Edit tour

macOS Analysis Report
https://boss-ops.oss-cn-beijing.aliyuncs.com/CGESrv

Overview

General Information

Sample URL:	https://boss-ops.oss-cn-beijing.aliyuncs.com/CGESrv
Analysis ID:	1577220
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false

Signatures

No high impact signatures.

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577220
Start date and time:	2024-12-18 09:25:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://boss-ops.oss-cn-beijing.aliyuncs.com/CGESrv
Analysis system description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Detection:	CLEAN
Classification:	clean0.mac@0/12@2/0

Warnings

Excluded IPs from analysis (whitelisted): 184.84.136.24, 34.195.111.96, 54.173.154.19, 64.233.177.95, 17.253.7.144, 23.216.72.129, 17.36.200.79, 17.253.7.140, 17.253.7.145, 23.202.144.19
Excluded domains from analysis (whitelisted): smoot-searchv2.v.aaplimg.com, lcdn-locator-usuqo.apple.com.akadns.net, updates.cdn-apple.com.akadns.net, e673.dsce9.akamaiedge.net, crl.apple.com, api.smoot.apple.com, bag-smoot.v.aaplimg.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, e1329.g.akamaiedge.net, configuration.apple.com, lcdn-locator.apple.com.akadns.net, lcdn-locator.apple.com, updates.g.aaplimg.com, configuration.apple.com.akadns.net, itunes.apple.com.edgekey.net, configuration.apple.com.edgekey.net, safebrowsing.googleapis.com, init.itunes.apple.com, mesu.apple.com, updates.cdn-apple.com, init-cdn.itunes-apple.com.akadns.net, api2.smoot.apple.com
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://boss-ops.oss-cn-beijing.aliyuncs.com/CGESrv

Process Tree

System is macvm-mojave

mono-sgen32 New Fork (PID: 613, Parent: 537)

open (MD5: 34bd93241fa5d2aee225941b1ca14fa4) Arguments: /usr/bin/open -a Safari https://boss-ops.oss-cn-beijing.aliyuncs.com/CGESrv

xpcproxy New Fork (PID: 614, Parent: 1)

Safari (MD5: 2dde28c2f8a38ed2701ba17a0893cbc1) Arguments: /Applications/Safari.app/Contents/MacOS/Safari

xpcproxy New Fork (PID: 629, Parent: 1)

com.apple.Safari.SandboxBroker (MD5: dbc4069451b58fff752f6b018b3f2c4e) Arguments: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker

xpcproxy New Fork (PID: 648, Parent: 1)

eficheck (MD5: 328beb81a2263449258057506bb4987f) Arguments: /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon

cleanup

HTTP traffic detected: GET /CGESrv HTTP/1.1Host: boss-ops.oss-cn-beijing.aliyuncs.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15

Source: unknown	HTTPS traffic detected: 59.110.190.28:443 -> 192.168.11.12:49374 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49405 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49406 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49408 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49415 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49417 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49418 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.68.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.68.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.74
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: .https://www.facebook.com/settings?tab=security_ equals www.facebook.com (Facebook)
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: 2https://www.linkedin.com/psettings/change-password_ equals www.linkedin.com (Linkedin)

Source: global traffic	DNS traffic detected: DNS query: boss-ops.oss-cn-beijing.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49402
Source: unknown	Network traffic detected: HTTP traffic on port 49406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49415
Source: unknown	Network traffic detected: HTTP traffic on port 49411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49355
Source: unknown	Network traffic detected: HTTP traffic on port 49405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49374
Source: unknown	Network traffic detected: HTTP traffic on port 49415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49404

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	Random device file read: /dev/urandom			Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 648)	Random device file read: /dev/random			Jump to behavior

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior
Source: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker (PID: 629)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 2)/AutoFillQuirks.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Info.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Downloads.plist	Jump to dropped file

Source: /usr/bin/open (PID: 613)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 614)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker (PID: 629)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Antivirus Detection	Reputation
boss-ops.oss-cn-beijing.aliyuncs.com	59.110.190.28	true	false		unknown
h3.apis.apple.map.fastly.net	151.101.3.6	true	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
59.110.190.28	boss-ops.oss-cn-beijing.aliyuncs.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
151.101.3.6	h3.apis.apple.map.fastly.net	United States	54113	FASTLYUS	false
23.216.73.74	unknown	United States	20940	AKAMAI-ASN1EU	false
151.101.131.6	unknown	United States	54113	FASTLYUS	false
23.216.68.203	unknown	United States	20940	AKAMAI-ASN1EU	false

Process:	/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker
File Type:	ASCII text, with very long lines (341)
Category:	dropped
Size (bytes):	765
Entropy (8bit):	5.11755057317815
Encrypted:	false
SSDEEP:	12:gQFOr3J4f9QFMF9omEVg2+LgV5e9LgV7qos2QFOr+f9QFityomEVg2+LgV5e9Lgw:gvr3J4FQFMx8EDx4vr+FQFZ8EDxyZLxe
MD5:	56D118CFF0498FEF70DC0C374A81EBCD
SHA1:	F39CA5CB68233763910677FA1077E99BE2410E9C
SHA-256:	04AB1EB5476D3A36EB9A3518DF5E052DEEC4FE637DE24A71F5100714EA504B48
SHA-512:	7908A7ADFA66D04D788974AF4031E0B729C6D1616A2215FAD31A8A6987C15A3868FBB2798FC9A38AFC9C715055E8D214731C8741C5AFB83754CC74F0CDE3B25F
Malicious:	false
Reputation:	low
Preview:	objc[629]: Class PurpleButtonCell is implemented in both /System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari (0x7fffaf1c03b0) and /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker (0x102de4ec8). One of the two will be used. Which one is undefined..objc[629]: Class PurpleButton is implemented in both /System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari (0x7fffaf1c0400) and /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker (0x102de4f18). One of the two will be used. Which one is undefined..2024-12-18 02:26:17.117 com.apple.Safari.SandboxBroker[629:5013] ApplePersistence=NO.

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	data
Category:	dropped
Size (bytes):	19328
Entropy (8bit):	2.9753497322131066
Encrypted:	false
SSDEEP:	192:XVlGq37NZFFFF/QQQQgdFSGXFFFFnQQQQ:uq37HFFFF/QQQQg3SGXFFFFnQQQQ
MD5:	1D8E1388683DC96ED97907EFCCE83FDA
SHA1:	561FDF03A98032BAAEB7BC214FD6FC2712BA42B0
SHA-256:	A6BE2B32F120066646A50B537477F2D359D7013851F123146CB9B6A7A1371E8C
SHA-512:	70A1E99DAD32B200EB26AD78E6433B3E9E052355ADA3A3AD1CB6C644C1A0513E593CCD89EF8B9B305013B37F3F850F049D787677878F412D23FB517147C18C98
Malicious:	false
Reputation:	low
Preview:	.............J..dJ......clti....0.......mlti........0...blti....2.......blti....2...H...blti....2...\|...blti....2.......blti....2.......blti....2.......blti....2...L...blti~...2.......5lti.@..,.......5lti.B..,....$..5lti.p..,.......5lti.D..,...87..................(....................................... .....................~...f... ...!............... ...4...3.......>.......U.......F...E...G...C...J...K...I...H...L...M...N.......O...?...9...P.......!............. .......t............."...........................................................#...............................^.......X...Y...Z...[...\...].......Q...........S.......R...............$.......(...%.......................&...'........... ...*...+...,...-.......5......./...0...1...6...7...8...:...4...3...........2...<...........T...;...=...>.......)...U...V...W.......@...A...B...F...E...G...C...D...J...K...I...H...L...M...N.......O...?.......9...P.......!...............j...X.....R...........%...7...........\.........".........

Name	Source	Malicious	Reputation
https://www.sephora.com/profile/MyAccount_	AutoFillQuirks.plist.242.dr	false	high
https://myaccount.uscis.gov/users/registration/password_	AutoFillQuirks.plist.242.dr	false	high
https://www.dotloop.com/my/account/#/settings_	AutoFillQuirks.plist.242.dr	false	high
https://xhamster.com/password-recovery_	AutoFillQuirks.plist.242.dr	false	high
https://hotels.com/profile/settings.html_	AutoFillQuirks.plist.242.dr	false	high
https://myspace.com/settings/profile/email_	AutoFillQuirks.plist.242.dr	false	high
https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_	AutoFillQuirks.plist.242.dr	false	high
https://allegro.pl/moje-allegro/moje-konto/logowanie-i-haslo_	AutoFillQuirks.plist.242.dr	false	high
https://customer.xfinity.com/users/me/update-password_	AutoFillQuirks.plist.242.dr	false	high
https://moncompte.lemonde.fr/gcustomer/account/password_	AutoFillQuirks.plist.242.dr	false	unknown
https://shein.com/user/security_	AutoFillQuirks.plist.242.dr	false	high
https://www.discogs.com/settings/user_	AutoFillQuirks.plist.242.dr	false	high
https://support.opentable.com/s/login/ForgotPassword?language=en_US_	AutoFillQuirks.plist.242.dr	false	unknown
https://fps.fidelity.com/ftgw/Fps/Fidelity/RtlCust/ChangePIN/Init_	AutoFillQuirks.plist.242.dr	false	high
https://www.amazon.com/ax/account/manage_	AutoFillQuirks.plist.242.dr	false	high
https://www.newsweek.com/contact_	AutoFillQuirks.plist.242.dr	false	high
https://www.birkenstock.com/profile_	AutoFillQuirks.plist.242.dr	false	high
https://id.sonyentertainmentnetwork.com/id/management/#/p/security_	AutoFillQuirks.plist.242.dr	false	high
https://www.nba.com/account/nbaprofile_	AutoFillQuirks.plist.242.dr	false	high
https://cloud.linode.com/profile/auth_	AutoFillQuirks.plist.242.dr	false	high
https://codepen.io/settings/account_	AutoFillQuirks.plist.242.dr	false	high
https://www.serasa.com.br/meus-dados/alterar-senha_	AutoFillQuirks.plist.242.dr	false	high
https://reg.usps.com/entreg/secure/ChangePasswordAction_input?returnActionName_	AutoFillQuirks.plist.242.dr	false	high
https://www.allrecipes.com/account/profile#/change-password_	AutoFillQuirks.plist.242.dr	false	high
https://pro.housecallpro.com/service_pro/account/reset_password_	AutoFillQuirks.plist.242.dr	false	high
https://user.manganelo.com/user_changes_pass_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.dailymail.co.uk/registration/profile/change-password.html_	AutoFillQuirks.plist.242.dr	false	high
https://www.11st.co.kr/register/popupModifyPWD.tmall_	AutoFillQuirks.plist.242.dr	false	high
https://www.zulily.com/account/edit?rel=top_flyout_	AutoFillQuirks.plist.242.dr	false	high
https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_	AutoFillQuirks.plist.242.dr	false	high
https://www.creditkarma.com/myprofile/security_	AutoFillQuirks.plist.242.dr	false	high
https://secure07ea.chase.com/web/auth/dashboard#/dashboard/myProfileSignInSecurity/resetPassword/res	AutoFillQuirks.plist.242.dr	false	unknown
https://account.magento.com/customer/account/changepassword_	AutoFillQuirks.plist.242.dr	false	unknown
https://profile.theguardian.com/reset_	AutoFillQuirks.plist.242.dr	false	high
https://reelgood.com/account_	AutoFillQuirks.plist.242.dr	false	high
https://dash.e.jimdo.com/profile_	AutoFillQuirks.plist.242.dr	false	unknown
https://go.com/profile/account-settings/edit_	AutoFillQuirks.plist.242.dr	false	high
https://genius.com/password_resets/new_	AutoFillQuirks.plist.242.dr	false	high
https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef	AutoFillQuirks.plist.242.dr	false	high
https://logowanie.pl.canalplus.com/zmien-haslo_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.alternate.de/html/myAccount/account/basicData.html_	AutoFillQuirks.plist.242.dr	false	high
https://blend.io/settings_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.aesop.com/my-account_	AutoFillQuirks.plist.242.dr	false	high
https://member.daum.net/change/password.daum_	AutoFillQuirks.plist.242.dr	false	unknown
https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_	AutoFillQuirks.plist.242.dr	false	unknown
https://mastercard.syf.com/login/reset_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.jcpenney.com/account/dashboard/personal/info_	AutoFillQuirks.plist.242.dr	false	high
https://worldstarhiphop.com/videos/reset.php_	AutoFillQuirks.plist.242.dr	false	high
https://www.shoop.de/einstellungen/benutzerdaten_	AutoFillQuirks.plist.242.dr	false	high
https://accounts.shopify.com/accounts/186490458/security_	AutoFillQuirks.plist.242.dr	false	high
https://app.carta.com/profiles/update/_	AutoFillQuirks.plist.242.dr	false	high
https://legacy.memoriams.com/Network/Account/ChangePassword_	AutoFillQuirks.plist.242.dr	false	unknown
https://profile.callofduty.com/cod/info_	AutoFillQuirks.plist.242.dr	false	high
https://blackwells.co.uk/bookshop/account/personal-details_	AutoFillQuirks.plist.242.dr	false	high
https://secure.hulu.com/account_	AutoFillQuirks.plist.242.dr	false	high
https://www.splunk.com/my-account/#/profile-details_	AutoFillQuirks.plist.242.dr	false	high
https://news.ycombinator.com/changepw_	AutoFillQuirks.plist.242.dr	false	high
https://classroom.udacity.com/settings/password_	AutoFillQuirks.plist.242.dr	false	unknown
https://pwrecovery.ruc.dk_	AutoFillQuirks.plist.242.dr	false	unknown
https://secure.ssa.gov/RIM/UpwdView.action_	AutoFillQuirks.plist.242.dr	false	high
https://www.ancestry.com/account/security/password_	AutoFillQuirks.plist.242.dr	false	high
https://key.harvard.edu/manage-account/change-password_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.amazon.ca/ax/account/manage_	AutoFillQuirks.plist.242.dr	false	high
https://account.id.me/signin/password_	AutoFillQuirks.plist.242.dr	false	high
https://www.carnival.com/profilemanagement/profiles/changepassword_	AutoFillQuirks.plist.242.dr	false	high
https://thejigsawpuzzles.com/profile/?changepassword_	AutoFillQuirks.plist.242.dr	false	high
https://www.patreon.com/settings/account_	AutoFillQuirks.plist.242.dr	false	high
https://account.deere.com/actmgmt/change-password_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.ikea.com/in/en/profile/dashboard/_	AutoFillQuirks.plist.242.dr	false	high
https://apps.anatel.gov.br/AnatelConsumidor/ConsumidorEditar.aspx_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.safeway.com/customer-account/account-settings_	AutoFillQuirks.plist.242.dr	false	high
https://www.amazon.de/ax/account/manage_	AutoFillQuirks.plist.242.dr	false	high
https://www.cars.com/reset_password_	AutoFillQuirks.plist.242.dr	false	high
https://www.amazon.es/ax/account/manage_	AutoFillQuirks.plist.242.dr	false	high
https://www.zocdoc.com/patient/editprofile?section=Password_	AutoFillQuirks.plist.242.dr	false	high
https://www.apartments.com/my-account/#_	AutoFillQuirks.plist.242.dr	false	high
https://logonservices.iam.target.com/change-password/?target=#	AutoFillQuirks.plist.242.dr	false	high
https://www.aerlingus.com/html/user-profile.html_	AutoFillQuirks.plist.242.dr	false	high
https://www.dickssportinggoods.com/MyAccount/AccountSettings_	AutoFillQuirks.plist.242.dr	false	high
https://login.tmon.co.kr/user/info_	AutoFillQuirks.plist.242.dr	false	unknown
https://my.nextdns.io/account_	AutoFillQuirks.plist.242.dr	false	unknown
https://secure.indeed.com/account/changepassword_	AutoFillQuirks.plist.242.dr	false	high
https://www.temu.com/bgp_account_security.html_	AutoFillQuirks.plist.242.dr	false	high
https://imgur.com/account/settings/password_	AutoFillQuirks.plist.242.dr	false	high
https://my.norton.com/extspa/account/personalinfo_	AutoFillQuirks.plist.242.dr	false	high
https://account.proton.me/u/0/vpn/account-password_	AutoFillQuirks.plist.242.dr	false	high
https://www.espn.com/_	AutoFillQuirks.plist.242.dr	false	high
https://www.consumidor.gov.br/pages/usuario/editar_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.nike.com/member/settings_	AutoFillQuirks.plist.242.dr	false	high
https://www.bathandbodyworks.com/my-account/edit-profile_	AutoFillQuirks.plist.242.dr	false	high
https://myvpostpay.verizon.com/ui/bill/secure/_	AutoFillQuirks.plist.242.dr	false	high
https://www.glassdoor.com/member/profile/settings.htm_	AutoFillQuirks.plist.242.dr	false	high
https://employeewe.bamboohr.com/dashboard/password.php_	AutoFillQuirks.plist.242.dr	false	unknown
https://login.yahoo.com/account/change-password_	AutoFillQuirks.plist.242.dr	false	high
https://www.pornhub.com/user/security_	AutoFillQuirks.plist.242.dr	false	high
https://www.cargurus.com/Cars/myAccount#/accountSettings_	AutoFillQuirks.plist.242.dr	false	high
https://www.prowlapp.com/settings.php_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.aeon.co.jp/app/settings/profile/password/_	AutoFillQuirks.plist.242.dr	false	unknown
https://accounts.intuit.com/app/account-manager/security/password_	AutoFillQuirks.plist.242.dr	false	high

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:26:13.433029890 CET	55103	53	192.168.11.12	1.1.1.1
Dec 18, 2024 09:26:13.792676926 CET	53	55103	1.1.1.1	192.168.11.12
Dec 18, 2024 09:26:24.052150011 CET	53	55636	1.1.1.1	192.168.11.12
Dec 18, 2024 09:27:59.895168066 CET	49651	53	192.168.11.12	1.1.1.1
Dec 18, 2024 09:28:00.036812067 CET	53	49651	1.1.1.1	192.168.11.12

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:26:14 UTC	358	OUT	GET /CGESrv HTTP/1.1 Host: boss-ops.oss-cn-beijing.aliyuncs.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-gb Connection: keep-alive Accept-Encoding: br, gzip, deflate User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
2024-12-18 08:26:15 UTC	476	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 18 Dec 2024 08:26:15 GMT Content-Type: application/octet-stream Content-Length: 6749072 Connection: close x-oss-request-id: 67628727E48B2B31363EF846 Accept-Ranges: bytes ETag: "F0D721E663F6E3A2FAFD2A27EF95CEE0" Last-Modified: Wed, 18 Dec 2024 07:33:10 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9416356292608232939 x-oss-storage-class: Standard Content-MD5: 8Nch5mP246L6/Son75XO4A== x-oss-server-time: 52
2024-12-18 08:26:15 UTC	3620	IN	Data Raw: cf fa ed fe 07 00 00 01 03 00 00 00 02 00 00 00 14 00 00 00 18 09 00 00 85 00 20 00 00 00 00 00 19 00 00 00 48 00 00 00 5f 5f 50 41 47 45 5a 45 52 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 28 02 00 00 5f 5f 54 45 58 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 e0 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 39 00 00 00 00 00 05 00 00 00 05 00 00 00 06 00 00 00 00 00 00 00 5f 5f 74 65 78 74 00 00 00 00 00 00 00 00 00 00 5f 5f 54 45 58 54 00 00 00 00 00 00 00 00 00 00 00 14 00 00 01 00 00 00 25 8b 30 00 00 00 00 00 00 14 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 04 00 80 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H__PAGEZERO(__TEXT99__text__TEXT%0
2024-12-18 08:26:15 UTC	4096	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-18 08:26:15 UTC	4096	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4d 8b 66 20 4d 85 e4 75 18 0f b6 48 17 83 e1 1f 80 f9 11 75 06 48 8b 48 40 eb 02 31 c9 48 89 c8 c3 4c 8d 6c 24 08 4d 39 2c 24 75 dd 49 89 24 24 eb d7 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 1e 55 48 89 e5 48 83 ec 08 4d 8b 66 20 4d 85 e4 75 1e 84 00 e8 a2 f7 ff ff 48 83 c4 08 5d c3 48 89 44 24 08 e8 52 02 07 00 48 8b 44 24 08 eb cb 4c 8d 6c 24 18 66 0f 1f 44 00 00 4d 39 2c 24 75 d1 49 89 24 24 eb cb cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4d 8b 66 20 4d 85 e4 75 04 48 8b 00 c3 4c 8d 6c 24 08 4d 39 2c 24 75 f1 49 89 24 24 eb eb cc cc 4d 8b 66 20 4d 85 e4 75 08 0f b6 40 17 83 e0 1f c3 4c 8d 6c 24 08 4d 39 2c 24 75 ed 49 89 24 24 eb e7 cc Data Ascii: Mf MuHuHH@1HLl$M9,$uI$$I;fvUHHMf MuH]HD$RHD$Ll$fDM9,$uI$$Mf MuHLl$M9,$uI$$Mf Mu@Ll$M9,$uI$$
2024-12-18 08:26:15 UTC	4096	IN	Data Raw: 68 00 0f ba e0 1d 0f 92 05 7e 98 68 00 0f ba e0 10 0f 92 c1 0f b6 54 24 42 21 ca 88 15 5f 98 68 00 84 d2 74 16 0f ba e0 1e 0f 92 05 51 98 68 00 0f ba e0 1f 0f 92 05 47 98 68 00 b8 00 00 00 80 48 89 04 24 e8 73 00 00 00 45 0f 57 ff 65 4c 8b 34 25 30 00 00 00 81 7c 24 08 01 00 00 80 73 06 48 83 c4 50 5d c3 b8 01 00 00 80 48 89 04 24 e8 48 00 00 00 45 0f 57 ff 65 4c 8b 34 25 30 00 00 00 8b 44 24 14 0f ba e0 1b 0f 92 05 fa 97 68 00 48 83 c4 50 5d c3 48 83 c4 50 5d 90 c3 48 83 c4 50 5d c3 e8 34 f2 06 00 e9 8f f7 ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 08 8b 4c 24 0c 0f a2 89 44 24 10 89 5c 24 14 89 4c 24 18 89 54 24 1c c3 cc cc cc cc cc b9 00 00 00 00 0f 01 d0 89 44 24 08 89 54 24 0c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc c7 44 24 Data Ascii: h~hT$B!_htQhGhH$sEWeL4%0\|$sHP]H$HEWeL4%0D$hHP]HP]HP]4D$L$D$\$L$T$D$T$D$
2024-12-18 08:26:15 UTC	4096	IN	Data Raw: 0f 74 c8 66 0f d7 d1 0f bc d2 74 ce 39 da 73 ca 49 89 10 c3 f3 0f 6f 4c 1e f0 66 0f 74 c8 66 0f d7 d1 89 d9 d3 e2 c1 ea 10 0f bc d2 74 ac 49 89 10 c3 80 3d 46 88 68 00 01 0f 85 62 ff ff ff 66 48 0f 6e c0 4c 8d 5c 1e e0 c4 e2 7d 78 c8 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 c5 fe 6f 17 c5 ed 74 d9 c4 e2 7d 17 db 75 26 48 83 c7 20 4c 39 df 7c e8 4c 89 df c5 fe 6f 17 c5 ed 74 d9 c4 e2 7d 17 db 75 0b c5 f8 77 49 c7 00 ff ff ff ff c3 c5 fd d7 d3 0f bc d2 48 29 f7 48 01 fa 49 89 10 c5 f8 77 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8b 74 24 08 48 8b 5c 24 10 8a 44 24 20 4c 8d 44 24 28 e9 a8 fe ff ff cc cc cc cc cc cc cc cc 48 8b 74 24 08 48 8b 5c 24 10 8a 44 24 18 4c 8d 44 24 20 e9 88 fe ff ff cc cc cc cc cc cc cc cc 55 48 89 Data Ascii: tft9sIoLftftI=FhbfHnL\}xfDot}u&H L9\|Lot}uwIH)HIwHt$H\$D$ LD$(Ht$H\$D$LD$ UH
2024-12-18 08:26:15 UTC	4096	IN	Data Raw: 0f 86 15 02 00 00 55 48 89 e5 48 83 ec 50 0f b6 48 14 f6 c1 08 0f 85 3b 01 00 00 48 89 5c 24 68 0f b6 48 17 83 e1 1f 80 f9 11 0f 86 d0 00 00 00 80 f9 14 74 26 0f 1f 80 00 00 00 00 80 f9 18 0f 84 c3 00 00 00 80 f9 19 0f 85 d2 00 00 00 48 8b 48 38 48 8b 50 40 e9 66 01 00 00 48 83 78 40 00 75 18 48 8b 0b 48 85 c9 74 06 48 8d 53 08 eb 1a 31 c0 31 db 48 83 c4 50 5d c3 48 8b 0b 48 85 c9 74 74 48 8b 49 08 48 8d 53 08 48 83 79 18 00 74 2c 0f b6 71 17 40 f6 c6 20 74 11 48 89 c8 48 89 d3 e8 56 ff ff ff 48 83 c4 50 5d c3 48 8b 1a 48 89 c8 e8 45 ff ff ff 48 83 c4 50 5d c3 48 89 c8 e8 17 d1 05 00 b9 18 00 00 00 48 89 c7 48 89 de 31 c0 48 8d 1d 7f d6 30 00 0f 1f 00 e8 bb cd 04 00 e8 96 18 06 00 48 89 c3 48 8d 05 ec 74 43 00 48 83 c4 50 5d c3 31 c0 31 db 48 83 c4 50 5d Data Ascii: UHHPH;H\$hHt&HH8HP@fHx@uHHtHS11HP]HHttHIHSHyt,q@ tHHVHP]HHEHP]HHH1H0HHtCHP]11HP]
2024-12-18 08:26:15 UTC	4096	IN	Data Raw: 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 c8 c2 06 00 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 f4 fc ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 25 55 48 89 e5 48 83 ec 08 4d 8b 66 20 4d 85 e4 75 1b 48 8b 42 08 0f 1f 44 00 00 e8 7b 00 00 00 48 83 c4 08 5d c3 e8 f0 c1 06 00 eb ce 4c 8d 6c 24 18 4d 39 2c 24 75 da 49 89 24 24 eb d4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4d 8b 66 20 4d 85 e4 75 0c 48 8b 42 10 48 ff 88 50 01 00 00 c3 4c 8d 6c 24 08 66 0f 1f 44 00 00 4d 39 2c 24 75 e3 49 89 24 24 eb dd cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 7b 55 48 89 e5 48 83 ec 08 80 38 00 74 67 49 8b 46 30 90 ff 80 08 01 00 00 49 8b 46 30 48 Data Ascii: HD$H\$HL$HD$H\$HL$I;fv%UHHMf MuHBD{H]Ll$M9,$uI$$Mf MuHBHPLl$fDM9,$uI$$I;fv{UHH8tgIF0IF0H
2024-12-18 08:26:15 UTC	4096	IN	Data Raw: 08 75 08 48 c7 42 30 00 00 00 00 48 ff 02 90 90 48 8b 44 24 40 e8 62 60 00 00 b8 01 00 00 00 48 83 c4 60 5d c3 4c 8d 05 d0 00 00 00 4c 89 44 24 50 48 89 4c 24 58 48 89 c8 48 89 d3 48 8b 4c 24 78 48 8d 7c 24 50 be 03 00 00 00 e8 ec 00 00 00 b8 01 00 00 00 48 83 c4 60 5d c3 48 8b 4c 24 70 83 79 1c 00 75 11 48 8d 05 c8 bc 30 00 bb 19 00 00 00 e8 05 4b 06 00 48 8d 05 be 1a 3d 00 48 8d 1d 07 3f 43 00 e8 12 47 06 00 48 8d 05 0e cb 30 00 bb 1b 00 00 00 e8 e1 4a 06 00 90 90 48 8b 44 24 40 e8 d5 5f 00 00 48 8d 05 8e 1a 3d 00 48 8d 1d d7 3e 43 00 e8 e2 46 06 00 90 48 89 44 24 08 48 89 5c 24 10 88 4c 24 18 48 89 7c 24 20 e8 09 b2 06 00 48 8b 44 24 08 48 8b 5c 24 10 0f b6 4c 24 18 48 8b 7c 24 20 e9 70 fa ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 Data Ascii: uHB0HHD$@b`H`]LLD$PHL$XHHHL$xH\|$PH`]HL$pyuH0KH=H?CGH0JHD$@_H=H>CFHD$H\$L$H\|$ HD$H\$L$H\|$ pI;f
2024-12-18 08:26:15 UTC	4096	IN	Data Raw: 76 1e 55 48 89 e5 48 83 ec 08 48 8b 42 08 84 00 48 83 c0 60 90 e8 62 50 00 00 48 83 c4 08 5d c3 e8 37 a2 06 00 eb d5 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 a5 01 00 00 55 48 89 e5 48 83 ec 40 48 89 5c 24 58 48 89 7c 24 68 48 89 74 24 70 48 83 78 08 00 75 26 48 85 c9 0f 84 ab 00 00 00 48 8b 40 28 e8 a6 f3 ff ff 48 8b 5c 24 58 48 8b 74 24 70 48 8b 7c 24 68 e9 8e 00 00 00 48 89 44 24 50 48 8b 50 38 44 0f b7 40 18 49 0f af d0 48 03 50 10 48 85 c9 74 2b 48 89 54 24 18 48 8b 70 28 48 89 cb 48 89 d1 48 89 f0 0f 1f 44 00 00 e8 1b 22 06 00 48 8b 44 24 50 48 8b 54 24 18 48 8b 5c 24 58 48 8b 70 28 48 8b 4b 18 48 89 f0 48 89 d3 e8 f9 21 06 00 48 8b 54 24 50 48 8b 72 38 48 ff c6 48 89 72 38 48 39 72 08 75 08 48 c7 42 38 00 00 Data Ascii: vUHHHBH`bPH]7I;fUHH@H\$XH\|$hHt$pHxu&HH@(H\$XHt$pH\|$hHD$PHP8D@IHPHt+HT$Hp(HHHD"HD$PHT$H\$XHp(HKHH!HT$PHr8HHr8H9ruHB8
2024-12-18 08:26:15 UTC	4096	IN	Data Raw: c7 81 90 00 00 00 00 00 00 00 e8 2d 00 00 00 48 8b 4c 24 10 90 49 89 8e a8 00 00 00 48 8d 05 09 09 43 00 e8 d4 90 06 00 48 83 c4 18 5d c3 e8 a9 92 06 00 eb 87 cc cc cc cc cc cc cc 49 3b 66 10 0f 86 85 00 00 00 55 48 89 e5 48 83 ec 30 66 44 0f d6 7c 24 28 c6 44 24 07 00 48 c7 44 24 10 00 00 00 00 48 89 44 24 08 48 8d 44 24 08 48 89 44 24 10 c6 44 24 06 00 48 8d 05 7e 00 00 00 48 89 44 24 18 48 8d 44 24 06 48 89 44 24 20 48 8d 44 24 18 48 89 44 24 28 c6 44 24 07 01 48 8b 54 24 10 48 8b 02 ff d0 c6 44 24 06 01 c6 44 24 07 00 48 8b 54 24 28 48 8b 02 ff d0 48 83 c4 30 5d c3 e8 17 ac 02 00 48 83 c4 30 5d c3 48 89 44 24 08 e8 07 92 06 00 48 8b 44 24 08 66 90 e9 5b ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 Data Ascii: -HL$IHCH]I;fUHH0fD\|$(D$HD$HD$HD$HD$D$H~HD$HD$HD$ HD$HD$(D$HT$HD$D$HT$(HH0]H0]HD$HD$f[I;f

Start time (UTC):	08:26:06
Start date (UTC):	18/12/2024
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Start time (UTC):	08:26:07
Start date (UTC):	18/12/2024
Path:	/Applications/Safari.app/Contents/MacOS/Safari
Arguments:	/Applications/Safari.app/Contents/MacOS/Safari
File size:	27120 bytes
MD5 hash:	2dde28c2f8a38ed2701ba17a0893cbc1

Start time (UTC):	08:26:16
Start date (UTC):	18/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	08:26:36
Start date (UTC):	18/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report https://boss-ops.oss-cn-beijing.aliyuncs.com/CGESrv

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/dev/null

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/com.apple.scriptmanager2.le.cache

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsDirectory.db_

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsObject.db_

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 2)/AutoFillQuirks.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Downloads.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Info.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

System Behavior

Analysis Process: mono-sgen32 PID: 613, Parent PID: 537

General

Chronological Activities

Analysis Process: open PID: 613, Parent PID: 537

General

Chronological Activities

Analysis Process: xpcproxy PID: 614, Parent PID: 1

General

Chronological Activities

Analysis Process: Safari PID: 614, Parent PID: 1

General

Chronological Activities

Analysis Process: xpcproxy PID: 629, Parent PID: 1

macOS Analysis Report
https://boss-ops.oss-cn-beijing.aliyuncs.com/CGESrv

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre