Analysis
-
max time kernel
124s -
max time network
148s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
-
submitted
24/04/2024, 12:14 UTC
General
-
Target
Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/CepAgreement.rtf
-
Size
872B
-
MD5
56c7d7a1176e27e3415b098f2d21b380
-
SHA1
f8cc0937175002b46ac73486cef828b7c4086de4
-
SHA256
5f0ca46768a9801dc5c714fdf6e9f438b6cb98992e987a55ca65a0450b2c3ce9
-
SHA512
78c4c0ed6219be788ad4c0c1feae99170b733d2acee972c27faaeacbfdb1cdf0efafaaca2743d8c6dd23b0cbff4408f14ff26457e9586ea64cf6b3da0c53fdcf
Score
4/10
Malware Config
Signatures
-
Resource Forking 1 TTPs 4 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/CepAgreement.rtf\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/CepAgreement.rtf\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/CepAgreement.rtf"1⤵
-
/bin/zsh/bin/zsh -c "/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/CepAgreement.rtf"2⤵
-
-
/Users/run/Install/Users/run/Install Parallels Desktop/Install Parallels Desktop.app/Contents/Resources/en.lproj/CepAgreement.rtf2⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵
Network
-
DNSbag-cdn-lb.itunes-apple.com.akadns.netRemote address:8.8.8.8:53Requestbag-cdn-lb.itunes-apple.com.akadns.netIN AResponsebag-cdn-lb.itunes-apple.com.akadns.netIN CNAMEh3.apis.apple.map.fastly.neth3.apis.apple.map.fastly.netIN A151.101.3.6h3.apis.apple.map.fastly.netIN A151.101.67.6h3.apis.apple.map.fastly.netIN A151.101.131.6h3.apis.apple.map.fastly.netIN A151.101.195.6 -
DNSbag-cdn-lb.itunes-apple.com.akadns.netRemote address:8.8.8.8:53Requestbag-cdn-lb.itunes-apple.com.akadns.netIN A
-
DNSbag-cdn-lb.itunes-apple.com.akadns.netRemote address:8.8.8.8:53Requestbag-cdn-lb.itunes-apple.com.akadns.netIN A
-
DNScds.apple.comRemote address:8.8.8.8:53Requestcds.apple.comIN AResponsecds.apple.comIN CNAMEcds-cdn.v.aaplimg.comcds-cdn.v.aaplimg.comIN CNAMEcds.apple.com.akadns.netcds.apple.com.akadns.netIN CNAMEcds.apple.com.edgekey.netcds.apple.com.edgekey.netIN CNAMEe14768.dscb.akamaiedge.nete14768.dscb.akamaiedge.netIN A104.68.86.71
-
DNShelp.apple.comRemote address:8.8.8.8:53Requesthelp.apple.comIN AResponsehelp.apple.comIN CNAMEhelp.origin-apple.com.akadns.nethelp.origin-apple.com.akadns.netIN CNAMEhelp-ar.apple.com.edgekey.nethelp-ar.apple.com.edgekey.netIN CNAMEe11408.d.akamaiedge.nete11408.d.akamaiedge.netIN A23.220.113.166
-
20.52.64.201:443tls, https -
51.116.246.105:443mobile.pipe.aria.microsoft.comtls
-
17.250.81.67:443tls, https -
104.68.86.71:443cds.apple.comtls -
23.220.113.166:443help.apple.comtls
-
23.220.113.166:443help.apple.comtls
-
8.8.8.8:53bag-cdn-lb.itunes-apple.com.akadns.netdns
DNS Request
bag-cdn-lb.itunes-apple.com.akadns.net
DNS Request
bag-cdn-lb.itunes-apple.com.akadns.net
DNS Request
bag-cdn-lb.itunes-apple.com.akadns.net
DNS Response
151.101.3.6151.101.67.6151.101.131.6151.101.195.6
-
8.8.8.8:53cds.apple.comdns
DNS Request
cds.apple.com
DNS Response
104.68.86.71
-
8.8.8.8:53help.apple.comdns
DNS Request
help.apple.com
DNS Response
23.220.113.166
-
224.0.0.251:5353