e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11

Resubmissions

11/10/2024, 09:26

241011-leelcawcpg10

25/06/2024, 13:03

25/06/2024, 13:01

25/06/2024, 12:57

25/06/2024, 12:54

25/06/2024, 12:54

25/06/2024, 12:45

25/06/2024, 12:32

Analysis

max time kernel
137s
max time network
140s
platform
macos-10.15_amd64
resource
macos-20240611-en
resource tags

arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
25/06/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nursultan NextGen Crack.exe
Size 213KB
Sample240625-p5krtstfrk
SHA256 e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11
MD5 c249d5324c19769443136eca7c0f5551
SHA1 0bf9b432f1308db8194ed60e0befb91b7e3cddb0
SHA512 5a6d602aef885c1c601a20ea1f76f7becc6f85e81480130ea85b4298f447253192b70b2490d80ab9f045b776433896648e038f7da8e10c4e81ad6ac048c726fd
SSDEEP 3072:W3uCMUS/OWETIyWNGc2AQPyI0JKeZHPDrf5vzm9jceuCQ2nEt:W3utUZfWp2JUKe1PR72m
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 11 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd	Process not Found
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/BDBEB0EA-9CEA-41B6-A54A-399E3D39BA99.activeSandbox/Root /	Process not Found
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Nursultan NextGen Crack.exe\""
1⤵
PID:552

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Nursultan NextGen Crack.exe\""
1⤵
PID:552

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Nursultan NextGen Crack.exe"
1⤵
PID:552
- /bin/zsh
  /bin/zsh -c "/Users/run/Nursultan NextGen Crack.exe"
  2⤵
  PID:553
- /Users/run/Nursultan
  /Users/run/Nursultan NextGen Crack.exe
  2⤵
  PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:555

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:559

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:559

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:580

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2E18A62F/OneDrive.app
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:587

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:590

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:592

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputMenuAgent
1⤵
PID:594

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputSwitcher
1⤵
PID:595

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:596

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:597

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:598

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:599

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:600

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:601

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:603

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:611

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:612

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:616

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:619

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:619

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:621

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:622

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:623

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 613
1⤵
PID:624

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Trash 612
1⤵
PID:629

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.messages.StorageManagementExtension 612
1⤵
PID:630

/System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension
"/System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension"
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.Photos.StorageManagementExtension 612
1⤵
PID:631

/System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
/System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.iOSFiles 612
1⤵
PID:632

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.AppleInternal 612
1⤵
PID:633

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.CloudDocsDaemon.StorageManagement 612
1⤵
PID:635

/System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
/System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
1⤵
PID:634

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
1⤵
PID:635

/System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
/System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.CloudFiles 612
1⤵
PID:637

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.OtherUsers 612
1⤵
PID:638

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Mail 612
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Applications 612
1⤵
PID:640

/System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
/System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
1⤵
PID:639

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.GarageBand 612
1⤵
PID:641

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
1⤵
PID:641

/System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
/System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy com.apple.iBooksX.DiskSpaceEfficiency
1⤵
PID:643

/System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
/System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.CloudPhotosConfiguration
1⤵
PID:644

/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:650

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy com.apple.automountd
1⤵
PID:651

/usr/libexec/automountd
automountd
1⤵
PID:651
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:652
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:657
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:687

/usr/libexec/xpcproxy
xpcproxy com.apple.installandsetup.systemmigrationd
1⤵
PID:653

/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy com.apple.storagekitd
1⤵
PID:654

/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesagent
1⤵
PID:656

/System/Library/CoreServices/iconservicesagent
/System/Library/CoreServices/iconservicesagent runAsRoot
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:660

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:660

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:664

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:665

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:666

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:667

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:667

/usr/libexec/xpcproxy
xpcproxy com.apple.softwareupdated
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:669

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:669

/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy com.apple.suhelperd
1⤵
PID:670

/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy com.apple.TextEdit.2092
1⤵
PID:673

/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
1⤵
PID:673

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.BA89B14E-7E09-4B70-8547-6D5FD67592AF 560
1⤵
PID:675

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:675

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:677

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/BDBEB0EA-9CEA-41B6-A54A-399E3D39BA99.activeSandbox/Root /
1⤵
PID:680

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
1⤵
PID:681

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.adid
1⤵
PID:683

/System/Library/PrivateFrameworks/CoreADI.framework/adid
/System/Library/PrivateFrameworks/CoreADI.framework/adid
1⤵
PID:683

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:684

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:685

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:685

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:684

/usr/libexec/xpcproxy
xpcproxy com.apple.coreduetd
1⤵
PID:686

/usr/libexec/coreduetd
/usr/libexec/coreduetd
1⤵
PID:686

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:690

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:690

/usr/libexec/xpcproxy
xpcproxy com.apple.contacts.donation-agent
1⤵
PID:691

/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
1⤵
PID:691

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:693

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:693

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:694

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:694

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.pkg.IncompatibleAppList.10_15.16U1923.bom

Path /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/BDBEB0EA-9CEA-41B6-A54A-399E3D39BA99.activeSandbox/Boms/com.apple.pkg.IncompatibleAppList.10_15.16U1923.bom
Size 61KB
SHA256 4bde0dc120c8239b758f62e655e23be5f09b41f32f666bffa05e0104e8109d46
MD5 2f0f49de9ad6128f83b55002ddc0c733
SHA1 348b668dd78199b508fa73253568f3024a03410f
SHA512 6ed163e207886dd7661e67944197ef84c663eb129ca8c988d2fade90fa7e626b581627165521b3e9a8be77c04c12936ac40e1311750c2ad0aae4f6707910a4aa
SSDEEP 192:RG40du9VtrdQ5BvtrMJ/Jm45/6LprMJ/Jm45/6L:RG2Tri5ZGF65GF6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 124KB
SHA256 7eaacc3cc2d691d501f45c374478f7a0f032fa2230b3ee3f40dd62e04926b715
MD5 3c6a5bdddbb2396e0e73a6690143a846
SHA1 5576206e58a6833df45d2fd5bafc2ced944d90a5
SHA512 721c195652f16e0227ac1a4b952f4e548ac29befa0dbe84d8395db14d83e2d91999bbf0d0df6f6c2b7cb1af009cc7b0701d4933d05b08b31bfde049914a6362f
SSDEEP 3072:UyWGpG1qcOZfykEJc5oslHzn0YgJfTNV38EiDtVQyqzyUInicNCx2JcY:UyWGpGqcOZl5LlTn0KDtLuvY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Experiments.pbd

Path /Users/run/Library/Caches/GeoServices/Experiments.pbd
Size 137B
SHA256 651d1b426e76b6b1cfba5979cffac9be31ac4071d81515e31c3cb0f6bd2e45bf
MD5 3f91fb8618cf8705b18c10dc24c36519
SHA1 84bb6878edca2b32925f7be76c1700e3bbcaf27b
SHA512 dbe693b3ec9e34033cc7aaa977a189586d4c30d72ea4474a755108d2c87fdbb842f518c7f2f4216fd9ddda9fc4891e3e8a8dca918680278b83724cdd20ddb2de
MD5 SHA1 SHA512

Submit Download

persona.kb

Path /private/var/db//keybags/persona.kb
Size 3KB
SHA256 773f492fbd23cb2e16a6f336ca9a931b86bb50fcb510b58eec0147eb3fa8daef
MD5 45470925605843090b70a58026b0aa31
SHA1 dd267ff58a8c0401e701735fea784657ec5c49cd
SHA512 e52e9a24da527a5c0e8529f9511525b2908f196b9422cd5a76604208635ed513eeaf0b6be672691713d32f37138f0e0774a8572e863c3e3cc3f7eedd7a79b03e
MD5 SHA1 SHA512

Submit Download

installd.commit.pid

Path /private/var/run/installd.commit.pid
Size 3B
SHA256 90b0ce469fbd8e30a2862bb24d562dc641c534a9b43c7c33c25cfaefe25e5e47
MD5 85fc37b18c57097425b52fc7afbb6969
SHA1 dc51d239fbced2ce3562b4cf820eac1e2b2344c7
SHA512 5f48cf37c08a7ffeb3ae8b3ec66162c97e915e80245844e8ea2142ee7885ae9660a08d552d27a558f8e331108e54d467c2a57168576e8a54bcd48afac8cb9401
MD5 SHA1 SHA512

Submit Download

adi.pb

Path /var/db/fpsd/adi/adi.pb
Size 642B
SHA256 8fe049bc9e3f9c2f9ccc08d993014c99cf7dc274e16f268574eb2d92816757cd
MD5 e2384aeda4d3ba4e615cf1bc4ccd2a7f
SHA1 c02ac1df5d31e043d7ac85095e7922c1cc80d5ab
SHA512 656b3dafb0de2997fa01f1e27afac3cad82204657a5df249e3dfe720f6391ddb1d2faf16c3860397e535a788b33d0a92c7f0ebc67200ccac54724dd5faa02b36
MD5 SHA1 SHA512

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CFNetworkDownload_gfj27S.tmp

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/SMIncompatibleAppUpdate/CFNetworkDownload_gfj27S.tmp
Size 324KB
SHA256 a0ee16e403dd8609ce56b56a111b2926b591d368b6e99a41c836beb280dcf687
MD5 8ac8e766276bb799857b359b3a4f2347
SHA1 075fe1052e1e6de0a38aaa7711a54e8a77bb65f8
SHA512 60f88aacc4d89e7a52aa30a469b430f781006fac52b320c2acd05d8f3ace9638a042fa0b0000885293cf6ee391915e7d68ffc656f4056fcb6de3b638d52a6439
SSDEEP 6144:SxT4GpoTuKqxr8Y3arWLsN+iPkGm7fuoBdMHeDM3ccghAOfTCTMN4QQWAOfG:SxTxyur181WZTfuoQHZ3cRA3gNvQWA7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads