11542046ff465e3b1b22e169ae584e138b64f89f0be5ea31992e99c7cacb7368 | Triage™

Login
Reports

Overview

overview

4

Static

static

4

Cofense_On...al.pdf

windows10-2004-x64

3

Cofense_On...al.pdf

windows11-ltsc_2024-x64

3

Cofense_On...22.pdf

windows10-2004-x64

3

Cofense_On...22.pdf

windows11-ltsc_2024-x64

3

Cofense_On...22.pdf

windows10-2004-x64

3

Cofense_On...22.pdf

windows11-ltsc_2024-x64

3

Global VPN...ta.key

macos-10.15-amd64

1

Global VPN...ta.key

macos-10.15-amd64

1

Cofense_On...ta.key

macos-10.15-amd64

1

Cofense_On...ta.key

macos-10.15-amd64

1

Cofense_On...ot.pdf

windows10-2004-x64

3

Cofense_On...ot.pdf

windows11-ltsc_2024-x64

3

Analysis

max time kernel
120s
max time network
112s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

Cofense_Onbording/COFENSE GLOBAL CODE OF CONDUCT_12-30-22_Final.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral2

Sample

Cofense_Onbording/COFENSE GLOBAL CODE OF CONDUCT_12-30-22_Final.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral3

Sample

Cofense_Onbording/Cofense Global Export_Sanctions_AML Policy_Final 12-2022.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral4

Sample

Cofense_Onbording/Cofense Global Export_Sanctions_AML Policy_Final 12-2022.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral5

Sample

Cofense_Onbording/Cofense Global Gifts and Entertainment Policy_Final - 12-2022.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral6

Sample

Cofense_Onbording/Cofense Global Gifts and Entertainment Policy_Final - 12-2022.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral7

Sample

Global VPN - Full Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Global VPN - Split Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Cofense_Onbording/Global VPN v4/Global VPN - Full Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Cofense_Onbording/Global VPN v4/Global VPN - Split Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

Cofense_Onbording/self-guided-new-hire-setup - mot.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral12

Sample

Cofense_Onbording/self-guided-new-hire-setup - mot.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

adware discovery spyware

Report Analysis Logs

General

Target
Global VPN - Full Tunnel v4/ta.key
Size 657B
Sample261002-phl2dav1cs
SHA256 11542046ff465e3b1b22e169ae584e138b64f89f0be5ea31992e99c7cacb7368
MD5 200e5cf2c8a8f4ac4a02b7135ddea813
SHA1 f47e921c116a2aa305f81bf0034f8d9965852d5d
SHA512 91e0aaedff2e67cea1f4283aaaf62ecf19cc89768e56f72d11aa2974f9d6ffb0be8a2e7832066d92082a21fb030d5651c2fd74c6c89ec4234c7974fd6ed2a1e6
TLSH
T14F012367FEA8E491CD4DD4D37FD24636C73B5A01258D642340EA32032AB1B917B4CD64
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Processes

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Global VPN - Full Tunnel v4/ta.key\""
1⤵
PID:466

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:467

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Global VPN - Full Tunnel v4/ta.key\""
1⤵
PID:466

/usr/libexec/xpcproxy
xpcproxy com.apple.csrutil.report
1⤵
PID:468

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Global VPN - Full Tunnel v4/ta.key"
1⤵
PID:466
- /bin/zsh
  /bin/zsh -c "/Users/run/Global VPN - Full Tunnel v4/ta.key"
  2⤵
  PID:471
- /Users/run/Global
  /Users/run/Global VPN - Full Tunnel v4/ta.key
  2⤵
  PID:471

/usr/libexec/xpcproxy
xpcproxy com.apple.emond.aslmanager
1⤵
PID:469

/usr/sbin/aslmanager
/usr/sbin/aslmanager -s /var/log/eventmonitor
1⤵
PID:469

/usr/bin/csrutil
/usr/bin/csrutil report
1⤵
PID:468

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:467

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:497

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:497

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:498

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:498

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:499

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:499

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2026

Terms | Privacy