mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
minor fixes (#99)
This commit is contained in:
Ryan Xu
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>4 May 2023</b></td>
|
||||
<td><b>19 May 2023</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>4 May 2023</b></td>
|
||||
<td><b>19 May 2023</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -37,6 +37,7 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
|
||||
|**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; may be identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
|
||||
|**Desynchronizing Opaque Predicates**|B0012.006|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[6]](#6) This method is related to Unprotect technique U0201.|
|
||||
|**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[4]](#4) for an analysis of a VBA-Stomped malicious VBA Office document. See [[5]](#5) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>21 November 2022</b></td>
|
||||
<td><b>19 May 2022</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -30,23 +30,20 @@
|
||||
|
||||
Malware may execute code in the address space of a separate process.
|
||||
|
||||
See ATT&CK: **Process Injection ([T1055](https://attack.mitre.org/techniques/T1055/), [T1631](https://attack.mitre.org/techniques/T1631/))**. Notes on ATT&CK's sub-techniques in the context of [[1]](#1) are as follows:
|
||||
See ATT&CK: **Process Injection ([T1055](https://attack.mitre.org/techniques/T1055/), [T1631](https://attack.mitre.org/techniques/T1631/))**.
|
||||
|
||||
|ID|ATT&CK Sub-Technique|Notes|
|
||||
|---|---|---|
|
||||
|E1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods, called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1). This method is related to Unprotect technique U1226.|
|
||||
|E1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary), called *Portable Executable Injection* in [[1]](#1). This method is related to Unprotect technique U1216.|
|
||||
|E1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations, called *Thread Execution Hijacking* in [[1]](#1). This method is related to Unprotect technique U1223.|
|
||||
|E1055.004|Asynchronous Procedure Call|Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread). AtomBombing [[1]](#1)[[3]](#3), a variant of APC injection, occurs when the attacker stores malicious code in the global atom table. The APC gets the targeted process to retrieve the code that will be injected to the memory of the targeted process. This method is related to Unprotect technique U1221 and U1220.|
|
||||
|E1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory, called *Extra Window Memory Injection* in [[1]](#1). This method is related to Unprotect technique U1219.|
|
||||
|E1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable, called *Process Hollowing* in [[1]](#1). This method is related to Unprotect technique U1225.|
|
||||
|
||||
Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hijack Execution Flow](../defense-evasion/hijack-execution-flow.md) behavior.
|
||||
The methods table includes existing ATT&CK sub-techniques, which have been enhanced with malware-specific details, as well as new methods. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hijack Execution Flow](../defense-evasion/hijack-execution-flow.md) behavior.
|
||||
|
||||
## Methods
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Dynamic-link Library Injection**|E1055.001|(Enhanced ATT&CK sub-technique) Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods, called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1). This method is related to Unprotect technique U1226.|
|
||||
|**Portable Executable Injection**|E1055.002|(Enhanced ATT&CK sub-technique) Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary), called *Portable Executable Injection* in [[1]](#1). This method is related to Unprotect technique U1216.|
|
||||
|**Thread Execution Hijacking**|E1055.003|(Enhanced ATT&CK sub-technique) Malware targets an existing thread of a process, avoiding noisy process or thread creations operations, called *Thread Execution Hijacking* in [[1]](#1). This method is related to Unprotect technique U1223.|
|
||||
|**Asynchronous Procedure Call**|E1055.004|(Enhanced ATT&CK sub-technique) Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread). AtomBombing [[1]](#1)[[3]](#3), a variant of APC injection, occurs when the attacker stores malicious code in the global atom table. The APC gets the targeted process to retrieve the code that will be injected to the memory of the targeted process. This method is related to Unprotect technique U1221 and U1220.|
|
||||
|**Extra Window Memory Injection**|E1055.011|(Enhanced ATT&CK sub-technique) Malware may inject into Explorer tray window’s extra window memory, called *Extra Window Memory Injection* in [[1]](#1). This method is related to Unprotect technique U1219.|
|
||||
|**Process Hollowing**|E1055.012|(Enhanced ATT&CK sub-technique) Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable, called *Process Hollowing* in [[1]](#1). This method is related to Unprotect technique U1225.|
|
||||
|**Hook Injection via SetWindowsHooksEx**|E1055.m01|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1) This method is related to Unprotect technique 1227.|
|
||||
|**Injection and Persistence via Registry Modification**|E1055.m02|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)|
|
||||
|**Injection via Windows Fibers**|E1055.m05|Malware executes shellcode via Windows fibers by converting a thread to a fiber. [[5]](#5)|
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>31 October 2022</b></td>
|
||||
<td><b>19 May 2023</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,6 +34,7 @@ Malware may attempt to get a listing of open application windows.
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Window Text**|E1010.m01|After finding an open application window, malware gets graphical window text.|
|
||||
|
||||
## Use in Malware
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>31 October 2022</b></td>
|
||||
<td><b>19 May 2023</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -36,6 +36,7 @@ Malware may inspect code or enumerate aspects.
|
||||
|---|---|---|
|
||||
|**Enumerate PE Sections**|B0046.001|Malware enumerates virtual offsets of code sections.|
|
||||
|**Inspect Section Memory Permissions**|B0046.002|Malware identifies section memory permissions from image section header.|
|
||||
|**Parse PE Header**|B0046.003|Malware parses the PE header.|
|
||||
|
||||
## Use in Malware
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>21 November 2022</b></td>
|
||||
<td><b>19 May 2023</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -39,7 +39,7 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware has an auto-start service that allows it to run whenever the machine boots. [[16]](#16)|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|To start itself at system boot, Poison Ivy adds registry entries. [[2]](#2)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[3]](#3)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1547.001|Hupigon persists via Run registry key. [[3]](#3)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon persists via Run registry key. [[3]](#3)|
|
||||
|[**Terminator**](../xample-malware/terminator.md)|2013|--|The Terminator RAT sets "2019" as Windows' startup folder by modifying a registry value. [[4]](#4)|
|
||||
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware creates an "autorun" registry key. [[5]](#5)|
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR installs itself under registry run keys to establish persistence. [[6]](#6)|
|
||||
@@ -52,7 +52,7 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol
|
||||
|[**Emotet**](../xample-malware/emotet.md)|2018|--|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [[13]](#13)|
|
||||
|[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle adds registry keys to enable its automatic execution at every system startup. [[14]](#14)|
|
||||
|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Malware adds registry keys to enable startup after reboot. [[15]](#15)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|E1547.001|Redhip persists via a Run registry key. [[17]](#17)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip persists via a Run registry key. [[17]](#17)|
|
||||
|
||||
|
||||
## References
|
||||
|
||||
@@ -39,7 +39,7 @@ See ATT&CK: [BlackEnergy - Techniques Used](https://attack.mitre.org/software/S0
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Process Injection::Injection using Shims (E1055.m05)](../defense-evasion/process-injection.md)|Malware bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution. [[1]](#1)|
|
||||
|[Defense Evasion::Install Insecure or Malicious Configuration (E1479)](../defense-evasion/install-insecure-or-malicious-configuration.md)|Malware configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component. [[1]](#1)|
|
||||
|[Defense Evasion::Install Insecure or Malicious Configuration (B0047)](../defense-evasion/install-insecure-or-malicious-configuration.md)|Malware configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component. [[1]](#1)|
|
||||
|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|Malware clears windows event logs and removes the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevent strings in the user32.dll.mui of the system. [[1]](#1)|
|
||||
|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Malware locates an inactive driver service to Hijack and set it to start automatically. [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Malware injects its dll component into svchost.exe. [[1]](#1)|
|
||||
|
||||
@@ -35,7 +35,7 @@ See ATT&CK: [EvilBunny - Techniques Used](https://attack.mitre.org/software/S039
|
||||
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Command and Scripting Interpreter (E1049)](../execution/command-and-scripting-interpreter.md)|EvilBunny executes Lua scripts. [[1]](#1)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|EvilBunny executes Lua scripts. [[1]](#1)|
|
||||
|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|EvilBunny communicates C2 via HTTP. [[1]](#1)|
|
||||
|
||||
## MBC Behaviors
|
||||
|
||||
@@ -64,8 +64,4 @@ SHA256 Hashes
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/
|
||||
|
||||
<a name="2">[2]</a> https://macpaw.com/how-to/remove-genieo-malware-mac
|
||||
|
||||
<a name="3">[3]</a> https://www.symantec.com/security_response/writeup.jsp?docid=2014-071013-3137-99
|
||||
<a name="1">[1]</a> https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/
|
||||
@@ -66,7 +66,7 @@ A family of backdoors.
|
||||
|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Hupigon replaces clipboard data. [[3]](#3)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Hupigon queries environment variables. [[3]](#3)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Hupigon accepts command line arguments. [[3]](#3)|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (E1547.001)](../persistence/registry-run-keys-startup-folder.md)|Hupigon persists via Run registry key. [[3]](#3)|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Hupigon persists via Run registry key. [[3]](#3)|
|
||||
|[Defense Evasion::Process Injection::Process Hollowing (E1055.012)](../defense-evasion/process-injection.md)|Hupigon uses process replacement. [[3]](#3)|
|
||||
|
||||
## MBC Behaviors
|
||||
|
||||
@@ -36,7 +36,7 @@ See ATT&CK: [Netwalker - Techniques Used](https://attack.mitre.org/software/S045
|
||||
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Command and Scripting Interpreter (E1049)](../execution/command-and-scripting-interpreter.md)|Netwalker is written and executed in Powershell. [[1]](#1)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Netwalker is written and executed in Powershell. [[1]](#1)|
|
||||
|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as Base64, hexademcimal, and XOR. [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001)](../defense-evasion/process-injection.md)|Netwalker uses reflective DLL loading to inject from memory. [[1]](#1)|
|
||||
|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|Netwalker encrypts files for ransom. [[1]](#1)|
|
||||
|
||||
@@ -47,7 +47,7 @@ Redhip is an information stealer.
|
||||
|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Redhip logs keystrokes via polling. [[2]](#2)|
|
||||
|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Redhip encodes data using XOR. [[2]](#2)|
|
||||
|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Redhip gets a file size. [[2]](#2)|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (E1547.001)](../persistence/registry-run-keys-startup-folder.md)|Redhip persists via a Run registry key. [[2]](#2)|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Redhip persists via a Run registry key. [[2]](#2)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Redhip checks the OS version. [[2]](#2)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Redhip accepts command line arguments. [[2]](#2)|
|
||||
|[Defense Evasion::Process Injection::Thread Execution Hijacking (E1055.003)](../defense-evasion/process-injection.md)|Redhip injects threads. [[2]](#2)|
|
||||
|
||||
@@ -48,7 +48,7 @@ WebCobra is cryptojacking malware. [[1]](#1)
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|From the command line, the malware drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
|
||||
|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|The dropped file is password-protected. Once unzipped, the file contains a DLL file to decrypt the second file (a bin file with an encrypted malicious payload). [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects miner code into a running process. [[1]](#1)|
|
||||
|[Defense Evasion::Disable or Evade Security Tools (E1089)](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being identified by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
|
||||
|[Defense Evasion::Disable or Evade Security Tools (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being identified by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
|
||||
|
||||
|
||||
## MBC Behaviors
|
||||
|
||||
Reference in New Issue
Block a user