Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
154s -
platform
macos-10.15_amd64 -
resource
macos-20240214-en -
resource tags
arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
22/02/2024, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
Payload/iNDS.app/iNDS
Resource
macos-20240214-en
General
-
Target
Payload/iNDS.app/iNDS
-
Size
16.8MB
-
MD5
954e66615baf2671dfafc5d1aaf3b47a
-
SHA1
7890d968b083de4c4f574a5e2811eef58500d574
-
SHA256
c831445f61d83127b191ebda4509d73a084873e74a4cbedf97fc68300a6eb2a4
-
SHA512
80906e02c77e2bd46d6acb8eaa151ab0f6a68243fc399862fb2607fcd6f8f9e4a6a9a836635c5790b62cd42563006233ebff23244650263c97ad06d16e3444b5
-
SSDEEP
196608:u7wjSYaadjuuAIasxVcsdWeAfZlkFp92uj5/m:NF9uuAFsxqwWeAfZr
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Payload/iNDS.app/iNDS\""1⤵PID:528
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Payload/iNDS.app/iNDS\""1⤵PID:528
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Payload/iNDS.app/iNDS1⤵PID:528
-
/bin/zsh/bin/zsh -c /Users/run/Payload/iNDS.app/iNDS2⤵PID:529
-
-
/Users/run/Payload/iNDS.app/iNDS/Users/run/Payload/iNDS.app/iNDS2⤵PID:529
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:547
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:547
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:554
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:554
-
/usr/libexec/xpcproxyxpcproxy com.apple.nehelper1⤵PID:555
-
/usr/libexec/nehelper/usr/libexec/nehelper1⤵PID:555
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵PID:566
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵PID:566
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵PID:567
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵PID:567
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵PID:568
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵PID:568
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵PID:569
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵PID:569
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵PID:570
-
/usr/libexec/neagent/usr/libexec/neagent1⤵PID:570
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵PID:579
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterDA6CE80A/OneDrive.app1⤵PID:580
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42B
MD5ce7f5b3d4bfc7b4b0da6a06dccc515f2
SHA1ce657a52a052a3aaf534ecfbf7cbdde4ee334c10
SHA2569261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1
SHA512db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb
-
Filesize
102B
MD541531bfeb1fcaa0616c0cac52bb384d3
SHA14c17da98d22bc143f3ce373027ed8c9088a1d35d
SHA256e011a72bbc74022b95a19b372a056dea8fc8a79528ec31ce0187a0192460c842
SHA51220ce2edfe1860d8d79350ba8646ec6cf269aaba05f144fd57388c06ddb7db2e8248729c6775932400e3cd07759b4bf99a41bc3b83f17601814214239eb274325
-
Filesize
147B
MD55303f7aad334b526983e94d3c60a8e4b
SHA18bd985ad720466bdec0ddedc65e650ecde4ca332
SHA256771c48bb7227928924e6c38fc221854afaa37c93430adcc7666acc601494e889
SHA51268b7b31be6ee1f537709860fe84147c6623e2a96d1adc4198b39e0744da81fe8c2c5bc640d5c15fd2ec999f6b79c30b9390771a7be1eeb3e1972b829ec2ba9a7
-
Filesize
167B
MD554ac2dfc3277cc71d095814696c9d295
SHA18f0d1dfbdff79cd6d57bc961c6c3fd097ba48893
SHA256c538c601d32e3052f7b1abeba70b33930f59b71d07abeb63578e4340334fc4da
SHA5129c6feb5711798bb03f566cfdce44150d28e9ac7cf6b6668aef9e9293b367b91a00d69db06d07198a7e2e3c8ba161ef2238e143bea6b1957cc9298ce8e9e7009b