diff --git a/anti-behavioral-analysis/detect-debugger.md b/anti-behavioral-analysis/detect-debugger.md index d5050b7..9af42ab 100644 --- a/anti-behavioral-analysis/detect-debugger.md +++ b/anti-behavioral-analysis/detect-debugger.md @@ -21,7 +21,7 @@ Methods * **Stack Canary**: Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack. * **TIB Aware**: Accessing thread information (e.g., fs:[20h]) for debug detection or process obfuscation. * **RtlAdjustPrivilege**: Calling RtlAdjustPrivilege to either prevent a debugger from attaching or to detect if a debugger is attached. -* **Interrupt 2D**: If int 0x2d is mishandled by the debugger, it can cause a single-byte instrustion to be inadvertently skipped, which can be detected by the malware. +* **Interrupt 2D**: If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by the malware. Malware Examples ---------------- diff --git a/anti-behavioral-analysis/evade-memory-dump.md b/anti-behavioral-analysis/evade-memory-dump.md index 4f49de1..61123bb 100644 --- a/anti-behavioral-analysis/evade-memory-dump.md +++ b/anti-behavioral-analysis/evade-memory-dump.md @@ -17,7 +17,7 @@ Methods * **Tampering**: Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.). * **Guard Pages**: Encrypt blocks of code individually and decrypt temporarily only upon execution. * **On-the-Fly APIs**: Resolve API addresses before each use to prevent complete dumping. -* **Feed Misinformation**: API behavior can be altered to prevent prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/hooking.md). +* **Feed Misinformation**: API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/hooking.md). * **Flow Opcode Obstruction**: flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4) Malware Examples diff --git a/anti-static-analysis/exe-code-compression.md b/anti-static-analysis/exe-code-compression.md index e795f34..e26a6c6 100644 --- a/anti-static-analysis/exe-code-compression.md +++ b/anti-static-analysis/exe-code-compression.md @@ -1,7 +1,7 @@ ||| |---------|------------------------| |**ID**|**M0036**| -|**Objective(s)**|[Anti-Behaviorial Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)| +|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)| |**Related ATT&CK Technique(s)**|[Software Packing](https://attack.mitre.org/techniques/T1045/)| Executable Code Compression diff --git a/anti-static-analysis/exe-code-optimize.md b/anti-static-analysis/exe-code-optimize.md index af46e07..ef4f0b3 100644 --- a/anti-static-analysis/exe-code-optimize.md +++ b/anti-static-analysis/exe-code-optimize.md @@ -12,7 +12,7 @@ Code is optimized, making it harder to statically analyze. Methods ------- * **Jump/Call Absolute Address**: Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms. -* **Minification**: Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted. +* **Minification**: Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted. Malware Examples ---------------- diff --git a/collection/man-in-browser.md b/collection/man-in-browser.md index 44b85e0..46b058e 100644 --- a/collection/man-in-browser.md +++ b/collection/man-in-browser.md @@ -6,6 +6,6 @@ Man in the Browser ================== -Malware leverages vulnerabilities and functionality in browser softwarwe to change content, modify behavior, and intercept information. +Malware leverages vulnerabilities and functionality in browser software to change content, modify behavior, and intercept information. **See ATT&CK:** [**Man in the Browser**](https://attack.mitre.org/techniques/T1185/). \ No newline at end of file diff --git a/defense-evasion/component-hijack.md b/defense-evasion/component-hijack.md index e439ebc..aa0e33c 100644 --- a/defense-evasion/component-hijack.md +++ b/defense-evasion/component-hijack.md @@ -2,11 +2,11 @@ |---------|------------------------| |**ID**|**T1122**| |**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)| -|**Related ATT&CK Technique(s)**|[Componpent Object Model Hijacking](https://attack.mitre.org/techniques/T1122)| +|**Related ATT&CK Technique(s)**|[Component Object Model Hijacking](https://attack.mitre.org/techniques/T1122)| -Componpent Object Model Hijacking +Component Object Model Hijacking ================================= Malware hijacks a component object model (COM) object to execute itself or other malicious code. -See ATT&CK: [**Componpent Object Model Hijacking**](https://attack.mitre.org/techniques/T1122). \ No newline at end of file +See ATT&CK: [**Component Object Model Hijacking**](https://attack.mitre.org/techniques/T1122). \ No newline at end of file diff --git a/persistence/system-firmware.md b/persistence/system-firmware.md index 9fbef1d..04d01d8 100644 --- a/persistence/system-firmware.md +++ b/persistence/system-firmware.md @@ -6,6 +6,6 @@ System Firmware =============== -Malware may overwrite the the system firmware with malicious firmware that is difficult to detect and/or enables persistence. +Malware may overwrite the system firmware with malicious firmware that is difficult to detect and/or enables persistence. see ATT&CK: [**System Firmware**](https://attack.mitre.org/techniques/T1019/). \ No newline at end of file diff --git a/xample-malware/kovter.md b/xample-malware/kovter.md index e7344cb..2b5950c 100644 --- a/xample-malware/kovter.md +++ b/xample-malware/kovter.md @@ -14,7 +14,7 @@ Behaviors --------- |Name|Use| |---------------------|-------------------------------------------------------| -|[Alternative Installation Location](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion/alter-install-location.md) | tores malware files in the Registry instead of the hard drive. [[1]](#1)| +|[Alternative Installation Location](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion/alter-install-location.md) | Stores malware files in the Registry instead of the hard drive. [[1]](#1)| |[Generate Fraudulent Advertising Revenue](https://github.com/MBCProject/mbc-markdown/tree/master/impact/generate-fraud-rev.md) | Performs click-fraud. [[1]](#1)| References