evilquest | 62b515fe9b918285b6ea5c2da32004609cf90e0fb3f6740834c637860db0898a

Analysis

max time kernel
149s
max time network
153s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27-04-2024 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f99c78f63787ce2497375e0a6f0d54_JaffaCakes118
Size

168KB
MD5

02f99c78f63787ce2497375e0a6f0d54
SHA1

6b0d4cc34fbb300427831098b9e8b94ad04c1363
SHA256

62b515fe9b918285b6ea5c2da32004609cf90e0fb3f6740834c637860db0898a
SHA512

b8a271cb29af4494be016677f743d107a82efbef46005faef12d5008ed2628251f644b55d6fa045055d6346e0aa28b595206bd967a118e9527bdd02ae4459547
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq920:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008ae09-4.dat	family_evilquest
behavioral1/files/0x000000030008ae09-6.dat	family_evilquest
behavioral1/files/0x000000030008ae09-15.dat	family_evilquest
behavioral1/files/0x000000030008ae09-22.dat	family_evilquest
behavioral1/files/0x000000030008ae09-27.dat	family_evilquest
behavioral1/files/0x000000030008ae09-32.dat	family_evilquest
behavioral1/files/0x000000030008ae09-37.dat	family_evilquest
behavioral1/files/0x000000030008ae09-42.dat	family_evilquest
behavioral1/files/0x000000030008ae09-47.dat	family_evilquest
behavioral1/files/0x000000030008ae09-52.dat	family_evilquest
behavioral1/files/0x000000030008ae09-57.dat	family_evilquest
behavioral1/files/0x000000030008ae09-63.dat	family_evilquest
behavioral1/files/0x000000030008ae09-67.dat	family_evilquest
behavioral1/files/0x000000030008ae09-72.dat	family_evilquest
behavioral1/files/0x000000030008ae09-77.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 16 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/02f99c78f63787ce2497375e0a6f0d54_JaffaCakes118\""
1⤵
PID:564

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/02f99c78f63787ce2497375e0a6f0d54_JaffaCakes118\""
1⤵
PID:564

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/02f99c78f63787ce2497375e0a6f0d54_JaffaCakes118
1⤵
PID:564
- /bin/zsh
  /bin/zsh -c /Users/run/02f99c78f63787ce2497375e0a6f0d54_JaffaCakes118
  2⤵
  PID:567
- /Users/run/02f99c78f63787ce2497375e0a6f0d54_JaffaCakes118
  /Users/run/02f99c78f63787ce2497375e0a6f0d54_JaffaCakes118
  2⤵
  PID:567

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:568

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:568

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:569

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:569

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:591

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:591

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:594

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:595

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:595

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:595

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:596

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:596

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:596

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:597

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:598

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:598

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:598

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:600

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:599

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:601

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:601

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:601

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:603

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:604

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:604

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:609

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:616

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:617

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:618

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:620

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:621

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:621

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:623

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:624

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:625

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:627

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:629

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:631

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:632

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:632

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:633

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:633

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:637

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:637

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:641

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:644

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:644

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:646

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:648

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:649

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:649

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:662

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:662

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:664

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:664

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:666

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:666

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:667

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:668

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:668

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:669

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:670

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:670

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:671

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
69b87f1cd734439bdf178ea6094ced84

SHA1
5d679d45b6c1b7d3db442a22dcc687bd598789fa

SHA256
a9ada5bca01198daa5e1df22cbb8555d2e08654ec5f94a1baa545968b8373feb

SHA512
e232b9bca9beb20b77ba55700f71c62e7bb1990b6a3ac9daa1a197a5ca682806cc5c95083454a9e1efbaccf03de97633f31eebb682d1e2eb5c55efd102d0b778

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
703cf3576c6e8c205b0ed53efc2986ac

SHA1
2976d5d9d801d664e71b3ac5c945f227ea71c13c

SHA256
a990c4072d5ce7dcb260481624b4b38b68581cac59375309af2a8e972cfd1e2e

SHA512
3c9cc6909bec38ea548d28d99e303918fd817b5820a1c1d69ab318172cf573d83dd69328f27d7d8f9aee9b8c876ce1934efbfb248622e655094c0f3536004077

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b2aee3b8bfa4204f4caa733702961497

SHA1
b600e9a4d6a135c58b6ddbb6339b05db4c04308d

SHA256
74fda8c34dfca70371f1690b01dbb66ed1d783cbddb8e3110d161ec979eae84a

SHA512
54c3ee602de0033753c4fcefbeda841548a9bbcb8428decf116df0c3bdd507594c231736cb2fd87fcc0b4c1c1aa8da8cc1c329a0f71223bb1d9b763ace5038a1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d272c39d61c5ed2716df5eb62fbefb81

SHA1
bf2301491951a29be51de8867aac3b4972b8db06

SHA256
0d3e59732662c589804cccf51fb1b69d2f25c942f4ef3f120a85ed3bc700d8a6

SHA512
f630d7387864cac8c336c0bfc44a60ced9deb54d664df79aea8c76f116a6644b83b950e1c48f40baa6122186b9583165275de5a711b0d33072ca4aa77b299771

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
21af57dd2d0c6d408ce1e1572a29ebe1

SHA1
e77a1ab575137bdcaa208938e804c2addbb2e1a2

SHA256
93f87bef3215cd1ab2b6e7f68b055d671ff6759ce1ca8122690345f88497f6ad

SHA512
3607d44a350961aa8c56d744d2990684b7db5497b680eb13c0793e8b173dc53ac138122dcb551f448f5dc164b25e4b54d7bd63770f88dba0daa721dd27d87cfe

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
757771a5870cb49d78bd570748e1ba58

SHA1
9e0a7988d645cb149e7c76d87f598afbd9bbc44a

SHA256
fa62eca2f63d7a5ae9d5231d8b601dfed9a363e75eb937fca123a0ac50461603

SHA512
b770e71a3b8379d70612be77278d73a7932da38ab7723ced494ad75544198a03e96685d7dc56212831a5adaebda89bb2924d39bc10645c207e7cfb54f2fd094f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e281726f9c2a68572cc8cb85290c852a

SHA1
d6cbf37affcb82d1da640e9a0e3e5f69da9961dd

SHA256
eb5b753b27d6a977de700e04d011694124744fab493d78b804ce4da6581c4983

SHA512
babb5ded7279da9074607e0c3a1b813cce702b3da5860b430a117c38f191fdb243d852ee9cab51b56818811660aadda2713b0f695a136da83ac9ed776211a6d8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d4ee855ac96485e9670844e1af08f452

SHA1
7be29d0a0c487d49fff281e6e3ef9ffe316579fb

SHA256
d4ba05eec0904537d4313b0c3dfb8004716e6a23f2b2b89ee4adf016fb1177e1

SHA512
53878553de4d8a195adab10ae8932c2090dc4569f76aff75aa0ea26f0602a21b1c0cd417e1c2077db77a7cf6148970f6615ae50e969e70205b07b27aa598e9e3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f4995c747bdcf154ddebf69c89fb9fc2

SHA1
a2d95f6e0cdae7e72119089c5f12d64e8e008797

SHA256
1e7ea68bbeae468040613648e78286672522e5e79950c355fbce23b1f44caac4

SHA512
e8fbb7f8bf8cf4e5388f309cbf871c402c726e8b43e84de434f6c1bb7926285d638cc1284d3ebb0732afe5d257a1a74a0ba51e732dd2631e614093d3763f56ff

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a94d8a5e9dafc0cbff06b6881a956e37

SHA1
f67198736523ba2cd8624c13416512790cb10fc8

SHA256
778d71b9f1e381feb828726f68ea805a25d868413afcb7454ad5494b4c82be98

SHA512
fd7d5293769ad74051983f7754998eadcf642358bdeaf44cfd792c5d456d68c35a332b2d118473c92e550a767296783ee2c4359c483cff656f492e3449b0a371

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
787ec307d2f201e8796d91de18dbd61e

SHA1
864e1e33cc5724ae78d353575839e604dfb60bff

SHA256
c44fff025248bb46eefbe8bdcd6e01a54ceea921304fbb8eb895cb80459868a1

SHA512
355cbbeb0328fee198972e9a5c8cfa746973daf4f938730a0fb401ea81ec36dad1d4f0a0883c872426664f6e32112a906d572b68af0783afb19f8cd968be54e2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4744616025b2aab877ee8556e891d00b

SHA1
469e436a919a42e6db461c0a583b62df680558cd

SHA256
8f9631cd231f8e803b78ba50148cdb86dd1b96694c2c7443ae71425c41818dc8

SHA512
502cf6738e913805e07295689cf9ae7549a62dae85f74bb30f26e495e9279337eed7dd622c8b1e422d63849b8a5981e3de10bf8235efd541d5e3be736be23323

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7932c086b610c2941824e70ed72081fd

SHA1
b8091412aa841a880df36bc87cf821bd7d5265ae

SHA256
d93bff154578363167ba3a771dde00c5f3e3e8a0f4610e4da52cd0d50eb091e4

SHA512
67a53c4a1efa4700be738d0d267bd7579807abe3b792fc5cbc0858f24f4425ac1fd20f5f6988c2be9b0d51fcdd4e95c694a4029842414fc39edd9a811ec1335e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
693a88305f326350f96c61ae3fcb6e37

SHA1
b3bd4a567be36d2fddf39a0b58d0f1bebbbdd373

SHA256
adad2029eea968c6d3f40d989465267f84370302fe899525b74f9772f892dbe6

SHA512
bc096fd092bf87cddb40a3379074e2a14c8b421ebd2e0d449e646f98485a15f2db6016322a95d8039fcdcc632ae8c9cf08ee097995d4ac568fb2e10c578b9cd0

Download Submit
/Users/run/02f99c78f63787ce2497375e0a6f0d54_JaffaCakes118

Filesize
168KB

MD5
8c64e5dbf7f4df96279cdbf1e95423d0

SHA1
d84811f3200d2b05c8625bd5c006606415e94057

SHA256
0a90997f11dbda80b60926b0912c44d6676331500e0ff1f86f2caa77cdc54b52

SHA512
bea3695b9a662f0d430568e248fa7a6f5f83294c65423e570e94347a270863ef9247b41a0a47076a7807dcac1a4a34cd04e9fcfdccab2dae91b3e59466af804c

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
28d11c46ec3ed23aa3d73469020a3c7f

SHA1
ff8f6f5d8827bad16e3efedbbad874e081020abc

SHA256
96dcf2eb3b8c97fca8fddba36a004e7c0c792405488c48aa66a83b824c5b0884

SHA512
bed93a658c8effd7b6abc56868543c1d2e8ee70b9b1cb6f1da5e36cebebccfa654e706836159bfcefb10929e02198996171748bc7f5e6e8b19527f8e2fcd5dcb

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
af7dcdbfb1b1881f60590c04adc05831

SHA1
00af43f8b7170098d47539eb39dd036f5a65edc5

SHA256
cd6936b04fdd31187b1caef76796237ae20f8011458f827825dad4d55142eaa6

SHA512
4ba41a2fe9e48ef463803d089385dd716b02b4b1e381887035948f58977e91c66097b4067ee41371933709229959e882d7db70258e9ec01f4bf62580f41d3533

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
93d945881d7f377350e69da4c9589891

SHA1
38914150f09013e53975221767d558bf0a91fc2c

SHA256
16f8a22a7e3344ede3e1c66a5da4ec15e710023184b42126b81adcc48b467041

SHA512
34de77a97cf43fd7e42d807f6048db049e8214f3face37138e01b3bcfbf15c99a9298819c7364c2fbd1bef987d505e790313b9ac1ec23649b0ecd012455c9c50

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
769ce6cc095c34b85b605fee4c1de0c6

SHA1
4b430cfdfab20f1526bd10ab62684dad12d65f6c

SHA256
4fd1f1e31fe571c0dc5cf8a0a53cfb86468375abfa786c5d669fb059fe0ccfa1

SHA512
f04fa5ebafeb1b7f441e2e9d71dcdaf97501daa102f9145cfa011fe1d84805c773f3c3a820001592091c6a1d0d5068ad5a430bf69af2ef38f4ec47f686e0f93f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e9fab8b4ecebd8dbae65025f124ca236

SHA1
ee755e5aaf50163e74c073e5639f15d1b151f5d9

SHA256
d19a02192b0d8d55fb8a75e6617945fb42d7c00c4c63c79ba787a939a40fd6c1

SHA512
5601a7345c59dbdefc0210fbd33bdb92f3a037558031c11d933d821e4ae4148108413e835d37f408816e41fc7a2a9c720ccdccbadacf55091d61beb24f15bf93

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9a3bcab4d7dfe15fde017cb358881e59

SHA1
c1e7fa229f9fcbb7cb35d4ff252fd8d429c3ce6a

SHA256
92e399ce0104ff8c205b3e343f8294072d43e3ded60cc186133fb2cef6d3b9c4

SHA512
4056eccdf43856268a48cf847265709f28446df7f331ff1e0197fc344e9d3015b85c511edb6164377c86e2691f7c018e91bad0cc84c941fa58ca606a70facdc6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
85bde32947907629da857ef72415c631

SHA1
04ff09761f05b9ac946faec3705d40bc00055926

SHA256
27da2a5e6b3edb0986913e42de64d7e16533c36c39388d8f550b1dbc4edb87a4

SHA512
3aab9e7223c90f76458015e1ef2eafc0750b530d5e1b1d09b01c2300697df0e61e8076f91afcf98e26e9290a18be4d3776b3fba0e430b32eb39a46615793016f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
12f1c0debfba8273e62a19baf86099aa

SHA1
26ef68cf49a48795e80c8e7885fc7e253533baa0

SHA256
e306421bad41bf8a731f30dfd6e6cf81ee6617f0c10c4d0550e6a17643bc51a6

SHA512
2d430ebccb8f835b7c707f51324e9e4abb105c81e5c6a78c994233af4d052d5ca34bfb83fb9048bd4e8ea18cf9f41f5c6830b567c832d3d9fbb6a0edf2118ea3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f28276337f6f1ec1c69188d49765a1f6

SHA1
89c9e9417f4e4a74c1a9a7cc6bf59fb32b128c48

SHA256
cc42cc4097658a4961400d6a248f9ce93234dea9c3f27514e5d21a59267f0108

SHA512
4f119460d213e02b7dd0e509a2f00453d3ae9eb07c7ba4c29dd91ef012190c10a9f2ebc770b2de11557b67cd8beb6aa8e277997925e5bf476494ac55b7098360

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
45b35b0a6a663a9fff14543e540dcb82

SHA1
880caf9fe0144766a6b72c23902231f05968d516

SHA256
b77fcfe9903e9002e6bd4d8f80876ec74c05ae65525e057964074ac0790f2d52

SHA512
a6db930998482f8a73d4c13527c61c1b06f2d6726f92e0c2bba52a176f1cee817dd3802295193866b51e196b11563b0ae7030df0049aa13182ffe2caffa834d6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2221e0aa4e40f8d518b29264e191d2f1

SHA1
52cd219e60067358df783bfaf790961f5b902760

SHA256
05203438ef7973bc28dd21b5ffe4712a33b442cf2a076208c16d15ec6658e615

SHA512
1bbdf9fa11a1b849f0869fc9de22fea71d2b97096321762c004fdc982fbd39e8784b6b899d4b09154b9094dc2ee253454eb361fdb8db5484283980d4c896ea62

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
74c2cb5d3f6edd48c8783ae2df6c24fc

SHA1
baa96ebb40b900e5a493637ceb62f6d161b8cfc2

SHA256
101914d0ee754077161bf9f0e5f6b52e31f2ce78b8e4abdb1029238f0c9a0ed3

SHA512
d6e4e34a05889cb6f0a08e2bdb0d13466ba826edb82987e6d1d72299492073607885c04cbb8bb3710511ec0cbe3521ef8a01737ce5e0d265c552c178ac455bd5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e437b265a0502ace0939c8a80f472ca6

SHA1
19ecdcc3dec14c474a5677b5e4ebc1985e817065

SHA256
81b7f99e9d20ca142f869f6121554be89049b2ecc33d54f8946c9f88cd5986ce

SHA512
2bbb698303fcaea1ad2bb7fc14a2a29a80f71de5e2fefec2b33f8a366cc734d7ac74ba4f434eb3c867b180347cea3417eadee9b25998a85dbefc33513e83fdce

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f82c76e58772b8f9d1be31d4dc873501

SHA1
45620f171faf2a9d4a511e4243669fbfdf3a4b61

SHA256
4737f2b9af6aa600f8cce45c593dfea4bc0688d5c112ff091e6e3b8ab32a2f18

SHA512
4714a9c4a62b966dc2680eecf2e473e60c60cf150b5cd6d51050b4540b49297f785ddb20b4a680a2d64d9a7c6e8b5fda74d1728f90d99533333da1981a7ceb55

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
bdd1c3ab0025b8a2d15cafdfee2eecbd

SHA1
2b597fe3c53f01d23809e4462c3f00785ca631b3

SHA256
30e781f289ab729fbaaca3378432f56bd8a993bff80bf678c464437b02e496f6

SHA512
beab74209f24369248bad20ce5ba4e739d21bef18646755751dfbdd0fac39dd3212bb9c207afa683836c0060271cc103c759e5605a7535c6d9e34670fe10aa18

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
63ce26fe08f317f421b86b8bfdf81364

SHA1
ee0952da1c78d874a2d85e6415b8b2694c966dd5

SHA256
a8637bdd83f038142a4c7e0f9f03c9f10958faff35aa2b4e25af5e6e0ce718a2

SHA512
393b8c109a4651666e8248d05bc05275a4915eeb50aa8cc1e8ba566985b13222081259f7390225cae455017fbe239f9a12e0d650e4575f15fe254883ed0e0b0d

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit