Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
144s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
26/04/2024, 10:43
Behavioral task
behavioral1
Sample
0095fcb2ca39c6c0a51baf727c88f82a_JaffaCakes118
Resource
macos-20240410-en
General
-
Target
0095fcb2ca39c6c0a51baf727c88f82a_JaffaCakes118
-
Size
168KB
-
MD5
0095fcb2ca39c6c0a51baf727c88f82a
-
SHA1
8e8119f8ebc17e0ee5694a227a48b8758bd81bdb
-
SHA256
31713adac874ff763558bf8574101523171d97e88d25478978ff59e6a9a1d920
-
SHA512
de78f5ec0b7a02fe99ce66b11f9dd03a6946d5370a4cdb1da65e61a748e800b499a0c89dcdee9e587ce994f99852529894f73dc5e07dfb7e6be89790405861b4
-
SSDEEP
3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9ed0:5SeOQdaZNxtk8cqhSxvHY9
Malware Config
Signatures
-
Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
-
AppleScript 1 TTPs 2 IoCs
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
ioc Process sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found -
Launchctl 1 TTPs 4 IoCs
Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
ioc Process sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/0095fcb2ca39c6c0a51baf727c88f82a_JaffaCakes118\""1⤵PID:485
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/0095fcb2ca39c6c0a51baf727c88f82a_JaffaCakes118\""1⤵PID:485
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/0095fcb2ca39c6c0a51baf727c88f82a_JaffaCakes1181⤵PID:485
-
/bin/zsh/bin/zsh -c /Users/run/0095fcb2ca39c6c0a51baf727c88f82a_JaffaCakes1182⤵PID:488
-
-
/Users/run/0095fcb2ca39c6c0a51baf727c88f82a_JaffaCakes118/Users/run/0095fcb2ca39c6c0a51baf727c88f82a_JaffaCakes1182⤵PID:488
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:489
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:489
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:489
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:513
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:513
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:513
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.authtrampoline1⤵PID:514
-
/System/Library/Frameworks/Security.framework/authtrampoline/System/Library/Frameworks/Security.framework/authtrampoline1⤵PID:514
-
/bin/sh/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:515
-
/bin/bash/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:515
-
/bin/launchctllaunchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:515
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:516
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:516
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:520
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:520
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:520
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:523
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:523
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:524
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:524
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:524
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:528
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:528
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:529
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:529
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:529
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:533
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:533
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:534
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:534
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:534
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:535
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:535
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:536
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:536
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:536
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:540
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:540
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:541
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:541
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:541
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:542
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:542
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:543
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:543
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:543
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:553
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:553
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:554
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:554
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:554
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:556
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:556
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:557
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:557
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:557
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:558
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:558
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:559
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:559
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:559
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:560
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:560
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:561
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:561
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:561
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:562
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:562
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:563
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:563
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:563
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:564
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:564
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:565
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:565
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:565
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:566
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:566
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:567
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:567
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:567
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:568
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:568
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:569
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:569
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:569