Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
78s -
max time network
76s -
platform
macos-10.15_amd64 -
resource
macos-20240711.1-en -
resource tags
arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
14/08/2024, 12:13
Static task
static1
General
-
Target
mojang.png
-
Size
8KB
-
MD5
a8bddcf66788596b0572b085667ee38a
-
SHA1
4179d824730d9e11770e24812c5bc2bd90269335
-
SHA256
15c8bc30dc68ecbe8d8b557d2b921110e5fdea80a53ad035708bc3ea25717d63
-
SHA512
3e87be98b28a1e2fe59f4ae6edee901d73584cd1492e9e3eee5eb1c68e75fbeb3a5d6e2e4d0639281397b28ef7b33299fe8a3ef9f7d5927c401082bd32f7dd7c
-
SSDEEP
192:1SDS0tKg9E05T3+d6xrnpZTMSlkhpV0FN3v6vrVE:UJXE05TiC7T/3aW
Malware Config
Signatures
-
File and Directory Discovery. 1 TTPs 1 IoCs
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
ioc Process dirname "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/jcontrol" Process not Found -
JavaScript 1 TTPs 1 IoCs
Adversaries may abuse various implementations of JavaScript for execution.
ioc Process "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" "-Xbootclasspath/a:/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/../lib/deploy.jar" "-Djava.locale.providers=HOST,JRE,SPI" -Djdk.disableLastUsageTracking "-Xdock:name=Java Control Panel" "-Xdock:icon=/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy/JavaControlPanel.prefPane/Contents/Resources/Java7VM.icns" com.sun.deploy.panel.ControlPanel Process not Found -
Resource Forking 1 TTPs 9 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
ioc Process /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck Process not Found /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref Process not Found "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" "-Xbootclasspath/a:/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/../lib/deploy.jar" "-Djava.locale.providers=HOST,JRE,SPI" -Djdk.disableLastUsageTracking "-Xdock:name=Java Control Panel" "-Xdock:icon=/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy/JavaControlPanel.prefPane/Contents/Resources/Java7VM.icns" com.sun.deploy.panel.ControlPanel Process not Found /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd Process not Found /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool Process not Found /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool Process not Found /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool Process not Found /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd Process not Found /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/mojang.png\""1⤵PID:485
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/mojang.png\""1⤵PID:485
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/mojang.png1⤵PID:485
-
/bin/zsh/bin/zsh -c /Users/run/mojang.png2⤵PID:487
-
-
/Users/run/mojang.png/Users/run/mojang.png2⤵PID:487
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵PID:514
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵PID:514
-
/usr/libexec/xpcproxyxpcproxy com.apple.systempreferences.21401⤵PID:523
-
/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"1⤵PID:523
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountProfileRemoteViewService 5231⤵PID:524
-
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService1⤵PID:524
-
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool1⤵PID:527
-
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool1⤵PID:528
-
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck1⤵PID:529
-
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref1⤵PID:530
-
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool1⤵PID:531
-
/usr/libexec/xpcproxyxpcproxy com.apple.nfcd1⤵PID:532
-
/usr/libexec/nfcd/usr/libexec/nfcd1⤵PID:532
-
/usr/libexec/xpcproxyxpcproxy com.apple.studentd1⤵PID:534
-
/usr/libexec/studentd/usr/libexec/studentd1⤵PID:534
-
/usr/libexec/xpcproxyxpcproxy com.apple.systempreferences.legacyLoader 5231⤵PID:537
-
/System/Library/Frameworks/PreferencePanes.framework/Versions/A/XPCServices/legacyLoader.xpc/Contents/MacOS/legacyLoader/System/Library/Frameworks/PreferencePanes.framework/Versions/A/XPCServices/legacyLoader.xpc/Contents/MacOS/legacyLoader1⤵PID:537
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/jcontrol"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/jcontrol"1⤵PID:538
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" "-Xbootclasspath/a:/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/../lib/deploy.jar" "-Djava.locale.providers=HOST,JRE,SPI" -Djdk.disableLastUsageTracking "-Xdock:name=Java Control Panel" "-Xdock:icon=/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy/JavaControlPanel.prefPane/Contents/Resources/Java7VM.icns" com.sun.deploy.panel.ControlPanel2⤵PID:543
-
-
/usr/bin/dirnamedirname "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/jcontrol"1⤵PID:542
-
/usr/libexec/xpcproxyxpcproxy com.apple.metadata.mdwrite1⤵PID:544
-
/usr/libexec/xpcproxyxpcproxy com.apple.FaceTime.18601⤵PID:546
-
/System/Applications/FaceTime.app/Contents/MacOS/FaceTime/System/Applications/FaceTime.app/Contents/MacOS/FaceTime1⤵PID:546
-
/usr/libexec/xpcproxyxpcproxy com.apple.videoconference.camera1⤵PID:547
-
/usr/libexec/avconferenced/usr/libexec/avconferenced1⤵PID:547
-
/usr/libexec/xpcproxyxpcproxy com.apple.iChat.18801⤵PID:548
-
/System/Applications/Messages.app/Contents/MacOS/Messages/System/Applications/Messages.app/Contents/MacOS/Messages1⤵PID:548
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.toolbox.reporting.service1⤵PID:551
-
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService1⤵PID:551
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 5471⤵PID:552
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵PID:552
-
/usr/libexec/xpcproxyxpcproxy com.apple.FaceTime.FaceTimeNotificationCenterService 5461⤵PID:553
-
/System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService/System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService1⤵PID:553
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 5481⤵PID:555
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵PID:555
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 5461⤵PID:556
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵PID:556
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵PID:557
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵PID:558
-
/usr/sbin/spindump/usr/sbin/spindump1⤵PID:558
-
/usr/libexec/xpcproxyxpcproxy com.apple.tailspind1⤵PID:559
-
/usr/libexec/tailspind/usr/libexec/tailspind1⤵PID:559
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump_agent1⤵PID:560
-
/usr/libexec/spindump_agent/usr/libexec/spindump_agent1⤵PID:560
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵PID:557
-
/usr/libexec/xpcproxyxpcproxy com.apple.CharacterPicker.FileService1⤵PID:562
-
/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService1⤵PID:562
-
/usr/libexec/xpcproxyxpcproxy com.apple.systemprofiler1⤵PID:563
-
/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"1⤵PID:563
-
/usr/libexec/xpcproxyxpcproxy com.apple.storedownloadd1⤵PID:569
-
/usr/libexec/xpcproxyxpcproxy com.apple.installd1⤵PID:570
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd1⤵PID:570
-
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd1⤵PID:569
-
/usr/libexec/xpcproxyxpcproxy com.apple.system_installd1⤵PID:571
-
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd1⤵PID:571
-
/usr/libexec/xpcproxyxpcproxy com.apple.replayd1⤵PID:572
-
/usr/libexec/replayd/usr/libexec/replayd1⤵PID:572
-
/usr/libexec/xpcproxyxpcproxy com.apple.Safari.CacheDeleteExtension 5641⤵PID:573
-
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension1⤵PID:573
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70B
MD574798be1f4ca6115228214925061cf9e
SHA184b3f602160ee2afd80610e0c3f58cb753005e79
SHA256ff22c45e4de806ec2c8cf165ca956d5ad343dd209f9193dd48bffc4340c5a5b0
SHA512ff78b2df8b01ee1fc844c504c02ba11c3a35ba920cf7a962ef392340cf10579b66349c66c3aca18d8ee417287a48c072a8bc03105d5d8390d39b7df8ce746727
-
Filesize
12KB
MD500e5f72258e6c602e6841bbf4c30b136
SHA152dbdf9eada5d7b0e015fd3523cca5cb915c23c2
SHA256905a454fcb15e9f2a469a9a7e6e42b8c6425d20b33a59be5b84818daae964807
SHA51250f0f286680fd33c29956455ca7e2d293402f369bd2e9079e45930853f1feb6e86208e1c8762d26dfc6f7e742044e912a4efded9a55ddfddaa454297cedc60c7
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
Filesize
8KB
MD52f2076f52e8ed08cb35347c1548a8e57
SHA1e8a980230ac07d6dfd70114936e55263d1555321
SHA256c0bdd416a16628fcd52e73956d94d8955b571431a6444d6912bedf3c523038aa
SHA51212c51a7c926b06ad47802aa683c9e9e3b19fd59955b404f8afdcd1c78b65c4b24708140c10a766eea8e0931c091d884a40666e108200c76050c0e216efe8d043