Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    68s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    13/10/2024, 09:35

Errors

Reason
Machine shutdown

General

  • Target

    Multiple_ROBLOX (1).exe

  • Size

    764KB

  • MD5

    aed655395747a6602479f6032d3c099f

  • SHA1

    5fcbd5735ed0e4a013667652f4c1382abb45203a

  • SHA256

    3d6123dc6ffbd1a11d73229988203052809bd17617b24a034c1122c8f4983db4

  • SHA512

    1a3db9e195e9e504a0a6c24557f1e141f90a73a89a853b8ad3ab2248d8e3fd97ba1ae78b93ad33005590ef0a44c5237e608b66a9c9fffde39e4730c226d91637

  • SSDEEP

    6144:PIUUUFEiCVrw4RVJsp0oFP+dkM+i1g0UhCVrw4RuJsp0oFP+dkM+i1g0U:PB3gWCEBg5CE

Score
4/10

Malware Config

Signatures

  • Resource Forking 1 TTPs 5 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/Multiple_ROBLOX (1).exe\""
    1⤵
      PID:485
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/Multiple_ROBLOX (1).exe\""
      1⤵
        PID:485
      • /usr/bin/sudo
        sudo /bin/zsh -c "/Users/run/Multiple_ROBLOX (1).exe"
        1⤵
          PID:485
          • /bin/zsh
            /bin/zsh -c "/Users/run/Multiple_ROBLOX (1).exe"
            2⤵
              PID:489
          • /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
            "/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
            1⤵
              PID:471
            • /usr/libexec/pkreporter
              /usr/libexec/pkreporter
              1⤵
                PID:474
              • /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                1⤵
                  PID:473
                • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                  /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                  1⤵
                    PID:475
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.audio.AudioComponentRegistrar
                    1⤵
                      PID:513
                    • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                      /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                      1⤵
                        PID:513
                      • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                        "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                        1⤵
                          PID:476
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.systemprofiler
                          1⤵
                            PID:527
                          • /System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
                            "/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
                            1⤵
                              PID:527
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.replayd
                              1⤵
                                PID:530
                              • /usr/libexec/replayd
                                /usr/libexec/replayd
                                1⤵
                                  PID:530
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.ReportMemoryException
                                  1⤵
                                    PID:533
                                  • /usr/libexec/ReportMemoryException
                                    /usr/libexec/ReportMemoryException
                                    1⤵
                                      PID:533
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.storedownloadd
                                      1⤵
                                        PID:535
                                      • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                        /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                        1⤵
                                          PID:535
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.system_installd
                                          1⤵
                                            PID:536
                                          • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                            /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                            1⤵
                                              PID:536
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.installd
                                              1⤵
                                                PID:537
                                              • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                                /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                                1⤵
                                                  PID:537
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy com.apple.PerformanceAnalysis.animationperfd
                                                  1⤵
                                                    PID:538
                                                  • /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                    /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                    1⤵
                                                      PID:538
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.Safari.CacheDeleteExtension 528
                                                      1⤵
                                                        PID:539
                                                      • /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                        /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                        1⤵
                                                          PID:539
                                                        • /usr/libexec/xpcproxy
                                                          xpcproxy com.apple.spindump
                                                          1⤵
                                                            PID:542
                                                          • /usr/sbin/spindump
                                                            /usr/sbin/spindump
                                                            1⤵
                                                              PID:542
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.tailspind
                                                              1⤵
                                                                PID:543
                                                              • /usr/libexec/xpcproxy
                                                                xpcproxy com.apple.spindump_agent
                                                                1⤵
                                                                  PID:544
                                                                • /usr/libexec/tailspind
                                                                  /usr/libexec/tailspind
                                                                  1⤵
                                                                    PID:543
                                                                  • /usr/libexec/spindump_agent
                                                                    /usr/libexec/spindump_agent
                                                                    1⤵
                                                                      PID:544
                                                                    • /usr/libexec/xpcproxy
                                                                      xpcproxy com.apple.PackageKit.InstallStatus
                                                                      1⤵
                                                                        PID:546
                                                                      • /usr/libexec/xpcproxy
                                                                        xpcproxy com.apple.warmd_agent
                                                                        1⤵
                                                                          PID:547
                                                                        • /System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
                                                                          "/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
                                                                          1⤵
                                                                            PID:546
                                                                          • /usr/libexec/warmd_agent
                                                                            /usr/libexec/warmd_agent
                                                                            1⤵
                                                                              PID:547
                                                                            • /usr/libexec/xpcproxy
                                                                              xpcproxy com.apple.ViewBridgeAuxiliary
                                                                              1⤵
                                                                                PID:548
                                                                              • /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                                                                /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                                                                1⤵
                                                                                  PID:548
                                                                                • /usr/libexec/xpcproxy
                                                                                  xpcproxy com.apple.sessionlogoutd
                                                                                  1⤵
                                                                                    PID:549
                                                                                  • /System/Library/CoreServices/sessionlogoutd
                                                                                    /System/Library/CoreServices/sessionlogoutd
                                                                                    1⤵
                                                                                      PID:549
                                                                                    • /sbin/shutdown
                                                                                      /sbin/shutdown -h now
                                                                                      1⤵
                                                                                        PID:0
                                                                                        • /bin/sh
                                                                                          sh -c "/usr/bin/wall -n"
                                                                                          2⤵
                                                                                            PID:551
                                                                                          • /bin/bash
                                                                                            sh -c "/usr/bin/wall -n"
                                                                                            2⤵
                                                                                              PID:551
                                                                                            • /usr/bin/wall
                                                                                              /usr/bin/wall -n
                                                                                              2⤵
                                                                                                PID:551
                                                                                              • /System/Library/Extensions/IOGraphicsFamily.kext/iogdiagnose
                                                                                                iogdiagnose -b /var/log/displaypolicy/iogdiagnose-last.bin
                                                                                                2⤵
                                                                                                  PID:4.784951e+07
                                                                                                • /usr/sbin/spindump
                                                                                                  spindump -shutdownstall 2 -timelimit 5
                                                                                                  2⤵
                                                                                                    PID:553
                                                                                                  • /bin/sh
                                                                                                    sh -c /usr/sbin/kextstat
                                                                                                    2⤵
                                                                                                      PID:554
                                                                                                    • /bin/bash
                                                                                                      sh -c /usr/sbin/kextstat
                                                                                                      2⤵
                                                                                                        PID:554
                                                                                                      • /usr/sbin/kextstat
                                                                                                        /usr/sbin/kextstat
                                                                                                        2⤵
                                                                                                          PID:554
                                                                                                        • /bin/bash
                                                                                                          bash /private/var/install/shutdown_installer_tasks
                                                                                                          2⤵
                                                                                                            PID:555
                                                                                                          • /bin/bash
                                                                                                            bash /private/var/install/deferred_install
                                                                                                            2⤵
                                                                                                              PID:556

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

                                                                                                            Filesize

                                                                                                            148KB

                                                                                                            MD5

                                                                                                            75dcba95a6118aef0c03d008eb44ebd7

                                                                                                            SHA1

                                                                                                            cf42f12b3858bfa1f95e1b598c3927061d967c2b

                                                                                                            SHA256

                                                                                                            41328abf4637c500da0210839a3f4448e4821191f6617cbe756ad02b0c1ce224

                                                                                                            SHA512

                                                                                                            7a0f3c968b0cc1ce0e8430c22e7b6b0cd694841ac5fcb09b91b0d2ec7233659b7a96da05caeae86217e562aa7648ae7b4c60512407911ac26de2f2e263607124