3d6123dc6ffbd1a11d73229988203052809bd17617b24a034c1122c8f4983db4

Reason

Machine shutdown

General

Target

Multiple_ROBLOX (1).exe
Size

764KB
MD5

aed655395747a6602479f6032d3c099f
SHA1

5fcbd5735ed0e4a013667652f4c1382abb45203a
SHA256

3d6123dc6ffbd1a11d73229988203052809bd17617b24a034c1122c8f4983db4
SHA512

1a3db9e195e9e504a0a6c24557f1e141f90a73a89a853b8ad3ab2248d8e3fd97ba1ae78b93ad33005590ef0a44c5237e608b66a9c9fffde39e4730c226d91637
SSDEEP

6144:PIUUUFEiCVrw4RVJsp0oFP+dkM+i1g0UhCVrw4RuJsp0oFP+dkM+i1g0U:PB3gWCEBg5CE

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Multiple_ROBLOX (1).exe\""
1⤵
PID:485

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Multiple_ROBLOX (1).exe\""
1⤵
PID:485

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Multiple_ROBLOX (1).exe"
1⤵
PID:485
- /bin/zsh
  /bin/zsh -c "/Users/run/Multiple_ROBLOX (1).exe"
  2⤵
  PID:489

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:471

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:474

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:473

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:475

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:513

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:513

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:476

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:527

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:530

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:533

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:535

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:536

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:537

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:538

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 528
1⤵
PID:539

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:542

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:544

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:543

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.PackageKit.InstallStatus
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.warmd_agent
1⤵
PID:547

/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
"/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
1⤵
PID:546

/usr/libexec/warmd_agent
/usr/libexec/warmd_agent
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:548

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.sessionlogoutd
1⤵
PID:549

/System/Library/CoreServices/sessionlogoutd
/System/Library/CoreServices/sessionlogoutd
1⤵
PID:549

/sbin/shutdown
/sbin/shutdown -h now
1⤵
PID:0
- /bin/sh
  sh -c "/usr/bin/wall -n"
  2⤵
  PID:551
- /bin/bash
  sh -c "/usr/bin/wall -n"
  2⤵
  PID:551
- /usr/bin/wall
  /usr/bin/wall -n
  2⤵
  PID:551
- /System/Library/Extensions/IOGraphicsFamily.kext/iogdiagnose
  iogdiagnose -b /var/log/displaypolicy/iogdiagnose-last.bin
  2⤵
  PID:4.784951e+07
- /usr/sbin/spindump
  spindump -shutdownstall 2 -timelimit 5
  2⤵
  PID:553
- /bin/sh
  sh -c /usr/sbin/kextstat
  2⤵
  PID:554
- /bin/bash
  sh -c /usr/sbin/kextstat
  2⤵
  PID:554
- /usr/sbin/kextstat
  /usr/sbin/kextstat
  2⤵
  PID:554
- /bin/bash
  bash /private/var/install/shutdown_installer_tasks
  2⤵
  PID:555
- /bin/bash
  bash /private/var/install/deferred_install
  2⤵
  PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

Filesize
148KB

MD5
75dcba95a6118aef0c03d008eb44ebd7

SHA1
cf42f12b3858bfa1f95e1b598c3927061d967c2b

SHA256
41328abf4637c500da0210839a3f4448e4821191f6617cbe756ad02b0c1ce224

SHA512
7a0f3c968b0cc1ce0e8430c22e7b6b0cd694841ac5fcb09b91b0d2ec7233659b7a96da05caeae86217e562aa7648ae7b4c60512407911ac26de2f2e263607124

Download Submit

Analysis

Sharing

Errors