evilquest | 495d562891fa3dd67a15f95c1044945f65a389a85c446a54ec320bc096d79e76

Analysis

max time kernel
149s
max time network
143s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-04-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

070c07cfcb26756849502d1bc611f3d2_JaffaCakes118
Size

168KB
MD5

070c07cfcb26756849502d1bc611f3d2
SHA1

8fb41a5ba50add4f83454be3c25017a96e5da148
SHA256

495d562891fa3dd67a15f95c1044945f65a389a85c446a54ec320bc096d79e76
SHA512

f8654f6b9569ab5e864b3a01e8d71a074320df91c7b40b75ad204cead23ac4a0a420eb6a7ebdefa1f4d64833a3c2d686977d42f6c93bef2acc48037db2b8dcb5
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9W0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008adfe-0.dat	family_evilquest
behavioral1/files/0x000000030008ad9e-3.dat	family_evilquest
behavioral1/files/0x000000030008adfe-9.dat	family_evilquest
behavioral1/files/0x000000030008adfe-17.dat	family_evilquest
behavioral1/files/0x000000030008adfe-22.dat	family_evilquest
behavioral1/files/0x000000030008adfe-27.dat	family_evilquest
behavioral1/files/0x000000030008adfe-32.dat	family_evilquest
behavioral1/files/0x000000030008adfe-37.dat	family_evilquest
behavioral1/files/0x000000030008adfe-42.dat	family_evilquest
behavioral1/files/0x000000030008adfe-47.dat	family_evilquest
behavioral1/files/0x000000030008adfe-52.dat	family_evilquest
behavioral1/files/0x000000030008adfe-57.dat	family_evilquest
behavioral1/files/0x000000030008adfe-62.dat	family_evilquest
behavioral1/files/0x000000030008adfe-67.dat	family_evilquest
behavioral1/files/0x000000030008adfe-72.dat	family_evilquest
behavioral1/files/0x000000030008adfe-78.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 16 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/070c07cfcb26756849502d1bc611f3d2_JaffaCakes118\""
1⤵
PID:561

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/070c07cfcb26756849502d1bc611f3d2_JaffaCakes118\""
1⤵
PID:561

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/070c07cfcb26756849502d1bc611f3d2_JaffaCakes118
1⤵
PID:561
- /bin/zsh
  /bin/zsh -c /Users/run/070c07cfcb26756849502d1bc611f3d2_JaffaCakes118
  2⤵
  PID:564
- /Users/run/070c07cfcb26756849502d1bc611f3d2_JaffaCakes118
  /Users/run/070c07cfcb26756849502d1bc611f3d2_JaffaCakes118
  2⤵
  PID:564

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:565

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:570

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:570

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:571

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:571

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:572

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:572

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:573

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:573

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:574

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:574

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:575

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:575

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:575

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:576

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:576

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:576

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:577

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:578

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:578

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:578

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:579

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:579

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:579

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:580

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:580

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:580

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:585

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:585

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:587

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:605

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:606

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:611

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:613

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:614

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:615

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:617

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:620

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:620

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:621

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:623

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:624

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:625

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:626

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:627

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:630

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:630

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:631

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:631

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:634

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:634

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:639

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:639

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:649

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:650

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:650

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:665

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:665

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:667

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:667

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:669

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:669

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:671

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:671

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
131f9b9ee55735cf7b8757d2fb708a45

SHA1
a824a0f393bb42e2bd449606e7c388d7193256ff

SHA256
87eb93ce37cf9a08578b8e3c21884356a1f3c83cd35df89601a88f3b9c9f1219

SHA512
0baef9b08b04b9576e82cf6d47a52e3b68d996432fe116d96f11fba252fe09f12634b64dfb4e455c5447d7aa46596b223befea4d4acf1363a39b8926dc5cdfa3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
479d329a942aceb92e96db6e08102d52

SHA1
fca6e4ecc20758bba5faeebab83eaba39c26304f

SHA256
846b8cd87379896c3f3438cb15b6b60423a5c7f88fb05938a49577616c1e360d

SHA512
c3f3b7ac3a2109a59afe15e87b0468f8a1943126c0d74d8df629e8040ef147a30b0dc5d22105b4d4ede6c2b13cac10560193acf07132d5cb1db2404cd4c84a8c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
57d681e9887655df932cfa948ac9c84b

SHA1
0a876c0571bedd5ff27e861c6b6504406b7292db

SHA256
6a82b114be57604c83588658048edd38e67adf3c2c569e27ed081b7bca683800

SHA512
7a93e685478809798a4a293f0dd1cc8b5b34a2f75f76409f542090e75feb0e9840a361adce2db8ff3ad1de7e361c2d94f03d424105cc1779c350ff2b2a0880b7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
10e05aca98e555937837d28e9cef92df

SHA1
98c9519758c6dd5773b04de517bb765051fc2476

SHA256
aca04061f8bb6e49a1b226681ade933e3077c2ee44bbf9a202353df313e17f41

SHA512
5d55b42d049c60633901b8d7b3f94a42cd95c968819c2e9b4962b9ad303fe237de8a0843d0d2d0a74e27bc885f1a95a63ad19b181ccc83c8ad4e478c2a3575f0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4a1e630d110eee24236a3af127bcee77

SHA1
8c3796a6f26c78ea87d5e0ae6f8d78e9a9ba50f2

SHA256
8fe002c76e8eb82837389722cda2f02292b302b47f4e69d7ebd0494347615f91

SHA512
349b28c56ce622b6213c2fc529f3a6dbffa4f42e5df6fee6f9ef817be5bd31c80e1e46dc5ce4da1e7b37dd966d239bf1975cf01aeb6f6303d0cbe5970f40b2bd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
151698e66b425d0bc2d771df3074b979

SHA1
d6cb1858d7672a884fc7e2ee5c071bcc3eb26651

SHA256
a0caddcb90b056a9f1f5e57a89e8d296feb714daa2de4d0a5462e898e30d0953

SHA512
cae4990b8c266822f7072fa8fbc44d686095896c3eee89ce079f402f3070c22c277a5ea442d225589e61c1031fb94713394b84dc296656df261b3ce6ff0e77dc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ee272242913c7ac70a5ee577bc6f99f4

SHA1
00e24f12b9d6d1283b4ab1c68b2aa3a3f2198e30

SHA256
869aafdac58c99c8e34fb91f14f4eebfe87d221cd735beafde3266f4818f86cc

SHA512
b3d5e2dbd0e1184d184ec9cd5f449db6466d9c2504b22dbcd55c697159877aecfd5ddafe2b11e81e136dc33e836d8c0454134baf28aa76dc5efb15a302bc1305

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b07e5ec0be0e3f77531a8cd8ec2e58b4

SHA1
4df971caef9170e0f1233d11ede3648ca5374416

SHA256
0d6986dc9a9d0ec97d5080c413e8a7487be74ac57b988cbb193e625152b6b498

SHA512
0be011f1a01fa6a1ab7dfbd8132591997cb83b173d3ff4d701e3faf49a7ceb161420da5e33b03bb51a67314f243a07f2c9f06e8ff79e450480ede46ca87b28db

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ffd865672911ae5e566b7aba7b1eaac8

SHA1
c3bc657d67fdfbfedc6847800fcb9d61a2c6c048

SHA256
8efa920a8572c5b37cacf9a0807faae49185afbb53c4fe556d536ba77e90b838

SHA512
0a21e49877d3941b9b6f00a76124b0e159750db9a093b97f28ad9e52a1841dec71e719eb5b835fa4b78e2b242b4d5de9928e3b0e0286593a21579adbc3221e21

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
67d85a97475bf726e6790573719d9290

SHA1
157d65c18672936b9acd282c7f1e80d143c5edc2

SHA256
9d9b2ef8ed54360024975116d16cc2bd4f56a98b558169110484f0352adfbd26

SHA512
0d925a91e07eec64652fa34b929621d3b8ed64b73ebb1d7550be42ff8c4c895ef71ac0fd67032ded7d728ab0e337b908dc412761e6ee6d9a8f89c9450f6bfe61

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
06132c5e887eb25aa1844cb9c1c2f4e0

SHA1
ed9a8f91f87abe1d83305e5bbd4eb8a2e7868a25

SHA256
42f7b5acf66f30e58f9254a2e05ed560e760793c5ead573736ee50a1289837fd

SHA512
91414da2c245962552127d366e4082ff23a86b8f21e7b8d0b2ad864a393d9291a868c196fccb4a09c856c31ecd97137d02a88394475d60ebb34d60cc7de06761

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a1417da0eb058000aa0653a728034b9c

SHA1
3ba0f79ea7f33d3f7af963f6a5b197ff3c2e062c

SHA256
0cb6f427995aecbfed85056958c623e24cffb91ecb21b61fe068102f6707c2d7

SHA512
37d0a719e38d6efc2dc94f46f316599a435dc18094ad402851a5ba29270d94c961d8ec99045fa16aaaca16a103af3ee840e70e4bfad4728445d15e57d086841f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5869f81949f85ccdd72a75d4ec8b8948

SHA1
cabd99281bcf6f6203437285d82b73118cde3159

SHA256
c69dbc4481b243775451db9252055b24057cf09e4f298c44716ca6d29042e0e0

SHA512
2ad945ef3c0b75bae033fff24f305190b3b4f73723e9db3daaf20ae3987918a0000bc776a42070dfd7730e8da4045082cbbedfdfe986826c042eb8a34c83fe35

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
85ea558861a4a061879e8b6914285155

SHA1
794cb0d74896fb71365f86b5daf664e995ac5245

SHA256
95c17dc6f9308bfd45db725000fad6f9a3626e4bc31003368fe269638ba508b5

SHA512
e49032c13df56bcd417392f47b7b9a666513fd166aa205d696db95be613bd221c8348d9012008cd0794f877bae4c480f936c759b23c6d91393f239da4730a6e7

Download Submit
/Users/run/070c07cfcb26756849502d1bc611f3d2_JaffaCakes118

Filesize
168KB

MD5
896fcff23d64406e16cfdcaa48804e9a

SHA1
490fb48d7111fbb93aba8795c92f1e5fc4febbb0

SHA256
aaab665401a651b2b480fb6dd4e41d92600e514cf7448f2d147705e26a7da540

SHA512
9d7e095845ce50c7fadb52574ee4d1afa55f0e418e374ab58616a048e8e8b77ad9196892aa1a022f0240ae21cdbdfb37ed42182894c9fdb061251a11dc247e4a

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
0aec9a2129e8432c33e36eb1e85ec351

SHA1
559d3d974e00fe1a2c235484755f71363377208a

SHA256
c3f9c990323c0d9e409a9e5e18b5dd95d084e942471d60e0bf130586d0c9a505

SHA512
bce16a22d6e8181ad3244123556e2f3f26eb9df93b47bde9bb6617f38c2e63a087b87de88d034bc18f421e8ce8490df2c24bd918e8d211556591d721d466a85b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
041b54f56cb9c045f780f389cf01b5a0

SHA1
cb5d6ab908f95afa23b876560f7ef5c67eee7fc3

SHA256
1b321b8ce7e4e19ea3dcf1b50c4cc748ca907ec3f48770880dd0b2e23faf3581

SHA512
698977020887211c42d8274563db8b34db7e7c2bb6275deaa4eb71412a61a24da876665a0e149103552fc906a1a278d9dc7aab3cc3c6657d1110c580750d3302

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
47a123f3143dd4afbe7ad71ef39fa84c

SHA1
f7aae35630e114b2561f2ac161c5ac8c00ed8a3a

SHA256
3d60b088c3006f291151ef2acd17c5dd07bf6cbc4c1ee66ee5fec3fb3c9cee3b

SHA512
1b251dd23638e8077ba24577ffa5f342da14f0e1b838440dc9da8e4f79f23d0fdbf09919223df13c0c390be534c2d2e354985f473337d032102ce6df9013ccc4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
97fe630d292a5fb4cf6d5f1235be2148

SHA1
1657701f91cc822db171740253279616b108fffd

SHA256
4cf14ac533b48abb246d6a6605495645e1f19deebec492c3a25d96329f9859b7

SHA512
7b4e93a47972a3ee774fdd7225c2af06f282b9f2cb31a3587c6ec0574a24f6c82b7f6eed140652fa5ead803463246f3fdb2beaf372f5c8b9dfd4abf244927b8d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1a70243642515e62dae810d7cbcd1a82

SHA1
2fec2d49e251eb231ea88129f9e8377937f63159

SHA256
dd7b6838caab3dc20344729bff8a5e0d3c64ee04427b795d2b6c19bbe8edd764

SHA512
0b847f1c641151ee0284b478130182c42b428712c0d4b88f9363fb4285410463d4e5bfc466b3fff13e266294a60d0a23346b122431ad6fdcc59c079d41ca074b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4f9a5bf16c26167ebe1b0102e604cb9c

SHA1
06019dec81381ae7963e7ae93e1b1b3cf1e199e4

SHA256
b2124265ff2d70441da369f3d4d51c12ad10eb8b40566a524b73ef4909d9f3eb

SHA512
a39cc5f91de50e944c4a7376d07522b965aaa3c60e9c88708a0bf7f4abcd73a81e72e2e091d867429ffefa9a4bd86cfb6eff1690efd2549474f6c77661f43bf6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
12576446cac0fcef7d35a947b0b637bb

SHA1
b067f0f0003d3d3274d0ca05f427fe5437c942ac

SHA256
10721846fa27d3425273bf6be2b881119c8dee10011244975e910bd4bb344fdd

SHA512
6b6a98e3f2e382dd56ad193294da1ddf41281b839654e287990537f8bde084063dd562c9024edba2147d4a6e21e783a16a8efcb4f6656af8bf66dba8d6c2dfa6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
210d0d6f88f1b818bbb1db8ae2b53eb3

SHA1
4a93fde202649ad408ba760b06b33f7ca85138b7

SHA256
517695e50250a745839fc819e2583793976519cca59d940d244bc5d1d35a9b45

SHA512
12be217bdf31c16f83a95ffc4629abecf33e76f2ea08e17f5c4463e1f7f7ef9e7c670d176151bec7cea7da198334f70882eee4c9e2441dd8917a9133c24f0b4e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
54a6b04ea781bdd86465d2b2dcf6d0af

SHA1
cd1bd485e9e1e1e68d3e9896f2c56f0829e390f1

SHA256
c838de6765f5c29eedddfc02894722a8d901de471b08571f95f332cf088f9818

SHA512
265e03db3769e55a5157e26bd51cdeb8ef761ab20bf5d05ff9afdee10c4618246d47166ee483b53544139b74c18df553cb29353fc0c4334a8fec6d13bdb7ebff

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
bbba2607cce694268df339a58f366440

SHA1
85ace0a744e91d4765aaa15aae6b8d7195dd43cb

SHA256
46f638a2496c28e72384f608c26a3aeedd172222a388073b53e3f0efa6033863

SHA512
ff962b0295442bbfddba07e847827cacf7d62a85aab5c50190ca471ebd6494d0f63ef1a63ddfa26431384997d34ebde36248c9bfdec39da7d4d27731c81e3a41

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
65c5702585859550e473153f5abe0cb6

SHA1
8c2aa6e5e43d8035f7978086dfe96de87d20a168

SHA256
71ded0809051d56792d4697c05d3c2b1c90438eaaa5fd0c4a70b95ef9b12b7cc

SHA512
8e9499589130ad4eb4c120a43517b8bb8d94edd3218f1ba1ef742e3fb234e84345ab064472ece11e5f37cac6132383e50edff101ec724ff3a2af7e6fba82a912

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
36f7c79a42eafde81e381e3fc7f113ef

SHA1
3fe28bdd695011ea139be84d49ee95400e337d0e

SHA256
96decaa5e722ae3a018a71df9f82cf3119666545cec8a83f5783731dd0117b41

SHA512
97b1b039306329a03f2ca0cd3b5629002effe28d3ca2f17809b07234f8330b35ca07de3e75b28aefb13b901ef8a56dd90231ec5da59b93dc54ec4244f3ed1dc9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
073461fd3b27f0155a94f7b73ba448e7

SHA1
96ae4da1b4e48d647abaf5df4f483e65704d519e

SHA256
2ff8d5d1f4a4ed123edad372446a69ec6f2ed611f74db7295fe945916d767a21

SHA512
6c787115e6bc8fea5bdfde5f44ebbe35ff24ee68c9302321666b3e28b2082275ad7970b4a443dbd2bc9a1fbf593a0921dadb56628bc2581c6638d01b1e83308c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5140905952deba01b6e76cf35193e3a3

SHA1
14b3daee624d70409a6be06861a02e73dcf5d1fd

SHA256
643e4a830cc8f52729bf7776f71e0753a450a6282cb04107a7eda28375c77a7e

SHA512
91ab22b1ab598d6fc1b52dd249b5aa21bc14f5097c09dc373dfc3e69611f4799ad6da9605ad8219741c7571f121ea8554f823fcead96edd5bf333433e23479ed

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
12c61bfa3cac7f461adccc15a0b4c6ad

SHA1
6a1c0c676c538531b50fd6925cb8da1b12e94928

SHA256
6c90f12877ddd2a4d3358ff292b0fe51b31ff147f1cf9ba92a74d5eebe3f8f7f

SHA512
962fee3854088a2fc45f7ca9a35435b56831b1fd22bcbfbfbab317d6e88362799130efb572c8bb7401e96b861224826c9e81960c50850970a937a6c30b151b41

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2bcecac293e2c3a146f574770c091b7a

SHA1
99e835d616f1668646741f6a8b25bc8e8e2b9267

SHA256
9fec7713c4c0451d8712357369d2518aae25627c98d24ccfa94fc51c7cc89f42

SHA512
6e98d1054501b28f24e31331b5a1bd38c7fad80c42110e29cf3ecfc8b6f6e9d2a850618ada57b938401d5c2a6e9ea532bdab95268b9c0fc4d542aa2482e7b333

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit