hxxps://www[.]speedrun[.]com/goose?h=Reverse_Area_Order-1_player&x=9d84jwqk-yn252xgn[.]81po42gq

Analysis

max time kernel
149s
max time network
153s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
18/02/2024, 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.speedrun.com/goose?h=Reverse_Area_Order-1_player&x=9d84jwqk-yn252xgn.81po42gq

Score

1^/10

Malware Config

Signatures

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:544

/bin/sh
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.speedrun.com/goose?h=Reverse_Area_Order-1_player&x=9d84jwqk-yn252xgn.81po42gq\""
1⤵
PID:546

/bin/bash
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.speedrun.com/goose?h=Reverse_Area_Order-1_player&x=9d84jwqk-yn252xgn.81po42gq\""
1⤵
PID:546

/usr/bin/sudo
sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.speedrun.com/goose?h=Reverse_Area_Order-1_player&x=9d84jwqk-yn252xgn.81po42gq"
1⤵
PID:546
- /bin/zsh
  /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.speedrun.com/goose?h=Reverse_Area_Order-1_player&x=9d84jwqk-yn252xgn.81po42gq"
  2⤵
  PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:572

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:572

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:576

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:579

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:580

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:581

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputMenuAgent
1⤵
PID:582

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputSwitcher
1⤵
PID:583

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:590

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:590

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:592

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater6BDB2703/OneDrive.app
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.E527F988-7A19-4448-9BB1-944A5DD89C6B 325
1⤵
PID:594

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:596

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:598

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.DictionaryServiceHelper
1⤵
PID:603

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:604

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariServices 325
1⤵
PID:615

/Library/Apple/System/Library/Frameworks/SafariServices.framework/Versions/A/XPCServices/com.apple.SafariServices.xpc/Contents/MacOS/com.apple.SafariServices
/Library/Apple/System/Library/Frameworks/SafariServices.framework/Versions/A/XPCServices/com.apple.SafariServices.xpc/Contents/MacOS/com.apple.SafariServices
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.ECE4A3AF-805C-48F3-A61F-24697F6F5447 325
1⤵
PID:617

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:619

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:620

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.6C7809D6-4328-4A78-8977-6F88FCEF7841 619
1⤵
PID:622

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:629

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.98662384-014E-4DAF-AD2B-C0C76E9D764B 619
1⤵
PID:630

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:630

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.passd
1⤵
PID:636

/System/Library/PrivateFrameworks/PassKitCore.framework/passd
/System/Library/PrivateFrameworks/PassKitCore.framework/passd
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:637

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.adid
1⤵
PID:638

/System/Library/PrivateFrameworks/CoreADI.framework/adid
/System/Library/PrivateFrameworks/CoreADI.framework/adid
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:647

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.CD8562DB-C4D7-4D2E-B52A-D56517692A60 647
1⤵
PID:648

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.AE8773A9-C4E6-4A42-B9A6-E6AE4F04B30E 647
1⤵
PID:651

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 647
1⤵
PID:652

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:653

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.647B3114-BAB4-4728-A197-2CCBF71A7616 647
1⤵
PID:654

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:655

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.SandboxHelper 651
1⤵
PID:656

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:657

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:657

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:658

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:659

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/PassKit/cache.plist

Filesize
488B

MD5
983afa02ac9bd03474cbd0754dfec41e

SHA1
696bf72962cb4a3f8872e4cca621f08657986dcb

SHA256
6d90fccdd6c7756e9bc28f85f4d38ae54481e32ed1748ff4ff2fbda5ba2097a8

SHA512
398b3b2d86db3e2f6f3d9cf22d12562c89b263629eadf3cc5863ad275b5ab2980a60308883df3992be0d64cca0260216ce36c0d16270e53c5d2b710f215a3116

Download Submit
/Users/run/Library/Containers/com.apple.Safari/Data/Library/Safari/AutoFillQuirks.plist

Filesize
57KB

MD5
df95370173f5d7662928edc4459a7572

SHA1
7f8a82a0a030b0a2ad1dda042b67143a8198def0

SHA256
3d6412327ab66989256565906a96d97ee069c8efd0a38b83fdf8b8db4f99fc35

SHA512
ffe2748bbdbe8ff7e938cc91d45ff0d67c753d336590c13a3ea12398dbbc296ea2d61f365f615e599d82492ca51cca4e6c2272a1b3d09dae0e3726c7a5e4309a

Download Submit
/Users/run/Library/Passes/PaymentWebServiceContext.archive

Filesize
64KB

MD5
4321ba2e908053d9d355547b1739379e

SHA1
bb9fddee32b189b8378a01722436380a9d76757d

SHA256
9cfe1ed8c4549720afb8f73f5dfef917a5c999f22e31b52d0f51d60bef008f9b

SHA512
5cac1b839ccbb47b6316cc4c24a5dff867d2040bfc12c8e9485d8ce6559a2d74f1fad895d5ff5cf79a47c62ad93735b3bb5fe3b3c26c56ebd2ff8f0849ea1a74

Download Submit
/Users/run/Library/Passes/ScheduledActivities.archive

Filesize
1KB

MD5
000d11f0a896f9c0d559f8f8e273c229

SHA1
f0a8f34d20730160ab94c3439f1fe07169b94b5c

SHA256
a7c40bcdfd688a3c37705191aa7d9a21e9b860ead4d429f98835cd97796f74d6

SHA512
6185a4324a0746ed7b10b9f6ed0c8bcf062d528d30bfdc16435baaed75588392b17cb14aa1db5c87ffeb2999953c76232605f47eba73c598dcd76e795b7f724d

Download Submit
/Users/run/Library/Passes/ScheduledActivities.archive

Filesize
1KB

MD5
26c67e98541fa4d63f7d573f6164aed8

SHA1
abff7e6cc276a468cef0157012debca86d94cca6

SHA256
173c24e78d762c560f643ca87e1167ff5f516d0cdc9a6212acfb3709b3ad0f18

SHA512
2747c258d2c5ede8f108a03d04db3f13c9dcecdd924d2cae62a0cc4afee1fccf66c0a6b5c560ca31e8e9b7be3bf17b13be4ebe1a20c8f77b96eeecba7cc16c13

Download Submit
/Users/run/Library/Passes/WebServiceTasks_v6.archive

Filesize
251B

MD5
09dfdae412e2ce9c6666f52f76002c1a

SHA1
d175b94d9dbbc3980c77cbd1da8fa7b853cf0783

SHA256
c620ab626d4350382bd8d7c999e0f3f765e7414a02264987cc38aa428ea03260

SHA512
54bfe4cf51f958dcec06b6bf81df0000d8b4cf464d7c1eadb22450fd0f86d42558f68acfc5e6806557cb1c76b2cd9b1c310c7c1e6fcbef018579e5789e183969

Download Submit
/Users/run/Library/Safari/CloudHistoryRemoteConfiguration.plist

Filesize
1012B

MD5
0c29425555c7ff0ca114b1fd0dc39c50

SHA1
d7d808e8be92462f4c3ceba66734f0e9bb26acdd

SHA256
52826afeec974bb7bacb85bdc01dc4f23bf917d65e04773d7cad393f7866f3fd

SHA512
d9c8364a85f4b4a96caac1409f32f9d6b2f8ae19201e0abd2d449a3eedadd471e99e44bc92deb5d8fb60287da64a88e61b45f759e7b9a383a9bbe5f5fd242f95

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/50081494814E9C76AF8EE5871492D9E9

Filesize
5KB

MD5
c8ce854f43233c620523bdb27d41653f

SHA1
e221f72af88610663bc5859b5a38f0da560a39ee

SHA256
7cad7ea4c9ef5aca3864a5d76dd682bd881e344c838fa4e10de1e98333f131d1

SHA512
83f8b64ee57a65e6f6ce5037d56844156e51dbf73ba948eca41ba49e33aab395fd5fc0748f85d3eccd080727536c4c6405c21f04559e5bd70ac7ef7d25d71466

Download Submit
/Users/run/Library/Safari/KnownExtensions.plist

Filesize
2KB

MD5
99707b6e8b1daa434de2a176a458f85c

SHA1
96324f62483dd7ac8683d1850d694bb900eb3419

SHA256
f282d8a52bfdcd208792a47c074e59a1e16d627d53094e11fc73e595aec7ddad

SHA512
e8018018f91a5ce5c418f5c6445dc11a44b40aa6f619958d496b18507b3fe309415bf9ab293e9c7c0b3e4ba109213d0216d39c0304a7bc3cce301db0a729430c

Download Submit
/Users/run/Library/Safari/LastSession.plist

Filesize
1KB

MD5
85c3745f00d43df202e086ded40da7f2

SHA1
5626813d0a6e0a186a3f006883d5ef7ed4dc52f5

SHA256
8410cdbbb22f1943de1eefcef86b250cbb9d84090b9bb964085d86e4bdc6b5c0

SHA512
c8b5f26cc24e4f230b1e0d7602e10482997c15accea275b90280df99af4896121b07143ccfb6bdbc0fc2fea46d8fcc47b3c502e492c633537b4ed7b60600063d

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression

Filesize
224KB

MD5
da529eb8e984f05ae8b12d434d0d7f4a

SHA1
e3ec2b3b2cf9ed3db187f53318df5198fed43189

SHA256
6459fc2365d3c4162c0fe224d4addf8cee96a9699b1da7703e2c06d21873d91d

SHA512
04c1ce80e794f91a360b2e6368798849a362991db389221b6f99acb38891998c7899acead251fe734cc374e3dafb7060de2e9e917af4ed8c2a7ca701ef1383fd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads