2e697828d0bb36a4aa0085997b62a9cc6a83e13afe94c299e4a707f3282b2a66

Resubmissions

06/03/2024, 20:19

240306-y3wwrage634

06/03/2024, 20:17

240306-y222dage534

Analysis

max time kernel
124s
max time network
139s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
06/03/2024, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf
Size 155KB
Sample240306-y3wwrage63
SHA256 d506f239fcc4ba2e4430c2059a43ad9a8ca4b07736fe560297bc0eea9f990947
MD5 13ef2b2caf4f6dbc77b79ff2450cb236
SHA1 533a09b5ee07a1c7b6e57db6ea06bd5841a14d1f
SHA512 7b19f8c34bb8488595610038fb67617fb33bca9c881d18aaf3d80a563a0171f767878afce30db6b6e1c4685379d2b37e71492830b1fe32985aff98eb95a872a5
SSDEEP 1536:l0d4JQZ4RD6ibfSK5mQWqdS5FLHcePasnXeNtrK/gjz1c23wN1vpbc:lWCM4RD6gKmmrz3LHcePjY1/y2cc
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 4 IoCs

evasion

Resource Forking

T1564.009

ioc	Process
sudo /bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf"	Process not Found
/bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf"	Process not Found
/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf	Process not Found
sh -c "sudo /bin/zsh -c \"/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf\""
1⤵
PID:533

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf\""
1⤵
PID:533

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf"
1⤵
PID:533
- /bin/zsh
  /bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf"
  2⤵
  PID:534
- /Users/run/Install
  /Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/pt-BR.lproj/License.rtf
  2⤵
  PID:534

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:539

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:565

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:566

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:567

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:568

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:571

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:574

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:575

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:585

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:585

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 42B
SHA256 9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1
MD5 ce7f5b3d4bfc7b4b0da6a06dccc515f2
SHA1 ce657a52a052a3aaf534ecfbf7cbdde4ee334c10
SHA512 db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 81B
SHA256 6bb23965fd46b9ffe67a1cdb2144943543894e063c05db3a4de54e94b84968a0
MD5 520bb9b65b89f03050030e5a985b9cd1
SHA1 91defba6d4540d4c8ede177730d104d747e8f57b
SHA512 81eebb3eda761a9ecc94aa9564deab4d476522d94025ec19e002e91b12b7fbf2bffda23e7c393c09cb91b6ecd953ec1bf39ef5f787058b70289a5a5d777f0cf6
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 126B
SHA256 58add3e6d1d91409a9ddd9bb9b7cb173f3ec1162905d907839ab007e43cf2d2a
MD5 52ef57acdaa153c35594e46bde4fe42c
SHA1 c2a5b1748aa61c311b670ef319d92663e3f92b00
SHA512 defea7dd6200a17dbf0b619e16efb2919dc14199e7f3cb6755b4e5f1fdc8fb2942fa9f7c8c4c19d9026acb0c64a7df0462c7e10685c7482e710e94ed15964209
MD5 SHA1 SHA512

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 124KB
SHA256 6d618b43151ef1b19fbf543680f6a5b0643ac85ceb779b369da2c7530c553181
MD5 ba6716217c44200824b31b41378c8903
SHA1 1efa018cbbf13e873832926674183b023a1e1658
SHA512 a8c6d33677dc4ab30556b424ce48a1a8b8e83b49d345748eb7380aed662e3513175fd69bad2146de45f4b6f9f9b453ab00e0fe3cfc9616e045bc9fd8efb92e20
SSDEEP 3072:mG1qr+G0O3qVwEJcrhslHsj0YgN0fT7V/CEF7tPGqpyqA7icNCRqcn:mGqr+G0O3HralMj0Ze7tOiHn
MD5 SHA1 SHA512 SSDEEP

Submit Download

altitude-1202.xml

Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1202.xml
Size 157KB
SHA256 f1d2905b871b9b80172b7c9dc298c1a3dd355e6ae633f77562f4e06ed52a54e7
MD5 f627cf4820da06be8e6ff3fdec6ebfee
SHA1 993d8ec88721b9e76c3fe1f5987338a61b452bf8
SHA512 bf698aa0eee296df872b91432670af719bda88be3b6d210a567b500da1cedc0e07055a805c2331ccacea0a8a17396e2e37b4bf70894b9052723049c96083001f
SSDEEP 768:SmSaD5wrMhcpPXOqMyDwnW8arz4DZKrj4zvJq2ZW/gt8VxtaxU3B4c4lWDSr/g2i:SmSsJbyoba6TU6CDTwlHEkmXCy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads