5ae7c1cbaf31c684c1b0c40740d7aa8196e63a1a712b8be907004d36b6cc70c8

Resubmissions

15/05/2024, 14:54

240515-r943daef53 1

15/05/2024, 14:53

240515-r9rgaaec81 3

15/05/2024, 14:50

240515-r73frsec3z 1

15/05/2024, 14:48

240515-r6enbaed55 4

Analysis

max time kernel
964s
max time network
1505s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
15/05/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KizakiStudio's.png
Size

6KB
MD5

a7530bd2c0f68c87efb7b732c6d82355
SHA1

1e5493e89de46ae6d8085792fcab44afb23feb87
SHA256

5ae7c1cbaf31c684c1b0c40740d7aa8196e63a1a712b8be907004d36b6cc70c8
SHA512

cc7408b8d67b6d5902d297d8fb2ff95e4207c69596c8f1bec26c3c46c1a23313d556b301c3a0ddb09f80a0f66030e0808a82750f2634fee2a01f6de67fd63fe9
SSDEEP

192:Zd/S4E4Q8eOo9Id2K3NGB4VXPPZqKxO/l1dbDUb:ZdS4LdeOo2dT3Ny4Vf7nb

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/KizakiStudio's.png\""
1⤵
PID:485

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/KizakiStudio's.png\""
1⤵
PID:485

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/KizakiStudio's.png"
1⤵
PID:485
- /bin/zsh
  /bin/zsh -c "/Users/run/KizakiStudio's.png"
  2⤵
  PID:486

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:490

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:490

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:491

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:491

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.6B091DA1-BD59-4796-901F-9D027AA2F420 490
1⤵
PID:493

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:493

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:514

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 490
1⤵
PID:516

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.B8EBD685-1D09-431E-AF3B-912D2E2F4D43 490
1⤵
PID:517

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:517

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:519

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0BF23177/OneDrive.app
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:522

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:524

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 517
1⤵
PID:525

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.D853DCA2-E74F-4C85-A504-3D87DCFACD96 490
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.02E4EA5D-35C3-4C0F-903E-A4457B25E859 490
1⤵
PID:529

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:528

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.passd
1⤵
PID:543

/System/Library/PrivateFrameworks/PassKitCore.framework/passd
/System/Library/PrivateFrameworks/PassKitCore.framework/passd
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:544

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:544

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:552

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:557

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:567

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.SandboxHelper 517
1⤵
PID:568

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:570

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:572

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:573

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:575

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:575

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/PassKit/cache.plist

Filesize
488B

MD5
983afa02ac9bd03474cbd0754dfec41e

SHA1
696bf72962cb4a3f8872e4cca621f08657986dcb

SHA256
6d90fccdd6c7756e9bc28f85f4d38ae54481e32ed1748ff4ff2fbda5ba2097a8

SHA512
398b3b2d86db3e2f6f3d9cf22d12562c89b263629eadf3cc5863ad275b5ab2980a60308883df3992be0d64cca0260216ce36c0d16270e53c5d2b710f215a3116

Download Submit
/Users/run/Library/Passes/PaymentWebServiceContext.archive

Filesize
49KB

MD5
7aba6dd190558cd38f7ee97f013a5361

SHA1
0d955b12e3b79c4f98f1d3ae1338997ea38ccf6d

SHA256
79885c6e4ed668973bd0a0d05fe4ea471f85115a25211a55229e57cdba867869

SHA512
91113824c4d7a73cfb030db0345c1d6223925462773c9fbae11184da5180629e9bdaf472870b71e950247913810f2e79d7278ee98c579c6f9a8c793bd28ae9f4

Download Submit
/Users/run/Library/Passes/PaymentWebServiceContext.archive

Filesize
65KB

MD5
6c79e0132da4f4e61fa6cc49450f72e4

SHA1
72b827592af5428a6ca975200abcc6021f93dbbb

SHA256
044c1b7a453b55235cd0ef26a8c5aa02c7e8e7514b64410d1672761255387c8e

SHA512
a85d3b3d8fc32b3d6e8f9dee281ddfbb2f3ea3e792802f529ec02d27a84b37aa45f2c38b150db6ac764cc3b63d774937fb2d8660f222c01acbf3826557870eb1

Download Submit
/Users/run/Library/Passes/PeerPaymentWebServiceContext.archive

Filesize
550B

MD5
3814d98200aa64e9f7d622965f12ae1a

SHA1
e16616ddc97af4396823a9f67d38b4a0298f139b

SHA256
2d4e2f2551dac33609b2f2db060f04a66a29b5c017aba775957d3b2e2a976bce

SHA512
39f9febe38a1dbabe1247c8b8ddfef2908a240fcda912ed6b47cdfad8e7c362a30315947ba4081c161106f44cfd7196215e069f40c32c6aa74848122e61924a6

Download Submit
/Users/run/Library/Passes/ScheduledActivities.archive

Filesize
1KB

MD5
25552f71ec8b93ee3faf3d44480d4d19

SHA1
d1a4aa8c06895584ee8e01467ad7e42e0df164b6

SHA256
e67ad25360e25ffe14bb503d5409b8c4ae0c6ec601337e59e688c3eb3799e66c

SHA512
a34b5d05a3c26ab84643c8a4c994d36a6780d9dbd0f98cc80267dfe7e11d43915902c7657bb3390f63bfa22959bc84e9681a2a2a4f8ba388878a1cf6642bc0cb

Download Submit
/Users/run/Library/Passes/WebServiceTasks_v6.archive

Filesize
251B

MD5
09dfdae412e2ce9c6666f52f76002c1a

SHA1
d175b94d9dbbc3980c77cbd1da8fa7b853cf0783

SHA256
c620ab626d4350382bd8d7c999e0f3f765e7414a02264987cc38aa428ea03260

SHA512
54bfe4cf51f958dcec06b6bf81df0000d8b4cf464d7c1eadb22450fd0f86d42558f68acfc5e6806557cb1c76b2cd9b1c310c7c1e6fcbef018579e5789e183969

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/CE7083715A0BDE4E800A83FC6448B281

Filesize
5KB

MD5
fbdcc92883587f7a5796784e771b2644

SHA1
7f149b1eb036c2de77e9f5d88166e98d6ccf6cb4

SHA256
aaa3dee76ef9db79aa640a6ce556c041b674ad5d3b59d22d8b4da195c4f24971

SHA512
aa236baabb5b48cb47135f577ef285118519827f4de9461e335d6dc3a03a10641242810ac9bee24828a70503bb19a604557ca65ebeca7b72fa62e790fc760018

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression

Filesize
222KB

MD5
ac7c859c35cd6491233432d0ba69801f

SHA1
b9a2dac2a941fb96221992978b69b5397d5905a2

SHA256
6a7e3318e7a76579b3aefe0ec2f04ec319651d327c2aca10f187c6b5cd1eb478

SHA512
a68d3929631456e4974eac7f88915e5819c71f0bfd0d4e44238fb7b5f67e02f724c942ba6bb81780161d84e430aefc80d011de6974bea1ff443cc66706aed4c2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression

Filesize
22.2MB

MD5
c93d964d08e189cf5a33156b1605eff2

SHA1
dab85f18ee901c4b38a7ce3cf0b2067b5918821c

SHA256
486855185db46a7bb040bb790c790cd61c7549aab2c4f4d898487795fe18fb4b

SHA512
caff04f0a5a438396367d1cefd139a6214fb7b6771a071494fd24303cf744175659d15d38afe01c1fec887a56b206ccbf7a5d711ce65f39eb3e63763057a921d

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression

Filesize
127KB

MD5
fb9dc81f85024ea81565ca5978c18771

SHA1
8c38bd2df8610520a9fa6793abd18948531722c4

SHA256
538911aa24463c62949c9dfa950102f07f396520087f08e1404965ddf36d22d6

SHA512
f325c7c686443db4db66379f513ccd0b895758461d707c27832066653e56c12416783be6d90d7ad1c6b2f9b698c0b2bd6b588928c5743ff554271aa454bf40b4

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads