2e697828d0bb36a4aa0085997b62a9cc6a83e13afe94c299e4a707f3282b2a66

Analysis

max time kernel
97s
max time network
128s
platform
macos-10.15_amd64
resource
macos-20231201-en
resource tags

arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
03-02-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf
Size

131KB
MD5

77b2707ae11ccc5b5e67ad9ab50b2e1d
SHA1

02f3af5d5647cecadb7e13366f090f2fb5b7979f
SHA256

6458c1abd29b67f8bf718595c990335d81d53b3be5f3e798a329e76d79fc7fa2
SHA512

3285412ae5e212720601a2ea5ec0ea8bf896b8f47bee45dd01c73f7dc5b760940a7a5b83e3495b43aa37e7699592a592e06a8100bd8886fb63c790a8c0a3637e
SSDEEP

3072:uRjJFIiQnZ9dFxxcb8to8T9ssVupUcfmOki:uRFFXQDxxDm8TipUKki

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 4 IoCs

evasion

Resource Forking

T1564.009

ioc	Process
sh -c "sudo /bin/zsh -c \"/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf\""	Process not Found
sudo /bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf"	Process not Found
/bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf"	Process not Found
/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf\""
1⤵
PID:577

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf\""
1⤵
PID:577

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf"
1⤵
PID:577
- /bin/zsh
  /bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf"
  2⤵
  PID:579
- /Users/run/Install
  /Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/License.rtf
  2⤵
  PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:599

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.PerfPowerServices
1⤵
PID:608

/usr/libexec/PerfPowerServices
/usr/libexec/PerfPowerServices
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:614

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:616

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:617

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:619

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:620

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:621

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:623

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:624

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:628

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:629

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:634

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:638

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:640

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:641

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy com.apple.PerfPowerServices
1⤵
PID:643

/usr/libexec/PerfPowerServices
/usr/libexec/PerfPowerServices
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:653

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:653

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
738306eaf56f8f8692541a9bbf8bc097

SHA1
6f59ff42722d6cebbf5428cb734782d1b787b0ca

SHA256
babb15ddb4cec2bb99ac537f54a9919a3f6cf8e9d8fd5f386c96b7191582ff92

SHA512
a5381bdd8bf9d7059e40a94346f083e6513d33cc2f8fd63c597be25863e9833c29e7d8da0f93edbb007baf2f537e343bdcdd12ab06a76e7d85ec8ffcbe076500

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
133B

MD5
11552c696e297b317f3655d7e1adfb74

SHA1
991ccb639ff6582f0e533517643590ad5c1f4b52

SHA256
065e4363a594b7b4c1d3cd5bdc7365f12c739ca6e81c39f09d550d3795c66b11

SHA512
57024de3a1866e06067db7681b9e6b4c2abf8ebe1ac253de75a69ab570b3f62c36bf4555832522dd645cb53bcc41effc899e7a9622218a9fa34b2068c1d4a990

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1168.xml

Filesize
150KB

MD5
76ebb0196d42a294b69ef118cbb301d5

SHA1
61e5ab752d351af1661716bc48c0520f66cd1d1b

SHA256
aaa9febe98e3a75220b4933d1f00f2bef276183491e7d171fa54d03259812759

SHA512
8dde09d72944e8925c5bd64dc3799a44d7c30191d5038939a24f8a45ccf4d66b84990e8be3e0f2ee1d42d1dd6e5ed3673c39f803874fb0840a3232cc1e533663

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit