Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
132s -
platform
macos-10.15_amd64 -
resource
macos-20240214-en -
resource tags
arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
04/04/2024, 13:48
Static task
static1
Behavioral task
behavioral1
Sample
42.zip
Resource
macos-20240214-en
General
-
Target
42.zip
-
Size
41KB
-
MD5
1df9a18b18332f153918030b7b516615
-
SHA1
6c42c62696616b72bbfc88a4be4ead57aa7bc503
-
SHA256
bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
-
SHA512
6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
-
SSDEEP
768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/42.zip\""1⤵PID:533
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/42.zip\""1⤵PID:533
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/42.zip1⤵PID:533
-
/bin/zsh/bin/zsh -c /Users/run/42.zip2⤵PID:534
-
-
/Users/run/42.zip/Users/run/42.zip2⤵PID:534
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.secd1⤵PID:539
-
/usr/libexec/secd/usr/libexec/secd1⤵PID:539
-
/usr/libexec/xpcproxyxpcproxy com.apple.nehelper1⤵PID:540
-
/usr/libexec/nehelper/usr/libexec/nehelper1⤵PID:540
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:541
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:541
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵PID:542
-
/usr/libexec/neagent/usr/libexec/neagent1⤵PID:542
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:573
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:573
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:574
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:574
-
/usr/libexec/xpcproxyxpcproxy com.apple.secinitd1⤵PID:575
-
/usr/libexec/secinitd/usr/libexec/secinitd1⤵PID:575
-
/usr/libexec/xpcproxyxpcproxy com.apple.cfprefsd.xpc.agent1⤵PID:576
-
/usr/sbin/cfprefsd/usr/sbin/cfprefsd agent1⤵PID:576
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵PID:578
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵PID:578
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵PID:579
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵PID:579
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵PID:580
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵PID:580
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵PID:582
-
/usr/sbin/spindump/usr/sbin/spindump1⤵PID:582
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump_agent1⤵PID:583
-
/usr/libexec/spindump_agent/usr/libexec/spindump_agent1⤵PID:583
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:589
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:589
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
439B
MD5c05b619361d2cac0288befbdef519546
SHA1634e507971e2bd2697df0cdbbe8772e6fbec276e
SHA2561b2c817978649cad70d67be41215a663790d97707b7512cfc156b488438cbec8
SHA51286308ab30375670ff5eb886d50e3b5be5f3b7d60e0de53458e0372c0c67cbfd1c58450acb201c7d21a5f351c2b0e796d1777dbaa1e2b83ef7f69a83dac26ba20
-
Filesize
487B
MD5e251c94fc14a772dbd695b0919d4f53a
SHA163c2eaa2aae3f097a6ad8952064d4764fe8295e0
SHA2562e8a5e8288abdb773269792173899a3261c3a04c2a4d07c119988542d1978b49
SHA51292222001d9e6f4bebf5abfc02f4a0b379b33c4f7dc4e9b27170e8b2d43f7c7e017632f893619d04f01eeaa48cfd79f77c7b910cc47d74d5b81f69ea83bd69a5d
-
Filesize
124KB
MD5aa186f9f58d8d1e4554edc17b69b1e2e
SHA14943e372154c718c88900d58d6d465a103e897ee
SHA25679cf7cbf7769ca60baaee6eb1b7b219020e0504756d3d12d8e7f25f7b33bcad0
SHA51231f4d423df9ad3ccc5a7eefaf3e04749e0438e9d72ff24a94bbd194273d26cbbb6e550d4f9460b1f2d65a1ae8514af94524217f227b29bf3c2e784443e7cbd9b
-
Filesize
162KB
MD5461dcb8e6914ac8c3efadaa2ab3bfe82
SHA1bfb82d565114a505c0dc45a7b88c64fe24c2a96f
SHA256267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904
SHA512b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818