evilquest | 010f7558c568939909474526e828951dbedb7e38eac83513ddfde0ad97d3e7b8

Analysis

max time kernel
150s
max time network
153s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27-04-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

023100d3daade2df9fab787af701fcf5_JaffaCakes118
Size

168KB
MD5

023100d3daade2df9fab787af701fcf5
SHA1

0033813dc489d8b8e4d60daedf3b5ce085bae096
SHA256

010f7558c568939909474526e828951dbedb7e38eac83513ddfde0ad97d3e7b8
SHA512

2488bbf84ef0419157a3a956a9eabbac70333c7335b7897ab6cca0f57a32b0b255b470f612bb945ed74dded1db24ff7be5733b550b0693334599aba66b278b2d
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9e0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008ae05-3.dat	family_evilquest
behavioral1/files/0x000000030008ae05-9.dat	family_evilquest
behavioral1/files/0x000000030008ae05-18.dat	family_evilquest
behavioral1/files/0x000000030008ae05-25.dat	family_evilquest
behavioral1/files/0x000000030008ae05-30.dat	family_evilquest
behavioral1/files/0x000000030008ae05-35.dat	family_evilquest
behavioral1/files/0x000000030008ae05-40.dat	family_evilquest
behavioral1/files/0x000000030008ae05-45.dat	family_evilquest
behavioral1/files/0x000000030008ae05-50.dat	family_evilquest
behavioral1/files/0x000000030008ae05-55.dat	family_evilquest
behavioral1/files/0x000000030008ae05-60.dat	family_evilquest
behavioral1/files/0x000000030008ae05-65.dat	family_evilquest
behavioral1/files/0x000000030008ae05-70.dat	family_evilquest
behavioral1/files/0x000000030008ae05-76.dat	family_evilquest
behavioral1/files/0x000000030008ae05-80.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 16 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/023100d3daade2df9fab787af701fcf5_JaffaCakes118\""
1⤵
PID:569

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/023100d3daade2df9fab787af701fcf5_JaffaCakes118\""
1⤵
PID:569

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/023100d3daade2df9fab787af701fcf5_JaffaCakes118
1⤵
PID:569
- /bin/zsh
  /bin/zsh -c /Users/run/023100d3daade2df9fab787af701fcf5_JaffaCakes118
  2⤵
  PID:572
- /Users/run/023100d3daade2df9fab787af701fcf5_JaffaCakes118
  /Users/run/023100d3daade2df9fab787af701fcf5_JaffaCakes118
  2⤵
  PID:572

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:588

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:588

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:590

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:590

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:592

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:592

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:593

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:594

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:595

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:595

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:595

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:596

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:596

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:596

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:598

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:597

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:599

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:598

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:607

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:609

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:613

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:614

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:616

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:617

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:618

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:622

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:627

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:627

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:629

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:630

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:631

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:632

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:633

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:634

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:636

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:637

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:638

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:638

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:644

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:644

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:646

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:651

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:651

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:655

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:655

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:656

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:657

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:659

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:659

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:661

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:662

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:662

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:664

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:664

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:666

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:666

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:667

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:668

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:668

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:669

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:670

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:670

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:671

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:678

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:678

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:679

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:679

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:679

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
76e935e6117af5fee9beaf812237494d

SHA1
af1416db1af866d40bfe04643a496c8058da2f6c

SHA256
fd7cc36d852373851fd142096b4ade203af10050f32bf321ba32d18594f83d3d

SHA512
0f57374930a7565edea5c6babd2c686e87ad72e4460c0fbe1d6b340300d2e9c0ae483cdfc79c08f8328e5fd2ec9aa8b12720e2338ee13f4b344205eb7d2f0a62

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c322576a130aaf8c498d38efff561739

SHA1
ebe74f3b43ed77d6c37acb49c2228cf6dc66a3c1

SHA256
6865375febd0086763cda8ab16b3e4eb2e1e56707490bd2b69492a433739da40

SHA512
6d4be41567567b972300fa9444e2bdff5efa8c82276a893b36517995f6df010fdd2d2d295b6fdf2794a739d071add1d8afdcd757c40bf95d4f98f8489fb065a2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ff020a18a0a17d5350a315417b0be9be

SHA1
c73c61324dde526538c4e7b6f61e5a5bab2029ed

SHA256
61720ac73ee3e87a3081aec948c4920d70e4738b599fc9667c065ec62d1670ea

SHA512
8263939006ed13bc45f1558e7db5096044a3e99215649aaa9e061b70a8d770a37b2d6846212ef9ecddefcf95b852f8f892643464f9eb6b00a550f1addce725f5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0beba921ad8fb2cf4544bdf9727db585

SHA1
aba7879668c36e3dc7648d881f154fd53f9485ae

SHA256
b5305af22911aaf84865541e66e17b6a10fc7f7879c1baeb29f719a850303cf0

SHA512
89b723efe64645f3482023738b16dba177b79cbaa4ea6053359f6e9dd883f67fde559ca0411d8f565992b88ec8062ffab7f1394e253037101324d2c7812fc3bd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f8eef8471d3ed226d3bbcd5b5c2e7469

SHA1
2c37a452906dcb1133526d21292c16569ca4c5ec

SHA256
86cf54ffed60a36e37dddaf2452b0fac62795772a93f1243a3a68cd507ddd303

SHA512
f52f9d33e223d3898c1fbe38fcf74109a632945b4919fc09221f9dc0b58350ceea89ec88766b51062ad332a999c24f62fb36ab3bb4d01278d65e06be93245842

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
54aea3a11285ec04559c0328b194c83d

SHA1
900275273011e8ae10634ce68cef0bf2d2a268ba

SHA256
1c1a01d6e90cb1d7bad3897b053e1c5728e7549fe98f428c50915ab454849969

SHA512
ed5f3a300336cabeac5e9c778a18a28a570a0272c77afb2087999b5f7b8d7f6ac85132839d87fd9802c4468fe281c74d4d1e30c95a53044fa9caa251b70f1967

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9c784dce85a5a5f423d187bf37c8646a

SHA1
af56f9ace0937d12bd4c3595a4389fac6a922821

SHA256
5d3b82d7c004720b18ee3e744e5b75531c58b8213af8de5019143f981f9caf22

SHA512
0ee1175131c3fbaebbe690f9006848bbb9cfa09f7775f4e0e69e4401e3e35ea74b7932904574e78bb1bf755025d782c56a495bf407d94b8d7d6f69b8fd0bbc50

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fd19a47667c3b5972f5d55e2eba57f61

SHA1
ad77ea9e95793b90ddf242e3bb15fedf6657c71f

SHA256
40d96ea75fe0071b26abf722d78a748e83eb420d8fe140be4b528c6031dc85f2

SHA512
a6a76ffe8dc35a64804baf1eda245a76b41c55978dadfbefa94938070ff0ec9e0666cdb8812e688ff82ece877f988d50ccf7c59c57f8659f46ebc43b594a5582

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
89523930136806d17c43d869eb27bcd4

SHA1
f77452431ff6cedb00cd949c74b0a59a94d5f277

SHA256
0d3ed01352516e8833dc23eee54bd82d3f0f03760a86563a76fd9d2a0cf44351

SHA512
df22acaa09f0b729e957fc6ff044440b271f85d0513eac0c2423e01fe56d0fb3132df7a422b7082c8dacce6ee97f97c8c6b6bac4d7214aee2bf7c8faca60609f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d18f068135f18d80aa9b9e60dd8d1b64

SHA1
3551037f1374caecf050c6a82271e2d91ad2cd10

SHA256
f4eab1b0af368ff5f73af917c6fb67fcbd7c3bace99f6b6e3eba87b6267cbecd

SHA512
3084d6ed538bd0fed62e4a6e0a4c0e87c203e5bd23f4b49f37be0046695e461722b68f1f185b55716d9488502aa7a37faf982bcc61eb4b2611f85c067413e498

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
df20f0878cf4817091f3cb9b5464ce0a

SHA1
80edfcd201911aba9ae962e9064980ea9fb23dc0

SHA256
4da13a5b77c224042b5700dabeba5cae0eaffe273451fe0f9d12591c25ffe098

SHA512
afb7f32cdf8f87b1b458d1a34a889f96e4426c8697cd1900255af8975531624c0507f21dd3e9c402d499b393f7d2a6441af2b6980b24dd8d0fbf103f5e6689d1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
521c7ac635d20fbaba8c9abaad9e90d6

SHA1
837f016090f64dcf88cc7f764d5725582cbc70ca

SHA256
d4a7bbddfc90b9a4be36d144553a70f03c6764a95ce997984e1a60e14b11c8ae

SHA512
e7e3883e5fadc8d65ddd6275f5f3e74ed432176d358b6183473e9fa562a435c7a1eeda5a43c2858e12e549712875bbf8281aa62c5660d60a584bc85839f2fa82

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
32caa23ef0a6783c8d3f2f85bbc1f525

SHA1
496ffedc8e8c0fd27120662ee85f0827e30e8e4b

SHA256
9a92d3e480618ea6afccc8c4a4fdced8c03916c349c89ac9f545cf52b76d3c0c

SHA512
60408f9620b8419990eb3bd3900632d6c5b98f1bb60298d2872d6584347b7da9d30a65d071c4c1cb0ab2ccd18ee0609d76803c4bdf73b6b10e50a4b94d7312b4

Download Submit
/Users/run/023100d3daade2df9fab787af701fcf5_JaffaCakes118

Filesize
168KB

MD5
3b78d65f38845f8705ea5b9986420df7

SHA1
cd1e9e31728e03133d746eb86d5c615724ab062d

SHA256
e0e8ab1c1ab229d61819e708bc2885eaef71d4f963a08f09b5b1698a74e65c43

SHA512
e4300fd1a4f2608dafd7fefecc808f27b7faf2d36f1e0271059a3c73b7c0012a85d9f77e194f32199ebb3d58d0a672bc46c3b09f1ba24113b444e338e3fcae61

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
16c6a461bace0d9315078c62f073a4bc

SHA1
ea871225e35e290337a5f03c56875cd114d2220f

SHA256
d2e8e8a5fa1de7808b796dc0ea14f08fba50ae7974dea3f6049d7ac74ea6d149

SHA512
4e469c6e08aff98d73baa3364851f89508a23e1acf15dc179e60bd8719c8e80019315a9205536017ed79fcd452c0aa504112a0bc33641936db4106dc2154e5b8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8e8b26bce1e39de2f14a22d009745662

SHA1
4e31db9f6da29bc72b16604da142903a4cdf0346

SHA256
54445d6bd0976f16b2f27593412f0139face9587bfabb11138520308f8c38048

SHA512
8886563477c02967f1c61aa75da007acf5431958066b188e2d5e7ee1d460b0bf9b923c0563ea78900166c48eb4657695bf389cdfd9a35c87cf872d14ec58a372

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
546a56601fea43629000ba33e6504850

SHA1
327664a50d0ef4299b2eb6c7214532006af614eb

SHA256
1f82a316a117877c3185b76d21e811a42300346ad41981b1a738c8637b6bb51e

SHA512
1a47409afb99112e0b4b807aeea13d58ddc7b08013bdd5c94ba771b22fca662f5203b1e11dc757b1f8e79b0801c0451922fdd272c0c55f44ab2e237ba1f59b39

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a48db95aeb4ae74730507c508e66e330

SHA1
94e3b13de39c7d3622574984fed60e6bdd720aa8

SHA256
67e1ad9cfb93e0dde142cf6ffea01b0fb75b92d55e860d4c68b1182f84ca3d1e

SHA512
2d01893bed4a1b151652c4e622d95612721bb222468179fa75c641cf16f3672ceef6e84ce9ffba861112d5a987ba425760206b2f4da9f7397967ad98b70f6a8e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
70cf74e3561471002c038c99fea21bd1

SHA1
a384c283eaa540d289d3f55edeaf3336148e3438

SHA256
5bf09f85e5689f01160a5b692cf4883442477f4ea3f105950f26ed848d51f3aa

SHA512
67f52a3c45940406aeef772769b3537be590d30888e03de5e6d328bd700b7e79d347bf275313b2071686941e8cda7e649106a46bb787fb1500a725d3e6870e3d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5f39ad314b9bd63df04f2e3a729afb24

SHA1
62c8937575f8383c84b81fdc739a1cc9569115ca

SHA256
8039f797c635a83f605579a909716e54a295d887db36c7e067a78ad60aeb411d

SHA512
d2eee557ebccebe75f1bab31ef25ac56a0528da323d8767cee9d6e06730c95a8bb8a8a26215a4b514f2bef50cccec752fbb1c181ff7a7680f894bea094531e88

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
967e630e8b84302edaa9f32884452eec

SHA1
65d02846b0f70e6f9d3f6aaebe4193a8503fd96c

SHA256
d68fc9c3d34773a458a5f4b890808e49aab8d74a59617cc77c5d299146dfde9b

SHA512
5e3c5c0b7bdb69d90768730ddeaff871b5fa85ad45d72ab1ebc862e0dc03a38a19f6f54017fed3f2efdd95bd15efaca706d17dc1a61bb7184b9478f938f3e32d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ae570f3ef7cd69052e1b28708dc93fad

SHA1
d3f72c5093dfa36f38dbbff4a9055e490346fdd0

SHA256
084b893a3651d9324a3738cdae5dd4df1e98cd1b5d4f822a8a589aaf2e0f8719

SHA512
3b0c20b10b10683038ada431bc180fcdd35e0574b0c4666d653824404f9ec03939787b98ea77efc6e7857282be9afce537e9ccef3f9215e10e74e207bdb5e207

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
78b1aa05e0602f7d13637299ee147a32

SHA1
3d05abb4dc11eb500fbdddea8b7613f5b0deb089

SHA256
a5ed44e3629587e58859de8ccdd8d11497c89cc8b7d8804cdf4847650db3b150

SHA512
c3a33d3365b1796111fee32c36d55ca3a2c16acd8692c3a78001105efa3fda36406ca4911699d61918708b5e348e793916572f52a8934c7049757926ba185147

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9fbdcefe6b7d3165eecb4ef57596b686

SHA1
b51b866e9f32cb6c03eb83369496c20c00020bb8

SHA256
5fa111fad81246654403dcdfc552c4520cc0a6bdc3e9a27bd21cbb859e2bae3e

SHA512
b7ba8013532b2db78057f3a2aaf1d30bffc4881987114db8cca015b9b4896c1652ae3c9109acdbeab1811360cb9c8f31a7247ec6d8505e53aab7a8b75d721875

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d0deb9b5467a864551dac2e78b058a44

SHA1
07d74ffa575fa12ac6bce9ce940d0c41048231d9

SHA256
ebf9d58d77afb72808a3cfd33802d57bc2493fada0e18455e13d4279765f211a

SHA512
76cba0c56f425c1712fd110b4e0fb0e9fbef8fe1ebbcc609d76a3a24a00752f98ddc040d3880a3e50b18ac28fae030c2e5adb37838ac5157256a42101675fc48

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
cf5505513f527ff2b3c191cccc181990

SHA1
7185aa807c6b06c935678bee9831c3b52c6d7d77

SHA256
84bbca7f5ce2b225d23f5acdff5c0c9a4856ae61ac9046420f187bd8c20083d5

SHA512
696db58b4fa469565a0ed0735d6ab66d87fb2c147cb1f37b966dcc68d3df9bd1dbcc440391c36f7d983ec4ca3498a568cc1104fdec6508cdcccbbca61a3ea407

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
608e82e9dfe7ec68d0404ccaa60989ac

SHA1
86b9323a307123b245926a5ced7bcfe9eb848841

SHA256
b18db59f80ef60f35bb2d889d823b3867a08f63ddc1a8b4152bf12fc022ff29b

SHA512
ca6a85c896ec0c8dd61a25ac6bd9f124c366a7882812f5ca0854c97f30cebc58f37929d4704a36350847471363c170980d608516e4132acc23465e1387754cd1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
791a04992c9e548e842b890ea1aaf39f

SHA1
45032c62c0626a7e5b38751fdc80eff8a88284a4

SHA256
f1c7ff99adadf2ffe1ffd62e56f025fc978fd1f37980bc1dc036985202b3b405

SHA512
09132e7d37ab89190251e628595d3d86e8547aa8777f3a914604e948a27dc742ea1942ac9d2855e7970e88c86c9ea08d02490f438428d3dac3ef48cdc1b8dc2c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
069e05009b4bdd3cd64b778479fbdf5b

SHA1
0df52b6843a0a9b69a8ec50633634e5b4b1b950e

SHA256
973ae7b085b7ae28bd6051a72e93a183faac87d77cd987b3711a2a2245f8f4d0

SHA512
425339cdc72cc84b36e24b2eb4ced075616fd9c1c78d8c8a76b49db7004b2e5f60fd2501e8642205927263be0b2f8636fa0ea049ee7d677862a774ba4a797759

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f4339d91e86140713d8ef18b7906a554

SHA1
fb8c7c836dea669c019b481e4a5925008d6a98b5

SHA256
60951474c566431df7e8fa3ae62950652cc74c6058ff74ba74ace0a4b7e2e32d

SHA512
2affd6e990492e44d1dc0d610a48e69848eda01ac06b0bda3ba5dcaf3766bc77d07a1a3d471280aaa162687f2599a4e07ab202a5fc321e7b0ff6399889cc0fe7

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit