ac499a6598b0f034e7e69e521d163f7c31df0623ccd06110ffff4421aea5bfde

General

Target
PC Computer - Roblox - Studio Grids.png
Size 8KB
Sample240503-vv4pvaef26
SHA256 ac499a6598b0f034e7e69e521d163f7c31df0623ccd06110ffff4421aea5bfde
MD5 55abaaba45951214b68c3dcc29c3b2d9
SHA1 8ff7b57632cda51bab2b44502fc8fb365e9fe7de
SHA512 11d362fcf94dddb1c8e575549b0fbfa9e919d19c6a42bc184e655edd1fb76ed35a63ec40130b9b2aeec4b4bbfed083e51ff9a1f923e5c0bbf51efb4880c779ae
SSDEEP 192:P4GwBx905zFzFzFoHgaBjQbE54bE5XfogaBRdfKDPV6FOJh:P4GwBx9+ppWHvQbE54bE5XAlJYOI
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent	Process not Found
/System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/activateSettings	Process not Found
/System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/usbmuxd -launchd	Process not Found
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/PC Computer - Roblox - Studio Grids.png\""
1⤵
PID:482

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/PC Computer - Roblox - Studio Grids.png\""
1⤵
PID:482

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/PC Computer - Roblox - Studio Grids.png"
1⤵
PID:482
- /bin/zsh
  /bin/zsh -c "/Users/run/PC Computer - Roblox - Studio Grids.png"
  2⤵
  PID:486
- /Users/run/PC
  /Users/run/PC Computer - Roblox - Studio Grids.png
  2⤵
  PID:486

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:527

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.warmd_agent
1⤵
PID:536

/usr/libexec/warmd_agent
/usr/libexec/warmd_agent
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:537

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 121
1⤵
PID:538

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.sessionlogoutd
1⤵
PID:539

/System/Library/CoreServices/sessionlogoutd
/System/Library/CoreServices/sessionlogoutd
1⤵
PID:539

/usr/bin/sudo
/usr/bin/sudo -k
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.76BB5383-6982-400C-A2B4-93E38F8BB1CA
1⤵
PID:542

/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow console
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.imklaunchagent
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.UserEventAgent-LoginWindow
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.universalaccessd
1⤵
PID:545

/System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent
/System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent
1⤵
PID:543

/usr/sbin/universalaccessd
/usr/sbin/universalaccessd launchd -s
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:546

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:546

/usr/libexec/UserEventAgent
/usr/libexec/UserEventAgent "(LoginWindow)"
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:547

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.security.agent.login.00000000-0000-0000-0000-0000000186BD
1⤵
PID:548

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 548
1⤵
PID:553

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.CryptoTokenKit.ahp.agent
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000001.activateSettings
1⤵
PID:555

/System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/activateSettings
/System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/activateSettings
1⤵
PID:555

/System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp
/System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.AmbientDisplayAgent
1⤵
PID:556

/System/Library/PrivateFrameworks/AmbientDisplay.framework/Versions/A/XPCServices/com.apple.AmbientDisplayAgent.xpc/Contents/MacOS/com.apple.AmbientDisplayAgent
/System/Library/PrivateFrameworks/AmbientDisplay.framework/Versions/A/XPCServices/com.apple.AmbientDisplayAgent.xpc/Contents/MacOS/com.apple.AmbientDisplayAgent
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.ctkd
1⤵
PID:557

/System/Library/Frameworks/CryptoTokenKit.framework/ctkd
/System/Library/Frameworks/CryptoTokenKit.framework/ctkd -tw
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.CryptoTokenKit.setoken 557
1⤵
PID:559

/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.usbmuxd
1⤵
PID:563

/System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/usbmuxd
/System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/usbmuxd -launchd
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:565

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.storagekitd
1⤵
PID:566

/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesagent
1⤵
PID:568

/System/Library/CoreServices/iconservicesagent
/System/Library/CoreServices/iconservicesagent runAsRoot
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:599

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:618

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:619

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:619

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mdsDirectory.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000bh00002w/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

NRM_Events_2024-05-03-17-22-41.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2024-05-03-17-22-41.event
Size 3KB
SHA256 72e72b616cbc42eba0b3515349bae78546d03b1d6757235bde101689d8c6046e
MD5 caec65a475ccc3694758070efc5d32fe
SHA1 4e9736604b55362a2daa6a7b4dbe2962ae14fa2a
SHA512 e2ce748b42412a3db3097ea1ad1fa6c60597b70d0469ac5f5eefbb5556b52debf6ac15c9d69ba23b41743f77dee38e2800f9afbbd5600d7e153f117264b6219b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads