2efee4c64b52c325b7975c817b7844b2c13ed3fe771fb376623f54f3a85841d6

Reason

Machine shutdown

General

Target
Flappy Bird v1.3.html
Size 1KB
Sample261011-tp3pxsda62
SHA256 2efee4c64b52c325b7975c817b7844b2c13ed3fe771fb376623f54f3a85841d6
MD5 d63a91914730f771a6812f3960c2518e
SHA1 971c01a89ec4bc6ed2e16e55d6c9d329f5cb161c
SHA512 c0d8921eebb5db4a8e90cce7b3fab6f9138ce6eb7872d69b1de585ed1f5666c313943231616a925b8c9a04237f0b8459322d2d6cb1a3f27ffbf2decde6440c39
TLSH
T175218412A2C5001FD441A500B2D2F5843E50C6C34BCF46D8B6A59A33BADF5AC92332C8
MD5 SHA1 SHA512 TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Flappy Bird v1.3.html\""
1⤵
PID:462

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Flappy Bird v1.3.html\""
1⤵
PID:462

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Flappy Bird v1.3.html"
1⤵
PID:462
- /bin/zsh
  /bin/zsh -c "/Users/run/Flappy Bird v1.3.html"
  2⤵
  PID:463
- /Users/run/Flappy
  /Users/run/Flappy Bird v1.3.html
  2⤵
  PID:463

/usr/libexec/xpcproxy
xpcproxy com.apple.AppStore.1900
1⤵
PID:497

/System/Applications/App Store.app/Contents/MacOS/App Store
"/System/Applications/App Store.app/Contents/MacOS/App Store"
1⤵
PID:497

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:499

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:501

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:501

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 497
1⤵
PID:504

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:504

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:506

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:513

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.contacts.donation-agent
1⤵
PID:517

/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.PackageKit.InstallStatus
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.warmd_agent
1⤵
PID:521

/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
"/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
1⤵
PID:520

/usr/libexec/warmd_agent
/usr/libexec/warmd_agent
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 125
1⤵
PID:522

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.sessionlogoutd
1⤵
PID:523

/System/Library/CoreServices/sessionlogoutd
/System/Library/CoreServices/sessionlogoutd
1⤵
PID:523

/sbin/shutdown
/sbin/shutdown -h now
1⤵
PID:131

/bin/sh
sh -c "/usr/bin/wall -n"
1⤵
PID:525

/bin/bash
sh -c "/usr/bin/wall -n"
1⤵
PID:525

/usr/bin/wall
/usr/bin/wall -n
1⤵
PID:525

/System/Library/Extensions/IOGraphicsFamily.kext/iogdiagnose
iogdiagnose -b /var/log/displaypolicy/iogdiagnose-last.bin
1⤵
PID:0
- /usr/sbin/spindump
  spindump -shutdownstall 2 -timelimit 5
  2⤵
  PID:527
- /bin/sh
  sh -c /usr/sbin/kextstat
  2⤵
  PID:528
- /bin/bash
  sh -c /usr/sbin/kextstat
  2⤵
  PID:528
- /usr/sbin/kextstat
  /usr/sbin/kextstat
  2⤵
  PID:528
- /bin/bash
  bash /private/var/install/shutdown_installer_tasks
  2⤵
  PID:529
- /bin/bash
  bash /private/var/install/deferred_install
  2⤵
  PID:530

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.AppStore//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.AppStore//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 136KB
SHA256 8fa62a7e54b62149ce742634df69cf92ec0cac6a05549d813f1b1e71574ea71f
MD5 a40bcf61d400a3b01c956532d92906a9
SHA1 76be92224b53ffa2ee0a16ecaf11ca8be7ed5677
SHA512 bd3da61159f53d2f306e2725efe721a1bdb577bd263210fe9900ca9dc46801813b78a6383d69fa9788811ed023d9bd5132d6be3c52f6b758b631a6b714c2ac7f
SSDEEP 3072:RzTVwAidrtRAtvJ/j7p9b/pQ0s2j98p8gU9IrOwGqO5NB6y44:/wNAth59yawUW6w5OE4
TLSH
T13ED312E02BB9953A80946F0FBD3F75A080E1429CFD159265877095BB80E5B33FB528DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads