evilquest | 4d1b9bcfde0d7efa94f6d9c48bddf8be3730a2ffeaef4b7c70d81c0ad2aac6a0

Analysis

max time kernel
150s
max time network
153s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-04-2024 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

072bea34bac649e05c825fce9a6b3a02_JaffaCakes118
Size

168KB
MD5

072bea34bac649e05c825fce9a6b3a02
SHA1

9ec1cd64c5ddcc0d818975392c3a08eb45548990
SHA256

4d1b9bcfde0d7efa94f6d9c48bddf8be3730a2ffeaef4b7c70d81c0ad2aac6a0
SHA512

b2504057fee736a7842f46597ef53f0107d7cc888582f2e6df08dc838fb2d602faeb01383e8e57e0012ef9cb412b8ed99797b2c0b0d5c752736bdc5de6456fbb
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9I0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008adf1-1.dat	family_evilquest
behavioral1/files/0x000000030008adef-0.dat	family_evilquest
behavioral1/files/0x000000030008adf1-15.dat	family_evilquest
behavioral1/files/0x000000030008adf1-23.dat	family_evilquest
behavioral1/files/0x000000030008adf1-31.dat	family_evilquest
behavioral1/files/0x000000030008adf1-35.dat	family_evilquest
behavioral1/files/0x000000030008adf1-42.dat	family_evilquest
behavioral1/files/0x000000030008adf1-49.dat	family_evilquest
behavioral1/files/0x000000030008adf1-54.dat	family_evilquest
behavioral1/files/0x000000030008adf1-59.dat	family_evilquest
behavioral1/files/0x000000030008adf1-64.dat	family_evilquest
behavioral1/files/0x000000030008adf1-69.dat	family_evilquest
behavioral1/files/0x000000030008adf1-74.dat	family_evilquest
behavioral1/files/0x000000030008adf1-79.dat	family_evilquest
behavioral1/files/0x000000030008adf1-84.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 16 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/072bea34bac649e05c825fce9a6b3a02_JaffaCakes118\""
1⤵
PID:561

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/072bea34bac649e05c825fce9a6b3a02_JaffaCakes118\""
1⤵
PID:561

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/072bea34bac649e05c825fce9a6b3a02_JaffaCakes118
1⤵
PID:561
- /bin/zsh
  /bin/zsh -c /Users/run/072bea34bac649e05c825fce9a6b3a02_JaffaCakes118
  2⤵
  PID:563
- /Users/run/072bea34bac649e05c825fce9a6b3a02_JaffaCakes118
  /Users/run/072bea34bac649e05c825fce9a6b3a02_JaffaCakes118
  2⤵
  PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:564

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:557

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:582

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:582

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:583

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:583

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:585

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:585

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:587

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:588

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:589

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:589

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:592

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:596

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:596

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:596

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:598

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:598

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:599

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:601

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:603

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:604

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:606

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:608

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:610

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:610

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:616

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:616

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:620

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:620

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:621

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:621

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:628

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:629

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:630

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:631

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:639

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:640

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:641

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:643

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:643

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:646

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:649

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:653

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:653

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:655

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:655

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:657

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:657

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:658

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:659

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:665

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:665

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:667

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:667

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:669

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:669

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:671

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:671

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:672

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:672

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:673

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2064e319676a0c5bef3fb9bb53a566a5

SHA1
8dd461c5c82ac78b05664f0532f3edaef1ccb22f

SHA256
b64931dd522687fff77ce0056709370e83df747bb9957a6af53c43180488a79a

SHA512
b29c0a104849b541f8f6cb140f6f6f4abf7a952b04390a09a702005f77507adb4de4a57cef6ba2e315fbf75c3407feacf323a554f809b134344da9332bec3e95

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
47ef500b252c54ea1603cb2b94b1e17d

SHA1
8fde3ebbc528310eba1b90ccd09dcf47c0ad7d54

SHA256
68e9e11090bac89de25600433fb64cbcb707ce97c954f538053a5a4cf951de32

SHA512
82dfe5fb49bc418c16c1f32f760efa838a8b0d0fe82bfb7deecfe841808d3acb3e10f8019000995829c0c17857424abf1374880cc165779953187f6292197ee0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5e1d2d8f7127957d9e19cc88a8a33599

SHA1
9c9fd9e44e1a3d51d62caa08581457dd0ff32e1c

SHA256
eca3da53741eccbe9bf7d5659a3e73f1ca700c568371a7dd39095a081c9e91a0

SHA512
2420ff198f95c76c6d2bb48a5ceb75b0f69b2ae67e7fa949cdd0ac8c079f66dd30b9bc4bb4ae02c7fe12398be03e34000a35978391ad65d201120ec7f84424f3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
063b46e2f1c6b6aa02edcdb19b9e7fac

SHA1
ff14abf1b86ab2cdd7dbd74c571c1857aafc3eb5

SHA256
6270561949e362dd47c50c031af88d51fd9102cb771fd1fa73b86b833c2763de

SHA512
ba5b6e4621a321991c590a91fe4fab071beb2d3fdf0614f14a98b17b326f53ac719799067c9e213800da006b361bb7956c532bbcf1cb1bab362a0807ab6aee66

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
91eaa5b90545a2cdaa539cb5e87dda27

SHA1
7fae8a34f2718ef440364572bf978b9999c30eda

SHA256
3f889d11523c2dffc785bb99f78e98f798178c2e3973b7ca6a2f2353c5daeb78

SHA512
7d486d4c001f5a5d303f9606931684cc21b59aafafa199344658e81f405078bedf8c27fde968f4a0288566e4afd77f079aaaa68404ff894311ef89c7ee4d65ab

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c7e204c606ef307ef0ca964688f999a3

SHA1
fd28febbe03378b4929a81ceddb0a4afed4aa0c3

SHA256
1d77b9265e68f3853e326b971a2958dfb3c1d3d07c401a15ff2b9d30c77f6e0c

SHA512
3a9f03ec3591c123e11c0e4fd7501ca76877b0547f839d41e341b2f1a8e08482896765b822c0488b38acc9e36ede6efc1a5e3be567d61b21e225b08b7826a4dc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
70d05ca6e7a1a19ce68837f03ad2dbb3

SHA1
c03fab5f3a63380c4847904bad1ee12c3bf2291b

SHA256
019f766b09fca390eef6c3d91641b3890fd5d505351333c5857222acaa68bd8c

SHA512
44e2e68b385e2880e079be721fea033a220a87bcf7ed269f9548a56bae7e8c540310d64b138c75346aec54e973e0c27d57a7cda9448f1e76f5e0c48c122df34c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e0c1e9be7c67ac97583f19af968c5977

SHA1
8d7372f05cfe2bc5d0d4244aed8a7d555f04a7ce

SHA256
5a84f3f3564a3792a27ed2cc0b47213dcc9c83c5d3e74dd42b6f7362f5be40ca

SHA512
20b481d55fd60502c172387ef5cb7b8583ae3ab57fb71a43c6313beb4dacbb6e2830a30b4ec07a36c8b6b91e83b3b353fccc4705e90005b3a52a8c745fbb46f3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b347af979bedb71415bd55937893f3f7

SHA1
c1bd9bd47cc9b8da9fe8433a935764819754f3b4

SHA256
e0d918df16b13d3bbdd812641b22b3d4c76db8fb5b8e9390002b9de5bbb39e01

SHA512
7945c33edea37b52dba4d0029d01cf1e5080a8d3eebea3f8ff6c8b9c7cb76abf223c6cd29eef6822ab411909fe60ff13b123beea48ad256ac3bdd101506af2bc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0d5a5c4e95e6636adc47d0a0266ec433

SHA1
4e5345e6c45c48a261e9c395c924099eeaf71c20

SHA256
d2cfc3514049e7efae8d93e9d1fee5da865cd7fec20cefed3b88eae6eebb3257

SHA512
e188dbe0488de48d386cb4a502a642f181191e61989a0042ac5e97e7ee73c166613024bea25dc5afe7ec544f3f0cc139981ca3c28a3bcf6c0373cf36858ff881

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a15cd889beabf3279e7beb450d4e8a2b

SHA1
febfc6b6aff581d55faabbcae74e55ad47f3bdd5

SHA256
9e54221aa735e9ee446c8f81367637a1626e5fa6f2db2ed8324cac5aee650e87

SHA512
e1e3fb40238d6e62faa4ca6b96855fc5ca48cc86797a5be0eba50687cebb85670f660f3ffeb589e818cb6998bba6204defc586f4a821c86ce6c6b4b9dfd323ba

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
07e7c63566d04a2efefce1361ccb0f32

SHA1
9565b74c4a7b6a1202b8ed0cc6c9e5c8855bbf77

SHA256
bc3901909fe5f423d8ae3d79abbaeafa5010c2e14f38d6a8108fff4fd9b07b6f

SHA512
d735ed9081c5ab234bd4cf55a6672d2a7d4e9eaa4ff1ef5f7475fd4ffca2a525980ef36165aa89716646a80cfbf5593530c50ef441497eced7a8959f2c40e484

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e48b4f283dd896525a4684afee272fb1

SHA1
cc27cf593455073b34971c7b74610707993af7a2

SHA256
ba062d2833d9aaa7048ccad254c4691ad1cfa00c8e70a522082b72e16c42ef8a

SHA512
74d95bdf2eb06c0246529a7e2929a34355e091cfd54772237e3192b9efe89a3625f3bfb2fccf2097973205e80c9112c546c83e95bb112870ee925727c80eca23

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3e29ec018c21e6ac10d9c157c3514e63

SHA1
03208ca7d723ca808ad224bc0474e38d2c0475cb

SHA256
b5662136c2919e4a64d5b43d91f86ae3b8e5501a4b4146839e21acd33eedaa67

SHA512
0794ed55155f5df1df76ac1168da215a4cef0fa31d2fd0b8b69dc9ff00ad83872e7f9f7f407629680a97c9bf638fec2ac04d81555c5d6b92f7ca3514cec0e7c3

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
09b3e50bd3b4f67c1aa056688c777d87

SHA1
76940f97a7f31d827f617692049e49ce51a6722e

SHA256
7a282dd4b0b2f925024102678722c5200511b23229e722c2607ab094a5e46f76

SHA512
79d5af34b3bbd5ed326c495b003b7956d842d216006cf7ba9047d0329d4674d4a83e094577c79ccf4d08fd1c3d0a9343ec7347d7d9e16ffbc4ca20aea9d5ba8f

Download Submit
/Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
430B

MD5
3d269391b44f568c96f9f5a420609082

SHA1
e2d49405da7ba6f883b366f71b6905b6ab556cae

SHA256
261e6af4aec0840afe0b4c75c21353d7bc8d69ffb1d26db364f5475962381a12

SHA512
81ae24faac0d2973a90b7ec7415273f95789fbbdeae164df6ffab10bfdfc4896d6ecf4d9b09ca13b2a151a385c59f48594d7b3d0df3b49e3bbc056f15908432c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b31ce3e968a3ea9d945599e79a30ded8

SHA1
6048574815e3acb929f261afb4f616b0ddb07f0f

SHA256
381d3d18e8cd9ab2e9f0a112b79da3310782b042d8a05a60178f2037ed1fd2fa

SHA512
40fbbae44523185315a9c255a5a30c8855e2a25e216365ea4c5c0acc5fb135022c57bc818cd992cc73407edb9bbc7875a99d7139827cc007ce4649426d9779f9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a5b6c0560d1f228d075c550be8c99a5e

SHA1
6517cacb249a346f3fcd8615002a22f881ab969b

SHA256
cd4ca450383f237d676c64e25761ec5f56537f6ba3a5d470ecf8153c12ac7cf9

SHA512
9889367862c00737be978bf68bca5ea1241c0fb13d513f79674ca515bfff2b52c35f57e822d0fdb380d5f7b5d20945f57d2a617acaa22711a3d91746e2375839

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
75036e3280015db951de2d423b601dd9

SHA1
baf5258de33e8829da7dc2d42b6b7649610efd19

SHA256
2b2e05f389190095f00d4af257ed73bcaf0a71106f2ce17b18fce462abc38691

SHA512
fb69cf27d20707059bb9348e2bb9fe741b9860f421216b22c6d43e3815533f67564ce3d88ea8bdc68733650754efe483ebeaa13a29d46f9af3bd53cbf41474c5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
df0e19ae3d82bdd30d5ca76a915b35bd

SHA1
209a863c4ec7b4ecd50fdb47c3b97207f40167c3

SHA256
b5da468ffdde41b10a616149800e1ec5aa3687957441e55e16e3b90240d69156

SHA512
3b41838b3712dd13e0bcd078d7289826343ff59beebf26871c987f0b09e267bfb54e9b17bb862e84daec73ff7f9ed5544d9e51052f9359632bfcb6a13058f8df

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
157b2f9ee4fe01f686e9c489ca8cef5d

SHA1
12cddafd5944c3aa1f29309426bd61b9622be068

SHA256
bdec29c52cded225adfc25a577d64690c821da86396de4235ab6ced061b49761

SHA512
7928c5082d9456d4a88ed6df03499b42eb05cc065b255c641152c5939814fe0b0184be2a12c9c77753f97c8b5782abaaa0a1c5c61ae22ae3072d3c5bd46ac159

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8550887db984985dd25deaa37d926528

SHA1
a4216fb1e5b123084b55135e3aea276df8b93b40

SHA256
8fb8bdf20691ce761e6f1ee079ad649e248cfa91efeb9cd6abd3c54364a6e0f0

SHA512
b7ac437eef2784f56fa2e5e1e4db3103a7e90d9c3dff42b356776f93a141b74df2bada2182c0feab6ae0011d88ca67bcef175dd19789f158573f9d25fc34b0a9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b03d391f3f58ad42b6e18f57bb16e1e0

SHA1
b6acd6f235d333cfd7ea17d90ff81753f19b61bd

SHA256
cf5eb0760d577f0fb9ec6e8e2783fb9d7289a6bc2dcc70b6896173d28757352c

SHA512
d99b618e74d6c33a4c99f9d4674227c2644175fa2188b7b5190ff6b14570a5a248065b13506d347c7f42c21c381d642f1b26238bf9f3db43d5aa5ed1837e884d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9192f2cc866d0207c85e26ac305ad44f

SHA1
e0935b37c003d89b12d2a39766ce5afba6c0277f

SHA256
a7f5c302bf37592ca7f6b5b0949a82e50bbcf272cb0acfdaab234682fd45e363

SHA512
f8bc5d047f58c38ddbe6b34cb432be7089ea73ac972b005071865a96048fea5aaa567aeb263d612e4b95c379e4f0322e460fd4a45f74e7c079f6c4e9332faad1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fc572cd5d98cb57baa16772903c84b9f

SHA1
a5dbc50ef4b42a455031deadb4f54c931024e1ca

SHA256
f5cd5925208050f82dd303bbe9eef9870d2594d6e7387bd65365745a6077f302

SHA512
8285f0fc89a62143bfd325832343d972f78e955507a248522674cdea07cb17e6d193d0f23a026dc44db7b07419da53bce41112cab6f2ea74f130bbb85b48d2a0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e76863101d8aeaffd120a402115fa874

SHA1
cb2f4580dacf49a67d5894a864d8ac948d58666c

SHA256
8d4f5646f067c54c6a756365f2ef5e3add197cd039c146a542145ae18f6a59df

SHA512
046e458fb207f55aa6f0ae966177f5754be1f993c3ce8e41ca09830db87d37825035c745d92f57035ad0c3c6c5b953f41ec303cb4e55346a521ca466561b36e1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b468b69d90661a42e2920a156e10ccc5

SHA1
f9395d65644ec0bf5a1f9187bc8a4fbbb6c0a3d1

SHA256
51d53d0ce80ee2602b99653fb326965dc39af40c95ebf3164dd4b034ccaa4f15

SHA512
9d9c7eb9aa5c66203aa03e0d4c7eb869ffb5f8080f454039424e5cd50a6af0a40abf4e5d78db333294abc906fb9a12c03477c6241f0132d92cc8c4074fc89a23

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6f7ccc2da1fdb12c49d235524158ef11

SHA1
ad0ad2c2441d8700e65ff3da589890b21704d7e7

SHA256
87c724c098484a3c0aaf5e939c84b6eaaa77025ac278500ffe9f25a9e8cebcff

SHA512
3b78881e9b3b82aae5c92fe54592fec8ac57d651fbb0e387bc24e8ff49a55527f8db341af5b984502f572a21e0470d1f11921b97d5945476fd8d006bc2bdceb4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
87a3d4baf238756e79a42e7f5d200648

SHA1
10a1329d60b38fc3cebac32ddddcdc8805940d39

SHA256
0c6946551b48fd76b73762b832447e45487f8287edf11bd186659556b7f78f8c

SHA512
deb57f23ec72aa0c58555f841f75de2897e2487627a69967480114f90da6e5c896b117c127a490ebc67d0e68f736a317a1e1a93fc6113714eeb722252533e452

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6632f6a6f9ef15f8e076236aed8093c0

SHA1
c73123cabccc2207fc566d0a5bc0d49fbac449b3

SHA256
48887cc90379e977cbd489f7c6319b222eb56f301b97bd294a8b88be0272ee7c

SHA512
40c9eb3ae0b5a40844a536884064f9bdd9410c68da69eb1e2f07a0723d4ce6207ba106d4965849069aca4bad6318823545d6943e8822c89cb9a7e9ca023a5a35

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit