Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
103s -
platform
macos-10.15_amd64 -
resource
macos-20241106-en -
resource tags
arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
26/11/2024, 02:26
Behavioral task
behavioral1
Sample
4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho
Resource
macos-20241106-en
General
-
Target
4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho
-
Size
795KB
-
MD5
02690d5154f0fa29c596f0f965b188d5
-
SHA1
7cc50836089fd178e8a013f2a6f241ec4b98ab1a
-
SHA256
4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d
-
SHA512
af22a0b9ade3472ef44fa21c21a0396b9151d7f396af5ee0cb3d67e3dd5c4ba14ab188cfb72a6894dd0f376f7bf676ebbab09a31a22f987597846d4df3f38d99
-
SSDEEP
24576:oFyOeWZxXXqurwayuStT6GWSPw/1nntuf2:oFyOBBrUtTESPw/1tC
Malware Config
Signatures
-
Queries the macOS version information. 1 TTPs 4 IoCs
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
ioc Process sh -c "/usr/bin/sw_vers -productVersion" Process not Found /usr/bin/sw_vers -productVersion Process not Found sh -c "/usr/bin/sw_vers -productVersion" Process not Found /usr/bin/sw_vers -productVersion Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho\""1⤵PID:476
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho\""1⤵PID:476
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho1⤵PID:476
-
/bin/zsh/bin/zsh -c /Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho2⤵PID:478
-
-
/Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho/Users/run/4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d.macho2⤵PID:478
-
-
/bin/shsh -c "/usr/bin/sw_vers -productVersion"1⤵PID:480
-
/bin/bashsh -c "/usr/bin/sw_vers -productVersion"1⤵PID:480
-
/usr/bin/sw_vers/usr/bin/sw_vers -productVersion1⤵PID:480
-
/bin/shsh -c "/usr/bin/sw_vers -productVersion"1⤵PID:482
-
/bin/bashsh -c "/usr/bin/sw_vers -productVersion"1⤵PID:482
-
/usr/bin/sw_vers/usr/bin/sw_vers -productVersion1⤵PID:482