d669200a0272d9b6d8a07a8dab67b10b940dcca3c1389445fccd0fcf592bdf78

Analysis

max time kernel
483s
max time network
496s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
25-02-2024 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.ps1
Size

96B
MD5

c069a5817117a2fef0218f98d80bd78f
SHA1

98c4cf0d497a12214c006eaafabc135ddff75633
SHA256

d669200a0272d9b6d8a07a8dab67b10b940dcca3c1389445fccd0fcf592bdf78
SHA512

3ff583b37a6a87800ac63cabc09848254050750acccc25943ba984bc6a40121e65249cf08c81179d25e8ebb55d7bf90a94cf54fea9fa08222127de77cfadf8af

Score

7^/10

evasion execution exfiltration persistence

Malware Config

Signatures

Exfiltration Over Alternative Protocol 1 TTPs 1 IoCs

exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

T1048.003

ioc	Process
curl https://setup.rbxcdn.com/mac/version-5c432a880bfa4a65-RobloxPlayer.zip -o ./RobloxPlayer.zip	Process not Found

File Permission 1 TTPs
evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
167	raw.githubusercontent.com
176	raw.githubusercontent.com
181	raw.githubusercontent.com
4	raw.githubusercontent.com

Launch Agent 1 TTPs
persistence

Launch Agent
T1543.001

Resource Forking 1 TTPs 8 IoCs

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found

Command and Scripting Interpreter 1 TTPs
execution

Unix Shell
T1059.004

Launchctl 1 TTPs 1 IoCs

execution

Launchctl

T1569.001

ioc	Process
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/file01.ps1\""
1⤵
PID:534

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/file01.ps1\""
1⤵
PID:534

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/file01.ps1
1⤵
PID:534
- /bin/zsh
  /bin/zsh -c /Users/run/file01.ps1
  2⤵
  PID:535
- /Users/run/file01.ps1
  /Users/run/file01.ps1
  2⤵
  PID:535
- /bin/sh
  sh /Users/run/file01.ps1
  2⤵
  PID:535
- /bin/bash
  sh /Users/run/file01.ps1
  2⤵
  PID:535
- - /usr/bin/curl
    curl -LJs https://raw.githubusercontent.com/retguard/fuzzy-octo-disco/main/install.sh
    3⤵
    PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:542

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:564

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:566

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 564
1⤵
PID:567

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:567

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:569

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:570

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:571

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:572

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:575

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:578

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:583

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:584

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:585

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:586

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:587

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:591

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:596

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.keyboard.remoteservice 564
1⤵
PID:597

/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
/System/Library/PreferencePanes/Keyboard.prefPane/Contents/XPCServices/Keyboard.remoteservice.xpc/Contents/MacOS/Keyboard.remoteservice
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:598

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:599

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:601

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputSwitcher
1⤵
PID:604

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:605

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:606

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.KeyboardSetupAssistant.2164
1⤵
PID:607

/System/Library/CoreServices/KeyboardSetupAssistant.app/Contents/MacOS/KeyboardSetupAssistant
/System/Library/CoreServices/KeyboardSetupAssistant.app/Contents/MacOS/KeyboardSetupAssistant
1⤵
PID:607

/usr/bin/curl
curl -LJs https://raw.githubusercontent.com/retguard/fuzzy-octo-disco/main/install.sh
1⤵
PID:614

/bin/bash
bash
1⤵
PID:615
- /usr/bin/curl
  curl https://setup.rbxcdn.com/mac/version-5c432a880bfa4a65-RobloxPlayer.zip -o ./RobloxPlayer.zip
  2⤵
  PID:616
- /usr/bin/unzip
  unzip -o -q ./RobloxPlayer.zip
  2⤵
  PID:619
- /bin/mv
  mv ./RobloxPlayer.app /Applications/Roblox.app
  2⤵
  PID:621
- /bin/rm
  rm ./RobloxPlayer.zip
  2⤵
  PID:622
- /bin/rm
  rm ./libHydrogen.dylib
  2⤵
  PID:623
- /usr/bin/curl
  curl -LJO https://github.com/retguard/fuzzy-octo-disco/raw/main/libHydrogen.dylib
  2⤵
  PID:624
- /bin/rm
  rm ./insert_dylib
  2⤵
  PID:627
- /usr/bin/curl
  curl -LJO https://github.com/retguard/legendary-couscous/raw/main/insert_dylib
  2⤵
  PID:628
- /bin/chmod
  chmod +x ./insert_dylib
  2⤵
  PID:633
- /bin/mv
  mv ./libHydrogen.dylib /Applications/Roblox.app/Contents/MacOS/libHydrogen.dylib
  2⤵
  PID:634
- ./insert_dylib
  ./insert_dylib /Applications/Roblox.app/Contents/MacOS/libHydrogen.dylib /Applications/Roblox.app/Contents/MacOS/RobloxPlayer --strip-codesig --all-yes
  2⤵
  PID:635
- /bin/mv
  mv /Applications/Roblox.app/Contents/MacOS/RobloxPlayer_patched /Applications/Roblox.app/Contents/MacOS/RobloxPlayer
  2⤵
  PID:638
- /bin/chmod
  chmod +x /Applications/Roblox.app/Contents/MacOS/libHydrogen.dylib
  2⤵
  PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:626

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000002.Microsoft Word"
1⤵
PID:629

/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
"/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word" -psn_0_213044
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 541
1⤵
PID:632

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:644

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:646

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy com.apple.sandboxd
1⤵
PID:647

/usr/libexec/sandboxd
/usr/libexec/sandboxd
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.fba.2660
1⤵
PID:648

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant"
1⤵
PID:648

/bin/launchctl
/bin/launchctl list
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy com.microsoft.autoupdate.helper
1⤵
PID:650

/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:650

/bin/launchctl
/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist
1⤵
PID:651

/usr/bin/codesign
/usr/bin/codesign -v /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:657

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy com.roblox.RobloxPlayer.3100
1⤵
PID:664

/Applications/Roblox.app/Contents/MacOS/RobloxPlayer
/Applications/Roblox.app/Contents/MacOS/RobloxPlayer
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:665

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:665

/Applications/Roblox.app/Contents/MacOS/RobloxCrashHandler
/Applications/Roblox.app/Contents/MacOS/RobloxCrashHandler --no-rate-limit --crashCounter Mac-ROBLOXPlayer-Crash --baseUrl https://www.roblox.com/ "--attachment=attachment_0.613.1.6130510_20240226T010212Z_Player_8f9d0_last.log=/Users/run/Library/Logs/Roblox/0.613.1.6130510_20240226T010212Z_Player_8f9d0_last.log" "--database=/Users/run/Library/Logs/Roblox/crashes" "--metrics-dir=/Users/run/Library/Logs/Roblox/crashes" "--url=https://uploads.backtrace.rbx.com/post" "--annotation=AppVersion=0.613.1.6130510" "--annotation=Format=minidump" "--annotation=RobloxChannel=production" "--annotation=RobloxGitHash=33db88719123bd6e70c8be814e9c3adf0810f627" "--annotation=RobloxProduct=RobloxPlayer" "--annotation=UniqueId=1173760552046720328" "--handshake-fd=5"
1⤵
PID:1.8446744071563117e+19

/usr/libexec/xpcproxy
xpcproxy com.roblox.RobloxPlayer.3100
1⤵
PID:670

/Applications/Roblox.app/Contents/MacOS/RobloxPlayer
/Applications/Roblox.app/Contents/MacOS/RobloxPlayer
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:671

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:671

/Applications/Roblox.app/Contents/MacOS/RobloxCrashHandler
/Applications/Roblox.app/Contents/MacOS/RobloxCrashHandler --no-rate-limit --crashCounter Mac-ROBLOXPlayer-Crash --baseUrl https://www.roblox.com/ "--attachment=attachment_0.613.1.6130510_20240226T010300Z_Player_df153_last.log=/Users/run/Library/Logs/Roblox/0.613.1.6130510_20240226T010300Z_Player_df153_last.log" "--database=/Users/run/Library/Logs/Roblox/crashes" "--metrics-dir=/Users/run/Library/Logs/Roblox/crashes" "--url=https://uploads.backtrace.rbx.com/post" "--annotation=AppVersion=0.613.1.6130510" "--annotation=Format=minidump" "--annotation=RobloxChannel=production" "--annotation=RobloxGitHash=33db88719123bd6e70c8be814e9c3adf0810f627" "--annotation=RobloxProduct=RobloxPlayer" "--annotation=UniqueId=6424269981514934939" "--handshake-fd=5"
1⤵
PID:1.8446744071563117e+19

/usr/libexec/xpcproxy
xpcproxy com.roblox.RobloxPlayer.3100
1⤵
PID:674

/Applications/Roblox.app/Contents/MacOS/RobloxPlayer
/Applications/Roblox.app/Contents/MacOS/RobloxPlayer
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:675

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:675

/Applications/Roblox.app/Contents/MacOS/RobloxCrashHandler
/Applications/Roblox.app/Contents/MacOS/RobloxCrashHandler --no-rate-limit --crashCounter Mac-ROBLOXPlayer-Crash --baseUrl https://www.roblox.com/ "--attachment=attachment_0.613.1.6130510_20240226T010336Z_Player_6abb5_last.log=/Users/run/Library/Logs/Roblox/0.613.1.6130510_20240226T010336Z_Player_6abb5_last.log" "--database=/Users/run/Library/Logs/Roblox/crashes" "--metrics-dir=/Users/run/Library/Logs/Roblox/crashes" "--url=https://uploads.backtrace.rbx.com/post" "--annotation=AppVersion=0.613.1.6130510" "--annotation=Format=minidump" "--annotation=RobloxChannel=production" "--annotation=RobloxGitHash=33db88719123bd6e70c8be814e9c3adf0810f627" "--annotation=RobloxProduct=RobloxPlayer" "--annotation=UniqueId=1446273722426375529" "--handshake-fd=5"
1⤵
PID:1.8446744071563117e+19

/usr/libexec/xpcproxy
xpcproxy com.roblox.RobloxPlayer.3100
1⤵
PID:678

/Applications/Roblox.app/Contents/MacOS/RobloxPlayer
/Applications/Roblox.app/Contents/MacOS/RobloxPlayer
1⤵
PID:678

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:679

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:679

/Applications/Roblox.app/Contents/MacOS/RobloxCrashHandler
/Applications/Roblox.app/Contents/MacOS/RobloxCrashHandler --no-rate-limit --crashCounter Mac-ROBLOXPlayer-Crash --baseUrl https://www.roblox.com/ "--attachment=attachment_0.613.1.6130510_20240226T010404Z_Player_b7afa_last.log=/Users/run/Library/Logs/Roblox/0.613.1.6130510_20240226T010404Z_Player_b7afa_last.log" "--database=/Users/run/Library/Logs/Roblox/crashes" "--metrics-dir=/Users/run/Library/Logs/Roblox/crashes" "--url=https://uploads.backtrace.rbx.com/post" "--annotation=AppVersion=0.613.1.6130510" "--annotation=Format=minidump" "--annotation=RobloxChannel=production" "--annotation=RobloxGitHash=33db88719123bd6e70c8be814e9c3adf0810f627" "--annotation=RobloxProduct=RobloxPlayer" "--annotation=UniqueId=362079376756140293" "--handshake-fd=5"
1⤵
PID:1.8446744071563117e+19

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Exfiltration Over Alternative Protocol

T1048