1c9a86a4e11a3078a0f3c9203afa6e5effce424f023fe27c6299ab866d59d113

Analysis

max time kernel
125s
max time network
129s
platform
macos_amd64
resource
macos-20220504-en
resource tags

arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
12/05/2023, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

youtube originel screeen.jpg
Size

139KB
MD5

bf4fe46da3cf56d1afb081211bf6913d
SHA1

d80cdde0207b006197a939b1c5562c20ca180d2b
SHA256

1c9a86a4e11a3078a0f3c9203afa6e5effce424f023fe27c6299ab866d59d113
SHA512

3b7aa700a886cac986b987c4801501545d03a07cfab7d23c78dd6e8ce7dbf2c9891c09393bcb15c28cc7c3baf3b3d0fb4853b1d4f11477d9f5d9731b6eb1ed56
SSDEEP

1536:3f2aiwbxNUYtIEtXuSg5yDyP8/oDN0fBGjUFQpOymWAmORuxx8o8IFB1FAXbrw9Z:XbxNlRtw5JNKLQ0kx1tt+r8E3gsU

Score

1^/10

Malware Config

Signatures

/usr/sbin/spctl
/usr/sbin/spctl --status
1⤵
PID:500

/usr/sbin/spctl
/usr/sbin/spctl --test-devid-status
1⤵
PID:501

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/youtube originel screeen.jpg\""
1⤵
PID:502

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/youtube originel screeen.jpg\""
1⤵
PID:502

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/youtube originel screeen.jpg\""
1⤵
PID:502

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/youtube originel screeen.jpg"
1⤵
PID:502

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/youtube originel screeen.jpg"
1⤵
PID:502
- /bin/zsh
  /bin/zsh -c "/Users/run/youtube originel screeen.jpg"
  2⤵
  PID:513
- /bin/zsh
  /bin/zsh -c "/Users/run/youtube originel screeen.jpg"
  2⤵
  PID:513
- /Users/run/youtube
  /Users/run/youtube originel screeen.jpg
  2⤵
  PID:513
- /Users/run/youtube
  /Users/run/youtube originel screeen.jpg
  2⤵
  PID:513

/usr/bin/syslog
/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
1⤵
PID:503

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:520

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.ncplugin.weather 321
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.ncplugin.stocks 321
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.iCal.CalendarNC 321
1⤵
PID:530

/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
1⤵
PID:528

/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
1⤵
PID:529

/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.iChat.1880
1⤵
PID:537

/System/Applications/Messages.app/Contents/MacOS/Messages
/System/Applications/Messages.app/Contents/MacOS/Messages
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.toolbox.reporting.service
1⤵
PID:539

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 537
1⤵
PID:541

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:542

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:543

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:544

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.warmd_agent
1⤵
PID:547

/usr/libexec/warmd_agent
/usr/libexec/warmd_agent
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.sessionlogoutd
1⤵
PID:551

/System/Library/CoreServices/sessionlogoutd
/System/Library/CoreServices/sessionlogoutd
1⤵
PID:551

/usr/bin/sudo
/usr/bin/sudo -k
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.E841EEB7-7032-4746-A45B-305AC46E7261
1⤵
PID:553

/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow console
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.imklaunchagent
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.UserEventAgent-LoginWindow
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.universalaccessd
1⤵
PID:556

/System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent
/System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent
1⤵
PID:554

/usr/sbin/universalaccessd
/usr/sbin/universalaccessd launchd -s
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:558

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:559

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.security.agent.login.00000000-0000-0000-0000-0000000186BB
1⤵
PID:560

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
1⤵
PID:560

/usr/libexec/UserEventAgent
/usr/libexec/UserEventAgent "(LoginWindow)"
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:562

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 560
1⤵
PID:565

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.CryptoTokenKit.ahp.agent
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000002.activateSettings
1⤵
PID:569

/System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp
/System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp
1⤵
PID:568

/System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/activateSettings
/System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/activateSettings
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.AmbientDisplayAgent
1⤵
PID:570

/System/Library/PrivateFrameworks/AmbientDisplay.framework/Versions/A/XPCServices/com.apple.AmbientDisplayAgent.xpc/Contents/MacOS/com.apple.AmbientDisplayAgent
/System/Library/PrivateFrameworks/AmbientDisplay.framework/Versions/A/XPCServices/com.apple.AmbientDisplayAgent.xpc/Contents/MacOS/com.apple.AmbientDisplayAgent
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.ctkd
1⤵
PID:571

/System/Library/Frameworks/CryptoTokenKit.framework/ctkd
/System/Library/Frameworks/CryptoTokenKit.framework/ctkd -tw
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.CryptoTokenKit.setoken 571
1⤵
PID:573

/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authhost.00000000-0000-0000-0000-0000000186BB
1⤵
PID:574

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.Kerberos.kcm
1⤵
PID:575

/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kcm
/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kcm --launchd
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.GSSCred
1⤵
PID:576

/System/Library/Frameworks/GSS.framework/Helpers/GSSCred
/System/Library/Frameworks/GSS.framework/Helpers/GSSCred
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesagent
1⤵
PID:579

/System/Library/CoreServices/iconservicesagent
/System/Library/CoreServices/iconservicesagent runAsRoot
1⤵
PID:579

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.iChat/mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.iChat/mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.iChat/mds/mdsDirectory.db_

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.iChat/mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.iChat/mds/mdsObject.db_

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsDirectory.db_

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsDirectory.db_

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsObject.db_

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C/mds/mdsObject.db_

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/private/var/run/utmpx

Filesize
3KB

MD5
75aeffef7cf516ce070811306427ea37

SHA1
ff17df91f8eeaaf905bd499d2f40d2adc6460df1

SHA256
00aec70d2a4e908f56b22246653ee907f81e65c81a6ee4e315e287a22320c57c

SHA512
1de09754c041274a522ba37fdd16226f2c868ea419c7e74af31bcfbf8715c815e2aa337524d7c1f84fa9fa770788b8cc1064d107923da3191fc240eba5597738

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads