Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
127s -
platform
macos-10.15_amd64 -
resource
macos-20241106-en -
resource tags
arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
13/02/2025, 13:06
Behavioral task
behavioral1
Sample
2025-02-13_d6d851d1f2beb2bd29d1007a5f9bbfaa_adload_evilquest_rekoobe
Resource
macos-20241106-en
General
-
Target
2025-02-13_d6d851d1f2beb2bd29d1007a5f9bbfaa_adload_evilquest_rekoobe
-
Size
337KB
-
MD5
d6d851d1f2beb2bd29d1007a5f9bbfaa
-
SHA1
153da0eb8f59e90594812d99980a2061948b2b9e
-
SHA256
5dbcbf048ec0f63c89bb7baf6c0dde82e20477884b9761b7baa4894daf484664
-
SHA512
a31319e577ed7868c46c1685a7726495233dfe008d069b89b60f29332a56a218926b46b0132d887a4dc5a5af96032d77aec40bbf8ae95253a063c5f7d6a7d0a1
-
SSDEEP
6144:5SeOQdaZNxtk8cqhSxvHY9RSeOQdaZNxtk8cqhSxvHY9Vg:5LOQdaDxq8cqavHYXLOQdaDxq8cqavHY
Malware Config
Signatures
-
Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
-
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
-
AppleScript 1 TTPs 8 IoCs
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
ioc Process osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found -
Resource Forking 1 TTPs 2 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
ioc Process "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck Process not Found /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer Process not Found -
Launchctl 1 TTPs 16 IoCs
Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
ioc Process /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/2025-02-13_d6d851d1f2beb2bd29d1007a5f9bbfaa_adload_evilquest_rekoobe\""1⤵PID:457
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/2025-02-13_d6d851d1f2beb2bd29d1007a5f9bbfaa_adload_evilquest_rekoobe\""1⤵PID:457
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/2025-02-13_d6d851d1f2beb2bd29d1007a5f9bbfaa_adload_evilquest_rekoobe1⤵PID:457
-
/bin/zsh/bin/zsh -c /Users/run/2025-02-13_d6d851d1f2beb2bd29d1007a5f9bbfaa_adload_evilquest_rekoobe2⤵PID:460
-
-
/Users/run/2025-02-13_d6d851d1f2beb2bd29d1007a5f9bbfaa_adload_evilquest_rekoobe/Users/run/2025-02-13_d6d851d1f2beb2bd29d1007a5f9bbfaa_adload_evilquest_rekoobe2⤵PID:460
-
-
/usr/libexec/pkreporter/usr/libexec/pkreporter1⤵PID:450
-
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer1⤵PID:453
-
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd1⤵PID:446
-
/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"1⤵PID:443
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:461
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:461
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:461
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck1⤵PID:454
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:484
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:484
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:484
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.authtrampoline1⤵PID:485
-
/System/Library/Frameworks/Security.framework/authtrampoline/System/Library/Frameworks/Security.framework/authtrampoline1⤵PID:485
-
/bin/sh/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:486
-
/bin/bash/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:486
-
/bin/launchctllaunchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:486
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:487
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:487
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:488
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:488
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:488
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:489
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:489
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:489
-
/bin/sh/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:490
-
/bin/bash/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:490
-
/bin/launchctllaunchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:490
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:491
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:491
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:491
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:492
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:492
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:492
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:493
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:493
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:493
-
/bin/sh/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:494
-
/bin/bash/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:494
-
/bin/launchctllaunchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:494
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:496
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:496
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:497
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:497
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:497
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:502
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:502
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵PID:504
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵PID:504
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:505
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:505
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:505
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:508
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:508
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:509
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:509
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:509
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:510
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:510
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:511
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:511
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:511
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:513
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:513
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:514
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:514
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:514
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:515
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:515
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:516
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:516
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:516
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:519
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:519
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:520
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:520
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:520
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:522
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:522
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:523
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:523
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:523
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:524
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:524
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:525
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:525
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:525
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:526
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:526
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:527
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:527
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:527
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:528
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:528
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:529
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:529
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:529
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:530
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:530
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:531
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:531
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:531
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:532
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:532
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:533
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:533
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:533
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:534
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:534
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:535
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:535
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:535
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD564f469698e53d0c828b7f90acd306082
SHA1bcc041b3849e1b0b4104ffeb46002207eeac54f3
SHA256d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd
SHA512a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f