f85ba13b1d04823edcf037d4a4131aa6c9cad75b2970d3156d67f5284663788d

Analysis

max time kernel
202s
max time network
214s
platform
macos-10.15_amd64
resource
macos-20231201-en
resource tags

arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02/01/2024, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Ghost Buster Pro 2.4.3 MAS/.ds_store
Size

10KB
MD5

b02a4eb03fed01de5439641270647d6e
SHA1

b9259e3396285f94621711ee97a757fcbc9a518e
SHA256

7749bc60dfb8091231f44fe051a28025a00374573c0b5f1cc29313e29c515201
SHA512

0f73817870e7002451428e765d81962c1b04b7c8ec67786267c0f22e6493933c7236a4e8fb35ade2c1c65cbc81e726e6decec0c23059709a95be2c8e7a502564
SSDEEP

96:2gKOj3yuF0Bevt6OfAKY9R6ggpzphDLfAKY9R6g:lF3yuPk9QkX

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Ghost Buster Pro 2.4.3 MAS/.ds_store\""
1⤵
PID:510

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Ghost Buster Pro 2.4.3 MAS/.ds_store\""
1⤵
PID:510

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Ghost Buster Pro 2.4.3 MAS/.ds_store\""
1⤵
PID:510

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Ghost Buster Pro 2.4.3 MAS/.ds_store"
1⤵
PID:510

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Ghost Buster Pro 2.4.3 MAS/.ds_store"
1⤵
PID:510
- /bin/zsh
  /bin/zsh -c "/Users/run/Ghost Buster Pro 2.4.3 MAS/.ds_store"
  2⤵
  PID:511
- /bin/zsh
  /bin/zsh -c "/Users/run/Ghost Buster Pro 2.4.3 MAS/.ds_store"
  2⤵
  PID:511
- /Users/run/Ghost
  /Users/run/Ghost Buster Pro 2.4.3 MAS/.ds_store
  2⤵
  PID:511
- /Users/run/Ghost
  /Users/run/Ghost Buster Pro 2.4.3 MAS/.ds_store
  2⤵
  PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:522

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:533

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:536

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:537

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:538

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:563

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:564

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 564
1⤵
PID:566

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:566

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:567

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:568

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:570

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:571

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:573

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:573

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/.dat.nosync0219.mSOZsi

Filesize
12KB

MD5
b7737ffbd64b24901d6e9fce8fc4f618

SHA1
44da403c8bec07d40f8475d84046fef2f804437c

SHA256
f70e4aa4ea8f36eb11c3d4eb09bf75185e5300e4878a4f1c4df92c2102b6f8a2

SHA512
8359d5f5a323f02fc38a840d5bde7315fa2c61dd5ee3e827367e7def0cf1a482ada5b61a09f03883d638f549e4cff505c8950f7d536b061336c0f18f86f86519

Download Submit
/Users/run/Library/Caches/.dat.nosync0234.azH7Tb

Filesize
294KB

MD5
a4889021f3493afa0ba0ed5ec8a7516b

SHA1
ebf2c4b09864daf0affdf0be8547e006cfb8fdc7

SHA256
be1d3ef767be15c68873387a0ce2131bfaf7f496a9110e86cea1409371514234

SHA512
dde7d6707cb85b1230b9bec72069587a03668834d6e86ded4b49d749f425a5377cf90cc3d72fde5206865a8ab2aff9cf4d7163f73e984bc30a5a7b53debbf38f

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/mds/mdsDirectory.db_

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/mds/mdsObject.db_

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.studentd/TemporaryItems/(A Document Being Saved By studentd)/isConnected

Filesize
9B

MD5
2ec0d16e4ca169baedb9b2d50ec5c6d7

SHA1
c2f9b7b4897f03f94abf92294c9ca46fea62360b

SHA256
22965568d22a14ee17af055d2870b50afcfe9fd94a83eec3196e266932297bb2

SHA512
22f8e80d23c6110fb42017d8f48db768acb5ed4c1a9153bdfc50f8fb0561dd4dc9267efcb9b88bf772200d7fb46c4c19bd86aec41432c12b52ba286729339334

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads