039c8597473dff058bbefd47f8ad139ec2504b40ea7ead8aa67071631846913b3bf107fddbaf620503d7

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/settings.json

Filesize
478B

MD5
b35182a5d0722d6f81654bbf9755bb77

SHA1
05203798855cfdf6f32161189ee340efe27386fb

SHA256
f9169b9b0d3706f8622513a6be8a722cdcef97826f1e71476439cb387792416c

SHA512
584f5d1afd86c2492a344447039c34b2239903af5b27590371226a13bc8668afa106af8bbefcfd75ed61a247ab251c93c51ce8192347b6d5ac53bf2b44bf89f9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads