Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
21/02/2024, 03:56
240221-ehdpwsbf32 321/02/2024, 03:52
240221-efkenaba6z 421/02/2024, 03:49
240221-edm3rsba2z 3Analysis
-
max time kernel
1800s -
max time network
1804s -
platform
macos-10.15_amd64 -
resource
macos-20240214-en -
resource tags
-
submitted
21/02/2024, 03:52
General
-
Target
A1.py
-
Size
2KB
-
MD5
d5fe66c95538284c75363f4b0c8d4581
-
SHA1
40714520dafe2c27560f2345e830276b5a5eecdc
-
SHA256
006b8d042862590447b34e6c5bb2f196e4e0fdeffd95734fd0de1a7b07e6e507
-
SHA512
e39ee887708d5ab729bceb42c01ad6cb36666907f4dec772e4852694f7b62e806537eca1229b63fe1dfb37e9acbbee1c5cd359ca4af757cd6fe9c2601e590a93
Malware Config
Signatures
-
Resource Forking 1 TTPs 3 IoCs
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/A1.py\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/A1.py\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/A1.py1⤵
-
/bin/zsh/bin/zsh -c /Users/run/A1.py2⤵
-
-
/Users/run/A1.py/Users/run/A1.py2⤵
-
-
/bin/shsh /Users/run/A1.py2⤵
-
-
/bin/bashsh /Users/run/A1.py2⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.secd1⤵
-
/usr/libexec/secd/usr/libexec/secd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.nehelper1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.systemsoundserverd1⤵
-
/usr/sbin/systemsoundserverd/usr/sbin/systemsoundserverd1⤵
-
/usr/sbin/spindump/usr/sbin/spindump1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump_agent1⤵
-
/usr/libexec/spindump_agent/usr/libexec/spindump_agent1⤵
-
/usr/libexec/nehelper/usr/libexec/nehelper1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵
-
/usr/libexec/neagent/usr/libexec/neagent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵
-
/usr/bin/loginlogin -pf run1⤵
-
/bin/zsh-zsh2⤵
-
/usr/libexec/path_helper/usr/libexec/path_helper -s3⤵
-
-
/usr/bin/localelocale LC_CTYPE3⤵
-
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountPolicyHelper1⤵
-
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Photos.18761⤵
-
/System/Applications/Photos.app/Contents/MacOS/Photos/System/Applications/Photos.app/Contents/MacOS/Photos1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.siri.context.service1⤵
-
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.colorsync.useragent1⤵
-
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.colorsyncd1⤵
-
/usr/libexec/colorsyncd/usr/libexec/colorsyncd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.secinitd1⤵
-
/usr/libexec/secinitd/usr/libexec/secinitd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.cfprefsd.xpc.agent1⤵
-
/usr/sbin/cfprefsd/usr/sbin/cfprefsd agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.systemprofiler1⤵
-
/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.replayd1⤵
-
/usr/libexec/replayd/usr/libexec/replayd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.installd1⤵
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.system_installd1⤵
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.storedownloadd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.CacheDeleteExtension 6091⤵
-
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd1⤵
-
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.20281⤵
-
/Applications/Safari.app/Contents/MacOS/Safari/Applications/Safari.app/Contents/MacOS/Safari1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.History1⤵
-
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.209F834F-7B6B-43D1-B7F4-CBA0609ADD7E 6231⤵
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.SafariLaunchAgent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.akd1⤵
-
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.05580AF5-D4BB-4E0E-AC54-F69A3BB4721E 6231⤵
-
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent1⤵
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.CoreAuthentication.agent1⤵
-
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd1⤵
-
/System/Applications/TV.app/Contents/MacOS/TV/System/Applications/TV.app/Contents/MacOS/TV1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accessibility.mediaaccessibilityd1⤵
-
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.mediaremoted1⤵
-
/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.adid1⤵
-
/System/Library/PrivateFrameworks/CoreADI.framework/adid/System/Library/PrivateFrameworks/CoreADI.framework/adid1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportCrash1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.304BC030-4359-43A0-AF5C-1E6CBBDF3F1F 6351⤵
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.SafeBrowsing.Service1⤵
-
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service1⤵
-
/System/Library/CoreServices/ReportCrash/System/Library/CoreServices/ReportCrash agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.SearchHelper 6231⤵
-
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.C5D24C92-895F-4FCE-944F-49B0AE33F6CC 6231⤵
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.WebKit.WebContent.FA7794F0-56A5-4AD5-9766-ADA0E243DDB2 6231⤵
-
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.knowledge-agent1⤵
-
/usr/libexec/knowledge-agent/usr/libexec/knowledge-agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.assistantd1⤵
-
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.diagnosticd1⤵
-
/usr/libexec/diagnosticd/usr/libexec/diagnosticd1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
439B
MD5c05b619361d2cac0288befbdef519546
SHA1634e507971e2bd2697df0cdbbe8772e6fbec276e
SHA2561b2c817978649cad70d67be41215a663790d97707b7512cfc156b488438cbec8
SHA51286308ab30375670ff5eb886d50e3b5be5f3b7d60e0de53458e0372c0c67cbfd1c58450acb201c7d21a5f351c2b0e796d1777dbaa1e2b83ef7f69a83dac26ba20
-
Filesize
487B
MD5e251c94fc14a772dbd695b0919d4f53a
SHA163c2eaa2aae3f097a6ad8952064d4764fe8295e0
SHA2562e8a5e8288abdb773269792173899a3261c3a04c2a4d07c119988542d1978b49
SHA51292222001d9e6f4bebf5abfc02f4a0b379b33c4f7dc4e9b27170e8b2d43f7c7e017632f893619d04f01eeaa48cfd79f77c7b910cc47d74d5b81f69ea83bd69a5d
-
Filesize
487B
MD57d3535f2750c80fb5549715a6eb18997
SHA1e4c3448aa704f5a1c3e3dc8c6362ec9238e38ef9
SHA256273fc7ecbe78aaf71d4692bc0c939735d1d6b02e48b9b7b503e9554bf54980b7
SHA512a3344e01a57099e812e88cd83577f43e0dc756a06460ceb3177dae23a15a09a77a6175d99f7704eef66dc0edbf3539afa7982686703d7a0f2cd0a729be59fe83
-
Filesize
517B
MD5a3707811a6096724d20927c4a5bbd31b
SHA1c3fcdadaae3dd1492e8c80c56cb241fd0983110f
SHA2569f5e32f0aad8cb6e9d9097ebe92aaf122599336818b90f3949cdc4c78b405417
SHA5128909835213fc0da36d5d17e142f3b41fa5c1461d1008da0d45732f0cc89ae2d6fd0febc06ddc175b925578293429448ef8e46e5bda40570fd893e4d4cabedc2f
-
Filesize
517B
MD5f7c5b3d0fc1f8e32f750e9b0d3e885f3
SHA1bfa4a65f345f45cd1bf9267fa0d173f7d277b2db
SHA256b3e6e0ebc7cdd61e832187c9e29e4bf23d9452d88b986478d1bf4dd3f62f126f
SHA51299f8b8e0594b327f6492c86a28c40d15ce7f35afa0a30def860777b7ab89d38a847f20ba4cf51209ebe4394f55f6f318cd7d200a240c0cba961f5917f2380b67
-
Filesize
124KB
MD5eee69b107d27211513d0e557ec9abf36
SHA1490da5b8fcb48e507db1e5d4d9a494c3888c4ee9
SHA2565aeca3a44df05be15a9f799875d343728a9ae51e11ac5052b6d20c7750921bd1
SHA512a67f49ca4de060c911dfb4a1bde11c689f47f25c5b3c9821dfb55d1469edafc6884907d0a867cb58358c328eef1946eccbf43be8e8b7c895aba4be3d8c4f6f2e
-
Filesize
137B
MD51d9f151308f7b9bfc81db69f920c161a
SHA1725aa3246ee34be45ae5e4a996c6caac19362402
SHA2564025d84152c6c85380dc2d83beea3fb5f848996763cbb06c671c9ee630f57817
SHA5123b2e155ada3b4be4d665d77676265b1df085c903c6650167e86c689bbc02a3db40d3d6aa8074595f1cabba56ee59e67d590d77c864643f6146c45506c025386d
-
Filesize
150KB
MD576ebb0196d42a294b69ef118cbb301d5
SHA161e5ab752d351af1661716bc48c0520f66cd1d1b
SHA256aaa9febe98e3a75220b4933d1f00f2bef276183491e7d171fa54d03259812759
SHA5128dde09d72944e8925c5bd64dc3799a44d7c30191d5038939a24f8a45ccf4d66b84990e8be3e0f2ee1d42d1dd6e5ed3673c39f803874fb0840a3232cc1e533663
-
Filesize
5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
Filesize
223KB
MD570140079853d9b5b640be83ddfb92e8c
SHA1935191180ef6f003ee6af76502f91d93cd9146ba
SHA256feb3f56c83087b5c170135cc21d7c420c461df250b35a1843cca2717d96c7c6f
SHA51244d53d423ebfa7a990599a5cf4fddf004258b48e6278465bca40efcbb560800106a50ba25dac7146b68b58dac1450054d34fd1fe51c32ccd3ae9222550b764d6
-
Filesize
3.2MB
MD55c22c2f54b5a429b7b8fee695a260bdf
SHA1a101e86c24641e849f39d50e9fdfe573c5cad532
SHA256c5b22883a6112764235eda93ffcdb72d822a8505c13e6df27b0b1dcb2135f23f
SHA512ffda5624559230eeaf71aa8bdad9e4beccce9d6f7ff39e1acc4a45be11594bd08b9e8e56cb9d8aa740d742d73971e1610910bc8ebe875537c4c4a063b1770698
-
Filesize
650KB
MD5690cec1fac70cc51cd12711b751f2c67
SHA10198f1c49ac97ffcdd176fe5c279049a32e1d913
SHA25689b3aaeacc2087ae7bed60dbfa5d09c37e813a805c147f54b0e236c8923a51b8
SHA5129e242f545c12d1937f4e489d6115a8a1fe7495a9dfe5be9ffae6563f523effd51f01deeceeb00e056e67d51dc9562ff6e0d96b82de2ebded51dc98b78d0b5cc6
-
Filesize
21KB
MD5fd790579f9bf920bdc1e7642d9743402
SHA16d8988a1642bcc14e0dfde68949b705e0c3fdc23
SHA256753b178aa9fac9ec02187dc87286c18b9e0a8496297664fbb963a523b8565758
SHA51292f7129c5ce3dfb2dba528ef9cf70e58f60d4def657c44142a9a39862591c09495d934c43685c0d985b1a4a0a608295245888d9a23656f7833e084938ef026bf