evilquest | 53c9ce413387a60362551b9e0d3e9fdaa0a7e23a80c851f1baba6b6f4b9fab41

Analysis

max time kernel
148s
max time network
138s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27-04-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02a762458c49af4a4392db04a33440b1_JaffaCakes118
Size

168KB
MD5

02a762458c49af4a4392db04a33440b1
SHA1

bf85338874cb6a4fde325d044d7261b280b4e763
SHA256

53c9ce413387a60362551b9e0d3e9fdaa0a7e23a80c851f1baba6b6f4b9fab41
SHA512

00b47017a30e4f1af87a9252edbf0a2380440522aaf339db6e95b409913be26f620f2568b5a3e9d97e0a3cab8fe718b9f281ea17f51074f1ccd4b86801accb2d
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq920:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

Processes:

resource	yara_rule
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 16 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/02a762458c49af4a4392db04a33440b1_JaffaCakes118\""
1⤵
PID:519

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/02a762458c49af4a4392db04a33440b1_JaffaCakes118\""
1⤵
PID:519

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/02a762458c49af4a4392db04a33440b1_JaffaCakes118
1⤵
PID:519

/bin/zsh
/bin/zsh -c /Users/run/02a762458c49af4a4392db04a33440b1_JaffaCakes118
2⤵
PID:520

/Users/run/02a762458c49af4a4392db04a33440b1_JaffaCakes118
/Users/run/02a762458c49af4a4392db04a33440b1_JaffaCakes118
2⤵
PID:520

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:547

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:547

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:548

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:548

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:549

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:549

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:550

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:550

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:551

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:551

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:552

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:552

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:552

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:553

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:553

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:553

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:554

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:554

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:554

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:555

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:555

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:555

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:556

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:556

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:556

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:557

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:557

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:557

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:558

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:558

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:561

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:563

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:568

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:568

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:569

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:569

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:571

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:572

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:573

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:573

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:580

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:578

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:580

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:582

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:586

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:589

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:591

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:591

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:587

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:594

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:595

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:598

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:598

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:605

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:605

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:607

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:607

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:609

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:609

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:610

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:610

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:611

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:611

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:612

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:613

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:615

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:615

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:624

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:624

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:625

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:625

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:628

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:628

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:630

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:631

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:631

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:634

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
98a2a1fbe744d9dedfc45a056f365939

SHA1
09fbc65c1d5a9f8b88e8a46cfdf7950812cc19fe

SHA256
9deadde5bb9d03cb0e7f74382322e80870e1ee9b51537cfb7ff4bf4e1f8b0920

SHA512
3d91747c2549e8c9f9f8f5c4c3c52e80b8b5a6219a827de5c144e267541433b346bef5feb272fab07f732e3ed06255ac916c72f8151a8ceda741fa6496539c38

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
b7fd93a17c33155eb9e4889bbc6b539d

SHA1
4fd8d7593f4a517a5c8d91cbcdee49a6d564dfc5

SHA256
0196c6ffdec0987094058fbca2ee022b0ef8835d55983d3961b2c34073464ca9

SHA512
8484b9d9b70e860759d42f43dd851fbd0caa1e27dfec8bfdfa25793f70a1da860b8a1c9b1345644394ab92a886b48fcdea98559d4bd4bf07b7e3f05c80bb8074

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
4ae51fd1a5ac2abf743b4d34ff16b392

SHA1
0945acf24cdc206f1a7ca25a8effd363791a888d

SHA256
d5af67f55abeccfddd4a224aedad8afc12bd7e93e5ab7ab721f1506747b5f1d9

SHA512
abe44a448e6aa493bf8cfcfafc421d6d5c62e4098a20f79ce2211e7c1674617346aec1cee0f71ee8c30aeaee7d3047c99061f8fbe544ba0d9850d684cc3d67f1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
0f474e62aa76c029fa90c5d3b550a432

SHA1
11fc394d6360e85b179acdf3b54974ec82b6360e

SHA256
b260524ecf001319c55ac4217f3b48600caebdcf4c39ad08fb45cbf94b5c3f5e

SHA512
3dac99e93ed350151c7aa432854dbd4493c3a8633cc03aadf03e19374e7d9a5a5b77a4bf73d9a53a244561af54db2613ec5aa8f8ced6920fed24371541fd5d35

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
018385874cb178d24993b29ba94d6d49

SHA1
6ca0fcffc399858453d814e375553661ca9af0ea

SHA256
150c8db8b0a4e604a3d5141554f6384a7880c19c7c5c934f3f7baa24df0861d6

SHA512
76ffcd87e111a9079ce0145487b650df9b75de0dd79996286c79e3218f672b8de413e8e73e33ca640832be34ec79f44046e11ddd796899eaa7a5fca18a42f6b0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
9e9effafc09ab929055d9fef4cde67b8

SHA1
f1d416b33321153f9f1e94ba418c38cf972f13e4

SHA256
8ec199187d756aa4c674d564c8d7374b59dd3e745007f6fe34c95a3dca8ec9b9

SHA512
36b8ba37fb9b93f7138e2595bb7bab37b83812ef13235f6ce7215254808d0603cb012822fc0252e9721a2157356ff485e6bc80e72c41a5b3e0363871007c341b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
685454bebed77a1eb83f612f7e87c1c4

SHA1
0dfdba89c2a6d3c6f1486a6a3a96ee150d624f89

SHA256
a1f1dafa77b0ae965d09fc5e5b9294eef7d9f538508038efede98381d1680fb1

SHA512
da49971a2bfd539fa5bf57d6d1595c3ab6708919c261bb77e6d85d09e43eb54adc3163934452e2c8e18e77abddc4a9322c7e7610e9a46f5b7a07b9ecc2d11e69

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
156a99a7160c69b3b57bfa9c31c0bef9

SHA1
544f2da6ae4f9043ddb4b8b4a9ac26d2fb2920c4

SHA256
9e7ad85a4a1b3323dd4c04414485bf5ae831574e43293b1fe374300a053c9455

SHA512
372b4f52489cb84a1e2ff78892e5b824d0eb4428845b426aa0ab87df38697c0529ca534170fb3f37da29d2cd78cfe535bf2d08a2518bd1b0f65c40a467a06369

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
89407f7aaf1b16926877772a3a5c78c4

SHA1
43b55b2ab39762fff72a67d91451ae0a995684ae

SHA256
f6c3bc9999b04d8c9c2d2f79e6d99afdbe1613c75a52811c5a142d88c080c397

SHA512
b73cba4614366b11b74d4b32ecca88c42f6818179faa909be717a39ee36a64e5a19a9ef7995455e11c648a69a9f41cf71e7f49fe67244421e1ff10def957fb28

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
d53a68483a0093594340db950a6a2393

SHA1
f48faa1e306bba0edd25fe4906eb3ec208eb10ce

SHA256
790e2fa4a9d998305fe7d3802ab7e4ba13f22383a3d3900e1bb53ae8c0ff8284

SHA512
9e0fc9793e2c968c8334f1c28c2aa543c84a50305f7c460007a4d564c7bcaa5db941ee5f6500377ea56197aa0b2852ecd7c407bd3dd5a9c88eaff922aaf37bc5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
a7a1247afc8fe893cdc46c10dd0d5faf

SHA1
f6aa44e984eb24c0c69b9226f9b80a1922d0b9c2

SHA256
15058d01d7d3c3e4352b23b86c7bf278b0e0dc9dfb67125f367e32b201d23676

SHA512
e35b4d802d092624b446cfa5f1731c21974171319e6172787990e5e842972f99d85a6bff6af184fc096346afe84861fe6c7b696fea2aa21e8c5b4f72593aa189

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
63a4dda38f9efaa264cd7cfbd3ac714a

SHA1
2080a0558b20d16ed4de73ae41a059fd4560605f

SHA256
0a025ba08ac75b25fb29652e1ab1db8b8757205389ba4e074fa0e0ba625c82fb

SHA512
ee6fa450e4c4aa6c614336a2c787140eef0935bd03931995cdea4e33320c6922ae114c7efa25d9868404dfa452278d2de96485255951cd14831affe9a0454a0c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist
Filesize
156B

MD5
d6eda6acd0601b451963dde41d306794

SHA1
96baf2a69cfe33b0a718fb811066843755355565

SHA256
92e99543be8ae8df598f141d67cb3f0ce61dc4678915b322776e16e5d1d5ac7f

SHA512
af97f2a2532c1f87a08805b425f0651acb2b4443432472c8b3705772c3256938919dbaac8630a3929196279d15eadd54b75f9e2402d54118de38164313485d7f

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
106B

MD5
a60a7bcfc47eacaa66e5e3d701d3ba80

SHA1
7093ffc5beca33187c18461c7ff3259a1781ae35

SHA256
17e96efaf7f2e45e407a3c68fb57b78f09dea6fc1edf3732b888be4a4eadd468

SHA512
58736bd680d6c7a25b8d7db08fd4a258cf761dbaa44a5ece0c2b813ab12c20dc213ab40844dfc780687945cf2459f549f1a38bf3da16c5c332756f3b53e1c3a5

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
126B

MD5
95f24d2f9121654acd5a1c44e572082b

SHA1
ea13b61b35ef396ebe42f09e638a39f13b93fd9b

SHA256
2b7b2a1c679a5a0d2465351f35584f1eb6de22160daefb4cba351838f98f155e

SHA512
d1eaa0bd0b245f98a03d24197e02096400abea41f5a36905a41c777bedba15194f3de256c12b4f038e38267147986e8b9dd543189fdc6d1788d3c012bc63270d

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
167B

MD5
1340033aca269b30874eafa2ec72adfe

SHA1
e1c0e123ffc93a5f22c906c7206a625a149944d1

SHA256
fb10f63de2c68693f4360c0c8cb0dd64e163dde54ffb9c97932d804df4a4f724

SHA512
587feb19b7dcfc422a0feb360fc1a855a766e518d8a16b0e6b1df509706c0b703270449e5688bcc584002f277981d6f1edbed996abdd81b8a402ba968c2d08e6

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Filesize
124KB

MD5
4cf2d19d57a9c9c3135ed5f06ea3e97e

SHA1
d41b72eeda9015fce5e23a9dd6c1719d080b2fdf

SHA256
e0e1b29d505742402e258bfe5c4310e4a7ba85f41aa1f97ec23ecc8228469d18

SHA512
fa958b8646cf716c2dd1331db3c1b2e169d24244c1a87b053b4d981d8b038b58d9e42e3de6133e0abdd6bc84ae0e99d7fc6db4d848c921bf880777decd3a1017

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1269.xml
Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
ab4cdb113ce39f64007e74a872fb3301

SHA1
5a7459b473a56033462b97597b391ce131d0e0c9

SHA256
b89c04dcbada73aac1f57dd52cdfe2105d704a88acdd9ab0f99cb835d3a5da53

SHA512
bccecccdabe915c12da0c927b94836d737c275f4a36e53227ac3f5de6c9fde8c3935671ed8cf1c4c86e426fd7323f9773d86b53566ccd0df517aedb46d9da962

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
45c1e3eaa0fb3acd83bd97cd86e6d0cc

SHA1
99fc91ff1b226a832d96b8e41124e18156a4d252

SHA256
64316610bc5d293342fd97de58f1a3412da06a886355e46add1965fa8e0dba1a

SHA512
f570a0220cf3c983ec783f05f9b515fbefd57fc93cfe9e93a18d681cbdc58c30551c6cb61d23c34afc418e33955f15903a1a152296b1b4f982a25277595a3e44

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
1843efaae3788ff4a7be7820e5363e38

SHA1
1cd003d449b10c91385a4073c0b3ea7bfeb31287

SHA256
5350af996e20e6cc82953eb47a973348b6fcaf1db08aa27e2d93a2e9bd11ce30

SHA512
71ede522611af76d79c1d2c292a5a45f4e212cd1c7bb4c5412b32d683d761f38b3fdd36e1b15ad481c3df66802b8d3b5cea0c50e3246cc6e55aedb89e2d4bbad

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
06992ab15abf4c295941f263c06c9b26

SHA1
27f388637dea55886c02d0cdaeac6cfca8d58f39

SHA256
e21d2281fd55b28688b2002d3b54e5d3fe8b5fc91a2ad340eafff3b90ed82e0f

SHA512
ee9d651a41753e183f1f1f5bf6e042bf2eaaa2588467c2bb88ebfbcbaa44398b0ec53b6836a42b10278b7a521167ea5ca523f20877ce8f2ffae13a91726ad634

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
71314b2d58f988b2b8fb1f8a6b3ac6cf

SHA1
f702a78c1c4455e22a646edc290079e9a96e48c6

SHA256
e4e7fbdfad95ea2853356ce7f1de1f97d4bd9ec92f97a62666814d9bb4cf73f1

SHA512
c0a2c8d7b9dd104888474502381ba5d8bd65cf542029ad0ab3f8d74e09bf89bea7ac3d74d0d9be6beb7668e1e4b001a9180b41efd8e24e49139e358a39c2fea1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
16d5f1aca67511d4837abc4713b4a5e9

SHA1
8796414ee5ee9528c824ba5194720c0e17cd077a

SHA256
a5b99dc1d8b4f09351758e0b730eab4ba558b9eff627ba5cff8ae6cf29dfa575

SHA512
4c4fb1d88a35a3fa4612d36716a95484b1659a0e13b29277be212aeb00efceabc7ffd04b374e21c19d56885c3a337339c5ebbb171108d2f96eadd31d0e5e68c0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
2346eb0944db2d8c93542656d4c7195b

SHA1
98cf22e590ecdeeda5ed1259fab5c39618ddd7d4

SHA256
5541fd90fbe81d4edc5f2f67055d3cf31250d3ffab862d82e7c36837b4389a4f

SHA512
0d817372d6052c8411968561630c8c04f0f281fc4787dda1fff2f9661ca475156b33cccf56075ff6e1416cd3ebb01f4ba176213b9e41c94e6f7ecdc8be70c6b6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
52f243cd81ef52484c921f21b33bc220

SHA1
8a4c79ea96d40043f531e6c468080febde017160

SHA256
51d33ffc3e8984b33107c5ecb0a55c8183e550a02ec8f0d214e6d658970cbe44

SHA512
4ab951a56838ff2cdf3ef0b6f118d7f87c141e63caba68075935386159ff9d857e9deb836397c2344d1fbc428d3e3463a38ead772419788ba583a0631e0129e0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
15b4e343c5eb370ae37fb557a15ca02e

SHA1
be4fc84af0048c64ab4e0c432504c5d919336548

SHA256
3b22f242d2c9023961f269fb6aff7f05888af54147628baaf638b27e91f44690

SHA512
c0a727d0490668658d6e6be2684d4da39e3824ba71c30855aa27fec2bfac28653a7a6093703451e9c05868ffd466f3260a5bf6a990c7a39a783a9703d6022c37

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
22b6d0765816efcc6f41560ed3fc884f

SHA1
9320f31269a975399b6fe0872148e96e1b4af534

SHA256
d632b7c6d366be9974957b5526a421eecdd1b3529d02ce8c858b6c2eab0ba096

SHA512
bddb2a46e37c30dee2f7243ccd5b50f4adda0ccf4e9e2dec0a3b33621b028014d74f8ddfe1de2d7d688583e0b5995eece2704f0a006dd3a8e4da6b06391dbf39

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
25c9cd8c2404f9262f455e27d617e262

SHA1
41e6de04636fa2997cf223b3d922d17de2d5c72f

SHA256
b1156b783af68a806d178688fc47f09ba260d990da593a98ab6c9c6dc6d9601c

SHA512
6bc71fca5c6350e899008dd52736199e64ebfe80a468eed50ae5bfa663960e936c954c0760f3fb0f465178eb0ccb4255973f02012056c1026f9b33374d3df760

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
31cad4f595f105b4225a2ccd35ff263a

SHA1
89d3fe464e8b4c92980e99de9162a3ceb2553cc7

SHA256
3b56ff3061f08699a3049690cd7a55617f813e9415e96b7b5545c91f25ab72f9

SHA512
d3f265b0b8e2e6ab8c6e361050da2530f5d204f721223f1a33c4c1977dcbe38c671f994e1228b2bd2a86f46e29265bb4580f7347e87782af571a54a50dc7c20f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
2aeb687afaff1647819947f3c668e0d8

SHA1
39e387f6177f2d1c9915a0e32a77a91f1d0c159f

SHA256
3b881c15770050598b484dfe635bdaa45f6e6c1057ac9b84fd6908f4d16127c6

SHA512
054ed1c3c0584fa5fd368ae4871e2bc1c7e98ba08a4bf0517056255e78f45cad9081e8c13a9ab8b11a2afefd327b606f26df1d1e2937d1d6e90ed31a330fb313

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
0bd24a423103945506ad1665d907033f

SHA1
f867827bad4e4c475a741e9dfdaecb0320791582

SHA256
2ac6c0632d5b2c0929d83794480ab3b8938edc1d63111ef29ed881e8a99a90a2

SHA512
6a075575dcd0c8c5e80ddcc1ff1acbac330c5ed8a6ff006863fee7ec094372c6fd187595fa02b8e4d7a8961cd8d699547557bf2aabbc38edc25e1b4118e92e84

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit