b4386e9cb13bba8fddbf2913fae7cd0ef99ab340d4492489b2cd578ffc106b01

Resubmissions

21/09/2024, 15:00

240921-sdbxdsyaka

21/09/2024, 14:59

21/09/2024, 14:57

21/09/2024, 14:55

21/09/2024, 14:53

Analysis

max time kernel
96s
max time network
94s
platform
macos-10.15_amd64
resource
macos-20240711.1-en
resource tags

arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
21/09/2024, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
iio.bat
Size 529B
Sample240921-sbm7msxhmf
SHA256 b4386e9cb13bba8fddbf2913fae7cd0ef99ab340d4492489b2cd578ffc106b01
MD5 4408c717590290587839b37ad06e2843
SHA1 5071a515dc397e55fe907452d6218ca48c5bde4c
SHA512 e64cf2a9ffc376b8ab8d97466ca4a7e61180fea5187065371aab26c712d94d549a601aa543a731b9c42cbe88f1a8ab1799cf07e814222693cf0f40b10e21d1b3
MD5 SHA1 SHA512

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/iio.bat\""
1⤵
PID:484

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/iio.bat\""
1⤵
PID:484

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/iio.bat
1⤵
PID:484
- /bin/zsh
  /bin/zsh -c /Users/run/iio.bat
  2⤵
  PID:485
- /Users/run/iio.bat
  /Users/run/iio.bat
  2⤵
  PID:485
- /bin/sh
  sh /Users/run/iio.bat
  2⤵
  PID:485
- /bin/bash
  sh /Users/run/iio.bat
  2⤵
  PID:485
- - /sbin/shutdown
    shutdown -r -t 10 -c "VIRUS DETECTED "
    3⤵
    PID:494

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:468

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:481

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:472

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:475

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:478

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:535

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:541

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.iCal.CalendarNC 318
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.ncplugin.stocks 318
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.ncplugin.weather 318
1⤵
PID:545

/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
1⤵
PID:543

/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
1⤵
PID:544

/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.PackageKit.InstallStatus
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.warmd_agent
1⤵
PID:551

/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
"/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
1⤵
PID:550

/usr/libexec/warmd_agent
/usr/libexec/warmd_agent
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.sessionlogoutd
1⤵
PID:552

/System/Library/CoreServices/sessionlogoutd
/System/Library/CoreServices/sessionlogoutd
1⤵
PID:552

/sbin/shutdown
/sbin/shutdown -h now
1⤵
PID:1.8446744073709552e+19

/bin/sh
sh -c "/usr/bin/wall -n"
1⤵
PID:554

/bin/bash
sh -c "/usr/bin/wall -n"
1⤵
PID:554

/usr/bin/wall
/usr/bin/wall -n
1⤵
PID:554

/System/Library/Extensions/IOGraphicsFamily.kext/iogdiagnose
iogdiagnose -b /var/log/displaypolicy/iogdiagnose-last.bin
1⤵
PID:0
- /usr/sbin/spindump
  spindump -shutdownstall 2 -timelimit 5
  2⤵
  PID:556
- /bin/sh
  sh -c /usr/sbin/kextstat
  2⤵
  PID:557
- /bin/bash
  sh -c /usr/sbin/kextstat
  2⤵
  PID:557
- /usr/sbin/kextstat
  /usr/sbin/kextstat
  2⤵
  PID:557
- /bin/bash
  bash /private/var/install/shutdown_installer_tasks
  2⤵
  PID:558
- /bin/bash
  bash /private/var/install/deferred_install
  2⤵
  PID:559

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 148KB
SHA256 0ab90962e31988b3a688e6200e35206b16154e66d7079159b5f8e5c9bd5f5dce
MD5 050d097e51a7f4ccbbfbd00b087e5a03
SHA1 cce440fea1063db26378a967e05dea66425ab401
SHA512 5e6d9ae4e527001f0d409acbf23cecea2e9b0249b3a60a81d9be952aece017f23d6c5c7829c2dd871dab55dd113f203d5bd152219c8ff56f4077c89deff3470e
SSDEEP 3072:yFtFKrHfZUArfSJE+Hx/VMwR5r15kA/n5G0FJsHjr+dO:atFWiAeJE+FVM+rzkAf5pJ2jr+dO
MD5 SHA1 SHA512 SSDEEP

Submit Download