evilquest | 2b5ebe0390396cd8ef1c167c60d8af1cbd252748ab5f909b57936c86bb1f3e04

Analysis

max time kernel
150s
max time network
146s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
26-04-2024 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0043450eb59e16890fa0f0035d930357_JaffaCakes118
Size

168KB
MD5

0043450eb59e16890fa0f0035d930357
SHA1

cac85c2904e54383d80d6cefe45ea4b1a0edeb2b
SHA256

2b5ebe0390396cd8ef1c167c60d8af1cbd252748ab5f909b57936c86bb1f3e04
SHA512

a4bf6b6b48b3836df1e612ea57a09e8fb7db0dc93508a51808ba2c77438aa0723b6a486daa2ea46aa4bd1bc4396b45eda0f2d95bc39e0cfc969a875a9543f692
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9y0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008adbe-0.dat	family_evilquest
behavioral1/files/0x000000030008adbe-3.dat	family_evilquest
behavioral1/files/0x000000030008adbe-8.dat	family_evilquest
behavioral1/files/0x000000030008adbe-13.dat	family_evilquest
behavioral1/files/0x000000030008adbe-18.dat	family_evilquest
behavioral1/files/0x000000030008adbe-23.dat	family_evilquest
behavioral1/files/0x000000030008adbe-28.dat	family_evilquest
behavioral1/files/0x000000030008adbe-33.dat	family_evilquest
behavioral1/files/0x000000030008adbe-38.dat	family_evilquest
behavioral1/files/0x000000030008adbe-43.dat	family_evilquest
behavioral1/files/0x000000030008adbe-48.dat	family_evilquest
behavioral1/files/0x000000030008adbe-53.dat	family_evilquest
behavioral1/files/0x000000030008adbe-58.dat	family_evilquest
behavioral1/files/0x000000030008adbe-63.dat	family_evilquest
behavioral1/files/0x000000030008adbe-68.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 10 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

Launchctl 1 TTPs 20 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/0043450eb59e16890fa0f0035d930357_JaffaCakes118\""
1⤵
PID:487

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/0043450eb59e16890fa0f0035d930357_JaffaCakes118\""
1⤵
PID:487

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/0043450eb59e16890fa0f0035d930357_JaffaCakes118
1⤵
PID:487
- /bin/zsh
  /bin/zsh -c /Users/run/0043450eb59e16890fa0f0035d930357_JaffaCakes118
  2⤵
  PID:489
- /Users/run/0043450eb59e16890fa0f0035d930357_JaffaCakes118
  /Users/run/0043450eb59e16890fa0f0035d930357_JaffaCakes118
  2⤵
  PID:489

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:490

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:490

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:490

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:514

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:514

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:516

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:516

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:517

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:517

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:518

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:518

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:519

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:519

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:520

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:520

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:520

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:521

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:522

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:522

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:522

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:523

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:523

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:523

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterB516C108/OneDrive.app
1⤵
PID:524

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:525

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:525

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:525

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:526

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:526

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:526

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:527

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:527

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:527

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:529

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:530

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:531

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:531

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:532

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:533

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:533

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:533

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:532

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:535

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:541

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:541

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:542

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:542

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:545

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:545

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:547

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:547

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:551

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:551

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:552

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:552

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:553

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:553

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:554

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:554

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:557

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:557

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:558

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:558

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:559

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:559

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:560

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:560

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:560

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:566

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:566

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:570

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:570

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:571

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:571

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:572

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:572

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:576

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:576

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:579

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:579

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:580

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:580

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:580

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:589

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:591

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:591

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:595

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:596

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:596

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:597

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:597

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:597

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fea491c17836d9c2f44f4537243d3b06

SHA1
9aee3075592c5a4ee7a6c82bd4c7725e323503bb

SHA256
39503374656db6270c23eb9944d1b9e92fb8644febdf294ea8618e5261935f31

SHA512
b81efd3c276ab16dd9472e9a546252ac1236a351efaabccfdde5dce49bc6abf22260f78cef58ce95ea0f9ab053f83c6767af19bea91d1b41a52e1f5ef3eea460

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
479602e839a936e47b158a6e271c3c0c

SHA1
44aa66bcbd8118aa68bb9da14524046081fbab43

SHA256
0af965150db895a6853a25ffd71325ae81da588c8c69cde87c65e761cdf0c3ba

SHA512
e7226e57cba7a0b3df5d09590d9540ef498080c570f69677265f2def1858acee3faf1418bf5d2f47c0b979b5dfeba7127d808c692e7f7b05d34e760e0517e4d6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
534213a235bcda5d49ba9fd4d10a21cd

SHA1
29602d93ab9a92850c86e630c73659c98c944d74

SHA256
0226734826d8cdc275044c9b7b8b7d3c56c2a2e4ed04da78c4821e7337d4bfd0

SHA512
fcc6a16764d82fffdd15ca6d4e182867520cd682ed4edcf5d84c339b1e790067a664ea3300a091016133ba7b814f84bf51d79c681bdcb84bcc673e2f1cda7831

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9cb95d4e18e0b69f708fce431415eee1

SHA1
115edc87271a65eefb0db545408e42c7fc44e81b

SHA256
cc5a03e25428cfbf80ecd5cb86d74d916ea3a3ef7ef71dfaf44e856aa449e2da

SHA512
ce7b8b5117b8977b57472619f9d2ba09d51d12bce9db6b0173a7529154bcadee0d58e77c8ada70f757c2db4187b94f9d48b71f07f9d7efb0009ce449ef180d38

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7054a071ed431e52500920e386451f20

SHA1
eb2e9d752d30c0725d6897554e8df076456a72ce

SHA256
a41038f6e0e258b4affa86d04eff61b3e73257886916bac0b53ce72cd47ac892

SHA512
1a1d14ff402e95cb83fb84e88851610a169593ef582403338addf060c5059539a5c7c382d231eea969098efefca9e3bad5b5e395c19235d43cda2eeef9188c64

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
3ddbe5d1de1cc7767bbedee1a28e0bf3

SHA1
2a5763355072c569db3086c84ba1e74e24e140a8

SHA256
747c8510d9263863bc828e6cced170f1ab0233ea6b974201e69c67c7eb66b92b

SHA512
758d31e58d626123987b2170ae6b3a05623d60ee17f8e2628c987cba3309988043342fc69f58cef78e01380b99e7bc27fed3bafe8084ad488566882968d8375e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1605ccb53b0697a096b9fc5afed190fe

SHA1
c759a92f21a48ce8c5d23cfc79e1818b046136af

SHA256
305e6e419156a8890736a004f19ccca80243876c52c81d1fd4a7dc8304666e7c

SHA512
0882b7f09fcd92585b9b13400b6e5187d0ff0489ffa720540f952fbfeb12c06733323eed42186daf19c6b7266d835363543f64c6ec1a7470a80d2d7100b565ae

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
15229501290ea1944fe905b2b20d87a0

SHA1
861cd54a8de4b73201ec09815e2d675b3a9fce5d

SHA256
96ae2cc5e4dcdd681a869962138fb631611590f716a59f946f2fe933bcb534b6

SHA512
f29cce6cd563a6f5e4969548259295dd156c4292f92e77dd1589311da7aee6e388e8ae36e0737051e1e20951bc0fcc9ea729776457ab72da26f92d2f3fe1c759

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8ea7cfa78035f6816ec5ce15f7c4fe3f

SHA1
af6e325bef3ef393210d6e192d10665d33fd0cc9

SHA256
0d6f5959e0d3e838e54d3cf05de0bcb4d17771302df6b3d3721ae954a9a04749

SHA512
9d1d3224cf685b3a7e8063736ac115a852ed05ffee79a5c62d3720ce35ab6933b96072eccd58806b33adeeb28a075c8d8896735874cdb00a092e1eb777efb596

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
048325954841973f4f6941af05f73d06

SHA1
a00e717b42b7c6599ab741c2dd674f7d456abd88

SHA256
33a9b16afc84a6812a4cebfa82d624a2c43e337c03204df072f02700db837672

SHA512
7340b2537087d8f012aed804e6453eb382aa6bf13447448d249d60fdb22c59fb6b2716ac5c6e7f3a4c463dee9a733cf93aecad78c2dfee193c8cd7ef59c1e9be

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
dfbd04493f2db234dbb52b4ad03d02f2

SHA1
a29306308dc5305c408d6800587889865f923bbf

SHA256
770422cb411d2e866936d06609e6b625540ed193c3b1d38dbeba97d6084ca1f2

SHA512
eb2919f7d95d648e5bb6f598b797ef8f4d8ee34c009bd7bb4d8b33bccdcdfdbbafde8044a3d90224eccb3d45420e5a1404891b9459df4b7952ab183f05ac6f2f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2cb19b12a8ae3d29af75b03221ad762e

SHA1
9c13eca8726dc281345d922b51e9e7341f194329

SHA256
c99bdde295e2cf82695eb7f9e7748233734477cdd24979f183db43302b9e5615

SHA512
8c13046290f016cd04a4c2ad672e81eda4854402e4ba453561f988e6a21893bd4f9812bb31d0e94323350e22b62563bb7334014f42752cdc9ce7a8031c77bf19

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0bc8cf282f809b24b207d384bc55bc85

SHA1
beb52ff460565501b3a2b7499a5ebe7971e82c8c

SHA256
cbb620bc627dac02a6ca6c03ff0b82bda16884dc5d1e101e44299b12027c9fc8

SHA512
f721c57dcb9fad4d794736e2751961469b91e7ef1a4de374bbc860517de6d440cea96b167465ea1a1e578535e69bbfa243352afd7485891ef520cd9e2d44a6ea

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0111a742dd3f9a4b8abedef729b67dd9

SHA1
d36bbefa85dbab522add3d9fe3ab0686a554da4d

SHA256
55c4029a5473a165c0a54f6a61cdd86d9571dbed2f52a37fc95bdc6fb1b41a20

SHA512
b2590a5917fe77156c507f11b1370832263b33f6d266fc928e6a46bbaacae02b22962bac1683496c0d830224d4dc66fd5ec4b3fd88cc833cfcb477e2cd0a7792

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0f3efc00a989c99aa7da4d2220f9ac75

SHA1
d2aba30e2add1b845ef3fb86ba0e7fc16301bdbf

SHA256
1f769f1e1071f6a0344cca57e8286abceb50e804ef91a07dac99aeb78c4765f6

SHA512
88d99169e6c4fe3a35fbfe49fd729ea2dfd45e89ed3d3367533761bbe0a4126efc63052bd449ebc6911ae0c7ced5d3a0b7d066c6db8003fd902fe99fe1353c5b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d99b5eb5e0dd31f23e95dd52b0c905e6

SHA1
5746a737c03bc619e08bdee448404bb25ad58683

SHA256
6c999a46ee87fdee0ab7df6392dd9ce17a86e0ef198605036662638e7e094f05

SHA512
2d053f60cba8bbb6684bc6716352212b0040fd7f2943728e6e54ca0279b793af9c64f2808ef83a4e8784dc5f60dd58779523ee05a984af8abb3c386c20a40177

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
cb960ccbb63cbbf3321d44ed23fe646c

SHA1
18b7bccde324f792520e855282cfe8cddbe4c55a

SHA256
59125368c1c6565befcddb2c37bd10afdc3ac987f045369caa4260d9bd7577f8

SHA512
04c08f41d0fa7947710df6e5c0b91efa33d42bdf27d9fa610d340364bbff213236d309f540af10b1186fea1e68bd86540131738aee6d1e0bdae0a8177817fe9d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7a444355052bf5023bb976c6af95f0a2

SHA1
c58b773c16dfd5d927d5511a48d77516211fc44b

SHA256
90af7d017188315572958a0d38ad8910dc9ef0ade5f8a29ab354eadff83676a5

SHA512
059f9a80e5e00a434631b4fb8daa3b55220b405dd5407d3f5ce4801506ad1b9372b4a70c0ebc74c198d3891b79aac955a7b84b1674d52c0ec63cbe90fe0b0353

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3e64ec658d555595298f9098f349ad38

SHA1
0c8263d46bf563e2749471df9b1f884138f082a5

SHA256
7a8686f3f135261a00bcde33b78b9d42b63b3221a119a8a9c26b85ceccb0f7a1

SHA512
df7881fe229a2db115190bc1e30d63f2cce5b50a53c3b19cfa222b474d956efd09af95dc387584edf4af4b8c44c2b828ceec95a0f6e53c83ab3fb237147ceefa

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0cc67d07e225ace5b4a0c278776f8eb8

SHA1
9f04387ddbc2ee81bf9a9cb53c28a949bdacb28d

SHA256
51a5cd90dd8aa69f68f5fd6eca595a7fb3b8c17a67ae3900904b8b900eea2ff1

SHA512
2f16b14aca6b3f22c128ef70d06a33b5a85eea0ac22ac590b5e4641ae9bd4e1a2bc024c31ea2087a03e8fd250952af3031c0998f7b0da55fcf98774daace6c0d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2f9c370c7d03c31696fbd75989e75d5a

SHA1
3cc36e51e547941983051023e081bfbf0b29c0b2

SHA256
f12a38c5a963ce91e5d5dc5bbe2cef31454f90962e10455e1ff0c5b9a7d9668f

SHA512
9666d93b0d7adc2efb9ffda8fe591e51a96da524b004a097194c8988782ad9df405daaf936574851afea2cb6198079514069702665c0241f0843e06c0cd53931

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
eaae921d88d9b6d77ca3f763d4f78794

SHA1
4ad91aff343189a987aeea8c0470cc09c36d068c

SHA256
3eb4fbcb45b8bdea1dec0f599b9fab9622de10fc4e0eeea15a4ac84bbacb1ee1

SHA512
f9bfd76670c1680e663d2fd7ac1e25e04e9e6db9b33454867f62ee25d3724fb716fe30c545ac041b38f45e95c5223151e0d706bce15f5e98abb4e782668e07f6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
381bdee8bf11cf4ad47c92da9190b45f

SHA1
d2673e1364f7a9585ad74afd4ad38857a4090adb

SHA256
297ddc0cd97dfa9bd35b8505a6d91d2798cd7b12005f83b946c18c0ae9d11e08

SHA512
b6d8496eaf044a7226040ebb766ba37a6f274c2478e6e22d92ef84a313416e2248d014832b856c4fa8788a2b9b1caa21b3b6abe4a4c96d446c21af1cd5b5f355

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b1b973da181f367d53d4c4438a0baa43

SHA1
7fb67ed79b76b882417fbdcb7a10c52430b63d31

SHA256
c3b71782482b77de31fc8e29d52593148dd6e076dbe2bff71080b6defc7cbd85

SHA512
298bfedab953d2ab2348f85ba172c08be8e5232b7fd6c584bf1b9cc0f41f6b725f51b2ef461cc977642eff83396c348f687938f7a5a4e41e7229a22484d59307

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3db38c0927bc81d025197189a6fdf205

SHA1
3d939656d284561e92f8dc324c5343fa7e5adc90

SHA256
c2c7b28fd5a00636ce0486de6541abbbc69849241136c7fa530e581691af9113

SHA512
f0cd48924b02dbb875f6c89508467d723e23cbf3f8eab6b5442048fa284052f1d8dc09da320e66e77fae290fd8b2db949176a3e0718613a7464b5cac83d79526

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6d65ae9f7fe883d07f4215bf2c0c3303

SHA1
d594379775a67a6f5db88e3bda05723957ea8745

SHA256
bb35187ce9757d9f03e28e844e5899f35cb6fba11146c117684801391d48eb66

SHA512
7ea4729ae701364893ab47ca1cae9d0a59dcc7f4fbf6da7753ea5f6b98db8ae952a1462ca4014f4617a30c39c9383ff5c924e51f4584afc97e6bee5a2b9b2ae4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9150fc22348993fe5c000536ca83a649

SHA1
a744e71770740af4407fe3a04053c84c662cb32a

SHA256
f374c03e5068b0d81524b28fdcb710e29e071c4ff9b4ce71f86a9570770e4cfc

SHA512
91e666112b6566989d2724ee64f76b9ac34667420570a043206af39424cfd8d2d0949f14435dece0aca368d8d5abce6fa472f45697b0a0d2dcc2d6f6bf743fcc

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
20e051d5fd29b3c02e4dbdcc83e572df

SHA1
58d31fae597cfa30ffc2fd5d121e4a09fdc8f0c9

SHA256
78328313f1a85cd4b20fa3689e421bcb81f5e68b8b34c587c565c49bcf0e522f

SHA512
79f1cb7b946b469591a01361d1e9267b8bad118896d152c0dc443aa3a3255b8dc6a160e8489173937c2589c446e3c69810b98566afe198ee532ce59a7a623705

Download Submit