Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    103s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241106-en
  • resource tags

    arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    26/11/2024, 02:26

General

  • Target

    4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho

  • Size

    795KB

  • MD5

    02690d5154f0fa29c596f0f965b188d5

  • SHA1

    7cc50836089fd178e8a013f2a6f241ec4b98ab1a

  • SHA256

    4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d

  • SHA512

    af22a0b9ade3472ef44fa21c21a0396b9151d7f396af5ee0cb3d67e3dd5c4ba14ab188cfb72a6894dd0f376f7bf676ebbab09a31a22f987597846d4df3f38d99

  • SSDEEP

    24576:oFyOeWZxXXqurwayuStT6GWSPw/1nntuf2:oFyOBBrUtTESPw/1tC

Score
7/10

Malware Config

Signatures

  • Queries the macOS version information. 1 TTPs 4 IoCs

    An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho\""
    1⤵
      PID:476
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho\""
      1⤵
        PID:476
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho
        1⤵
          PID:476
          • /bin/zsh
            /bin/zsh -c /Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho
            2⤵
              PID:478
            • /Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho
              /Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho
              2⤵
                PID:478
            • /bin/sh
              sh -c "/usr/bin/sw_vers -productVersion"
              1⤵
                PID:480
              • /bin/bash
                sh -c "/usr/bin/sw_vers -productVersion"
                1⤵
                  PID:480
                • /usr/bin/sw_vers
                  /usr/bin/sw_vers -productVersion
                  1⤵
                    PID:480
                  • /bin/sh
                    sh -c "/usr/bin/sw_vers -productVersion"
                    1⤵
                      PID:482
                    • /bin/bash
                      sh -c "/usr/bin/sw_vers -productVersion"
                      1⤵
                        PID:482
                      • /usr/bin/sw_vers
                        /usr/bin/sw_vers -productVersion
                        1⤵
                          PID:482

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads