evilquest | d4cdeb6301ae45c2498c355ffaf022063a0dcc79ee4699d38ac6711e49985c60

Analysis

max time kernel
150s
max time network
152s
platform
macos-10.15_amd64
resource
macos-20240611-en
resource tags

arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
23-06-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-23_0ddba0b1b7478d96a51dc8c5f302f190_adload_evilquest_rekoobe
Size

168KB
MD5

0ddba0b1b7478d96a51dc8c5f302f190
SHA1

1e6a3015406e9ba85f36fb67135a343b95a42d66
SHA256

d4cdeb6301ae45c2498c355ffaf022063a0dcc79ee4699d38ac6711e49985c60
SHA512

8640f39c8a6d39d6443ee83b2c34352ab4799503048d1fefbb49fee7aef0ac2063d14a895a9daab90c87dea52678f2638748676640aec477097a87b393dbdf1d
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq910:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008ad9d-1.dat	family_evilquest
behavioral1/files/0x000000030008ad9b-0.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-39.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-44.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-49.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-54.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-59.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-64.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-69.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-74.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-79.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-84.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-89.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-94.dat	family_evilquest
behavioral1/files/0x000000030008ad9d-99.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 14 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

Launchctl 1 TTPs 28 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-06-23_0ddba0b1b7478d96a51dc8c5f302f190_adload_evilquest_rekoobe\""
1⤵
PID:494

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-06-23_0ddba0b1b7478d96a51dc8c5f302f190_adload_evilquest_rekoobe\""
1⤵
PID:494

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-06-23_0ddba0b1b7478d96a51dc8c5f302f190_adload_evilquest_rekoobe
1⤵
PID:494
- /bin/zsh
  /bin/zsh -c /Users/run/2024-06-23_0ddba0b1b7478d96a51dc8c5f302f190_adload_evilquest_rekoobe
  2⤵
  PID:495
- /Users/run/2024-06-23_0ddba0b1b7478d96a51dc8c5f302f190_adload_evilquest_rekoobe
  /Users/run/2024-06-23_0ddba0b1b7478d96a51dc8c5f302f190_adload_evilquest_rekoobe
  2⤵
  PID:495

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:496

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:496

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:499

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:508

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:509

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:509

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:509

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:506

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:521

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:521

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:522

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:522

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:523

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:523

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:524

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:524

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:524

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:525

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:525

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:525

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:526

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:526

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:526

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:527

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:527

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:527

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:529

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:529

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:529

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:530

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:533

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:533

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:533

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:534

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:534

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:534

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:535

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:535

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:535

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:536

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:536

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:536

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:537

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:537

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:537

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:538

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:538

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:538

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:539

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:539

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:541

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:542

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:543

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:544

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:544

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:546

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0B4C966A/OneDrive.app
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:550

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:550

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:553

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:553

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:555

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:555

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:556

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:556

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:560

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:560

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:562

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:562

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:564

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:564

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:569

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:569

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:570

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:570

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:571

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:571

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:572

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:572

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:574

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:574

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:576

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:582

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:583

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:583

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:584

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:584

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:585

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:585

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:586

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:586

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:587

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:587

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:588

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:588

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:591

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:591

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:594

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:595

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:597

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:597

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:599

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:599

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:601

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b6165839263170971140721140a1769c

SHA1
1f091db975e0b7f10f896d8781ad491b91d7b98c

SHA256
420c363cdd7497bc46996090265aeba837cffd6760987778fa5d28cf52ac0c8c

SHA512
2230a4dcc12142a4f48697647f1b11625abc4541710190efc98a1b98413fdf9682e1ab6e4a757e382186edb2431ae02b32f7ec1e3225975a09630b5aeac00756

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
15f815037f5e13eee53f1b1563734ecb

SHA1
9fa348d6a7e29bde61bb39260a9b2b6e881b94b5

SHA256
d651cb735d4cea91e73d503a4e57aeb2e349801dc7a405f8b9f06eec06b02c84

SHA512
71dc2c1cfc304f7e67e828cdc8568679da3a2dbc4998f6a08db0b62a8392b274835d54272c6fc591b20a1cacb0b1d8d78e6ae675fc89438ceaa2946d1e09cf0e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
291c6c0c8ee347e9ca1267c5a5e93e2c

SHA1
ec6ae41d9c9ee3a9419516b0de8bf70f96f508eb

SHA256
a7f5d821166c3d05120428753f2c95fe5d457d0424c708b87c1477aea5167ed8

SHA512
5eb2a62f7b9c5500c49623078558f1460568144778a1e700dd58bb6e329f4386b8ad31ec5d16e35c1d04b683d4999dad26a1bddecfd2f1191fe344d3c290f2c0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
34207b59c50b6f6294d0fee147605a52

SHA1
aebd938729a45a6d2d901250b7c454ee2c9550e9

SHA256
d0f26359c8535fe025ed7a2e88867c6823a8616ea59a0b1ad375e16de5a33b67

SHA512
cd01b831633b6c84b3d4e2ae7d696076d304289554f37f0d1c39a4e095931e018a1bb7395c361f190ac87626358b42d6cd3ccc0b84f0d03bc9b11c66bee2275e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
3584ef6a7e9d6c9b6c4737d1c6bab273

SHA1
2c241a1d9a3ed523f8efadaca2630798f3da07a6

SHA256
aff609fae063b2ca3de0c94ed2f1255ba6a79f62982c5634c993571c6e27489d

SHA512
ca7db44b536ff169c8940a38fe865ec8286ee259878a8f3879467d98764ed704af6a4ee987d30bd702e0416b3186ebd224ff71d2ef8f96c628a7910cdadb602c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f67bf5ab54a3d4a977a78db560a019d9

SHA1
5f8eacc88f57b21294aab6dd5b77a65645136340

SHA256
be67c7b317e480a2d8cbfe28885d2421392b34339c35622970559b186eaba848

SHA512
f89a81cb7ae7310ed1c4deb7c5e0494ef2e7dd67b86d81ff99df507247d7b1302a82ff9439f816e44be98386c207205e1c2258fd4e04aa9dde59cd02cc09379f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
10bbdbb043ba680a1ad5f9fc492cb565

SHA1
27fdd5721f862aece8ba109d316a86cd8969e311

SHA256
4770b44f6c617d39d45c774ffb6b2a6b90945ef2fe232843521499bfe872623f

SHA512
3a1c3f9b6f6a840dfdb795e12c0083b9b9be39518a9b26352cb3888296c2ae456bc45400ca0a8dccd2df99ea7c4f806c2ebcdf785c6a7334425028e9e68feb7f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fb9fb72b5bb25a8dd6b631fc35355e60

SHA1
e12292e13cae9cdb9a819677c07696016e5cd9f8

SHA256
9c89f8368b618a5b2f4310094364bf6a504303eb5d2c6e004e06339d4473417e

SHA512
42b45bfcc4ad6ac926f4f0da0df8ec4469ae4f972add6ad452158fe6b7f9251611f72845de286b2626c621a20114076319bf500ecb9fe0de25b59b52ae32129e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5d9fa449129637117e7f094aa4f87f73

SHA1
0a56e54d377862de6fd3204f15cd4fa0b1e1e399

SHA256
4075540a5f2a2bacdbfe2348fbb0a75a13770084687c7cb9f47b8203ff957214

SHA512
ded3a67bc1628705bf2b932167485aadb863d58447486b080fbbe321da0f641e0afb9c67ab333bd83f0e6d724a686e99e24b11df40acad740a6cc0db24a69998

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d71547bede6065faab1fbad577e0615d

SHA1
0471b8a833d34fc85045bd01852bfe089f42b280

SHA256
b2b47ed2a0d2b557895b2630e9150cb26cb13e66b7c6ff641ff0bbcccc37bdd4

SHA512
454fe28071146089d95cadaf894cd4242f03be33a26eb2b6ddbd4b5725df4de255da344833dae9043d26acd8b0bbd4db9838676900083debc9cc907b85427ef4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b2faa927c6e56846162e713ea6d1735b

SHA1
5d65180429e1b85c6710477756d255358bef63a6

SHA256
54632128150973cb7e57ee017bad3f9a5bb59b36557b6d1d7fb95aa153ab523c

SHA512
500749d2ce7804ebe9042bc8fc1ce755aacf7332c29675df96224dccac388aad9eeea70fc117af6ca152dd282e6dbf67fb46277063bde097ab85a043d4f7dd4a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0f221aa54505b52587351abf09182922

SHA1
03296c83a6355a7aa8badeef04b4d29d49ee0ab4

SHA256
a0d6e97cf5981a4d54da48748299fc87a527cc57c5e180680c2f317f6d9b8357

SHA512
ac640e451e0dcfa37777238bdb52076a5f9e82bb8f89f914998756ced9218497a65f143008fcc26572597915347f66dce02de7c3350eebb787aa66a5f0ebbd7b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
72ef7275c72767fda9633d6f6b4403bb

SHA1
0875a44bc3bb011c79c4a8ce99f3979f4f33eead

SHA256
4ffc246aed19a4afcf8ff4784e583761565bb54c93e03ba5f5f3688f26c79f31

SHA512
26bfc96a0f761b1fd0d32cff7760a46ef8389a777724c22e0b2ad948a7c6abdfe235dff572d3824455316233fff93461b5b6e42916aa0ef2e984190f791d6a3e

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
138807bc042fcd7bd083065c47201598

SHA1
0ae3ecb06917f5f34bd76ce7775f649bd9396aba

SHA256
c06ff6e82a404eead10f4c16da31b3b9201cdf2c94e9200d47be9d7c985b6f1e

SHA512
ae8232d41c455c04323d79e78e16abf2f21fc4419a493e33d938456dc622074cf26db76fe16f7a435394d8aeb97376d0f64d789bf33cfebe6806fb3424f83372

Download Submit
/Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
430B

MD5
3d269391b44f568c96f9f5a420609082

SHA1
e2d49405da7ba6f883b366f71b6905b6ab556cae

SHA256
261e6af4aec0840afe0b4c75c21353d7bc8d69ffb1d26db364f5475962381a12

SHA512
81ae24faac0d2973a90b7ec7415273f95789fbbdeae164df6ffab10bfdfc4896d6ecf4d9b09ca13b2a151a385c59f48594d7b3d0df3b49e3bbc056f15908432c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e17bd6f40370ff083a5484c6e75e0880

SHA1
fbe2d65a851ecabc7b7cd3774743a977370a35f1

SHA256
38b92b8c28bcf06a637bc951c39685b8f733cc464c66613cfe0f8922dae2b2f9

SHA512
9808d0079994ab0ef3818ffa36706e13ed20bb2b857981c47209938d1c67fdd8eab07e535fe6c0ed82e454e71a30669c9d0e7d69120564bb13edae1328122f8e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1396165134a897dc32d7e73a5e84c53d

SHA1
9bf0daf044e182c51ec46eee7dac0c5ec9733498

SHA256
643c2c024d39275955c660fc6a053ab31b5a661365031045b508f7f801e61da4

SHA512
f000b7640dded46a05de5e07149178495f11c81eef21b9d93dfae789af6e6742d304a052c104948729ff8c2100c69db9687877f2a88cf409e25b97d11972a427

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
88d81bd39881afd1454ca095eeba5daf

SHA1
79e1860bbcb9c49d5d3d7ee97e2b97068a794970

SHA256
5a3caa7c39509a564828ebb4e42a61c91edcf29ec6a07b388b213b6d0336d714

SHA512
462b388cc56de0ab1ef6a112fcd903fd912cbcbccbeb911cef41d1c94d8669fb141262ff710a73cc6c2cb7a5f5f5d262e6e848bf55406fe247c2b7dca21d02a7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e4d1c6e7eda5e8d4f64478453c3f1580

SHA1
c59657e46da109261b264b0a8cf28fb726dda804

SHA256
af5823b245f0b0208fd1cfe93e66819f6274d26061abe1df436a4c0682003103

SHA512
90ff5ab1e4d9d1a5c01afeedae5e5f7cfafcfcece0297be9d903a52ffb2ba87985581adfb218d45452329945f9f0830afb17ebc2ccdbde01c4db0eeb5f6ebaf5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
03d78a501581b439429cd33eef384d23

SHA1
4c41a329d127d7823923c83c2c41adf961e19cbf

SHA256
cd0d538f3ec15554678cc6ea9725152ce00e3e094354e3a56519066d85fa7d41

SHA512
b0aed4e79227154fdf4c71c0ace62c4c157fbfe36aaa4988a3749f130380781d1fd44529d067284fb8751398db7c1ae414cc85ccdb5f0396660d9f67d6efc71b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
38281a9ce33831f4d95b77ff86da3e8a

SHA1
4ddc3794977ac093aec0baed153256c273b69e3f

SHA256
53e08c5d00778e20fab17291f6a01394afba1a94388241f709113d40502cf20e

SHA512
b2b1db68d77e1217c4920de4401f143306e62627733c0d424b4fc924699f03955d77f72e4dd70cf43adc0c04bbb911d2fd3080af56311ce847a2563f7fe8d809

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9c3c1ebf8d1d272512f9aee508538c6a

SHA1
ca1d2cc6bcfeadf4565617e7d33f9add9793b66e

SHA256
ebeb1e03600d43cc7f8e5ccea8a65974a749f28fab1ba061b99a65620f76b810

SHA512
5b39ca982612160ab7d8619ae5c10f9e28b83c05fbc48553367c7bc62772744caa3057fcd764f6144d4979a17ec96ec017075b70d753c2cf9c2ba903bb4b314f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d1fd258c59701731e7c26ce58407f11c

SHA1
e8a377c7fd82c0caadffd60f351fa66fbbb498ae

SHA256
a35bf7e15614d41ca2e9b26b9808bce10819e55b9de1ca0c9d6d1ec25657c282

SHA512
2ae423d8045c22344d328fc5f6c2414d8d9be3fab273bb5bdabd4aab3b374a50549335d1d8ddecf1ec0a052901b6d924037c5e4d68e691580a8479d40e89bf91

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0c109c8ccaf99b4761c4d16d550fc586

SHA1
d9d8106b96ff2c617e5b90afb696a8f73fbde22a

SHA256
15582a5b1525034933a818229b957c9d01486322718db657ca7d923a06c19b6f

SHA512
51ee67d8b07fb146613976f69e9929e79ea011dfbb70e251d586a83714929489696b288b40b9676434267fb5e4dcfc10503bbe37c51fcd4c549d75d58c71bac9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
785fc26fc6270056f73f60d895d4dee5

SHA1
8e4f45ea3184ee69ec1ab08b1520a1b315c9e383

SHA256
3738331dcb3b0432be66fb09904707b12c0320cd46065b8711f2d88c26648898

SHA512
4042643ea56d216bcfa1ca299816efb64aaab9fc51592f1137da80651c726b4e9b492f5d0f1a9bbd4ef2c7de075f938c7dee6860c44bb93ad66abd96bcded436

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ca41460d96c0943adb14277646de9142

SHA1
beb94a309fea4b2816e016a8cdcd7f35ad003a0b

SHA256
6b281a6702105690741b47f742ffe220dbba808c1009ae2ea28be3ea36d78bec

SHA512
a5a224efa8bdd32ca262d4817f15b4d9096638e090f659397c744604f16f3994ff9dbf3a0f0cc8de88e0a1b36f3a0bb6f014703914de791b5da728ceab435476

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2a9c8df85cc5a6d2e49d4569938f733c

SHA1
30268997f11f20aa69021f41cdba3e1167d9301a

SHA256
b797776a0a654d6486d718013b348595df68a8b8aa2e2345d20059a8946bd2fc

SHA512
a089a7f9b11391846ea79f0b3c3c86f60bc9ee9bd8838ce41b3e3a45e38514e0f94b738d5f289eb1b2bcf30799556094c1f859a074e1b0890e0fac7aa18cceb0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4c9a6f9b1d22690bdff16ebfccb5badd

SHA1
88b91579a230771f5f12e8e3fdaf4ffc81a2eaf4

SHA256
9e62f0ffe6a5d8b803331d4b27079f50da414856b628e98ab0be6e1add5a15f5

SHA512
2f1cd815515af9586c1e62fda265c419fd6b9b4b5403b590ed7569c4ae6044486980a557227c314339976c46634df12e9fae8f2b6ac6cb5fe6d9c491e3ada1c7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a9bf435bb84a0028fe3195440ceba6c8

SHA1
0c98c0e570804a089e7593fbf522e3221f64e65e

SHA256
88b5cdb23e4ce609ca63f5f90a9e06f9c5bc2d7d64581d849f14bd61c938c230

SHA512
d0e6013c42f24bdc1706aae8d1935d4942d6fddb077bd8a4b5e968e77ff4045679b1fd8e7af54eedfe6ae57c8c6503f8e1d5edf17eaa56cd9d6c53e653a59eab

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit