f85ba13b1d04823edcf037d4a4131aa6c9cad75b2970d3156d67f5284663788d

Analysis

max time kernel
348s
max time network
560s
platform
macos-10.15_amd64
resource
macos-20231201-en
resource tags

arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02-01-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine
Size

22B
MD5

a200809dcff602f0873c924e4922e805
SHA1

688116e29625cbbd2f60628ea97cb8ef3d5bd0b6
SHA256

53a355bf83c012a82a6f727b1eefa96919791e3a4fb9b64f1cbeaa0bc4505f8c
SHA512

e4b652e52188568ecfbd294ce1b90b532129b3bd596cb15dc4d3f88738fc2aa454c99d1e43bc7c2bb9dba99899fb5b1bfb112a18a78a398d6d0c4cf1e0968bbf

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine\""
1⤵
PID:514

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine\""
1⤵
PID:514

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine\""
1⤵
PID:514

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine"
1⤵
PID:514

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine"
1⤵
PID:514
- /bin/zsh
  /bin/zsh -c "/Users/run/Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine"
  2⤵
  PID:515
- /bin/zsh
  /bin/zsh -c "/Users/run/Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine"
  2⤵
  PID:515
- /Users/run/Ghost
  /Users/run/Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine
  2⤵
  PID:515
- /Users/run/Ghost
  /Users/run/Ghost Buster Pro 2.4.3 MAS/.VolumeIcon.icns:com.apple.quarantine
  2⤵
  PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:556

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000002.Archive Utility"
1⤵
PID:557

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_176171
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 544
1⤵
PID:558

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:558

/usr/bin/macbinary
/usr/bin/macbinary probe --verbose /Users/run/Desktop/payload.zip
1⤵
PID:559

/usr/bin/file
/usr/bin/file -b /Users/run/Desktop/payload.zip
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.archiveutility.auhelperservice 557
1⤵
PID:561

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
1⤵
PID:561

/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 557
1⤵
PID:564

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:565

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.E95E9105-856E-4E6E-95C4-488C47EB8380 566
1⤵
PID:567

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:568

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000003.TextEdit
1⤵
PID:569

/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
/System/Applications/TextEdit.app/Contents/MacOS/TextEdit -psn_0_184365
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:573

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:581

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:581

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/happymeal

Filesize
3.4MB

MD5
176fd682841c1bf121d5d31ed4e79ff6

SHA1
4cef56665caa85e9ea0c6cea82b1bd7fb3c93392

SHA256
9660253445f7637d98d663c855a9c18a59e921de127df607e1781d2b57486431

SHA512
34bcdc43bf91af165df72f49f73cbdaedf0e02daa272ce4e19cbf2db00ad203879c02f90626d75299d4d87628bf8a8d3c5ea8ffb013e43f1a8070e107c16e068

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/helloworld.elf

Filesize
3.1MB

MD5
1320f30e54fde2a12bb026ee71aebced

SHA1
cce4aed2c45bc53839c7f45486b64ac34d8980fb

SHA256
b0e492430d6d2f70735093395176ee8b6bc62d7cd2a9513ad631ad089174e689

SHA512
79b9288b2984ad423d17b2ad735dfc68499fcd8a8996039c8597473dff058bbefd47f8ad139ec2504b40ea7ead8aa67071631846913b3bf107fddbaf620503d7

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/settings.json

Filesize
478B

MD5
b35182a5d0722d6f81654bbf9755bb77

SHA1
05203798855cfdf6f32161189ee340efe27386fb

SHA256
f9169b9b0d3706f8622513a6be8a722cdcef97826f1e71476439cb387792416c

SHA512
584f5d1afd86c2492a344447039c34b2239903af5b27590371226a13bc8668afa106af8bbefcfd75ed61a247ab251c93c51ce8192347b6d5ac53bf2b44bf89f9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads