Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
macos-10.15_amd64 -
resource
macos-20241101-en -
resource tags
arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
23/12/2024, 21:53
Behavioral task
behavioral1
Sample
2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe
Resource
macos-20241101-en
General
-
Target
2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe
-
Size
3.5MB
-
MD5
84a4f4f8c8591cf1024b41a8ac11fed9
-
SHA1
0b64f3d007f3301d102dd3d9dcd95b68d96e5f2d
-
SHA256
2ad461e3de346b8eec04d2e5926b3105f6aaa7165070ec91938dbef09a29e120
-
SHA512
5508f2449c664a056f8594bc2c41a98b10b5ec89c16e6241c24cd1f91396da20b4965186d3a590f32f9ce06381830479b10fa5fd3ff089f59641163b0bdba6d0
-
SSDEEP
49152:U33dQ333dQk33dQ33G33dQ333dQk33dQ33f33dQ333X:4
Malware Config
Signatures
-
EvilQuest payload 1 IoCs
resource yara_rule behavioral1/files/0x000000030008e563-1.dat family_evilquest -
Evilquest family
-
Compromise Client Software Binary 1 TTPs 7 IoCs
Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server.
ioc Process /Library/AppQuest/com.apple.questd Process not Found /Library/AppQuest/com.apple.questd Process not Found /var/root/Library/AppQuest/com.apple.questd Process not Found /Users/run/Library/AppQuest/com.apple.questd Process not Found /Users/run/Library/AppQuest/com.apple.questd Process not Found /Library/AppQuest/com.apple.questd Process not Found /Users/run/Library/AppQuest/com.apple.questd Process not Found -
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
-
AppleScript 1 TTPs 26 IoCs
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
ioc Process osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"sudo /Library/AppQuest/com.apple.questd\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"sudo /Library/AppQuest/com.apple.questd\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found -
Launchctl 1 TTPs 60 IoCs
Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
ioc Process launchctl start questd Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found launchctl start questd Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found launchctl start questd Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found launchctl start questd Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found launchctl start questd Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found launchctl start questd Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found launchctl start questd Process not Found launchctl start questd Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges" Process not Found launchctl start questd Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found launchctl start questd Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found launchctl start questd Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\"" Process not Found launchctl start questd Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe\""1⤵PID:448
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe\""1⤵PID:448
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe1⤵PID:448
-
/bin/zsh/bin/zsh -c /Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe2⤵PID:450
-
-
/Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe/Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe2⤵PID:450
-
-
/Users/run/.2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe12⤵PID:450
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:474
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:474
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:474
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.authtrampoline1⤵PID:475
-
/System/Library/Frameworks/Security.framework/authtrampoline/System/Library/Frameworks/Security.framework/authtrampoline1⤵PID:475
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:476
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:476
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:477
-
-
/bin/launchctllaunchctl start questd2⤵PID:479
-
-
/usr/libexec/xpcproxyxpcproxy questd1⤵PID:478
-
/usr/bin/sudosudo /Library/AppQuest/com.apple.questd --silent1⤵PID:478
-
/Library/AppQuest/com.apple.questd/Library/AppQuest/com.apple.questd --silent2⤵PID:484
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"sudo /Library/AppQuest/com.apple.questd\\\" with administrator privileges\""1⤵PID:481
-
/bin/bashsh -c "osascript -e \"do shell script \\\"sudo /Library/AppQuest/com.apple.questd\\\" with administrator privileges\""1⤵PID:481
-
/usr/bin/osascriptosascript -e "do shell script \"sudo /Library/AppQuest/com.apple.questd\" with administrator privileges"1⤵PID:481
-
/bin/sh/bin/sh -c "sudo /Library/AppQuest/com.apple.questd"1⤵PID:482
-
/bin/bash/bin/sh -c "sudo /Library/AppQuest/com.apple.questd"1⤵PID:482
-
/usr/bin/sudosudo /Library/AppQuest/com.apple.questd1⤵PID:482
-
/Library/AppQuest/com.apple.questd/Library/AppQuest/com.apple.questd2⤵PID:483
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:487
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:487
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:487
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:488
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:488
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:489
-
-
/bin/launchctllaunchctl start questd2⤵PID:490
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:491
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:491
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:491
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:492
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:492
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:492
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:493
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:493
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:493
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:494
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:494
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:495
-
-
/bin/launchctllaunchctl start questd2⤵PID:496
-
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:497
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:497
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:498
-
-
/bin/launchctllaunchctl start questd2⤵PID:499
-
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:500
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:500
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:501
-
-
/bin/launchctllaunchctl start questd2⤵PID:502
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:505
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:505
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:505
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:506
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:506
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:507
-
-
/bin/launchctllaunchctl start questd2⤵PID:508
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:509
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:509
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:509
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:510
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:510
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:511
-
-
/bin/launchctllaunchctl start questd2⤵PID:512
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:513
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:513
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:513
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:514
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:514
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:515
-
-
/bin/launchctllaunchctl start questd2⤵PID:516
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:517
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:517
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:517
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:518
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:518
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:519
-
-
/bin/launchctllaunchctl start questd2⤵PID:520
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:523
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:523
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:523
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:524
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:524
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:525
-
-
/bin/launchctllaunchctl start questd2⤵PID:526
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:527
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:527
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:527
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:528
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:528
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:529
-
-
/bin/launchctllaunchctl start questd2⤵PID:530
-
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:531
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""1⤵PID:531
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"1⤵PID:531
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:532
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"1⤵PID:532
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.questd.plist2⤵PID:533
-
-
/bin/launchctllaunchctl start questd2⤵PID:534
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
435B
MD5a3d34532a7dd2cd1d73cea75deb0677f
SHA13019d1c50907fb2597121c03619990c5670ff6f4
SHA256779a31e4de99f9de28de8bf064c504382e050c114e2e865cc1f694c7e6339735
SHA51252618a5f14247c909a3857b122a124d0ddd00890c128cf041976182423b3d728cab11daf5b6a1adb6845d062b54083e72380184b6f76369482305c2782bedd91
-
Filesize
2.9MB
MD54e1b7b5deb351fa51e6ace857eb43e25
SHA1c21855f3b4627cf8cf76d2ff55f8d3608dd68f74
SHA25649e4fb3445bded5946724f0e187bf28f4ebc88bb386678b66752f33f35d03640
SHA51226e995633cd5b4be505eff30f6d8ad8526b1f60cbf577902745f838b0159b8a9a4163de7d0b57c1456f7459b8f8324f9d77caab6693ae3878d042a7cec4d9a45
-
Filesize
423B
MD5eb73619f4e724257ff0fd951883a30ae
SHA15032251e50b32e340d8171631a598596bad8991e
SHA2566e56467f3f5502588094c91e2d58bbb1e43c4e8171093db14931dd41788e17d4
SHA512ec95c395414181bc77c7a2980fbd3fe69b718aa98c878e514c3f28b738e1669488126cbdfa96e3a182afd8536b54bc1791a044fa3535d1fd3fad54dfda337b7c
-
Filesize
422B
MD570c1e05ff6b32db6e1ef873321abd1f9
SHA116878e40cd5a569bc8f441988cc07b66ffc8534a
SHA256ba60feb2a639cd847674e6599cabf986ede7876231a292785b0365d58b7b9378
SHA5121e82629b3b1fa7bb88e7efe0393aee7114631555fbfe614d33b9b1efb4d299c35dac5e393f834dcc26a5e192e46e317124c0b841f65ab371819c34802424712e