Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

6b03d8484a...kes118

macos-10.15-amd64

1

ProntoInst...taller

macos-10.15-amd64

4

ProntoInst...ntoApp

macos-10.15-amd64

4

ProntoInst.../unrar

macos-10.15-amd64

4

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    23/05/2024, 12:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ProntoInstaller/ProntoInstaller.app/Contents/Resources/ProntoApp.app/Contents/Resources/PRTPLG1.bundle/Contents/Resources/unrar

  • Size

    429KB

  • MD5

    f81f991af0573feb57ce426f934178ca

  • SHA1

    d2225575cda170aa3bea9ceec44cf7f74329e37d

  • SHA256

    c64cac9318db65d129772f2f422046d06d6d61fc4c6f3a6326e9a8bea32e8aa7

  • SHA512

    1a49a7a16891d2b4a5c060a785733743f56b84bbda3c137ed69bb03237bd842077867d40bd99fd1b92a87fead580c76f102c75b3be94c212540a4408a915cdb8

  • SSDEEP

    6144:HtSkE65w2iLuabZ1jeBZjyc6XkWhSLbOExpL22Nz3D81u6aTV90c6G/ZkM+:H1Ef2iTbZZeBJyRhubOmpLzD0NsHCGb+

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 4 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/ProntoInstaller/ProntoInstaller.app/Contents/Resources/ProntoApp.app/Contents/Resources/PRTPLG1.bundle/Contents/Resources/unrar\""
    1⤵
      PID:487
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/ProntoInstaller/ProntoInstaller.app/Contents/Resources/ProntoApp.app/Contents/Resources/PRTPLG1.bundle/Contents/Resources/unrar\""
      1⤵
        PID:487
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/ProntoInstaller/ProntoInstaller.app/Contents/Resources/ProntoApp.app/Contents/Resources/PRTPLG1.bundle/Contents/Resources/unrar
        1⤵
          PID:487
          • /bin/zsh
            /bin/zsh -c /Users/run/ProntoInstaller/ProntoInstaller.app/Contents/Resources/ProntoApp.app/Contents/Resources/PRTPLG1.bundle/Contents/Resources/unrar
            2⤵
              PID:488
            • /Users/run/ProntoInstaller/ProntoInstaller.app/Contents/Resources/ProntoApp.app/Contents/Resources/PRTPLG1.bundle/Contents/Resources/unrar
              /Users/run/ProntoInstaller/ProntoInstaller.app/Contents/Resources/ProntoApp.app/Contents/Resources/PRTPLG1.bundle/Contents/Resources/unrar
              2⤵
                PID:488

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads