abe0149f9d65062ab9cf54b3b1aa68b563f136cc0bba153c7c20ddc5afadbd5c

Resubmissions

02/02/2024, 11:26

240202-njxzlacgc2 6

02/02/2024, 11:25

240202-njf13sehcp 1

02/02/2024, 11:22

240202-ngjn7aeger 4

02/02/2024, 11:16

240202-ndfhcsefhk 6

Analysis

max time kernel
149s
max time network
154s
platform
macos-10.15_amd64
resource
macos-20231201-en
resource tags

arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02/02/2024, 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RobloxPlayerInstaller.exe
Size

4.6MB
MD5

93cc28bff51a677298618fa83bc6d3c0
SHA1

1ebe43e0025f7b2d0ce29fb2cda02329e8b435cb
SHA256

abe0149f9d65062ab9cf54b3b1aa68b563f136cc0bba153c7c20ddc5afadbd5c
SHA512

71825ca24b464992c0319a35461b95642d5992d0b97973157e91cb97c800d50f6f946e2e175044d9a5cba8471ef844e4ccedac962fe5e857135e20a822b18933
SSDEEP

98304:UKv7eIj5JTMVQ9pv/qFHvjhgPVUT6V7zGpsdSt6+ebY3y:VBTyGBuNg95usg4uy

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 7 IoCs

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd	Process not Found
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/RobloxPlayerInstaller.exe\""
1⤵
PID:558

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/RobloxPlayerInstaller.exe\""
1⤵
PID:558

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/RobloxPlayerInstaller.exe
1⤵
PID:558
- /bin/zsh
  /bin/zsh -c /Users/run/RobloxPlayerInstaller.exe
  2⤵
  PID:559
- /Users/run/RobloxPlayerInstaller.exe
  /Users/run/RobloxPlayerInstaller.exe
  2⤵
  PID:559

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:582

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:583

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:584

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:585

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:587

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:588

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 588
1⤵
PID:590

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:590

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:592

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:593

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:594

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:596

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:598

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.screentime.remoteservice 588
1⤵
PID:599

/System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice
/System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsync.useragent
1⤵
PID:601

/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsyncd
1⤵
PID:602

/usr/libexec/colorsyncd
/usr/libexec/colorsyncd
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:604

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.adid
1⤵
PID:605

/System/Library/PrivateFrameworks/CoreADI.framework/adid
/System/Library/PrivateFrameworks/CoreADI.framework/adid
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:615

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:616

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:617

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:618

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputMenuAgent
1⤵
PID:619

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputSwitcher
1⤵
PID:620

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:624

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:625

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.A7CF12C0-22A6-45E8-81F3-B34F075F6A3C 624
1⤵
PID:626

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:631

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.93B251BC-48A3-4326-A513-C92FFA1F74B2 624
1⤵
PID:632

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:633

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 624
1⤵
PID:634

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:635

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.B65734F8-18C0-445B-9CEC-E412A47D6114 624
1⤵
PID:636

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:639

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:639

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy com.apple.mediaremoted
1⤵
PID:648

/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:649

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.SandboxHelper 632
1⤵
PID:650

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy com.apple.speech.speechsynthesisd
1⤵
PID:651

/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:652

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:653

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:654

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:654

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:655

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:658

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:658

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
8c7ba197fa31cf5e7237d77874b2f163

SHA1
a51bcef7e0464720df713b4d9de99f7799458825

SHA256
6ccb469fea943935d4ee6ce985d4c3ee886566529b66197e7105e7ef143dc35a

SHA512
e9513ab52cf312e05c1bf850820c678fc9aeafa2bda6accbfb567cbb88af9daa5c160ef9f54fbba1e6c87c87b92e14e2bce2729ca52232568dab2bdb871411c7

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1168.xml

Filesize
150KB

MD5
76ebb0196d42a294b69ef118cbb301d5

SHA1
61e5ab752d351af1661716bc48c0520f66cd1d1b

SHA256
aaa9febe98e3a75220b4933d1f00f2bef276183491e7d171fa54d03259812759

SHA512
8dde09d72944e8925c5bd64dc3799a44d7c30191d5038939a24f8a45ccf4d66b84990e8be3e0f2ee1d42d1dd6e5ed3673c39f803874fb0840a3232cc1e533663

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/5D1E7DD77DE17EA4CEBE4A7E66D69157

Filesize
5KB

MD5
79c897bd28b9ccc97f5b6575e3653fe6

SHA1
0dfe38884e3d4ad1abaab041a4c5523993e4b82b

SHA256
e58a8be4176bda139d271e49511fd1ab40fe07ae5de02c66c64c091732892594

SHA512
6aa85f5d6b079a9eddd8105237b6e3cb3e1cfb30fddd792a867131d1302a129d82f1f48d4d0ef7197c7224e44ef7662fb78eae8f2d566210a6952d67408bb6df

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression

Filesize
225KB

MD5
ef21e1b5e106f5ea61c27f32cc305e46

SHA1
6930fc0daf7fbf08f6f82d32bc0df8128cbae666

SHA256
2324f94bc42fad873ef06b74b71cbcdda5ea7c67c8da92b68ca9ac96a43330f3

SHA512
cc8438f44d6014ebdf00fcdd6cef15ff1e0067ea2f3321cfccd0885548cf50623538ae150c29204f5e975fa92be30bcf649c064ffcb58dac85f2ef08f073badc

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression

Filesize
23.3MB

MD5
1dda7ea7d21718e7ad25150338900ffd

SHA1
86565337fb93b35702134730a0c35f92c08b8062

SHA256
3053a4fc6ffce3e3cc8cca7971fc84627f07d46590f9e6f9dfb6f5b7dd638412

SHA512
7023dd29a41ab79c3c1275fae36013182f0653530f871ea44cffc4c0f9aaa572453906c685e4c5828d2dcb7f2f48de8f0a3f1c448c6c8a158ae8dd3a0341ea7d

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression

Filesize
122KB

MD5
d43d936f048fed7d370f92d406ce36ae

SHA1
ba61155e5ca2a4b41d1ff4cc794f76fe73c76884

SHA256
ab42774d6aee2ecd4df0a52b388010dc1148ea91fb760b2dc3557f908892901f

SHA512
e9dbfdf2d61494e270e6cb5353624f22e8c1541f91281dfdb63b1f97d80f0617c95291d2178c4274df82887b75c6d71218c76afaf25981b90b2c2f04f0f3a167

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.colorsync.profiles.502

Filesize
21KB

MD5
2bac05d4e96ef4f01c8c1f4dc5571168

SHA1
217fdd2886d0e7e19c05681711f72a6747027fb3

SHA256
ae94bca2813c6f71ef03a80b4582ffced8ec175dcffa48df2d93f3398c4e3758

SHA512
99285755e5d2a1ccc44db79f89222e4bf79d569704d5d7de9e18c7ba61284bd74989897455d1f5ce6f03677215ccc9f45f1d5452031acd0c36f5ad73a2e9e7c2

Download Submit