Overview
overview
4Static
static
1ParallelsD...in.vbs
macos-10.15-amd64
1ParallelsD..._dylib
macos-10.15-amd64
1ParallelsD....dylib
macos-10.15-amd64
1ParallelsD...70.dmg
macos-10.15-amd64
1Parallels ...cOS/7z
macos-10.15-amd64
1Parallels ...vm_app
macos-10.15-amd64
1Parallels ...ervice
macos-10.15-amd64
1Parallels ...ervice
macos-10.15-amd64
1Parallels ...ed.vbs
macos-10.15-amd64
4Parallels ...vm_app
macos-10.15-amd64
1Parallels ...ttool2
macos-10.15-amd64
1Parallels ....dylib
macos-10.15-amd64
1Parallels ....dylib
macos-10.15-amd64
1Parallels ...nt_app
macos-10.15-amd64
1Parallels ...onvert
macos-10.15-amd64
1Parallels ...k_tool
macos-10.15-amd64
1Parallels ...sd2iso
macos-10.15-amd64
1Parallels ...daemon
macos-10.15-amd64
1Parallels ..._users
macos-10.15-amd64
1Parallels ...helper
macos-10.15-amd64
1Parallels ..._mkiso
macos-10.15-amd64
1Parallels ..._naptd
macos-10.15-amd64
1Parallels ..._start
macos-10.15-amd64
1Parallels ...nplace
macos-10.15-amd64
1Parallels ...rf_ctl
macos-10.15-amd64
1Parallels ...ps2pdf
macos-10.15-amd64
1Parallels ...spaces
macos-10.15-amd64
1Resubmissions
18-03-2024 20:43
240318-zhqdxahg22 4Analysis
-
max time kernel
120s -
max time network
171s -
platform
macos-10.15_amd64 -
resource
macos-20240214-en -
resource tags
arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
18-03-2024 20:43
Static task
static1
Behavioral task
behavioral1
Sample
ParallelsDesktop-19.0.0-54570/Crack_Parallels_v19_SIP_enabled/main.vbs
Resource
macos-20240214-en
Behavioral task
behavioral2
Sample
ParallelsDesktop-19.0.0-54570/Crack_Parallels_v19_SIP_enabled/tool/insert_dylib
Resource
macos-20240214-en
Behavioral task
behavioral3
Sample
ParallelsDesktop-19.0.0-54570/Crack_Parallels_v19_SIP_enabled/tool/libInjectLib.dylib
Resource
macos-20240214-en
Behavioral task
behavioral4
Sample
ParallelsDesktop-19.0.0-54570/ParallelsDesktop-19.0.0-54570.dmg
Resource
macos-20240214-en
Behavioral task
behavioral5
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/7z
Resource
macos-20240214-en
Behavioral task
behavioral6
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels Mac VM.app/Contents/MacOS/prl_macvm_app
Resource
macos-20240214-en
Behavioral task
behavioral7
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels Service
Resource
macos-20240214-en
Behavioral task
behavioral8
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels Service.app/Contents/MacOS/prl_disp_service
Resource
macos-20240214-en
Behavioral task
behavioral9
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels Service.app/Contents/Resources/Unattended.vbs
Resource
macos-20240214-en
Behavioral task
behavioral10
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels VM.app/Contents/MacOS/prl_vm_app
Resource
macos-20240214-en
Behavioral task
behavioral11
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/inittool2
Resource
macos-20240214-en
Behavioral task
behavioral12
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/libMonitor.dylib
Resource
macos-20240214-en
Behavioral task
behavioral13
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/libMonitorArm.dylib
Resource
macos-20240214-en
Behavioral task
behavioral14
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_client_app
Resource
macos-20240214-en
Behavioral task
behavioral15
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_convert
Resource
macos-20240214-en
Behavioral task
behavioral16
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_disk_tool
Resource
macos-20240214-en
Behavioral task
behavioral17
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_esd2iso
Resource
macos-20240214-en
Behavioral task
behavioral18
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_launchdaemon
Resource
macos-20240214-en
Behavioral task
behavioral19
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_ls_users
Resource
macos-20240214-en
Behavioral task
behavioral20
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_macvm_helper
Resource
macos-20240214-en
Behavioral task
behavioral21
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_mkiso
Resource
macos-20240214-en
Behavioral task
behavioral22
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_naptd
Resource
macos-20240214-en
Behavioral task
behavioral23
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_net_start
Resource
macos-20240214-en
Behavioral task
behavioral24
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_packer_inplace
Resource
macos-20240214-en
Behavioral task
behavioral25
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_perf_ctl
Resource
macos-20240214-en
Behavioral task
behavioral26
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_ps2pdf
Resource
macos-20240214-en
Behavioral task
behavioral27
Sample
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/prl_switchspaces
Resource
macos-20240214-en
General
-
Target
Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels VM.app/Contents/MacOS/prl_vm_app
-
Size
31.0MB
-
MD5
e261ae75c5436146c7e2b62fd633569b
-
SHA1
0e01940c168c5a75df3d214c750a5689a8f8fc85
-
SHA256
66affd3b986e151074c146f1a5e3e0696a0f6fe3d9540bafd54f7929bf998572
-
SHA512
595d93655b565dfe623e60ba441d5407aa33d8853c2d88d4a6a3a1459b809bd693845d8c57be2188004e5663fbc6d9efc6a67fb380ccbf8c922c19cfe54b40eb
-
SSDEEP
393216:4VayMxbo3Hvder8WD1m72wLhr/AVWsWBr:oMxM3VfOIpLt/Agsc
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels VM.app/Contents/MacOS/prl_vm_app\""1⤵PID:563
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels VM.app/Contents/MacOS/prl_vm_app\""1⤵PID:563
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels VM.app/Contents/MacOS/prl_vm_app"1⤵PID:563
-
/bin/zsh/bin/zsh -c "/Users/run/Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels VM.app/Contents/MacOS/prl_vm_app"2⤵PID:564
-
-
/Users/run/Parallels/Users/run/Parallels Desktop 19/Parallels Desktop.app/Contents/MacOS/Parallels VM.app/Contents/MacOS/prl_vm_app2⤵PID:564
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:565
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:565
-
/usr/libexec/xpcproxyxpcproxy com.apple.nehelper1⤵PID:566
-
/usr/libexec/nehelper/usr/libexec/nehelper1⤵PID:566
-
/usr/libexec/xpcproxyxpcproxy com.apple.siri.context.service1⤵PID:569
-
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService1⤵PID:569
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵PID:579
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵PID:579
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:582
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:582
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:583
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:583
-
/usr/libexec/xpcproxyxpcproxy com.apple.secinitd1⤵PID:584
-
/usr/libexec/secinitd/usr/libexec/secinitd1⤵PID:584
-
/usr/libexec/xpcproxyxpcproxy com.apple.cfprefsd.xpc.agent1⤵PID:586
-
/usr/sbin/cfprefsd/usr/sbin/cfprefsd agent1⤵PID:586
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵PID:592
-
/usr/libexec/neagent/usr/libexec/neagent1⤵PID:592
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵PID:595
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵PID:595
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵PID:598
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵PID:598
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵PID:601
-
/usr/libexec/xpcproxyxpcproxy com.apple.tailspind1⤵PID:602
-
/usr/libexec/tailspind/usr/libexec/tailspind1⤵PID:602
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵PID:601
-
/usr/libexec/xpcproxyxpcproxy com.apple.assistantd1⤵PID:605
-
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd1⤵PID:605
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵PID:609
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42B
MD5ce7f5b3d4bfc7b4b0da6a06dccc515f2
SHA1ce657a52a052a3aaf534ecfbf7cbdde4ee334c10
SHA2569261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1
SHA512db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb
-
Filesize
106B
MD5a60a7bcfc47eacaa66e5e3d701d3ba80
SHA17093ffc5beca33187c18461c7ff3259a1781ae35
SHA25617e96efaf7f2e45e407a3c68fb57b78f09dea6fc1edf3732b888be4a4eadd468
SHA51258736bd680d6c7a25b8d7db08fd4a258cf761dbaa44a5ece0c2b813ab12c20dc213ab40844dfc780687945cf2459f549f1a38bf3da16c5c332756f3b53e1c3a5
-
Filesize
81B
MD5520bb9b65b89f03050030e5a985b9cd1
SHA191defba6d4540d4c8ede177730d104d747e8f57b
SHA2566bb23965fd46b9ffe67a1cdb2144943543894e063c05db3a4de54e94b84968a0
SHA51281eebb3eda761a9ecc94aa9564deab4d476522d94025ec19e002e91b12b7fbf2bffda23e7c393c09cb91b6ecd953ec1bf39ef5f787058b70289a5a5d777f0cf6
-
Filesize
122B
MD516a15c7222b5f487f9e47219bec96c9e
SHA147bb4748ff46c6365fb2bf5b22ca60387b4f42bb
SHA2569ae1d6f1888fc41b8d9c6315df10394ef187eb1f57ac0abe48c5606b3277463c
SHA51241595eb4b33c09cf1d087977c2a49c14a2894083a4d73dc88a0c9532e6c6b546f872c7cec14a16f674ebd0137c04e690124b777e197677cb964eb9336745d919
-
Filesize
122B
MD55b21a7d986c41307be285d416dcfbfd4
SHA199f5e69f60b6de45d6e2ef98b06d2a16b0b8dbc1
SHA25632e02684c812ae318d21fd46c6b34bc663c8a36279535e4f01894c01ed04deb5
SHA512f8003c0b2274fd15567bb629a44489cffddd2e45981345c64b4d2b35b78a4673046441660e496cb834ce13c25e130607cb948a273f9c1d08481c1bb92204429c
-
Filesize
124KB
MD507356a34f2cc8d035a63a290c983cff4
SHA1896a7a31d05d7c6269037ad9f18e84863fdb043e
SHA256c0447c30031e68865ce24a8ddb4eb7452a487b3e92ab77327cad1df851df26db
SHA512f73e46e67e5ff90d04043c8a87bb93731633bcbc015ef5fa4518bbbcd05844ffc97105b8110e09e17091c84388916ea9269112b480be410575ea3fb5a7071908
-
Filesize
158KB
MD53beb34e02eb9bd01714f9926b3ebfc96
SHA1d558e451b1b1ea9f8a7a29449fe1d2985abbd96c
SHA256032673ebc61db6f46d76d507b19b1b0136a3f7e766a311f38921d2ee7fe450be
SHA512f882c6dc232cc24367e6a83117a8f358860fe8cc9b5d67fa2255645a43658e1cf72af44fa3708ec03c24a788c78abea2a268214adcfcb52aa7dce207102627ff
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818