evilquest | 57a7d3eb27faf33e5294e087b6cdb21392ff6dce7053d945940e670e5e196239

Analysis

max time kernel
148s
max time network
152s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27-04-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118
Size

337KB
MD5

01ffe9ebdd78db6fdda14ebcfde59a6f
SHA1

1d1625a4987c1575ecf0391dc3b87f18c2c2ed09
SHA256

57a7d3eb27faf33e5294e087b6cdb21392ff6dce7053d945940e670e5e196239
SHA512

3cbf9ae42de78e0ef7055a8775a3511b46bcdcad47a9a7ab236d2a77152660d68ff80c16997ed9fe2e0c35d0fae52278bd372f35d7b06457575bc626ab01b810
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY9+1rxZSeOQdaZNxtk8cqhSxvHY9:5LOQdaDxq8cqavHYYLOQdaDxq8cqavHY

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008ae05-3.dat	family_evilquest
behavioral1/files/0x000000030008ae05-6.dat	family_evilquest
behavioral1/files/0x000000030008ae05-17.dat	family_evilquest
behavioral1/files/0x000000030008ae05-23.dat	family_evilquest
behavioral1/files/0x000000030008ae05-30.dat	family_evilquest
behavioral1/files/0x000000030008ae05-35.dat	family_evilquest
behavioral1/files/0x000000030008ae05-40.dat	family_evilquest
behavioral1/files/0x000000030008ae05-45.dat	family_evilquest
behavioral1/files/0x000000030008ae05-50.dat	family_evilquest
behavioral1/files/0x000000030008ae05-55.dat	family_evilquest
behavioral1/files/0x000000030008ae05-60.dat	family_evilquest
behavioral1/files/0x000000030008ae05-65.dat	family_evilquest
behavioral1/files/0x000000030008ae05-70.dat	family_evilquest
behavioral1/files/0x000000030008ae05-75.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 16 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118\""
1⤵
PID:565

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118\""
1⤵
PID:565

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118
1⤵
PID:565
- /bin/zsh
  /bin/zsh -c /Users/run/01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118
  2⤵
  PID:568
- /Users/run/01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118
  /Users/run/01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118
  2⤵
  PID:568

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:569

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:569

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:589

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:591

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:591

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:594

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:597

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:596

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:598

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:598

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:598

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:599

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:600

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:600

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:601

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:603

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:605

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:605

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:610

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:610

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:617

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:617

/usr/bin/bzip2
/usr/bin/bzip2 -f /var/log/wifi.log.0
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:623

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:624

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:625

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:627

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:627

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:631

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:632

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:633

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:634

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:635

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:636

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:636

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:637

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:637

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:638

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:643

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:644

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:654

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:656

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:656

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:657

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:658

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:660

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:660

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:662

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:665

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:665

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:667

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:667

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:676

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:676

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:677

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:678

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:678

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:679

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:679

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:679

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:680

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:680

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:681

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:681

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:681

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
df8ad1b5f7ed8590678c2bc3e5ed92cf

SHA1
2227ca9eac7eb32524fe5e20a5f54c6b0dfdb530

SHA256
3bbb08f4444ad81e79a10af45b3dc623842925815a8b9db599835f6eac99835b

SHA512
09629f7f6a6e1435e4aa4d0f832d9fa10aab60f293050e7692755e21c353ac699fab2d3e1cee9b6172f904040f07ca654622f7b7b2b1c38aa585fe862ec959ec

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
161bfcb17b4215bd04b081ac81c09a8d

SHA1
50158b75d20b5327ab55e6bc175327fe0b5b6295

SHA256
7639c9a061e67a5aac056c8ef6a40071d8c3e1f432a1a05a2a02fbfebeed22d8

SHA512
ba86156f0fb48eac2250985b21bb6f76a0770f7b7b6375f8b2e97f05b30e49450defa1d333185ad04deb5b81b29c8d11de92df9b3444fd7cd70fedc203e16db9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f185755f9288080e981f6abd7e24e743

SHA1
f2760ed46df18bb72b9bfa620ead2ba42c26558f

SHA256
0239d29b30c7d082928115b94545d18456e6afeb9854fbd4e94a79399e2d5874

SHA512
76079bb6b97f46d6bb04d7e8f8101c1bd4b1f5b2a65de3f7d82bf712efa5e0dc4bdbc0f5f7e4ed2ed9a59b68cb6c562c3ff8904192915067645ab273690b6d8a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
66ac45e4c02331dd196760fc519eb1a7

SHA1
c6d31b8a4ff2e03e03b8f5bba6fcd2ce01941e53

SHA256
4ac48208b82539ebe3c6538558d7525ef80daaf667bede60bfe8302288002ad5

SHA512
697f1e476bfe68b5a6f5c1ba48ea8631447f9dea9f994b9324d0db01dd9a3324bf889e6dffb5e9e931646ca657f13a703d15622aa9f337d3fe43cfee18d92e7c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
65e5504783940acb8b4d130e9a79bef0

SHA1
8ea5a7c377cf1b245b8016f90b3ce2801a7c1bdb

SHA256
4b65e997534cabe91d50e6ac3b1928f0f037363b9f970a12ae4e4e5132415692

SHA512
4419088fa10474e463b3e4fb24af03c1ab4da1d43b375d23509da3b65794e22484fffd1cd5ce4cd6183e3145e798cd9dc1283516eab24124ad59d873861ebd8a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b4b123b084ed49927c69d75ad12ab54d

SHA1
8333980ad21d4ef791d9ddc51f4847632050b0b0

SHA256
ce0683bef53217d2b28e8d3aac68aa70ceabd84ded3e668638f5322dc6165091

SHA512
3d990244c61665dc46ae100b4458cda03026be2c3aa3ea1abc5856e0f435c3be3a93f851a30180d55e3c260ddf2336b37d0de8b9bf8c0a76bc3bbc3faabf8884

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6eb68f51b70a7d519a0bb2ca3dbf3af5

SHA1
4f24f166f864a0a8fd9cab35c435e5706092432b

SHA256
b93239fb19720162a7021fdfd72c748bcebf237a95ac2e395c0ea44f8fb057d8

SHA512
7856f38a733042449cf53b26b9dc22387fdb2dc8a1548c02d16cc2bdfdb5ccc901350ec97cbe0353391ebb83cec67f8e4c4bdb0a7a38e5740a2dcf5e859668b7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
028454be06f86a3b863373810eb83c2b

SHA1
efb155f8ca2694a40199dd77bdcd229e17581496

SHA256
8a7405327067e0b4455fdbf33bbd561c826ceaf2be32e18a0344abd7413fd2aa

SHA512
c1d991f98894b1da3a0a8275ba2d77ae4e156fbf4213b25a378be151e19de923eeabfff06c78661860fe7bc51513e63ebe0b89c84b49c0337cfb4142a6d10683

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ebae48955b7423173d921c7d3d5860d1

SHA1
6c48d3fb629a0e9cb38b311c90bc7cc333c2125e

SHA256
480e37bad60143bcb7fad6bfdd23b4f845e500afa366736887d27712e8ad8c33

SHA512
b59d2c81dad824a906f6a23f0efd8e1890fdbc684433fbad255226888fc4524b656645a1098b3f57546b7f738980b7b7eda39e91e38043a928e2b7b0a6ee1fd0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
84f407e58867a1da1b991e789851ed4f

SHA1
63af68ed4023c2d712f70623e5fa98f8beb7eb0f

SHA256
e7965ab8cc487539d8b488c8bd9f8748d8062e90d420d40d2d06ca384d2ece2f

SHA512
224daa0cfe45edb5cb6622257da60f098e83ba04edf375769c8810accbe1f88d87684a401a972ac92840c4f3d46b0260daeb13f4039279e35d2a43fe8b2977a3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ad8af83cd7b1ac9789a290887784f333

SHA1
25900d8c093c88407cfe839300fe17ee8ae0609c

SHA256
cad999e21c611b2f0537458904ae5a775be0aa2de6591e62267673ecbf12c035

SHA512
b391679b6a5b5638c9ceec94e5b0c50f5141f3d5c8b6ff2ff76ac63f076ed6eb08445194d00d5b3f4ce38578432403a7537b3fed02db9528f1247d895d6b9542

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
acfb47fc7d57ef07a6998c8d0e6ceabf

SHA1
9e47b691e4267cb5b7f13b6fa4dfd5eadbc8812b

SHA256
dc7c0a94768f372e7caa2071314fb0d4fd818a39a27a9eec19ef065c2bf4ac78

SHA512
7fd9a2bdc32b9814ec70d32f56e927a7c623f9efd92729afc78d27109bff80fd0eeb61d176a9c1306893719fb7bdfb2dcaf9fc9ed70b24eb8a77ce96d589e86e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d914902bbb5ca49bc9b99017e15eeb8d

SHA1
92924c4e2bc7bf5c03960f9397c1dd78363653e3

SHA256
ebc7c91f95f151e13694cd5b95f24d0b7c1462e1f4a154fea9a5e6aeda74ab65

SHA512
2b8c85af6354c5233c6091eb5e89ca85e542917e5f169518c629e92437567ff3b392f659b0c6d2cd2f33252cac069cf51bafa55b1a28dbea5de0fd7c6fd630b4

Download Submit
/Users/run/01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118

Filesize
337KB

MD5
cfbb318f0b7f9abb0807706174e437fe

SHA1
30e9ee444f1d2bfbefa8e0d98a54983e064e4c3d

SHA256
ecd5fd136a3768c3ff525d6ad0d35d78a72d97f9e5bbf2163bf28418280baf57

SHA512
ae6705f34869eb878ccf6b218e1b8e0e48fb17a747f7bb44433d47387d1860124c19590cd2a4d9c6ace04080bbfa555fa5b6db3b435507af3b4b86ab6662c3f0

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
27e40184f8b3b72bd6e85cb674557e4a

SHA1
589c584c9cb0abf605335097c630d9f13bd57d6d

SHA256
ec4320eec48694c78b75a8f423312d04dd1182f93e7e291bc2121159bd400d79

SHA512
08c3550b8169245143637fa0ab1061fc60fb13569ef57c8773c023c1c817085a2e14615b824b4c28b0e3e2229b14411eb3c400b8af14c9492e401d5faaee79b9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
d75760640f5197b96632c45535e2562f

SHA1
d4b3d01e6e3e84e04826ba3f5cb8e0633393dc1e

SHA256
802137b414bf3ea373d942a62991e1d307b08a2ae967a0f364caf1588c03add9

SHA512
82d876d21ff3edfce64ad8d07800b13e1d1c8b09e585d2e1a45775be311ee33415153e5519782e58babd133814e6c8cdbdc9e18db4b70b2c14d3489c3d59c06b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
99b1ad77b0bcb0f91a19a69cd6364243

SHA1
d120e172761554191f68815abc1c9bd323baf701

SHA256
95a8aa90602e7a9b71cc7fada87b158f66057625a3f370cb53b266d44f21447a

SHA512
5a88fa93f8d5c046137140f099c597c898e31ff255a1bc6df14b2d147165df93cd770f301c432df07dd55e73ee5f60d9585866b8ec4161a187d199acd9ce1217

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
1557f2dbb973bbc214fe4cd3fd68c7c9

SHA1
4ff9cf409b74d6038da18f9d129c6081728c9d82

SHA256
76788eaa0ab1a537644022ff60cde5a05fa2eb398d7f23a37228033d6c888ebe

SHA512
bf8e587f59e6bcae0f92f1f3456bc5ff4ae86199e219097bd5686fd755780064d86933dc19d0f5098f6af622a8f89f76a003416439af92aeebdcb022c4a6b98f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
8fbba10f691a204bb8453dae52f493ab

SHA1
a5afe9977ef0e5c39f38d360d5016934337d2a0a

SHA256
7d4264808a96670e31f428d03e5f7b8bdc79f59d43423be3ebeefcfed06ce362

SHA512
7479f32b4f368f90e2f725018102c54d314b619869972b25d9a39f7b06cdde817dde33e79d58e6ab859b5da3dc162ed24c491235ba22fa76aedc05b3ceae5775

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
adbbf0e7677c77f1a0120eff99f2b416

SHA1
701818a33bde49104b40ad539bbdc8476cc6b43c

SHA256
88fbacb5f50e77b2c16fb60518753f770170d72a0160c9a79d2c5bb316d88253

SHA512
979f52c733f17c6e977740dcbe68778a2fbfd6d3b2c464b9f1a78a084bf235787fb00f5f33f91bad2547b6cf85f5c7facd16e1dc32b20e0d20b43f63242d5b12

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
4d9d3cf15064166e4a21dee666541a4e

SHA1
6b2ec9acbc3b20e31b6639980642cab86753fc2d

SHA256
371c2a5bbdbc9fc0d84939f190598e4ff243e46f7106fe5adfa2ebaeb745fc3c

SHA512
0ff38301b489daf29b08beae333337281f1833e9aba2161dc7f2f354bb6da941ac6ec07e8eb406a483905f9f3aab60a7eab672fd6419584888c4f88146374c1f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
6719683871fa636fe8577bfa32ac2060

SHA1
d1de3c4ae34ee8422745c8c29aec3ef321b9d541

SHA256
e118d29a94eb20e932a2ec64a7b4b267d76e190c0d88b6971e2cc9f33c99ec54

SHA512
1c9e8979e32ecd0463c82ef0cafdef340490b0b4383c0b4d1fc43a83e7c4181fadaced4d882467945c2099aacaf0760ab759c82b8e36becccf56f01feddb5ccd

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
d2a2773569b7049a95ec01990e5d14ff

SHA1
2109a002220db840dad185daf8b11ff7f4739a36

SHA256
81dff4460e92a3818c251f62ececa5c3171d7c6240320c7f2441ac186d45a111

SHA512
19f92a1a3b0af7ecba65fdbc5203eba69c6220e34768b8c7f93971543c840418162370b89efbf3c84cfc8d898d1fd442010383c24880efe1ef680d4d5dd3a47c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
de49e8d27bec416b288624841a1fd05a

SHA1
9535cb6275f9f725ca4a8060bcdcad07e1d8ed7c

SHA256
7d59afdf285d0d92c42e745839568d5a05bc28877327a5acf93ce04060d884f2

SHA512
742ffe069c02b78365812563d6199ee7b61a2ee7a9c273047cece3e7848314eb19b3ade260213df248788c6a2a0445b261b77adbacc6d55b949cbf8fcebcefdb

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
eb2ebc9ae160c9423d2ce122e427f19c

SHA1
e418058f9a328d046eef29205ecc140b11b03d3b

SHA256
e1cf938e10a38401d11faa1bac85ee72a05ca4b83245e1adba8c381bcdfcf2de

SHA512
e94ca5fcc271ae277264eb5bbd8a8346a7d4cd3a772b4afd6e5618af479e2e032675828262d40027619f13daff8d0fa407c5fe370be067ae32d39e4d86dc6f73

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
251b5be1a1b3f32a005fd89a47a5685d

SHA1
3eaf3372318c86423bfea13c7644bc9b6841d0d4

SHA256
f839277616f8118f6be198ad4b789ceb2c27bb6efd7f9bd726a9b3c15a25b305

SHA512
b5120f71ebfc041588e6947851eb20477515aca46f6859989b82dd7b390ffae583b7210f28c7b3677d06e9cbfb2438ef72aa261a2cdb6142ed33640ac304efe5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
60567dd125e57e8fc7d65c948c8c9401

SHA1
87e540d3bfd9f586c707f657076fb2ac798dffc3

SHA256
1446470d16ceb948cdef9d4a24312d5b911d99df5a0c317c6cf289bdb3cc6f72

SHA512
4a41e0d53e0687aaaf7cbb1295d451ba1fd4c550f7c3e96ae116b74c71e26c19fa175084ca9824141fd0555258944420250f067838477866fa2d5a60eb3fdab2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
a9ba061e0817dd422a263e801d08ec06

SHA1
552e407845a36faaea81f851a91c42db5b1eb2c7

SHA256
074107311980d8301a67c37a04be0384b9078f818fedf60bf86ee68b808d7f71

SHA512
1304c2a8296d28710ffcecbd5aa489a748d35b36353a1edb20b23361381ddc1285af1a3a505b494b959158273aaab125d1bfaa5aa53c36515e81ed1138733fc5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
8fe5121628d08e322bdcab28fbeac6aa

SHA1
3b58e69e90e4f98209dbe82e2b6712a51c3e3393

SHA256
52b747f02032132ae9e77ffaf6015d146cdfc5ff68700676b5d7b1b0bda01070

SHA512
4d18cc99b5063d818fa8efa12fbb54c4795b3fcf679dd14b245464dea959da9aaa5fd53e3ad04ac4a4147ed7df00abde7335664f5fa46c844422ff8b5d54b663

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit