db5d7f84baf1b1e37383273814398ada75b8d1b0b1b4ec9227776f090cbc5870

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

Paste 4.4....d].dmg

macos-10.15-amd64

Paste 4.4...._store

windows7-x64

Paste 4.4...._store

windows10-2004-x64

Paste 4.4....n.icns

windows7-x64

Paste 4.4....n.icns

windows10-2004-x64

Paste 4.4....g.tiff

windows7-x64

Paste 4.4....g.tiff

windows10-2004-x64

Paste 4.4....123.gz

windows7-x64

Paste 4.4....123.gz

windows10-2004-x64

Paste 4.4....124.gz

windows7-x64

Paste 4.4....124.gz

windows10-2004-x64

Paste 4.4....d-uuid

windows7-x64

Paste 4.4....d-uuid

windows10-2004-x64

Paste 4.4....fo.xml

windows7-x64

Paste 4.4....fo.xml

windows10-2004-x64

Paste 4.4.....plist

windows7-x64

Paste 4.4.....plist

windows10-2004-x64

Paste 4.4....Helper

macos-10.15-amd64

Paste 4.4....kgInfo

windows7-x64

Paste 4.4....kgInfo

windows10-2004-x64

Paste 4.4....es.xml

windows7-x64

Paste 4.4....es.xml

windows10-2004-x64

Paste 4.4..../Paste

macos-10.15-amd64

Paste 4.4.....dylib

macos-10.15-amd64

Paste 4.4....kgInfo

windows7-x64

Paste 4.4....kgInfo

windows10-2004-x64

Paste 4.4....n.icns

windows7-x64

Paste 4.4....n.icns

windows10-2004-x64

Paste 4.4....te.cer

windows7-x64

Paste 4.4....te.cer

windows10-2004-x64

Paste 4.4....ts.pdf

windows7-x64

Paste 4.4....ts.pdf

windows10-2004-x64

Analysis

max time kernel
141s
max time network
158s
platform
macos-10.15_amd64
resource
macos-20240711.1-en
resource tags

arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
21/09/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Static task

static1

pdf evasion

1 signatures

Behavioral task

behavioral1

Sample

Paste 4.4.0 [MacKed].dmg

Resource

macos-20240711.1-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

Paste 4.4.0 [MacKed]/.ds_store

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral3

Sample

Paste 4.4.0 [MacKed]/.ds_store

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

Paste 4.4.0 [MacKed]/.VolumeIcon.icns

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral5

Sample

Paste 4.4.0 [MacKed]/.VolumeIcon.icns

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

Paste 4.4.0 [MacKed]/.background/dmgcanvas_bg.tiff

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

Paste 4.4.0 [MacKed]/.background/dmgcanvas_bg.tiff

Resource

win10v2004-20240910-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Paste 4.4.0 [MacKed]/.fseventsd/000000000159b123.gz

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral9

Sample

Paste 4.4.0 [MacKed]/.fseventsd/000000000159b123.gz

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

Paste 4.4.0 [MacKed]/.fseventsd/000000000159b124.gz

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral11

Sample

Paste 4.4.0 [MacKed]/.fseventsd/000000000159b124.gz

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

Paste 4.4.0 [MacKed]/.fseventsd/fseventsd-uuid

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

Paste 4.4.0 [MacKed]/.fseventsd/fseventsd-uuid

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Info.xml

Resource

win7-20240704-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral15

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Info.xml

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/Info.plist

Resource

win7-20240708-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral17

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/Info.plist

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral18

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/MacOS/LaunchAtLoginHelper

Resource

macos-20240711.1-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/PkgInfo

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/PkgInfo

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/_CodeSignature/CodeResources.xml

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral22

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/_CodeSignature/CodeResources.xml

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/MacOS/Paste

Resource

macos-20240711.1-en

evasion

macos-10.15-amd64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/MacOS/macked.app.dylib

Resource

macos-20240711.1-en

evasion

macos-10.15-amd64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/PkgInfo

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/PkgInfo

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/AppIcon.icns

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral28

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/AppIcon.icns

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral29

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/AppleIncRootCertificate.cer

Resource

win7-20240729-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/AppleIncRootCertificate.cer

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/Assets.pdf

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral32

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/Assets.pdf

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

6 signatures

150 seconds

Report Analysis Logs

General

Target

Paste 4.4.0 [MacKed].dmg
Size

18.0MB
MD5

ebcb830313f9d3f74ba099f171bf1741
SHA1

c810d3f36cf559a50be7d2364093e6dc65a63b9f
SHA256

db5d7f84baf1b1e37383273814398ada75b8d1b0b1b4ec9227776f090cbc5870
SHA512

144ddf9987d1f0b907fc3b86763d1c514794ba80db450ea33dccae8e359628eab0272f0966c6a13045dc0a9b412c65e2b2e6572e8580868e81eac2b17f706235
SSDEEP

393216:JZaDECXVBvr+IvEz7WhSlwxMQ48qxuVA7vVrXu/vHTktrh/4OJX2v9P:/CXnT+IvEzT/QAh9rXu//46OJGv9

Score

1^/10

Malware Config

Signatures

Processes

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Paste\\ 4.4.0\\ [MacKed]/Paste.app\""
1⤵
PID:520

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Paste\\ 4.4.0\\ [MacKed]/Paste.app\""
1⤵
PID:520

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Paste\\ 4.4.0\\ [MacKed]/Paste.app"
1⤵
PID:520
- /bin/zsh
  /bin/zsh -c "open /Volumes/Paste\\ 4.4.0\\ [MacKed]/Paste.app"
  2⤵
  PID:521

/usr/bin/bzip2
/usr/bin/bzip2 -f /var/log/wifi.log.0
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:532

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:532

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:535

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:536

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads