Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

6

Paste 4.4....d].dmg

macos-10.15-amd64

1

Paste 4.4...._store

windows7-x64

3

Paste 4.4...._store

windows10-2004-x64

3

Paste 4.4....n.icns

windows7-x64

3

Paste 4.4....n.icns

windows10-2004-x64

3

Paste 4.4....g.tiff

windows7-x64

1

Paste 4.4....g.tiff

windows10-2004-x64

1

Paste 4.4....123.gz

windows7-x64

3

Paste 4.4....123.gz

windows10-2004-x64

3

Paste 4.4....124.gz

windows7-x64

3

Paste 4.4....124.gz

windows10-2004-x64

3

Paste 4.4....d-uuid

windows7-x64

1

Paste 4.4....d-uuid

windows10-2004-x64

1

Paste 4.4....fo.xml

windows7-x64

3

Paste 4.4....fo.xml

windows10-2004-x64

1

Paste 4.4.....plist

windows7-x64

3

Paste 4.4.....plist

windows10-2004-x64

3

Paste 4.4....Helper

macos-10.15-amd64

1

Paste 4.4....kgInfo

windows7-x64

1

Paste 4.4....kgInfo

windows10-2004-x64

1

Paste 4.4....es.xml

windows7-x64

3

Paste 4.4....es.xml

windows10-2004-x64

1

Paste 4.4..../Paste

macos-10.15-amd64

4

Paste 4.4.....dylib

macos-10.15-amd64

4

Paste 4.4....kgInfo

windows7-x64

1

Paste 4.4....kgInfo

windows10-2004-x64

1

Paste 4.4....n.icns

windows7-x64

3

Paste 4.4....n.icns

windows10-2004-x64

3

Paste 4.4....te.cer

windows7-x64

1

Paste 4.4....te.cer

windows10-2004-x64

1

Paste 4.4....ts.pdf

windows7-x64

3

Paste 4.4....ts.pdf

windows10-2004-x64

3

Analysis

  • max time kernel
    117s
  • max time network
    127s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    21/09/2024, 00:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Paste 4.4.0 [MacKed]/Paste.app/Contents/MacOS/Paste

  • Size

    15.3MB

  • MD5

    7ab722690af613a48db2147ec1fdac57

  • SHA1

    1d46a96b5701499fa2be108fd72db13b198871e8

  • SHA256

    2ebba7056363bc3cb70fba70f1cc2c45755d793c9fc41ff44ea0b8e4f743b26e

  • SHA512

    7cdabf0a9a6ef134738a89eadf962385092860bbb7fc226340bb4386d8fdd7a33394bddcdefd7a57734b49d4bf10317b01665c7d6208e8072d82bc8fb67793f0

  • SSDEEP

    98304:9C8G4bkZjUEue/+O08m9b61tr0IB/U2upBNDGgnZF8uyL9fd6JB/LzYipMUJ:c5AQ84/MNqgnZF8udn/

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/Paste 4.4.0 [MacKed]/Paste.app/Contents/MacOS/Paste\""
    1⤵
      PID:512
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/Paste 4.4.0 [MacKed]/Paste.app/Contents/MacOS/Paste\""
      1⤵
        PID:512
      • /usr/bin/sudo
        sudo /bin/zsh -c "/Users/run/Paste 4.4.0 [MacKed]/Paste.app/Contents/MacOS/Paste"
        1⤵
          PID:512
          • /bin/zsh
            /bin/zsh -c "/Users/run/Paste 4.4.0 [MacKed]/Paste.app/Contents/MacOS/Paste"
            2⤵
              PID:513
          • /usr/bin/bzip2
            /usr/bin/bzip2 -f /var/log/wifi.log.0
            1⤵
              PID:525
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
              1⤵
                PID:530
              • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                1⤵
                  PID:530
                • /bin/launchctl
                  /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                  1⤵
                    PID:538
                  • /bin/launchctl
                    /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                    1⤵
                      PID:539
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.systemstats.daily
                      1⤵
                        PID:540
                      • /usr/libexec/xpcproxy
                        xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
                        1⤵
                          PID:541
                        • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                          /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                          1⤵
                            PID:541

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads