evilquest | 551302c3df37a560ae9455243191b2c9ae660e9036dc96bee8fd4a2f3c965ccf

Analysis

max time kernel
148s
max time network
144s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
28-04-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0484d93ffa7bdce47c10504123dabca2_JaffaCakes118
Size

168KB
MD5

0484d93ffa7bdce47c10504123dabca2
SHA1

9ba50900c509814438739276830ea6b88ef67f78
SHA256

551302c3df37a560ae9455243191b2c9ae660e9036dc96bee8fd4a2f3c965ccf
SHA512

d691eb91500c0b96341be612214928f63f2413fe28ba07ca972d79ae34b3c6eb3efa9732fa828f1bcdcc37720d92165a533a375c75eca6779f786970f65af239
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9sP0:5SeOQdaZNxtk8cqhSxvHY9s

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008adf3-3.dat	family_evilquest
behavioral1/files/0x000000030008adf3-6.dat	family_evilquest
behavioral1/files/0x000000030008adf3-14.dat	family_evilquest
behavioral1/files/0x000000030008adf3-23.dat	family_evilquest
behavioral1/files/0x000000030008adf3-28.dat	family_evilquest
behavioral1/files/0x000000030008adf3-35.dat	family_evilquest
behavioral1/files/0x000000030008adf3-40.dat	family_evilquest
behavioral1/files/0x000000030008adf3-45.dat	family_evilquest
behavioral1/files/0x000000030008adf3-50.dat	family_evilquest
behavioral1/files/0x000000030008adf3-55.dat	family_evilquest
behavioral1/files/0x000000030008adf3-60.dat	family_evilquest
behavioral1/files/0x000000030008adf3-65.dat	family_evilquest
behavioral1/files/0x000000030008adf3-70.dat	family_evilquest
behavioral1/files/0x000000030008adf3-75.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 16 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/0484d93ffa7bdce47c10504123dabca2_JaffaCakes118\""
1⤵
PID:561

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/0484d93ffa7bdce47c10504123dabca2_JaffaCakes118\""
1⤵
PID:561

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/0484d93ffa7bdce47c10504123dabca2_JaffaCakes118
1⤵
PID:561
- /bin/zsh
  /bin/zsh -c /Users/run/0484d93ffa7bdce47c10504123dabca2_JaffaCakes118
  2⤵
  PID:563
- /Users/run/0484d93ffa7bdce47c10504123dabca2_JaffaCakes118
  /Users/run/0484d93ffa7bdce47c10504123dabca2_JaffaCakes118
  2⤵
  PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:564

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:553

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:590

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:590

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:592

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:592

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:593

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:594

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:595

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:595

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:595

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:596

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:596

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:596

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:598

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:597

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:599

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:600

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:602

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:602

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:605

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:606

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:606

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:612

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:612

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:617

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:624

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:626

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:627

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:628

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:630

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:630

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:631

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:631

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:633

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:637

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:638

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:639

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:643

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:643

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:645

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:646

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:654

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:656

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:658

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:658

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:660

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:660

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:669

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:669

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:671

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:671

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:673

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:673

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:678

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:678

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:679

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:679

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:680

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:680

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:680

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:681

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:681

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:682

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:682

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:682

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
25ee8ac0c46f83fa9fd194856578444d

SHA1
f2aea222f5a3f5556a241b1c88bbcbee31b7a92c

SHA256
9d50b358fc7549d272b48d0955d8ed66d092f203ee801188467d530e5e1d163f

SHA512
f526cbe435daea9955dfa52d4e05bb91f50d3a55ebdeef8efcbb49a3845d6aac8e092e7bf2e7d08fe0a963c2c714862243ef62156f41554f3e0000bef6f51879

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
20d1ef2473c50590364ca16f1275db0a

SHA1
e69338f6bb923d2c12a37c21ee0c57197adf9c91

SHA256
73ca7ac4bf0bf2fddf6474f9f6c7f561f170a323d72bc8395cf76ca71c686992

SHA512
9ac234d73c0e5d2025079d1cfcd195a84fd138474104ce080f541d68a7ccb59abc954cac60ccacd3097e9b0d1966152853b7426e9c206e8eb9988935abf6a93a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4384178f5c5bbb4ada3ab8537eac62ae

SHA1
012291d700c4e184f808c6a9ec5f66436d96ca9c

SHA256
613ceb7257618f1ef2253ad026671b029bfb747e6daaab27f0751b237c128c53

SHA512
05bcb4aab497077bd72cf68e0b72bede14a41258184f27be2b99a307fde586824f28965db115b9857ba979e90cec3fe035ddc96c2cb2f9e32bf3702807165be3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7817bcae174101763009ea307d99e753

SHA1
974269066d67466cb6d0f25a83d2d40da8acfd13

SHA256
464c5587f56ec19ee7380dd73d8dfeebb0a4f5e646cdd45c0bc324c99f077fbf

SHA512
c34762212b8662dd60e36bcd7537f7a3ed3fa6dc395350b04cdbf8581baea269b70a34f8fe10640feeffe21c522d1aca25e054ed53b34ee584cf202ce4ba0240

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7941fa5037e7b963492f30217276b82c

SHA1
96abf309ae60cacac7ce8c1c8c08f4025fb7977f

SHA256
0193ee6ec440efc8e15fee597ad98125577d9a0a947ae81a91a6a2979022b169

SHA512
1a1ac71c388ddc3a1f8976d1cb0b53eca838e383bc582b145bd001c3aa01577162625252f243b344c8834170b63f0831255b447f21d4c230d716f419273e67a1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
eaa062fa13f52dd2f77dc94febb67191

SHA1
a51b56088172abd2f577bef4d1d1f9c03416556c

SHA256
6db2d95b27d3d1a2cb4c3ca3ec80b20eda5dae6c0cb7d9097784762e5f3a8e32

SHA512
1183d2eb946f3e74a5f2a14dda35b2f2303e488c286c3373c709622af9a6cd4d229c3c05c2c09de2c6e6264e9b3689d5d6afd933856aaacfdb6dca0a642507d8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c8455adf82bda14372370725e6b9ad76

SHA1
508c1d0fd56fcc453257c8760d69fb73ccdf130b

SHA256
4d0813daf850c87ca00e953fd6a9757e80a43173aad6ebe4e4e8613be74088f8

SHA512
220804774a3a22fc0970ea4e998da48419a82835a06a48fef3e41b9f0112a1f3ed9b1f2508b4ce6d9e3c5eb2629be536ae1aaa97004f4b86ca79c8f4be402a82

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cfb748185fd1c8fe94426ec1db848c68

SHA1
ca8118cc06d4cd08a4c17241d0da409fd360fac1

SHA256
661c915c6ce069088556d8d95420641d21be154023eb9baed587e0081c990d2a

SHA512
811191ec570752a22559463fa4e2d104f991df87137cffae29ed57681b82696ce5bf7946b60391684e074206372b68c19aecde0af51211042488858610cbcfea

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1a81c5d4855ed5d362091264caf14e95

SHA1
5eae2957d9983deaeecbbd62d4f7ad3fca59d9b7

SHA256
594d2a0b45cd619044d6abf55a8835d94588123e3555ab370720f3baf42c7dd9

SHA512
28caeab135601f994f2c31caec14c7eac9d75c75083d64bf81775bb563ecd60efa17482b38db5f8b22320fe0ced4455f7402c78761ce62d7eb72ce65c2200953

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
15388083243a97ab54007cc64f388158

SHA1
f77b76dc374399cbdaed58b0f68a8af3f7b5eb5e

SHA256
a79fb1cac350c5886b257e6c70c33c368debebf096c59f349cef3a928eddf26a

SHA512
cb0c6f43984ce0dd0d3b623cf3db290853e87eb3e8cbb0b98276fb6e3cc201dc3232b1c7cf3155cd17440984c1e2b0f13c17ba95281b91d41b0afa78be6162bf

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2c1629e881af62b41762bb8522df06d8

SHA1
d1ece7389a3e71d86a1167ab6321697f6fbb29d9

SHA256
d1c8ba1086f1c6cf35c9e59b6a273a29936492ebe40600889d4fb4f015343dba

SHA512
c9ac112265aafd321a29aa877f523792c26fc177635a1a32568dbe375ec2063a5241f05307f292bb4ea99722b40ee2878a5cdb62cd295a7fd8650a70dca22854

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
db532a27a0dd1036640ab1a73c3a1147

SHA1
deb731bf5779b6956e7a25138657ea6fc3f9ebc2

SHA256
71c8a2cf165db716b159577984bca16008123d753cbf7c5a300b003dd260cdb3

SHA512
3a97ee8af038b4ac5008a7c0d16144243eb2005139e628c72e82fc91ca7d3ba1d3d23544b56dc73686d1b0f01ba41fe624a6255ac9d81da8f2081c480b2f183f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
50485ff3201e0d8e059c351488ec218f

SHA1
5dce7566d3e613771faf453b9d7f591201467a08

SHA256
35594ef427fe6c1162ebb691d9fac325015dca24200b0b1f74264f859c060115

SHA512
743b6e9307c922ef27dca743e575b01605db64ea1527ab5af1c83b7bafa0749bb0edeac0dc220ea9e2713c968198c3d85262f751c39428470779e423e06aa9bc

Download Submit
/Users/run/0484d93ffa7bdce47c10504123dabca2_JaffaCakes118

Filesize
168KB

MD5
ea5c837a532f2c31a3028bc3a9722cca

SHA1
e08b39a6cb8f2266207524a9ec88a8b183559c6f

SHA256
000813fb1adcbd5847babf4869ea210d64effaf9deafba8c5ba8ce118e787090

SHA512
a9a384c2df34f30957679dbf7938542069507b4123e96759eb68cec75eb850b65accbd65daf050870d725e2d264ceadea23d88b3c78d6376427df04bf990db03

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
e7857dd59aec8b05a395a4f099117523

SHA1
b2c5d9c0a5a999f79847c74e9086bda83ed3ca54

SHA256
e4d34044dd23d01fcaa316c1584ed6b738250a15efe06a3d21174ae4e82a35e0

SHA512
76ec7e5413982f7e1c1ca3946f2ba740a7e61a647e669be5f165373e3ba38a80c407f29f7d9c11a394cf115892e793067276286b7b66ab6ac077e4dc7ff49112

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
da4674c9751d86eb4afe36ef403533bf

SHA1
e3387f82c1195e27b3bfca2552f38fd9e9ec74cd

SHA256
f76f552443ed694b0e4236ac8f3d6bd03ac738d434c6bcfb81a6f1a2630e09d0

SHA512
d0779da785ba2f76392448451d8457f44a202858b6c44b5f226098c0d8415960f1f889f9834980a7b99da6efbb6892c6321fcdeba362c30fc7ad40a747f51e93

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5fe5d33c7bc37498d46fc439245f03a1

SHA1
ba1f9b242d9ed5a573fe1513079645ac2a6e11f7

SHA256
85f947cb75226acc5306a0c785ac9bb6275058965b1ef7c6c32fed91243f3781

SHA512
48dafda3fb019a3a1e83d25ab0de08f009bf5c05850714a578bfe1eacd7f4231bfb4ca465b271956839fdc5801688e294f121f8ae5c8e8daca64c6d25a3c8cb1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ca81c91d47a0341cc1551dc0c436f0c6

SHA1
9d95af60c0092d7a0790c83e4bd1f960b48f9b58

SHA256
75e25a47735ee25cfea20b0808e6a4727816cb2660cdfdfddb0711bee49cb2ba

SHA512
0e75652385452d19e800db82dc96a3d43b83bda3c057805bdf28eba18a38258b46e0db3fe3b14bee3dd281a7c8758f72b24a1352f56bd81c4d5eddf42d85bb77

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f9c38ff13cd06573e27daf95e103e2a7

SHA1
144cbff49d74ad323ee682068c649a6076cef61b

SHA256
7573f7c025c16ed3cba9dfaf8e4bfa9c9315dc35162457036e7076e5ffd072ba

SHA512
d103df8d5a9022e438ce46fd342a629f17bbc919bb1026cda241129f8b5edba7d3863abc25a4487a90a28e81ce4307b30fb447e1fa32a24ffc07a0f4ed8fac6d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
228254e914cbb0f6c034f7037aebf401

SHA1
f561dab55e029752c5d67a6bab607535770a0b1b

SHA256
1d36ee5a37afcb2ee7a7c91713b1c84afd8bf4a3461e5d3756c233967e813110

SHA512
ddcdf64ce9d85391886f71c6342cd33d901717782725bff48a01e1c433d7337a567136c90e8ea9e4c5248235c8a9cb719ad4b0a8a64985b065c640877bd8856b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d073151397fa9d881062505b1910f179

SHA1
14fc4d74b96a09deec84bcecc60f2204d4187764

SHA256
16a35bdda2555a7b0f0ab26ec8fe472470bdfe7425c997c77018fa591ca8dfd9

SHA512
a663e269baea95ad87498b66cc872e019adc167d844d27d1879fa622e2012f49c913dcda5120bfc251bd15d0dddbfdaa1dfef8f52e9ae135ce0ed6fc3572e34c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6a36edde1367a2d7c1a29e9f6633ae84

SHA1
64fec5bb33290b92cdea424799e387a42ce7c193

SHA256
fe551d91bb752ce42beadb6089dead9ccef4a775cb216fd4224f94e82d490682

SHA512
89cd904812ad6878cb04e2d14ec517ba7bc5d83e16f2fa2f37fa02fbcc18ae2942d6a25336acf03e96ad4a0da32996b3e2847111bf79918873dfcfa4051294b5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0ecabdb9beb9152b947b689a552a99ec

SHA1
aaafcd793530e1c7ee3c6fcc365c8203294dd23a

SHA256
a883c84c16a3e5968e648154eadb9d5baf53074779013544fba8594650614118

SHA512
7b7bcd38c0033b139f854cbb2ab0588e8b7441f56c1663f332f172f0b0b7b2f9e90a0ffe06e441ef97eec84dc184511bcf5579967bc51353dfbc62c5ab972ddc

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4acf9351fa0cf7359e318cbf8720969e

SHA1
bb12e48d13e537b43da802d179bc124a3b256aa1

SHA256
8cb0e00cb1e8e19b8ff0fee6fa03a0a408370a21d39f75dcdd46dcc35a2fe0fa

SHA512
ef9a8d45f00e46f61207522b8f1f25865e2c0fcf0f3cc90c314f4588b6a3c350cd87e9cb6c76894019a07c14bf2ce0d784d8f59dbfbb34cd64b787ffe4c665de

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
397775fd1bc104c18ab0f4ce4ad59b42

SHA1
eab609f31c6587d7d62b97ca3457ad8ed9d45c0b

SHA256
88519f1e6a1d199ee5d05d454beb7f901e142684ede3710335084ead5c4abd17

SHA512
008025a7ff591a1412f7e62306f6e6f2482eddc068b23d4dba8038ce582d50a9bdb74807945da078d92820df419bf9d9d6902ce88fb0619e02781841e66297e2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d7b65ec19214ec236c79e260cfd2a613

SHA1
c632cd5e98280123fd452763cfc9522d3d45c6f0

SHA256
7fab6558873fb2019573df50e5c08df4decd6a8becb777bc3ab0e7b077e32dcc

SHA512
f291992ad128287854999806a7d04e2b457ee102483167f6d29d95de974497da7740aa96302fdf5505b0933a4d7ea394c7e49de10cdf2c64ed68b8bc1565b6da

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
03fd88ed956f2e71beb817f3cf897a7a

SHA1
d5b0d9973861160af880a5c25cd74538b699735c

SHA256
c9c27ce6cd6ad5c1616aae86a64a895eb73c51750cd230ab07ec4a9f602bac8f

SHA512
cff7841c3783bf40752f3af85c399da4dcd15b8adce206ebd29415d3403adfeb5726e37cd985d04d6e00fcb2227a3f17af3b4ef4183517548850e312ee5f1ac9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ad811a2a0c5379a0b22620d09eaa168b

SHA1
30e74f5d55a1ec1f2529803169e92667db456331

SHA256
1764c691159061af9402d3242ec6c6b23c457530e21345de0376bf8c66d1161b

SHA512
83d9d5ab887f8e857d1ca542338ee492450e74feaf51f611ca769604b850a3d927f031691fba2a63d652ffc02df30d1c27b4028876b233698e9c1a49d1bc51f4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b9ce06dece406f90442f3bc085f4ebc1

SHA1
fa7dd5914594a223b223b982f368e26865b6d416

SHA256
ad4214591d945113d155cc9e70c2c2cc4d795e0bd29457892e8cde8ee6813c7f

SHA512
b1e3aa38b07406b29ab6bfb144a71b57ad1818bf25f9ee84e292d4b3db40cb3c12b225dd200da18bc9417c567f160c5d8614e33e9e40d771be6bca84e83747d7

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit