Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    26-08-2024 18:58

General

  • Target

    XMouseButtonControlSetup.2.20.5.exe

  • Size

    2.9MB

  • MD5

    2e9725bc1d71ad1b8006dfc5a2510f88

  • SHA1

    6e1f7d12881696944bf5e030a7d131b969de0c6c

  • SHA256

    2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

  • SHA512

    62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39

  • SSDEEP

    49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/XMouseButtonControlSetup.2.20.5.exe\""
    1⤵
      PID:483
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/XMouseButtonControlSetup.2.20.5.exe\""
      1⤵
        PID:483
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/XMouseButtonControlSetup.2.20.5.exe
        1⤵
          PID:483
          • /bin/zsh
            /bin/zsh -c /Users/run/XMouseButtonControlSetup.2.20.5.exe
            2⤵
              PID:485
            • /Users/run/XMouseButtonControlSetup.2.20.5.exe
              /Users/run/XMouseButtonControlSetup.2.20.5.exe
              2⤵
                PID:485
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.AddressBook.1780
              1⤵
                PID:511
              • /System/Applications/Contacts.app/Contents/MacOS/Contacts
                /System/Applications/Contacts.app/Contents/MacOS/Contacts
                1⤵
                  PID:511
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.contacts.donation-agent
                  1⤵
                    PID:512
                  • /System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
                    /System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
                    1⤵
                      PID:512
                    • /bin/launchctl
                      /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                      1⤵
                        PID:523
                      • /bin/launchctl
                        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                        1⤵
                          PID:524
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                          1⤵
                            PID:540
                          • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                            /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                            1⤵
                              PID:540

                            Network

                            MITRE ATT&CK Matrix

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • /Users/run/Library/Application Support/AddressBook/Metadata/.info

                              Filesize

                              278B

                              MD5

                              ceb12b166b68312c41af8bcfe2c01570

                              SHA1

                              0eb463f486b4a3b2116135006c13b0823b189c37

                              SHA256

                              323ee2778aab52148273ec7ffa46018ea3f8fd1dc408fd7532cc2a5220ba1894

                              SHA512

                              49bca53444dcbdae2d1e666abbefc990b98feba7991c9e5a80c0cb2f42d69df7e146632e105658340d6869a3e7307432e897547434ac351ce50e72c2b5a5fd24