admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding capa analysis to corpus and improved backtrace to behavior pages (#80)

Browse Source 
* Adding script files

* Scripting overhaul

* Adding capa analysis from MITRE into corpus

* Adding capa analysis from MITRE into corpus

* Backtracing capa mappings to behavior pages

* Other fixes

* merge dev into staging

* Fixing capa mappings

* merge dev into staging

* fix writes file typo

* merge dev into staging

* Fix method column + cape analysis
This commit is contained in:
Ryan Xu
2023-02-01 10:28:30 -05:00
committed by GitHub
parent da00a07f6b
commit 1917b816ca
145 changed files with 2443 additions and 684 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-behavioral-analysis/debugger-detection.md
+13 -5
View File
@@ -82,11 +82,14 @@ Details on methods of detecting debuggers are given in the references; many are
|Name|Date|Method|Description|
|---|---|---|---|
|[**Redhip**](../xample-malware/rebhip.md)|January 2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware detects debuggers using an INT 03h trap and IsDebuggerPresent[[8]](#8)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|an anti-analysis function within the packer is called to check the username and filename of the executing process for strings like “malwar”, “sampl”, “viru”, and “sandb”. [[9]](#9)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy Variant checks for breakpoints and exits immediately if found [[10]](#10)|
|[**Redhip**](../xample-malware/rebhip.md)|January 2011|B0001, B0001.035, B0001.032|Please see the Redhip malware page for details. [[4]](#4)|
|[**Gamut**](../xample-malware/gamut.md)|2014|B0001.006, B0001.008|Please see the Gamut malware page for details. [[8]](#8)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0001.016, B0001.038, B0001.032|Please see the Rombertik malware page for details. [[9]](#9)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|B0001.005, B0001.008|Please see the Poison-Ivy malware page for details. [[10]](#10)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0001.032|Check for time delay via GetTickCount (This capa rule had 4 matches) [[11]](#11)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.034, B0001.025, B0001.032|Please see the Hupigon malware page for details. [[11]](#11)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|B0001.032|Check for time delay via GetTickCount (This capa rule had 1 match) [[11]](#11)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0001.028|Manipulates TLS Callbacks while injecting to child process [[12]](#12)|
## References
@@ -109,3 +112,8 @@ Details on methods of detecting debuggers are given in the references; many are
<a name="9">[9]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="10">[10]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
<a name="11">[11]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="12">[12]</a> https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
anti-behavioral-analysis/debugger-evasion.md
+5 -5
View File
@@ -77,9 +77,8 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
|Name|Date|Method|Description|
|---|---|---|---|
|**Fake Adobe Flash Update OS X**|February 2016|--|[[2]](#2)|
|**Dridex**|March 2015|--|[[3]](#3)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|
|**Fake Adobe Flash Update OS X**|February 2016|--|Malware contains code that manually detects a debugger [[2]](#2)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[3]](#3)|
## References
@@ -87,10 +86,11 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
<a name="2">[2]</a> https://www.synack.com/2016/02/17/analyzing-the-anti-analysis-logic-of-an-adware-installer/
<a name="3">[3]</a> http://phishme.com/dridex-code-breaking-modify-the-malware-to-bypass-the-vm-bypass/
<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="4">[4]</a> http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/
<a name="5">[5]</a> https://search.unprotect.it/map/
<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="6">[6]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
anti-behavioral-analysis/dynamic-analysis-evasion.md
+6 -7
View File
@@ -60,20 +60,18 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|Name|Date|Method|Description|
|---|---|---|---|
|[**Ursnif**](../xample-malware/ursnif.md)|May 2016|--|Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
|[**Terminator**](../xample-malware/terminator.md)|October 2013|--|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
|[**Terminator**](../xample-malware/terminator.md)|October 2013|B0003.003|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
|**Nap**|2013|--|Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [[3]](#3)|
|**Smokeloader**|2019|--|Smokeloader drops a copy of ntdll.dll to %APPDATA%\Local\Temp\ [[4]](#4)|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Evades dynamic analysis.)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware stalls by writing a byte of random data to memory 960 million times which complicates analysis. It also calls specific Windows API functions [[5]](#5)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering) [[6]](#6)|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Evades dynamic analysis. [[2]](#2)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0003.002, B0003.011|Please see the Rombertik malware page for details. [[5]](#5)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0003.012|Uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering) [[6]](#6)|
## References
<a name="1">[1]</a> http://joe4security.blogspot.com/2013/06/overloading-sandboxes-new-generic.html
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
<a name="2">[2]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
<a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
@@ -82,3 +80,4 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
<a name="5">[5]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="6">[6]</a> https://www.joesecurity.org/blog/498839998833561473
anti-behavioral-analysis/emulator-detection.md
+1 -6
View File
@@ -44,16 +44,11 @@ Detects whether the malware instance is being executed inside an emulator. If so
|**Failed Network Connections**|B0004.004|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.|
## Detection
|Tool: capa|Mapping|APIs|
|---|---|---|
|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution [[2]](#2)|
## References
<a name="1">[1]</a> https://search.unprotect.it/map/sandbox-evasion/
anti-behavioral-analysis/emulator-evasion.md
+2 -1
View File
@@ -47,4 +47,5 @@ Behaviors that obstruct analysis in an emulator.
## References
<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
anti-behavioral-analysis/memory-dump-evasion.md
+2 -1
View File
@@ -53,7 +53,7 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor
|Name|Date|Method|Description|
|---|---|---|---|
|[Kraken](../xample-malware/kraken.md)|April 2008|--|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
|[**Kraken**](../xample-malware/kraken.md)|2008|--|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
## Code Snippets
@@ -110,3 +110,4 @@ jmp short loc_401326
<a name="3">[3]</a> http://waleedassar.blogspot.com/search/label/anti-dump
<a name="4">[4]</a> https://www.gironsec.com/code/packers.pdf
anti-behavioral-analysis/sandbox-detection.md
+7 -23
View File
@@ -56,25 +56,10 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|Name|Date|Method|Description|
|---|---|---|---|
|[**Redhip**](../xample-malware/rebhip.md)|2011|B0007.005|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware check for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[2]](#2)|
|[**Terminator**](../xample-malware/terminator.md)|2013|--|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Ursnif uses malware macros to evade sandbox detection.|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[5]](#5)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware check for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[6]](#6)|
|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny hooks time retrieval APIs and calls each API twice to calculate a delta. Execution aborts depending on the delta value [[7]](#7)|
## Detection
|Tool: capa|Mapping|APIs|
|---|---|---|
|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)|CreateFile|
|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)|GetModuleHandle|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0007.010|The malware check for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[2]](#2)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0007.007|Ursnif uses malware macros to evade sandbox detection. [[6]](#6)|
|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny hooks time retrieval APIs and calls each API twice to calculate a delta. Execution aborts depending on the delta value [[4]](#4)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[5]](#5)|
## Code Snippets
@@ -115,15 +100,14 @@ mov bl, 1
## References
<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="2">[2]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
<a name="4">[4]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
<a name="5">[5]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
<a name="6">[6]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="6">[6]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques
<a name="7">[7]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
anti-behavioral-analysis/virtual-machine-detection.md
+16 -12
View File
@@ -84,18 +84,13 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|Name|Date|Method|Description|
|---|---|---|---|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|May 2018|--|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|May 2018|B0009, B0009.024, B0009.023, B0009.018, B0009.028|Please see the GravityRAT malware page for details. [[3]](#3)|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names [[7]](#7)|
## Detection
|Tool: capa|Mapping|APIs|
|---|---|---|
|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[1]](#1)|
|[**Emotet**](../xample-malware/emotet.md)|2018|B0009.010|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names [[7]](#7)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0009.012|Check for unmoving mouse cursor (This capa rule had 1 match) [[8]](#8)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0009.004|Checks if there are virtual machine processes running (Vbox, vmware, etc) [[9]](#9)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0007.010, B0001.016, B0001.038|Please see the Rombertik malware page for details. [[10]](#10)|
## Code Snippets
@@ -152,4 +147,13 @@ jmp short loc_401CBB
<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="7">[7]</a> https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/
<a name="7">[7]</a> https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/
<a name="8">[8]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="9">[9]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques
<a name="10">[10]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="11">[11]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
anti-static-analysis/disassembler-evasion.md
+12 -1
View File
@@ -44,6 +44,14 @@ Some methods apply to both types of disassemblers; others apply to one type and
|**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
|**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often in the same basic block or function.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|B0012.001|Contain obfuscated stackstrings (This capa rule had 3 matches) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0012.001|Contain obfuscated stackstrings (This capa rule had 1 match) [[6]](#6)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0012.001|Contain obfuscated stackstrings (This capa rule had 1 match) [[6]](#6)|
## References
<a name="1">[1]</a> http://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf
@@ -54,4 +62,7 @@ Some methods apply to both types of disassemblers; others apply to one type and
<a name="4">[4]</a> https://boingboing.net/2019/05/05/p-code-r-us.html
<a name="5">[5]</a> https://www.ndss-symposium.org/wp-content/uploads/2020/04/bar2020-23004-paper.pdf
<a name="5">[5]</a> https://www.ndss-symposium.org/wp-content/uploads/2020/04/bar2020-23004-paper.pd
<a name="6">[6]</a> capa v4.0, analyzed at MITRE on 10/12/2022
anti-static-analysis/executable-code-obfuscation.md
+3 -19
View File
@@ -65,15 +65,8 @@ For encryption and encoding characteristics of malware samples, as well as malwa
|Name|Date|Method|Description|
|---|---|---|---|
|[**Heriplor**](../xample-malware/heriplor.md)|March 2019|--|The Heriplor Trojan uses API Hashing. [[1]](#1)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**Rombertik**](../anti-static-analysis/executable-code-obfuscation.md)|2015|--|Most of the malware file consists of unnecessary code or unnecessary data [[4]](#4)|
|[**Ursnif**](../anti-static-analysis/executable-code-obfuscation.md)|2016|--|Creates an encrypted Registry key called TorClient to store its data [[5]](#5)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy variant encrypts all its strings [[6]](#6)|
|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV [[7]](#7)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|The configuration data block is encoded with a NOT XOR 0xFF operation [[8]](#8)|
|[**Emotet**](../xample-malware/emotet.md)|2018|B0032.007|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0032.002|Most of the malware file consists of unnecessary code or unnecessary data [[1]](#1)|
## Code Snippets
@@ -140,18 +133,9 @@ jmp short loc_401326
## References
<a name="1">[1]</a> https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html
<a name="1">[1]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="2">[2]</a> https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/
<a name="3">[3]</a> Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons
<a name="4">[4]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="5">[5]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
<a name="6">[6]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
<a name="7">[7]</a> https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html
<a name="8">[8]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
anti-static-analysis/executable-code-virtualization.md
+1
View File
@@ -53,3 +53,4 @@ Virtualized code is a software protection technique. Themida is a commercial too
<a name="1">[1]</a> https://github.com/xiaoweime/WProtect
<a name="2">[2]</a> https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/
anti-static-analysis/software-packing.md
+8 -3
View File
@@ -59,10 +59,10 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
|---|---|---|---|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip samples are packed with different custom packers. [[3]](#3)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware comes packed by a crypter/FUD [[4]](#4)|
|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker is propagated as a DLL which has been backed using the UPX packer [[5]](#5)|
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|Has the option to compress its payload using UPX or MPRESS [[6]](#6)|
|[**Conficker**](../xample-malware/conficker.md)|2008|F0001.008|Conficker is propagated as a DLL which has been backed using the UPX packer [[5]](#5)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Has a custom packer to obfuscate itself [[7]](#7)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads [[8]](#8)|
|[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads [[8]](#8)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Has the option to compress its payload using UPX or MPRESS [[6]](#6)|
## References
@@ -81,3 +81,8 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
<a name="7">[7]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf
<a name="8">[8]</a> https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf
<a name="9">[9]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
<a name="10">[10]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
cape.md
+566 -71
View File
@@ -1,5 +1,5 @@
# CAPE Signature Distribution #
XX December 2022
# CAPE Rule Distribution #
February 2023
## Histograms ##
The histograms below show the number of CAPE signatures mapped into each ATT&CK tactic, MBC objective, and MBC micro-objective. Details of the tactics and objectives follow.
@@ -10,98 +10,593 @@ Information on CAPE signatures can be found [here](https://github.com/kevoreilly
### ATT&CK Mapping Histogram ###
| **TACTIC** | **Number** | |
| **TACTIC** | **Number of Techniques** | |
|-----|-----|-----|
|**Reconnaissance**|5| **XXXXX** |
|**Resource Development**|2| **XX** |
|**Initial Access**|4| **XXXX** |
|**Execution**|18| **XXXXXXXXXXXXXXXXXX** |
|**Persistence**|34| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Privilege Escalation**|27| **XXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Defense Evasion**|70| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Credential Access**|15| **XXXXXXXXXXXXXXX** |
|**Discovery**|19| **XXXXXXXXXXXXXXXXXXX** |
|**Lateral Movement**|3| **XXX** |
|**Collection**|10| **XXXXXXXXXX** |
|**Command And Control**|18| **XXXXXXXXXXXXXXXXXX** |
|**Exfiltration**|4| **XXXX** |
|**Impact**|11| **XXXXXXXXXXX** |
### MBC Mapping Histogram (Objectives) ###
| **OBJECTIVE** | **Number** | |
| **OBJECTIVE** | **Number of Behaviors** | |
|-----|-----|-----|
|**Anti-behavioral Analysis**|36| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Anti-static Analysis**|7| **XXXXXXX** |
|**Collection**|6| **XXXXXX** |
|**Command And Control**|4| **XXXX** |
|**Credential Access**|6| **XXXXXX** |
|**Defense Evasion**|22| **XXXXXXXXXXXXXXXXXXXXXX** |
|**Discovery**|7| **XXXXXXX** |
|**Execution**|3| **XXX** |
|**Exfiltration**|1| **X** |
|**Impact**|9| **XXXXXXXXX** |
|**Lateral Movement**|1| **X** |
|**Persistence**|11| **XXXXXXXXXXX** |
|**Privilege Escalation**|4| **XXXX** |
### MBC Mapping Histogram (Micro-Objectives) ###
| **MICRO-OBJECTIVE** | **Number** | |
| **MICRO-OBJECTIVE** | **Number of Micro-Behaviors** | |
|-----|-----|-----|
|**Communication**|13| **XXXXXXXXXXXXX** |
|**Cryptography**|3| **XXX** |
|**Data**|1| **X** |
|**File System**|9| **XXXXXXXXX** |
|**Hardware**|1| **X** |
|**Memory**|3| **XXX** |
|**Process**|5| **XXXXX** |
|**Operating System**|7| **XXXXXXX** |
### Objective-only Mapping Counts ###
This histogram indicates the number of CAPE signatures that map to an MBC objective.
| **OBJECTIVE** | **Number of CAPE signatures** | |
|-----|-----|-----|
|**Anti-behavioral Analysis**|84| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Anti-static Analysis**|23| **XXXXXXXXXXXXXXXXXXXXXXX** |
|**Collection**|10| **XXXXXXXXXX** |
|**Command And Control**|15| **XXXXXXXXXXXXXXX** |
|**Credential Access**|16| **XXXXXXXXXXXXXXXX** |
|**Defense Evasion**|98| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Discovery**|68| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Execution**|72| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Exfiltration**|3| **XXX** |
|**Impact**|22| **XXXXXXXXXXXXXXXXXXXXXX** |
|Lateral Movement|0| |
|**Persistence**|22| **XXXXXXXXXXXXXXXXXXXXXX** |
|**Privilege Escalation**|4| **XXXX** |
This histogram indicates the number of CAPE signatures that map to an MBC micro-objective.
| **MICRO-OBJECTIVE** | **Number of CAPE signatures** | |
|-----|-----|-----|
|**Communication**|45| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Cryptography**|12| **XXXXXXXXXXXX** |
|**Data**|1| **X** |
|**File System**|51| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Hardware**|1| **X** |
|**Memory**|3| **XXX** |
|**Process**|72| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Operating System**|94| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
## ATT&CK MAPPINGS ##
### Collection: ###
num:
### Reconnaissance ###
num: 5
- Gather Victim Host Information [T1592] Count-2
- Client Configurations [T1592.004] Count-2
- Gather Victim Identity Information [T1589] Count-1
- Credentials [T1589.001] Count-1
- Software [T1592.002] Count-1
### Command and Control: ###
num:
### Credential Access: ###
num:
### Resource Development ###
num: 2
- Develop Capabilities [T1587] Count-1
- Digital Certificates [T1587.003] Count-1
### Defense Evasion: ###
num:
### Initial Access ###
num: 4
- Replication Through Removable Media [T1091] Count-1
- Spearphishing Link [T1192] Count-1
- Phishing [T1566] Count-1
- Spearphishing Link [T1566.002] Count-1
### Discovery: ###
num:
### Execution: ###
num:
### Exfiltration: ###
num:
### Impact: ###
num:
### Initial Access: ###
num:
### Lateral Movement: ###
num:
### Persistence: ###
num:
### Privilege Escalation: ###
num:
### Reconnaissance: ###
num:
### Resource Development: ###
num:
### Execution ###
num: 18
- Exploitation for Client Execution [T1203] Count-19
- Command and Scripting Interpreter [T1059] Count-52
- Native API [T1106] Count-13
- Scripting [T1064] Count-20
- JavaScript [T1059.007] Count-5
- PowerShell [T1086] Count-12
- Regsvr32 [T1117] Count-4
- PowerShell [T1059.001] Count-14
- Visual Basic [T1059.005] Count-5
- Windows Command Shell [T1059.003] Count-2
- InstallUtil [T1118] Count-2
- User Execution [T1204] Count-6
- Scheduled Task/Job [T1053] Count-2
- Scheduled Task [T1053.005] Count-2
- At [T1053.002] Count-1
- Windows Management Instrumentation [T1047] Count-5
- Malicious File [T1204.002] Count-4
- Shared Modules [T1129] Count-2
### Persistence ###
num: 34
- Office Application Startup [T1137] Count-20
- Browser Extensions [T1176] Count-2
- Modify Existing Service [T1031] Count-6
- New Service [T1050] Count-5
- Create or Modify System Process [T1543] Count-6
- Windows Service [T1543.003] Count-6
- Bootkit [T1067] Count-6
- Pre-OS Boot [T1542] Count-5
- Bootkit [T1542.003] Count-5
- Office Template Macros [T1137.001] Count-6
- Hidden Files and Directories [T1158] Count-3
- Image File Execution Options Injection [T1183] Count-2
- Event Triggered Execution [T1546] Count-4
- Image File Execution Options Injection [T1546.012] Count-2
- Server Software Component [T1505] Count-3
- Web Shell [T1505.003] Count-3
- Registry Run Keys / Startup Folder [T1060] Count-4
- Boot or Logon Autostart Execution [T1547] Count-5
- Registry Run Keys / Startup Folder [T1547.001] Count-4
- Scheduled Task/Job [T1053] Count-2
- Scheduled Task [T1053.005] Count-2
- At [T1053.002] Count-1
- Accessibility Features [T1015] Count-1
- Accessibility Features [T1546.008] Count-1
- Hijack Execution Flow [T1574] Count-2
- Kernel Modules and Extensions [T1215] Count-1
- Kernel Modules and Extensions [T1547.006] Count-1
- DLL Side-Loading [T1574.002] Count-1
- Add-ins [T1137.006] Count-1
- Create Account [T1136] Count-2
- Local Account [T1136.001] Count-2
- Account Manipulation [T1098] Count-1
- Application Shimming [T1138] Count-1
- Application Shimming [T1546.011] Count-1
### Privilege Escalation ###
num: 27
- Process Injection [T1055] Count-20
- New Service [T1050] Count-5
- Create or Modify System Process [T1543] Count-6
- Windows Service [T1543.003] Count-6
- Extra Window Memory Injection [T1055.011] Count-2
- Image File Execution Options Injection [T1183] Count-2
- Event Triggered Execution [T1546] Count-4
- Image File Execution Options Injection [T1546.012] Count-2
- Boot or Logon Autostart Execution [T1547] Count-5
- Registry Run Keys / Startup Folder [T1547.001] Count-4
- Scheduled Task/Job [T1053] Count-2
- Scheduled Task [T1053.005] Count-2
- At [T1053.002] Count-1
- Accessibility Features [T1015] Count-1
- Accessibility Features [T1546.008] Count-1
- Hijack Execution Flow [T1574] Count-2
- Kernel Modules and Extensions [T1547.006] Count-1
- Bypass User Account Control [T1088] Count-5
- Abuse Elevation Control Mechanism [T1548] Count-6
- Bypass User Account Control [T1548.002] Count-5
- DLL Side-Loading [T1574.002] Count-1
- Application Shimming [T1138] Count-1
- Application Shimming [T1546.011] Count-1
- Portable Executable Injection [T1055.002] Count-1
- Process Hollowing [T1055.012] Count-2
- Extra Window Memory Injection [T1181] Count-1
- Process Doppelgänging [T1055.013] Count-1
### Defense Evasion ###
num: 70
- Virtualization/Sandbox Evasion [T1497] Count-39
- Time Based Evasion [T1497.003] Count-4
- Modify Registry [T1112] Count-75
- Masquerading [T1036] Count-11
- Masquerade Task or Service [T1036.004] Count-1
- Match Legitimate Name or Location [T1036.005] Count-3
- Disabling Security Tools [T1089] Count-22
- Impair Defenses [T1562] Count-30
- Disable or Modify Tools [T1562.001] Count-17
- Hidden Window [T1143] Count-1
- Hide Artifacts [T1564] Count-6
- Hidden Window [T1564.003] Count-1
- System Checks [T1497.001] Count-12
- Scripting [T1064] Count-20
- Software Packing [T1045] Count-21
- Obfuscated Files or Information [T1027] Count-30
- Software Packing [T1027.002] Count-22
- Indicator Blocking [T1054] Count-7
- Impair Command History Logging [T1562.003] Count-1
- Indicator Blocking [T1562.006] Count-7
- Regsvr32 [T1117] Count-4
- System Binary Proxy Execution [T1218] Count-8
- Regsvr32 [T1218.010] Count-4
- Rootkit [T1014] Count-4
- Process Injection [T1055] Count-20
- Disable or Modify System Firewall [T1562.004] Count-3
- Timestomp [T1099] Count-4
- Indicator Removal [T1070] Count-11
- Timestomp [T1070.006] Count-4
- Pre-OS Boot [T1542] Count-5
- Bootkit [T1542.003] Count-5
- Extra Window Memory Injection [T1055.011] Count-2
- Code Signing [T1116] Count-2
- Subvert Trust Controls [T1553] Count-5
- Code Signing [T1553.002] Count-3
- Invalid Code Signature [T1036.001] Count-2
- Hidden Files and Directories [T1158] Count-3
- Hidden Files and Directories [T1564.001] Count-3
- InstallUtil [T1118] Count-2
- Trusted Developer Utilities Proxy Execution [T1127] Count-3
- InstallUtil [T1218.004] Count-2
- Image File Execution Options Injection [T1183] Count-2
- Clear Windows Event Logs [T1070.001] Count-1
- NTFS File Attributes [T1096] Count-3
- NTFS File Attributes [T1564.004] Count-2
- Indirect Command Execution [T1202] Count-4
- Rename System Utilities [T1036.003] Count-1
- Install Root Certificate [T1130] Count-1
- Deobfuscate/Decode Files or Information [T1140] Count-4
- Install Root Certificate [T1553.004] Count-2
- Compile After Delivery [T1500] Count-3
- Compile After Delivery [T1027.004] Count-3
- File Deletion [T1107] Count-2
- File Deletion [T1070.004] Count-2
- User Activity Based Checks [T1497.002] Count-1
- Hijack Execution Flow [T1574] Count-2
- Bypass User Account Control [T1088] Count-5
- Abuse Elevation Control Mechanism [T1548] Count-6
- Bypass User Account Control [T1548.002] Count-5
- DLL Side-Loading [T1073] Count-1
- DLL Side-Loading [T1574.002] Count-1
- Disable Windows Event Logging [T1562.002] Count-1
- CMSTP [T1218.003] Count-1
- Template Injection [T1221] Count-1
- Portable Executable Injection [T1055.002] Count-1
- Process Hollowing [T1093] Count-2
- Process Hollowing [T1055.012] Count-2
- Extra Window Memory Injection [T1181] Count-1
- Process Doppelgänging [T1186] Count-1
- Process Doppelgänging [T1055.013] Count-1
### Credential Access ###
num: 15
- Credentials in Files [T1081] Count-7
- OS Credential Dumping [T1003] Count-18
- Unsecured Credentials [T1552] Count-8
- Credentials In Files [T1552.001] Count-7
- Input Capture [T1056] Count-3
- Keylogging [T1056.001] Count-2
- Credentials from Password Stores [T1555] Count-6
- Credentials from Web Browsers [T1503] Count-5
- Credentials from Web Browsers [T1555.003] Count-5
- Group Policy Preferences [T1552.006] Count-1
- Steal Web Session Cookie [T1539] Count-1
- LSASS Memory [T1003.001] Count-1
- Security Account Manager [T1003.002] Count-4
- LSA Secrets [T1003.004] Count-1
- Network Sniffing [T1040] Count-1
### Discovery ###
num: 19
- Process Discovery [T1057] Count-35
- File and Directory Discovery [T1083] Count-31
- Virtualization/Sandbox Evasion [T1497] Count-39
- Time Based Evasion [T1497.003] Count-4
- System Information Discovery [T1082] Count-24
- System Checks [T1497.001] Count-12
- Security Software Discovery [T1063] Count-18
- Software Discovery [T1518] Count-21
- Security Software Discovery [T1518.001] Count-18
- Application Window Discovery [T1010] Count-3
- Permission Groups Discovery [T1069] Count-2
- Query Registry [T1012] Count-21
- System Owner/User Discovery [T1033] Count-3
- System Network Configuration Discovery [T1016] Count-4
- Domain Trust Discovery [T1482] Count-2
- Account Discovery [T1087] Count-3
- User Activity Based Checks [T1497.002] Count-1
- System Service Discovery [T1007] Count-1
- Network Sniffing [T1040] Count-1
### Lateral Movement ###
num: 3
- Remote Services [T1021] Count-4
- Remote Desktop Protocol [T1021.001] Count-3
- Replication Through Removable Media [T1091] Count-1
### Collection ###
num: 10
- Data from Local System [T1005] Count-7
- Email Collection [T1114] Count-2
- Input Capture [T1056] Count-3
- Keylogging [T1056.001] Count-2
- Data Staged [T1074] Count-1
- Screen Capture [T1113] Count-2
- Clipboard Data [T1115] Count-3
- Archive Collected Data [T1560] Count-4
- Browser Session Hijacking [T1185] Count-3
- Automated Collection [T1119] Count-1
### Command And Control ###
num: 18
- Application Layer Protocol [T1071] Count-35
- Remote Access Software [T1219] Count-39
- Proxy [T1090] Count-5
- Web Protocols [T1071.001] Count-19
- Multi-hop Proxy [T1188] Count-3
- Multi-hop Proxy [T1090.003] Count-3
- Standard Cryptographic Protocol [T1032] Count-15
- Encrypted Channel [T1573] Count-14
- File Transfer Protocols [T1071.002] Count-1
- Non-Application Layer Protocol [T1095] Count-4
- Custom Command and Control Protocol [T1094] Count-2
- DNS [T1071.004] Count-7
- Ingress Tool Transfer [T1105] Count-2
- Data Encoding [T1132] Count-1
- Standard Encoding [T1132.001] Count-1
- Domain Generation Algorithms [T1483] Count-2
- Dynamic Resolution [T1568] Count-3
- Domain Generation Algorithms [T1568.002] Count-2
### Exfiltration ###
num: 4
- Exfiltration Over C2 Channel [T1041] Count-2
- Automated Exfiltration [T1020] Count-1
- Data Encrypted [T1022] Count-4
- Exfiltration Over Alternative Protocol [T1048] Count-2
### Impact ###
num: 11
- Data Encrypted for Impact [T1486] Count-22
- Endpoint Denial of Service [T1499] Count-3
- Application or System Exploitation [T1499.004] Count-3
- Service Stop [T1489] Count-1
- Defacement [T1491] Count-1
- Internal Defacement [T1491.001] Count-1
- System Shutdown/Reboot [T1529] Count-1
- Inhibit System Recovery [T1490] Count-8
- Data Destruction [T1485] Count-4
- Disk Wipe [T1561] Count-1
- Resource Hijacking [T1496] Count-2
## MBC MAPPINGS ##
### Anti-Behavioral Analysis: ###
num:
### Anti-Static Analysis: ###
num:
### Anti-behavioral Analysis ###
num: 36
- Sandbox Detection [B0007] Count-10
- Sandbox Detection [B0007.002] Count-5
- Dynamic Analysis Evasion [B0003] Count-5
- Dynamic Analysis Evasion [B0003.002] Count-1
- Dynamic Analysis Evasion [B0003.003] Count-1
- Virtual Machine Detection [B0009] Count-29
- Virtual Machine Detection [B0009.015] Count-1
- Software Packing [F0001] Count-19
- Software Packing [F0001.010] Count-1
- Virtual Machine Detection [B0009.001] Count-6
- Debugger Detection [B0001] Count-9
- Debugger Detection [B0001.002] Count-1
- Debugger Detection [B0001.012] Count-1
- Debugger Detection [B0001.001] Count-1
- Software Packing [F0001.009] Count-1
- Dynamic Analysis Evasion [B0003.010] Count-1
- Emulator Detection [B0004] Count-4
- Virtual Machine Detection [B0009.005] Count-13
- Virtual Machine Detection [B0009.024] Count-2
- Debugger Detection [B0001.030] Count-1
- Virtual Machine Detection [B0009.008] Count-3
- Debugger Detection [B0001.016] Count-1
- Sandbox Detection [B0007.003] Count-1
- Virtual Machine Detection [B0009.012] Count-1
- Debugger Detection [B0001.032] Count-1
- Emulator Detection [B0004.003] Count-2
- Software Packing [F0001.008] Count-1
- Debugger Detection [B0001.009] Count-1
- Debugger Evasion [B0002] Count-3
- Debugger Evasion [B0002.008] Count-1
- Software Packing [F0001.013] Count-1
- Virtual Machine Detection [B0009.006] Count-1
- Software Packing [F0001.011] Count-2
- Debugger Evasion [B0002.024] Count-1
- Debugger Detection [B0001.014] Count-1
- Virtual Machine Detection [B0009.009] Count-1
### Privilege Escalation: ###
num:
### Anti-static Analysis ###
num: 7
- Software Packing [F0001] Count-19
- Software Packing [F0001.010] Count-1
- Software Packing [F0001.009] Count-1
- Obfuscated Files or Information [E1027] Count-6
- Software Packing [F0001.008] Count-1
- Software Packing [F0001.013] Count-1
- Software Packing [F0001.011] Count-2
### Collection ###
num: 6
- Keylogging [F0002] Count-2
- Keylogging [F0002.001] Count-1
- Screen Capture [E1113] Count-2
- Cryptocurrency [B0028] Count-1
- Cryptocurrency [B0028.001] Count-1
- Input Capture [E1056] Count-3
### Command And Control ###
num: 4
- C2 Communication [B0030] Count-14
- C2 Communication [B0030.005] Count-1
- Ingress Tool Transfer [E1105] Count-1
- Domain Name Generation [B0031] Count-2
### Credential Access ###
num: 6
- Keylogging [F0002] Count-2
- Keylogging [F0002.001] Count-1
- Screen Capture [E1113] Count-2
- Cryptocurrency [B0028] Count-1
- Cryptocurrency [B0028.001] Count-1
- Input Capture [E1056] Count-3
### Defense Evasion ###
num: 22
- Modify Registry [E1112] Count-71
- Disable or Evade Security Tools [F0004] Count-23
- Hidden Files and Directories [F0005] Count-7
- Hidden Files and Directories [F0005.002] Count-1
- Indicator Blocking [F0006] Count-7
- Software Packing [F0001] Count-19
- Software Packing [F0001.010] Count-1
- Rootkit [E1014] Count-4
- Process Injection [E1055] Count-23
- Software Packing [F0001.009] Count-1
- Hidden Files and Directories [F0005.004] Count-3
- Bypass Data Execution Prevention [B0037] Count-1
- Bootkit [F0013] Count-5
- Obfuscated Files or Information [E1027] Count-6
- Disable or Evade Security Tools [F0004.005] Count-3
- Polymorphic Code [B0029] Count-1
- Self Deletion [F0007] Count-2
- Disable or Evade Security Tools [F0004.007] Count-1
- Software Packing [F0001.008] Count-1
- Disable or Evade Security Tools [F0004.003] Count-1
- Software Packing [F0001.013] Count-1
- Software Packing [F0001.011] Count-2
### Discovery ###
num: 7
- File and Directory Discovery [E1083] Count-17
- System Information Discovery [E1082] Count-24
- Application Window Discovery [E1010] Count-1
- Analysis Tool Discovery [B0013] Count-5
- Analysis Tool Discovery [B0013.001] Count-1
- Analysis Tool Discovery [B0013.009] Count-1
- Analysis Tool Discovery [B0013.008] Count-1
### Execution ###
num: 3
- Exploitation for Client Execution [E1203] Count-26
- Command and Scripting Interpreter [E1059] Count-47
- Install Additional Program [B0023] Count-5
### Exfiltration ###
num: 1
- Archive Collected Data [E1560] Count-6
### Impact ###
num: 9
- Exploitation for Client Execution [E1203] Count-26
- Data Encrypted for Impact [E1486] Count-8
- Remote Access [B0022] Count-43
- Denial of Service [B0033] Count-4
- Disk Wipe [F0014] Count-2
- Disk Wipe [F0014.001] Count-1
- Data Destruction [E1485] Count-4
- Resource Hijacking [B0018] Count-2
- Resource Hijacking [B0018.002] Count-1
### Lateral Movement ###
num: 1
- Ingress Tool Transfer [E1105] Count-1
### Persistence ###
num: 11
- Remote Access [B0022] Count-43
- Modify Registry [E1112] Count-71
- Hidden Files and Directories [F0005] Count-7
- Hidden Files and Directories [F0005.002] Count-1
- Kernel Modules and Extensions [F0010] Count-2
- Kernel Modules and Extensions [F0010.001] Count-1
- Modify Existing Service [F0011] Count-6
- Hidden Files and Directories [F0005.004] Count-3
- Bootkit [F0013] Count-5
- Registry Run Keys / Startup Folder [F0012] Count-3
- Ingress Tool Transfer [E1105] Count-1
### Privilege Escalation ###
num: 4
- Process Injection [E1055] Count-23
- Kernel Modules and Extensions [F0010] Count-2
- Kernel Modules and Extensions [F0010.001] Count-1
- Modify Existing Service [F0011] Count-6
## MBC MICRO-BEHAVIOR MAPPINGS ##
### Communication: ###
num:
### Communication ###
num: 13
- HTTP Communication [C0002] Count-23
- HTTP Communication [C0002.003] Count-1
- HTTP Communication [C0002.005] Count-3
- WinINet [C0005] Count-5
- WinINet [C0005.002] Count-1
- WinINet [C0005.003] Count-1
- SMTP Communication [C0012] Count-1
- Socket Communication [C0001] Count-6
- WinINet [C0005.001] Count-1
- DNS Communication [C0011] Count-8
- ICMP Communication [C0014] Count-2
- Interprocess Communication [C0003] Count-1
- Interprocess Communication [C0003.001] Count-1
### Cryptography ###
num: 3
- Encrypt Data [C0027] Count-10
- Encryption Key [C0028] Count-1
- Decrypt Data [C0031] Count-1
### Data ###
num: 1
- Decompress Data [C0025] Count-1
### File System ###
num: 9
- Create File [C0016] Count-24
- Writes File [C0052] Count-8
- Create Directory [C0046] Count-1
- Alter File Extension [C0015] Count-4
- Delete File [C0047] Count-7
- Read File [C0051] Count-6
- Create File [C0016.002] Count-1
- Copy File [C0045] Count-1
- Create File [C0016.001] Count-1
### Hardware ###
num: 1
- Load Driver [C0023] Count-1
### Memory ###
num: 3
- Change Memory Protection [C0008] Count-1
- Heap Spray [C0006] Count-1
- Allocate Memory [C0007] Count-1
### Process ###
num: 5
- Create Mutex [C0042] Count-59
- Check Mutex [C0043] Count-4
- Create Process [C0017] Count-3
- Create Process [C0017.002] Count-1
- Create Thread [C0038] Count-4
### Operating System ###
num: 7
- Registry [C0036] Count-89
- Registry [C0036.001] Count-9
- Wallpaper [C0035] Count-1
- Console [C0033] Count-1
- Registry [C0036.005] Count-16
- Registry [C0036.003] Count-3
- Registry [C0036.006] Count-1
collection/input-capture.md
+4 -5
View File
@@ -44,10 +44,8 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056),
|---|---|---|---|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware injects itself into a browser and captures user input data [[1]](#1)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Injects HTML into browser session to collect sensitive online banking information when the victim performs their online banking [[2]](#2)|
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|Can capture audio and video [[3]](#3)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Can capture audio and video [[4]](#4)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors keyboard and mouse activity to determine if the machine is in use [[5]](#5)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors keyboard and mouse activity to determine if the machine is in use [[3]](#3)|
## References
@@ -55,8 +53,9 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056),
<a name="2">[2]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279
<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
<a name="3">[3]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="4">[4]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
<a name="5">[5]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="5">[5]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
collection/keylogging.md
+12 -3
View File
@@ -44,12 +44,16 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
|Name|Date|Method|Description|
|---|---|---|---|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Certain variants of the malware may have keylogging functionality [[1]](#1)|
|[**UP007**](../xample-malware/up007.md)|2016|--|The malware logs keystrokes to a file [[2]](#2)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|F0002, F0002.002|Please see the Hupigon malware page for details. [[1]](#1)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Keylogger plugin allows for collection of keystrokes [[3]](#3)|
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet can capture keystrokes [[4]](#4)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Can capture keystrokes [[5]](#5)|
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK collects user keystrokes [[6]](#6)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|F0002, F0002.002|Please see the Dark Comet malware page for details. [[4]](#4)|
|[**Kovter**](../xample-malware/kovter.md)|2016|F0002.002|Log keystrokes via polling (This capa rule had 1 match) [[7]](#7)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|F0002.001, F0002.002|Please see the Redhip malware page for details. [[7]](#7)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Log keystrokes via polling (This capa rule had 7 matches) [[7]](#7)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|The malware logs keystrokes to a file [[2]](#2)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Log keystrokes via polling (This capa rule had 1 match) [[7]](#7)|
## References
@@ -64,3 +68,8 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
<a name="5">[5]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
<a name="6">[6]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
<a name="7">[7]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="8">[8]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
collection/screen-capture.md
+9 -3
View File
@@ -43,10 +43,13 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
|Name|Date|Method|Description|
|---|---|---|---|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR is capable of capturing screenshots. [[1]](#1)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR is capable of capturing screenshots. [[1]](#1)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Screenshot plugin allows for collection of screenshots [[2]](#2)|
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|Can take screenshots of victim's computer [[3]](#3)|
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK takes snapshots of deskop and window contents [[4]](#4)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1113, E1113.m01|Please see the Dark Comet malware page for details. [[3]](#3)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1113.m01|Capture screenshot (This capa rule had 2 matches) [[5]](#5)|
|[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Capture screenshot (This capa rule had 1 match) [[5]](#5)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Capture screenshot (This capa rule had 2 matches) [[5]](#5)|
## References
@@ -56,4 +59,7 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
<a name="5">[5]</a> capa v4.0, analyzed at MITRE on 10/12/2022
command-and-control/c2-communication.md
+29 -9
View File
@@ -60,17 +60,24 @@ As "server" and "client" are confusing terminology, we use the terms "controller
|Name|Date|Method|Description|
|---|---|---|---|
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|The malware sends a hash value generated from system information [[1]](#1)|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR receives data from the C2 [[2]](#2)|
|[**Terminator**](../xample-malware/terminator.md)|2013|--|The malware sends data to C2 [[3]](#3)|
|[**UP007**](../xample-malware/up007.md)|2016|--|The malware receives payloads [[4]](#4)|
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|Connects to the command and control server using HTTP to send device information [[5]](#5)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Ursnif variant Dreambot authenticates and encrypts traffic to C2 server using TOR [[6]](#6)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|New email addresses are collected automatically from the victim's address books [[7]](#7)|
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK sends data to the C2 server using HTTP POST requests [[8]](#8)|
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|B0030.001, B0030.002|Please see the CryptoWall malware page for details. [[1]](#1)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|B0030.002|GoBotKR receives data from the C2 [[2]](#2)|
|[**Terminator**](../xample-malware/terminator.md)|2013|B0030.001|The malware sends data to C2 [[3]](#3)|
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|B0030.006|Connects to the command and control server using HTTP to send device information [[5]](#5)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0030.011|Ursnif variant Dreambot authenticates and encrypts traffic to C2 server using TOR [[6]](#6)|
|[**Emotet**](../xample-malware/emotet.md)|2018|B0030.010|New email addresses are collected automatically from the victim's address books [[7]](#7)|
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|B0030.001|CHOPSTICK sends data to the C2 server using HTTP POST requests [[8]](#8)|
|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar communicates with a C2 server [[9]](#9)|
|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny communicates C2 via HTTP [[10]](#10)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer communicates to a Tor Onion Service via HTTP [[11]](#11)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0030.001, B0030.002, B0030.011|Please see the CryptoLocker malware page for details. [[12]](#12)|
|[**Gamut**](../xample-malware/gamut.md)|2014|B0030.002|The malware receives data from C2 [[13]](#13)|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0030.002|Receive data (This capa rule had 1 match) [[14]](#14)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0030.002, B0030.001|Please see the Hupigon malware page for details. [[14]](#14)|
|[**Kovter**](../xample-malware/kovter.md)|2016|B0030.002, B0030.001|Please see the Kovter malware page for details. [[14]](#14)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0030.001, B0030.002|Please see the Rombertik malware page for details. [[15]](#15)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|B0030.002| The malware receives data from the C2 server. [[16]](#16)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|B0030.002, B0030.001|Please see the UP007 Malware Family malware page for details. [[4]](#4)|
## Code Snippets
@@ -117,4 +124,17 @@ jmp short loc_4019A2
<a name="10">[10]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
<a name="11">[11]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="11">[11]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="12">[12]</a> https://www.secureworks.com/research/cryptolocker-ransomware
<a name="13">[13]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
<a name="14">[14]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="15">[15]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="16">[16]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
<a name="17">[17]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
command-and-control/domain-name-generation.md
+5 -1
View File
@@ -38,8 +38,9 @@ The related **Dynamic Resolution: Domain Generation Algorithms ([T1568.002](http
|---|---|---|---|
|[**Kraken**](../xample-malware/kraken.md)|April 2008|--|Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
|[**Conficker**](../xample-malware/conficker.md)|November 2008|--|Conficker uses a domain name generator. [[3]](#3)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware sends a hash value generated from system information [[4]](#4|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware sends a hash value generated from system information [[4]](#4)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Ursnif has used a Domain name generation algorithm in the past [[5]](#5)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0030.001|The malware sends data to the C2 [[6]](#6)|
## References
@@ -52,3 +53,6 @@ The related **Dynamic Resolution: Domain Generation Algorithms ([T1568.002](http
<a name="4">[4]</a> https://www.secureworks.com/research/cryptolocker-ransomware
<a name="5">[5]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
<a name="6">[6]</a> https://blogs.cisco.com/security/talos/rombertik
command-and-control/ingress-tool-transfer.md
+15 -14
View File
@@ -38,25 +38,26 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison-Ivy implant is running on the target machine, the attacker can use a Windows GUI controller to control the target computer. [[1]](#1)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware receives a public key from the C2 [[2]](#2)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware receives data from C2 [[3]](#3)|
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|Can download files from remote repository upon instruction [[4]](#4)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory [[5]](#5)|
|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar requests a file using SSL to a C2 domain [[6]](#6)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory [[2]](#2)|
|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar requests a file using SSL to a C2 domain [[3]](#3)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Can download files from remote repository upon instruction [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware receives files from C2 [[4]](#4)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can download additional files and update itself. [[5]](#5)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|The malware downloads files from C2 [[6]](#6)|
## References
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
<a name="2">[2]</a> https://www.secureworks.com/research/cryptolocker-ransomware
<a name="2">[2]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/
<a name="3">[3]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
<a name="3">[3]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
<a name="4">[4]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
<a name="4">[4]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
<a name="5">[5]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/
<a name="5">[5]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
<a name="6">[6]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
<a name="7">[7]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
<a name="6">[6]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
defense-evasion/alternative-installation-location.md
+3 -2
View File
@@ -41,11 +41,12 @@ Malware may install itself not as a file on the hard drive. [[1]](#1)
|Name|Date|Method|Description|
|---|---|---|---|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
|[**SYNfulKnock**](../xample-malware/synful-knock.md)|2015|--|100 memory-resident modules can be installed [[2]](#2)|
|[**Kovter**](../xample-malware/kovter.md)|2016|B0027.002|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|B0027.001|100 memory-resident modules can be installed [[2]](#2)|
## References
<a name="1">[1]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
<a name="2">[2]</a> https://www.mandiant.com/resources/synful-knock-acis
defense-evasion/bootkit.md
+2 -1
View File
@@ -37,10 +37,11 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma
|Name|Date|Method|Description|
|---|---|---|---|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware [[2]](#24)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware [[2]](#2)|
## References
<a name="1">[1]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
<a name="2">[2]</a> https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf
defense-evasion/bypass-data-execution-prevention.md
-6
View File
@@ -36,12 +36,6 @@ Malware may bypass Data Execution Prevention (DEP).
|---|---|---|
|**ROP Chains**|B0037.001|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot has come with a signed downloader component [[2]](#2)|
## References
<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce
defense-evasion/disable-or-evade-security-tools.md
+1 -1
View File
@@ -53,7 +53,6 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta
|Name|Date|Method|Description|
|---|---|---|---|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|
## References
@@ -65,3 +64,4 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta
<a name="3">[3]</a> Alexander Adamov, Stealthy WastedLocker: eluding behavior blockers, but not only. Online: https://vblocalhost.com/conference/presentations/stealthy-wastedlocker-eluding-behaviour-blockers-but-not-only/
<a name="4">[4]</a> Carl Petty, Red Canary, 3/3/2020. Online: https://redcanary.com/blog/heavens-gate-technique-on-linux/
defense-evasion/hidden-files-and-directories.md
+4 -3
View File
@@ -46,8 +46,8 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://
|Name|Date|Method|Description|
|---|---|---|---|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Modifies target files' time to August 2012 as an antiforensic trick [[2]](#2)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|F0005.004|Modifies target files' time to August 2012 as an antiforensic trick [[2]](#2)|
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK creates a hidden file for temporary storage [[3]](#3)|
## References
@@ -56,4 +56,5 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://
<a name="2">[2]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/
<a name="3">[]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
<a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
defense-evasion/hide-artifacts.md
+1
View File
@@ -55,3 +55,4 @@ See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/
<a name="1">[1]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
<a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
defense-evasion/hijack-execution-flow.md
+5 -5
View File
@@ -59,12 +59,11 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
|Name|Date|Method|Description|
|---|---|---|---|
|**Kronos**|June 2014|--|Kronos hooks the API of processes to prevent detection. [[6]](#6)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Hooks various DLL exported functions when the component is loaded in their respective Browser application process is running to monitor network traffic [[7]](#7)|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--| Abuses Microsoft's Dynamic Data Exchange (DDE) protocol [[8]](#8)|
|[**SYNfulKnock**](../xample-malware/synful-knock.md)|2015|--|Hooks IOS functions to call and initialize the malware [[9]](#9)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Escalates privilege by impersonating the token. First uses LogonUser and ImpersonateLoggedOnUser, then ImpersonateNamedPipeClient. [[10]](#10)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet. [[11]](#11)|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|F0015.006| Abuses Microsoft's Dynamic Data Exchange (DDE) protocol [[8]](#8)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|F0015.006|Escalates privilege by impersonating the token. First uses LogonUser and ImpersonateLoggedOnUser, then ImpersonateNamedPipeClient. [[10]](#10)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.003, F0015.007|Please see the Stuxnet malware page for details. [[11]](#11)|
|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|--|Hooks IOS functions to call and initialize the malware [[9]](#9)|
## References
@@ -89,3 +88,4 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
<a name="10">[10]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/
<a name="11">[11]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
defense-evasion/indicator-blocking.md
+2 -1
View File
@@ -45,8 +45,8 @@ See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mi
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Clears windows event logs and removes the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevent strings in the user32.dll.mui of the system [[1]](#1)|
|[**Conficker**](../xample-malware/conficker.md)|2008|--|Terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software [[2]](#2)|
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|Can disable security center functions like anti-virus and firewall [[3]](#3)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV) [[4]](#4)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Can disable security center functions like anti-virus and firewall [[3]](#3)|
## References
@@ -57,3 +57,4 @@ See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mi
<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
<a name="4">[4]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
defense-evasion/install-insecure-or-malicious-configuration.md
+5 -1
View File
@@ -34,8 +34,12 @@ Malware may install malicious configuration settings or may modify existing conf
|Name|Date|Method|Description|
|---|---|---|---|
|[**Black Energy**](../xample-malware/blackenergy.md)|2007|--|Configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component [[1]](#1)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component [[1]](#1)|
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|Changes iOS Safari's default configuration [[2]](#2)|
## References
<a name="1">[1]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
<a name="2">[2]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
defense-evasion/modify-registry.md
+5 -6
View File
@@ -37,19 +37,17 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[2]](#2)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[2]](#2)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware adds many entries to the registry [[3]](#3)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware adds a registry key [[4]](#4)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware modifies the registry during execution [[5]](#5)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy [[6]](#6)|
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK may encrypt and store configuration data inside a registry key [[7]](#7)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer edits the registry [[8]](#8)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer edits the registry [[1]](#1)|
## References
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
<a name="1">[1]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
@@ -63,4 +61,5 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
<a name="7">[7]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
<a name="8">[8]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="8">[8]</a> https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem.
defense-evasion/obfuscated-files-or-information.md
+38 -5
View File
@@ -60,12 +60,28 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Obfuscates files.|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Obfuscates files.|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|E1027.m02|Trojan spyware program that has mainly been used for targeting banking sites. [[4]](#4)|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Obfuscates files. [[5]](#5)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware will use a key to decrypt text from a URL to create more malicious code [[2]](#2)|
|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as base64, hexademcimal, and XOR [[3]](#3)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|E1027.m05|Encrypt data using RC4 via WinAPI (This capa rule had 1 match) [[7]](#7)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1027.m02|Encode data using XOR (This capa rule had 13 matches) [[7]](#7)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
|[**Gamut**](../xample-malware/gamut.md)|2014|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1027.m02, E1027.m05|Please see the Hupigon malware page for details. [[7]](#7)|
|[**Kraken**](../xample-malware/kraken.md)|2008|E1027.m02|Encode data using XOR (This capa rule had 2 matches) [[7]](#7)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|E1027.m02|Encode data using XOR (This capa rule had 4 matches) [[7]](#7)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|E1027.m02|Encode data using XOR (This capa rule had 2 matches) [[7]](#7)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|E1027.m07|Poison Ivy variant encrypts all its strings [[6]](#6)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1027.m02|Encode data using XOR (This capa rule had 5 matches) [[7]](#7)|
|[**SamSam**](../xample-malware/samsam.md)|2015|E1027.m07|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV [[8]](#8)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1027.m01, E1027.m02|Please see the Stuxnet malware page for details. [[9]](#9)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|E1027.m02|Encode data using XOR (This capa rule had 13 matches) [[7]](#7)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Creates an encrypted Registry key called TorClient to store its data [[10]](#10)|
## References
@@ -73,4 +89,21 @@ Instead of being listed alphabetically, methods have been grouped to better faci
<a name="2">[2]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
<a name="3">[3]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
<a name="3">[3]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
<a name="4">[4]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
<a name="5">[5]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
<a name="6">[6]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
<a name="7">[7]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="8">[8]</a> https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html
<a name="9">[9]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
<a name="10">[10]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
<a name="11">[11]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
defense-evasion/polymorphic-code.md
+3 -1
View File
@@ -47,4 +47,6 @@ Polymorphic code, a file with the same functionality but different execution, is
## References
<a name="1">[1]</a> https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf
<a name="2">[2]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
<a name="2">[2]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
defense-evasion/process-injection.md
+22 -9
View File
@@ -57,15 +57,17 @@ Methods not captured by ATT&CK Process Injection sub-techniques are listed below
|Name|Date|Method|Description|
|---|---|---|---|
|[**UP007**](../xample-malware/up007.md)|April 2016|--|Injects secondary payload into memory. [[4]](#4)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites. [[11]](#11)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Injects minor code into a running process.|
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--| [[6]](#6)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware injects itself into processes such as cmd.exe, notepad.exe [[7]](#7)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution [[8]](#8)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet injects the entire DLL into another process and then just calls the particular export [[9]](#9)|
|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker uses reflective DLL loading to inject from memory [[10]](#10)|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Injects minor code into a running process. [[12]](#12)|
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|The malware injects code into a new svchost process [[6]](#6)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1055, E1055.012|Please see the Hupigon malware page for details. [[7]](#7)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|E1055.m05|Bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution [[8]](#8)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1055.001, E1055.m05|Please see the Stuxnet malware page for details. [[9]](#9)|
|[**Netwalker**](../xample-malware/netwalker.md)|2020|E1055.001|Netwalker uses reflective DLL loading to inject from memory [[10]](#10)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|The malware loads multiple DLLs into memory [[4]](#4)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Attach user process memory (This capa rule had 1 match) [[13]](#13)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|E1055.003|Inject thread (This capa rule had 1 match) [[13]](#13)|
## References
@@ -87,4 +89,15 @@ Methods not captured by ATT&CK Process Injection sub-techniques are listed below
<a name="9">[9]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
<a name="10">[10]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
<a name="10">[10]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
<a name="11">[11]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
<a name="12">[12]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
<a name="13">[13]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="14">[14]</a> https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
<a name="15">[15]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
defense-evasion/rootkit.md
+2 -9
View File
@@ -50,16 +50,8 @@ Rootkits may hide artifacts (kernel modules, services, threads, userspace librar
|Name|Date|Method|Description|
|---|---|---|---|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--| Certain variants of the malware may have rootkit functionality [[3]](#3)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate [[4]](#4)|
## Detection
Rootkits can be detected by detecting primary rootkit behaviors: Hide Artifacts, Impair Defenses, Highjack Execution Flow. Hidden artifacts include kernel modules (hides use of kernel modules used by the malware instance), services (hides any system services that the malware instance creates or injects itself into), threads (hides one or more threads that belong to the malware instance), userspace libraries (hides use of userspace libraries used by the malware instance).
Rootkits can also be detected via memory dump analysis or virtual machine introspection.
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1014.m17|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate [[4]](#4)|
## References
@@ -70,3 +62,4 @@ Rootkits can also be detected via memory dump analysis or virtual machine intros
<a name="3">[3]</a> https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml
<a name="4">[4]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
defense-evasion/self-deletion.md
+7 -4
View File
@@ -46,12 +46,15 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
|Name|Date|Method|Description|
|---|---|---|---|
|[**Terminator**](../xample-malware/terminator.md)|2013|--|Evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[1]](#1)|
|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary [[2]]](#2)|
|[**Terminator**](../xample-malware/terminator.md)|2013|F0007.001|Evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[1]](#1)|
|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary [[2]](#2)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted, and then will delete itself. [[3]](#3)|
## References
<a name="1">[1]</a> https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes
<a name="2">[2]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
<a name="2">[2]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
discovery/analysis-tool-discovery.md
+3 -2
View File
@@ -51,11 +51,12 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi
|Name|Date|Method|Description|
|---|---|---|---|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|If it recieves a response from the c2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the ShellExecuteW function and exits [[1]](#1)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy Variant runs a threat to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one fo the analysis tools is running. [[2]](#2)|
|[**Emotet**](../xample-malware/emotet.md)|2018|B0013.002|If it recieves a response from the c2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the ShellExecuteW function and exits [[1]](#1)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|B0013, B0013.010|Please see the Poison-Ivy malware page for details. [[2]](#2)|
## References
<a name="1">[1]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
<a name="2">[2]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
discovery/application-window-discovery.md
+16 -1
View File
@@ -34,4 +34,19 @@ Malware may attempt to get a listing of open application windows.
|Name|ID|Description|
|---|---|---|
|**Window Text**|E1010.m01|After finding an open application window, malware gets graphical window text.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1010.m01|Get graphical window text (This capa rule had 2 matches) [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|E1010.m01|Get graphical window text (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1010.m01|Get graphical window text (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|E1010.m01|Get graphical window text (This capa rule had 2 matches) [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1010.m01|Get graphical window text (This capa rule had 2 matches) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|E1010.m01|Get graphical window text (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
discovery/code-discovery.md
+21 -1
View File
@@ -36,4 +36,24 @@ Malware may inspect code or enumerate aspects.
|---|---|---|
|**Enumerate PE Sections**|B0046.001|Malware enumerates virtual offsets of code sections.|
|**Inspect Section Memory Permissions**|B0046.002|Malware identifies section memory permissions from image section header.|
|**Parse PE Header**|B0046.003|Malware parses the PE header.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0046.001|Enumerate PE sections (This capa rule had 3 matches) [[1]](#1)|
|[**Emotet**](../xample-malware/emotet.md)|2018|B0046.001|Enumerate pe sections (this capa rule had 1 match) [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0046.001|Enumerate PE sections (This capa rule had 3 matches) [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|B0046.001|Enumerate PE sections (This capa rule had 2 matches) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|B0046.002|Inspect section memory permissions (This capa rule had 1 match) [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0046.002|Inspect section memory permissions (This capa rule had 2 matches) [[1]](#1)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
discovery/file-and-directory-discovery.md
+18 -1
View File
@@ -41,9 +41,23 @@ Malware may enumerate files and directories or may search for specific files or
|Name|Date|Method|Description|
|---|---|---|---|
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--| [[1]](#1)|
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|The malware searches for user files before encrypting them [[1]](#1)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware searches for user files before encrypting them [[2]](#2)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Collects local files with specified file extensions and information from the victim's machine [[3]](#3)|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Enumerate files on windows (This capa rule had 3 matches) [[4]](#4)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1083, E1083.m01|Please see the Hupigon malware page for details. [[4]](#4)|
|[**Kovter**](../xample-malware/kovter.md)|2016|E1083.m01|Access the Windows event log (This capa rule had 2 matches) [[4]](#4)|
|[**SamSam**](../xample-malware/samsam.md)|2015|--|Enumerate files on windows (This capa rule had 1 match) [[4]](#4)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Enumerate files on windows (This capa rule had 1 match) [[4]](#4)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Get common file path (This capa rule had 3 matches) [[4]](#4)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Get file version info (This capa rule had 1 match) [[4]](#4)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Get common file path (This capa rule had 5 matches) [[4]](#4)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Check if file exists (This capa rule had 1 match) [[4]](#4)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Get file size (This capa rule had 1 match) [[4]](#4)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Get file size (This capa rule had 1 match) [[4]](#4)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Get file size (This capa rule had 3 matches) [[4]](#4)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Get file version info (This capa rule had 1 match) [[4]](#4)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Get common file path (This capa rule had 1 match) [[4]](#4)|
## References
@@ -52,3 +66,6 @@ Malware may enumerate files and directories or may search for specific files or
<a name="2">[2]</a> https://www.secureworks.com/research/cryptolocker-ransomware
<a name="3">[3]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf
<a name="4">[4]</a> capa v4.0, analyzed at MITRE on 10/12/2022
discovery/system-information-discovery.md
+26 -5
View File
@@ -42,14 +42,24 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Learns about the system so it can drop compatible miner software.|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites. [[7]](#7)|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Learns about the system so it can drop compatible miner software. [[8]](#8)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Uses windows command prompt commands to gather system info, task list, installed drivers, and installed programs [[1]](#1)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|uses Systeminfo to gather OS version, system configuration, BIOS, the motherboard, and processor [ [[2]](#2)|
|[**DarkComet**](../xample-malware/darkcomet.md)|2008|--|Can collect information about the compter, resources, and operating system version [[3]](#3)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Uses Systeminfo to gather OS version, system configuration, BIOS, the motherboard, and processor [ [[2]](#2)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Collects information related to OS, processes, and sometimes mail client information and sends it to c2 [[4]](#4)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the net to spread itself [[5]](#5)|
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK collects information from the host including Windows version, CPU architecture, and UAC settings [[6]](#6)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Can collect information about the compter, resources, and operating system version [[3]](#3)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|Query environment variable (This capa rule had 1 match) [[9]](#9)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Query environment variable (This capa rule had 1 match) [[9]](#9)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses wmic, systeminfo and ver commands to collect information about the system and the installed software. [[10]](#10)query environment variable (This capa rule had 2 matches) [[9]](#9)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Query environment variable (This capa rule had 1 match) [[9]](#9)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Get disk information (This capa rule had 1 match) [[9]](#9)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Check OS version (This capa rule had 1 match) [[9]](#9)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Check OS version (This capa rule had 1 match) [[9]](#9)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Get disk size (This capa rule had 1 match) [[9]](#9)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Get hostname (This capa rule had 1 match) [[9]](#9)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Query environment variable (This capa rule had 1 match) [[9]](#9)|
## References
@@ -63,4 +73,15 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
<a name="5">[5]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
<a name="6">[6]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
<a name="6">[6]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
<a name="7">[7]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
<a name="8">[8]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
<a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="10">[10]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
<a name="11">[11]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf
discovery/taskbar-discovery.md
+11 -1
View File
@@ -28,4 +28,14 @@
# Taskbar Discovery
Malware may find the taskbar.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Find taskbar (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
execution/command-and-scripting-interpreter.md
+23 -2
View File
@@ -38,13 +38,23 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or
|---|---|---|---|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses cmd.exe to execute commands. [[2]](#2)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses cmd.exe to execute commands. [[2]](#2)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware executes malicious javascript and powershell [[3]](#3)|
|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam uses a batch file for executing the malware and deleting certain components [[4]](#4)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion [[5]](#5)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell [[6]](#6)|
|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny executes Lua scripts [[7]](#7)|
|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker is written and executed in Powershell [[8]](#8)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|Accept command line arguments (This capa rule had 2 matches) [[9]](#9)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Accept command line arguments (This capa rule had 2 matches) [[9]](#9)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Accept command line arguments (This capa rule had 2 matches) [[9]](#9)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs a script to inject JavaScript script and modify web traffic. [[10]](#10)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
## References
@@ -62,4 +72,15 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or
<a name="7">[7]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
<a name="8">[8]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
<a name="8">[8]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
<a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="10">[10]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
<a name="11">[11]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
<a name="12">[12]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
<a name="13">[13]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
execution/conditional-execution.md
+13 -4
View File
@@ -56,17 +56,26 @@ Some aspects of this Conditional Execution behavior are related to the [Executio
|Name|Date|Method|Description|
|---|---|---|---|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
|[**Conficker**](../xample-malware/conficker.md)|2008|--|A routine causes the process to suicide exit if the keyboard language is set to Ukranian.|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.) [1] [[3]](#3)|
|[**Conficker**](../xample-malware/conficker.md)|2008|B0025, B0025.001|Please see the Conficker malware page for details. [[5]](#5)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0025.004|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.) [[3]](#3)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware only proceeds if it detects the BIOS ROM is Award BIOS [[4]](#4)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0025.007|Run as service (This capa rule had 1 match) [[6]](#6)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|B0025.007|Run as service (This capa rule had 1 match) [[6]](#6)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0025.004|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution [[7]](#7)|
## References
<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
<a name="2">[2]</a>
https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service
<a name="2">[2]</a> https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service
<a name="3">[3]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques
<a name="4">[4]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
<a name="5">[5]</a> https://en.wikipedia.org/wiki/Conficker
<a name="6">[6]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="7">[7]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
execution/exploitation-for-client-execution.md
+2 -1
View File
@@ -51,8 +51,9 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or
|Name|Date|Method|Description|
|---|---|---|---|
|[**SamSam**](../xample-malware/samsam.md)|2015|--|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|
|[**SamSam**](../xample-malware/samsam.md)|2015|E1203.m01|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|
## References
<a name="1">[1]</a> https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/
execution/install-additional-program.md
+26 -7
View File
@@ -37,14 +37,18 @@ Malware that installs another component is called a "dropper." If the code is co
|Name|Date|Method|Description|
|---|---|---|---|
|[**WebCobra**](../xample-malware/webcobra.md)|November 2018|--|Drops software to mine for cryptocurrency. [[1]](#1)|
|[**Geneio**](../xample-malware/geneio.md)|August 2015|--|Tricks OS X keychain to create application files.|
|[**GotBotKR**](../xample-malware/gobotkr.md)|July 2019|--|GotBotKR reinstalls its running instance if it is removed. [[3]](#3)|
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|Installs a backdoor.|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|A Trojan downloader.|
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|Can download and install arbitrary iOS apps.|
|[**UP007**](../xample-malware/up007.md)|2016|--|The malware is a dropper that creates multiple files [[4]](#4)|
|[**Geneio**](../xample-malware/geneio.md)|August 2015|--|Geneio installs the browser extension ~/Library/Safari/Extensions/Omnibar.safariextz. It also creates app files. [[7]](#7)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR reinstalls its running instance if it is removed. [[3]](#3)|
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|Installs a backdoor. [[8]](#8)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware contains a dropper that installs additional programs like Cbrom.exe. [[9]](#9)|
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|Can download and install arbitrary iOS apps. [[10]](#10)|
|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|Upon execution, CozyCar drops a decoy file and a secondary dropper [[5]](#5)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer drops a file masquerading as a Control Panel (CPL) file [[6]](#6)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Contain an embedded PE file (This capa rule had 1 match) [[11]](#11)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Contain an embedded PE file (This capa rule had 1 match) [[11]](#11)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Contain an embedded PE file (This capa rule had 1 match) [[11]](#11)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs an open-source program called mitmproxy. [[12]](#12)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|The malware is a dropper that creates multiple files [[4]](#4)|
## References
@@ -58,4 +62,19 @@ Malware that installs another component is called a "dropper." If the code is co
<a name="5">[5]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
<a name="6">[6]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="6">[6]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="7">[7]</a> https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/
<a name="8">[8]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
<a name="9">[9]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
<a name="10">[10]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
<a name="11">[11]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="12">[12]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
<a name="13">[13]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
execution/prevent-concurrent-execution.md
+3 -2
View File
@@ -34,8 +34,9 @@ To avoid running multiple instances of itself, malware may check a system to see
|Name|Date|Method|Description|
|---|---|---|---|
|[**Bagle**](../xample-malware/bagle.md)|2004|--|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [1](#1)|
|[**Bagle**](../xample-malware/bagle.md)|2004|--|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/worm_bagle.u
<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/WORM_BAGLE.U/
execution/remote-commands.md
+2 -1
View File
@@ -56,7 +56,7 @@ Autonomous behaviors - those done by the malware without an active attacker - sh
|Name|Date|Method|Description|
|---|---|---|---|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, upload a log file which contains stolen information [[1]](#1)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|infected bots receive commands from botmaster to load plugins associated with botmaster's goals [[2]](#2)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Infected bots receive commands from botmaster to load plugins associated with botmaster's goals [[2]](#2)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Receives various commands from c2 server. [[3]](#3)|
## References
@@ -66,3 +66,4 @@ Autonomous behaviors - those done by the malware without an active attacker - sh
<a name="2">[2]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
<a name="3">[3]</a> https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
execution/send-email.md
+4 -2
View File
@@ -38,8 +38,7 @@ This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/tec
|---|---|---|---|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
|[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|spam email with the Emotet loader is sent automatically [[3]](#3)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Spam email with the Emotet loader is sent automatically [[3]](#3)|
## References
@@ -48,3 +47,6 @@ This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/tec
<a name="2">[2]</a> https://en.wikipedia.org/wiki/Bagle_(computer_worm)
<a name="3">[3]</a> https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/
<a name="4">[4]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
execution/send-poisoned-text-message.md
+2 -1
View File
@@ -34,10 +34,11 @@ A malicious attachment is sent via spam SMS or MMS messages. When the user click
|Name|Date|Method|Description|
|---|---|---|---|
|[**MazarBot**](../xample-malware/mazarbot.md)||--|MazarBot is delivered via a poisoned SMS message. [[1]](#1)|
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|MazarBot is delivered via a poisoned SMS message. [[1]](#1)|
## References
<a name="1">[1]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
<a name="2">[2]</a> https://www.player.one/new-android-sms-malware-can-completely-own-your-phone-just-one-text-how-avoid-mazar-512363
execution/user-execution.md
+10 -2
View File
@@ -36,10 +36,11 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites.|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware relies on a victim to execute itself [[2]](#2)|
|[**Terminator**](../xample-malware/terminator.md)|2013|--|The malware relies on user interaction to execute [[3]](#3)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware relies on victims to execute [[5]](#5)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|A user must execute the malicious program. [[4]](#4)|
## References
@@ -48,3 +49,10 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq
<a name="2">[2]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="3">[3]</a> https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes
<a name="4">[4]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
<a name="5">[5]</a> https://www.secureworks.com/research/cryptolocker-ransomware
<a name="6">[6]</a> https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf
exfiltration/archive-collected-data.md
+3 -3
View File
@@ -48,12 +48,12 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers [[2]](#2)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|E1560.m02|Uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1560.m04|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers [[2]](#2)|
## References
<a name="1">[1]</a> https://www.bitdefender.com/blog/labs/trickbot-is-dead-long-live-trickbot/
<a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
impact/clipboard-modification.md
+9 -2
View File
@@ -39,7 +39,14 @@ ATT&CK defines Clipboard Modification as a Mobile technique (Android platform).
|Name|Date|Method|Description|
|---|---|---|---|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors the clipboard for cryptocurrency addresses and replaces them with ones controlled by the adversary [[1]](#1)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Write clipboard data (This capa rule had 4 matches) [[2]](#2)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Write clipboard data (this capa rule had 1 match) [[2]](#2)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Replace clipboard data (This capa rule had 1 match) [[2]](#2)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Replace clipboard data (This capa rule had 1 match) [[2]](#2)|
## References
<a name="1">[1]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="1">[1]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="2">[2]</a> capa v4.0, analyzed at MITRE on 10/12/2022
impact/data-destruction.md
+5 -2
View File
@@ -48,10 +48,10 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148
|Name|Date|Method|Description|
|---|---|---|---|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery.[[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery. [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the User's home folder [[2]](#2)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy 2 variant contains a Destroy plugin that destroys data stored on victim hard drives by overwriting file contents [[3]](#3)|
|[**Conficker**](../xample-malware/conficker.md)|2008|--|resets system restore points and deletes backup files [[4]](#4)|
|[**Conficker**](../xample-malware/conficker.md)|2008|--|Resets system restore points and deletes backup files [[4]](#4)|
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|Can erase phone data [[5]](#5)|
## References
@@ -65,3 +65,6 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148
<a name="4">[4]</a> https://en.wikipedia.org/wiki/Conficker
<a name="5">[5]</a> https://heimdalsecurity.com/blog/security-alert-mazar-bot-active-attacks-android-malware/
<a name="6">[6]</a> https://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow
impact/data-encrypted-for-impact.md
+5 -4
View File
@@ -46,8 +46,8 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni
|Name|Date|Method|Description|
|---|---|---|---|
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|[[1]](#1)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|[[2]](#2)|
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|E1486.001|The malware launches Internet Explorer to show ransom notes [[1]](#1)|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|E1486.001|The malware launches Internet Explorer to show ransom notes [[2]](#2)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Encrypts files for ransom without any connection to the Internet [[3]](#3)|
|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam encrypts data to hold for ransom [[4]](#4)|
|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker encrypts files for ransom [[5]](#5)|
@@ -56,10 +56,11 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni
<a name="1">[1]</a> http://www.secureworks.com/cyber-threat-intelligence/threats/cryptowall-ransomware/
<a name="2">[2]</a> http://www.secureworks.com/cyber-threat-intelligence/threats/cryptolocker-ransomware/
<a name="2">[2]</a> https://www.secureworks.com/research/cryptolocker-ransomware
<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/
<a name="4">[4]</a> https://www.cisa.gov/uscert/ncas/alerts/AA18-337A
<a name="5">[5]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
<a name="5">[5]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
impact/denial-of-service.md
+5 -2
View File
@@ -43,10 +43,13 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|October 2007|--|Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[2]](#2)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[2]](#2)|
## References
<a name="1">[1]</a> http://atlas-public.ec2.arbor.net/docs/BlackEnergy+DDoS+Bot+Analysis.pdf
<a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
<a name="3">[3]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
impact/destroy-hardware.md
+3
View File
@@ -43,3 +43,6 @@ Destroys a physical piece of hardware. For example, malware may cause hardware t
## References
<a name="1">[1]</a> https://www.bbc.com/timelines/zc6fbk7
<a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
impact/disk-wipe.md
+1 -1
View File
@@ -41,7 +41,7 @@ This description refines the ATT&CK **Disk Wipe ([T1203](https://attack.mitre.or
|---|---|---|---|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|An overwrite component will overwrite the MBR so that the compromised computer can no longer start [[1]](#1)|
## References
<a name="1">[1]</a> https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=281521ea-2d18-4bf9-9e88-8b1dc41cfdb6&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
impact/exploit-kit.md
-6
View File
@@ -36,12 +36,6 @@ An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver
See related ATT&CK Technique: **Exploit Public-Facing Application ([T1190](https://attack.mitre.org/techniques/T1190))**, which relates to Initial Access. Under the Impact objective, exploit behaviors are considered more broadly in MBC.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Ursnif**](../xample-malware/ursnif.md)||--|Ursnif is sometimes delivered via exploit kit. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
impact/generate-traffic-from-victim.md
+9 -3
View File
@@ -46,7 +46,8 @@ Malware may generate traffic from the victim system such as clicks of advertisin
|Name|Date|Method|Description|
|---|---|---|---|
|[**DNSChanger**](../xample-malware/dnschanger.md)|November 2011|--|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Performs click-fraud. [[4]](#4)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Performs click-fraud. [[3]](#3)|
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1643.m02|Displays brief advertisements whenever the user opens applications on their phone [[4]](#4)|
## References
@@ -54,6 +55,11 @@ Malware may generate traffic from the victim system such as clicks of advertisin
<a name="2">[2]</a> https://www.fipp.com/news/insightnews/what-are-the-nine-types-of-digital-ad-fraud
<a name="3">[3]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
<a name="3">[3]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
<a name="4">[4]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
<a name="5">[5]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
<a name="6">[6]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
<a name="4">[4]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
impact/manipulate-network-traffic.md
+4 -1
View File
@@ -41,8 +41,11 @@ The related **Data Manipulation: Transmitted Data Manipulation ([T1565.002](http
|Name|Date|Method|Description|
|---|---|---|---|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|Intercepts encrypted web traffic to inject adds. [[1]](#1)|
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|Intercepts data coming into and going out of device.|
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|Intercepts data coming into and going out of device. [[2]](#2)|
## References
<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
<a name="2">[2]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
impact/remote-access.md
+4 -1
View File
@@ -49,7 +49,7 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu
|Name|Date|Method|Description|
|---|---|---|---|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Allows an attacker to control the system via a GUI.|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Allows an attacker to control the system via a GUI [[3]](#3)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware acts as a backdoor [[4]](#4)|
## References
@@ -61,3 +61,6 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu
<a name="3">[3]</a> https://en.wikipedia.org/wiki/DarkComet
<a name="4">[4]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HUPIGON
<a name="5">[5]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
impact/resource-hijacking.md
+4 -3
View File
@@ -48,8 +48,8 @@ The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1
|Name|Date|Method|Description|
|---|---|---|---|
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Drops software to mine for cryptocurrency. [[1]](#1)|
|Adylkuzz|May 2017|--|Consumes system resources to mine for cryptocurrency. [[2]](#2)|
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[3]](#3)|
|**Adylkuzz**|May 2017|--|Consumes system resources to mine for cryptocurrency. [[2]](#2)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[3]](#3)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer uses sytem resources to mine for cryptocurrency [[4]](#4)|
## References
@@ -60,4 +60,5 @@ The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1
<a name="3">[3]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
<a name="4">[4]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="4">[4]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
impact/spamming.md
+2 -1
View File
@@ -38,7 +38,7 @@ Malware may use a victim machine to create and send spam.
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../xample-malware/trickbot.md)|July 2019|--|In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)|
|[**TrickBot**](../xample-malware/trickbot.md)|2019|--|TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|If port 25 is open, the bot uses a spam template and email list to send spam. [[2]](#2)|
## References
@@ -46,3 +46,4 @@ Malware may use a victim machine to create and send spam.
<a name="1">[1]</a> https://techcrunch.com/2019/07/12/trickbot-spam-millions-emails/
<a name="2">[2]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
lateral-movement/supply-chain-compromise.md
+2 -1
View File
@@ -41,8 +41,9 @@ The supply chain may be compromised to enable initial malware infection. MBC obj
|Name|Date|Method|Description|
|---|---|---|---|
|[**YiSpecter**](../xample-malware/yispecter.md)|October 2015|--|Attacks both jailbroken and non-jailbroken iOS devices by exploiting private APIs. [[1]](#1)|
|[**YiSpecter**](../xample-malware/yispecter.md)|October 2015|E1195.m02, E1195.m01|Please see the YiSpecter malware page for details. [[1]](#1)|
## References
<a name="1">[1]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
mbc_summary.md
+1 -1
View File
@@ -131,7 +131,7 @@
|C0049|FILE SYSTEM|**[Get File Attributes](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/get-file-attributes.md)**|
|C0050|FILE SYSTEM|**[Set File Attributes](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/set-file-attributes.md)**|
|C0051|FILE SYSTEM|**[Read File](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/read-file.md)**|
|C0052|FILE SYSTEM|**[Writes File](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/write-file.md)**|
|C0052|FILE SYSTEM|**[Writes File](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/writes-file.md)**|
|C0053|DATA|**[Decode Data](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/decode-data.md)**|
|C0054|PROCESS|**[Resume Thread](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/resume-thread.md)**|
|C0055|PROCESS|**[Suspend Thread](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/suspend-thread.md)**|
micro-behaviors/communication/dns-communication.md
+12
View File
@@ -39,3 +39,15 @@ The DNS Communication micro-behavior focuses on DNS communication.
|**Resolve Free Hosting Domain**|C0011.005|Resolves a free hosting domain (e.g., freeiz.com).|
|**Resolve TLD**|C0011.004|Resolves top level domain.|
|**Server Connect**|C0011.002|Connects to DNS server.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0011.001|Resolve DNS (This capa rule had 1 match) [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0011.001|Resolve DNS (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/communication/http-communication.md
+13
View File
@@ -54,3 +54,16 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
|**WinHTTP**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
|**WinINet**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0002.011, C0002.010|Please see the BlackEnergy malware page for details. [[1]](#1)|
|[**Emotet**](../xample-malware/emotet.md)|2018|C0002.012|Create http request (this capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|C0002.009, C0002.012|Please see the Kovter malware page for details. [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/communication/interprocess-communication.md
+12
View File
@@ -38,3 +38,15 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
|**Create Pipe**|C0003.001||
|**Read Pipe**|C0003.003||
|**Write Pipe**|C0003.004||
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0003.001, C0003.004|Please see the Hupigon malware page for details. [[1]](#1)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|C0003.004|Write pipe (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/communication/socket-communication.md
+7 -2
View File
@@ -59,9 +59,14 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|Name|Date|Method|Description|
|---|---|---|---|
|[**SYNfulKnock**](../../xample-malware/synful-knock.md)|2015|--|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0001.010|Create UDP socket (This capa rule had 1 match) [[2]](#2)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0001.011|Create TCP socket (This capa rule had 1 match) [[2]](#2)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0001.009|Initialize Winsock library (This capa rule had 1 match) [[2]](#2)|
|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|C0001.014|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router [[1]](#1)|
## References
<a name="1">[1]</a> https://www.mandiant.com/resources/synful-knock-acis
<a name="2">[2]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/cryptography/cryptographic-hash.md
+14
View File
@@ -40,3 +40,17 @@ Malware may use a cryptographic hash.
|**SHA256**|C0029.003|Malware uses a SHA-256 hash.|
|**Snefru**|C0029.006|Malware uses a Snefru hash.|
|**Tiger**|C0029.005|Malware uses a Tiger hash.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0029, C0029.001, C0029.002|Please see the BlackEnergy malware page for details. [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Hash data via WinCrypt (This capa rule had 22 matches) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0029, C0029.002|Please see the Redhip malware page for details. [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0029.002|Hash data using SHA1 (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/cryptography/decrypt-data.md
+13 -1
View File
@@ -49,6 +49,14 @@ Malware may decrypt data.
|**Stream Cipher**|C0031.013|Malware decrypts data encrypted with a stream cipher.|
|**Twofish**|C0031.014|Malware decrypts data encrypted with the Twofish algorithm.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
## Code Snippets
### C0031
@@ -106,4 +114,8 @@ pop ebx
retn
</pre>
</details>
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/cryptography/encrypt-data.md
+15 -5
View File
@@ -54,11 +54,19 @@ Malware may encrypt data.
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../../xample-malware/trickbot.md)|2016|--|Uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files [[1]](#1)|
|[**Emotet**](../../xample-malware/emotet.md)|2018|--|Emotet uses RSA to encrypt network traffic to its C2 [[2]](#2)|
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--| GravityRat v3 supports file AES file encryption [[3]](#3)|
|[**Poison-Ivy**](../../xample-malware/poison-ivy.md)|2005|--|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key [[4]](#4)|
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK encrypts the configuration block using RC4 encryption [[5]](#5)|
|[**TrickBot**](../../xample-malware/trickbot.md)|2016|C0027.001|Uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files [[1]](#1)|
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|C0027.001| GravityRat v3 supports file AES file encryption [[3]](#3)|
|[**Poison-Ivy**](../../xample-malware/poison-ivy.md)|2005|C0027.003|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key [[4]](#4)|
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|C0027.009|CHOPSTICK encrypts the configuration block using RC4 encryption [[5]](#5)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0027.009|Encrypt data using RC4 via WinAPI (This capa rule had 1 match) [[6]](#6)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 3 matches) [[6]](#6)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 1 match) [[6]](#6)|
|[**Emotet**](../xample-malware/emotet.md)|2018|C0027.011, C0027.009|Please see the Emotet malware page for details. [[2]](#2)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0027.004|Encrypt data using DES (This capa rule had 1 match) [[6]](#6)|
|[**Kraken**](../xample-malware/kraken.md)|2008|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 2 matches) [[6]](#6)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 1 match) [[6]](#6)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Encrypt data using DPAPI (This capa rule had 6 matches) [[6]](#6)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 1 match) [[6]](#6)|
## Code Snippets
@@ -131,3 +139,5 @@ retn
<a name="5">[5]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
<a name="6">[6]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/cryptography/encryption-key.md
+14
View File
@@ -36,3 +36,17 @@ Malware may import, generate, or otherwise use an encryption key.
|---|---|---|
|**Import Public Key**|C0028.001|Malware imports a public key.|
|**RC4 KSA**|C0028.002|Malware uses the RC4 Key Scheduling Algorithm (KSA).|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Create new key via CryptAcquireContext (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Create new key via CryptAcquireContext (This capa rule had 1 match) [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Create new key via CryptAcquireContext (This capa rule had 1 match) [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0028.002|Encrypt data using RC4 KSA (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/cryptography/generate-pseudorandom-sequence.md
+12 -1
View File
@@ -38,4 +38,15 @@ The Generate Pseudo-random Sequence microbehavior can be used for a number of pu
|**Use API**|C0021.003|Malware generates a pseudo-random sequence using a Windows API.|
|**rand**|C0021.002|Malware generates a pseudo-random sequence using rand.|
|**RC4 PRGA**|C0021.004|Malware generates a pseudo-random sequence using the RC4 Pseudo Random (Byte) Generation Algorithm (PRGA).|
|**Mersenne Twister**|C0021.005|Malware generates a pseudo-random sequence using the Mersenne Twister PRNG.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/data/check-string.md
+11
View File
@@ -29,3 +29,14 @@
# Check String
Malware may check a string for some characteristics, such as being ascii content; credit card number; or length.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Reference Base64 string (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/data/checksum.md
+14 -1
View File
@@ -38,4 +38,17 @@ Malware may derive a checksum from some block of data. The checksum is often use
|**BSD**|C0032.003|Malware computes a BSD checksum.|
|**CRC32**|C0032.001|Malware computes a CRC32 checksum.|
|**Luhn**|C0032.002|Malware uses Luhn algorithm, often to validate identification numbers (e.g, credit card number).|
|**Verhoeff**|C0032.004|Malware uses the Verhoeff algorithm, often for purposes of error detection.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0032.001|Hash data with CRC32 (This capa rule had 5 matches) [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|C0032.001|Hash data with CRC32 (This capa rule had 1 match) [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0032.001|Hash data with CRC32 (This capa rule had 2 matches) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0032.001|Hash data with CRC32 (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/data/compression-library.md
+12 -1
View File
@@ -28,4 +28,15 @@
# Compression Library
Malware uses a compression library.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/data/decompress-data.md
+11
View File
@@ -37,3 +37,14 @@ Malware may decompress data.
|**aPLib**|C0025.003|Malware decompresses data using aPLib.|
|**IEncodingFilterFactory**|C0025.002|Malware decompresses data using IEncodingFilterFactory.|
|**QuickLZ**|C0025.001|Malware decompresses data using QuickLZ.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Bagle**](../xample-malware/bagle.md)|2004|C0025.003|Decompress data using aPLib (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/data/encode-data.md
+24
View File
@@ -36,3 +36,27 @@ Malware may encode data.
|---|---|---|
|**Base64**|C0026.001|Malware may encode data using Base64.|
|**XOR**|C0026.002|Malware may use xor to encode data.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0026.002|Encode data using XOR (This capa rule had 13 matches) [[1]](#1)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0026.002|Encode data using XOR (This capa rule had 8 matches) [[1]](#1)|
|[**Kraken**](../xample-malware/kraken.md)|2008|C0026.002|Encode data using XOR (This capa rule had 2 matches) [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0026.002|Encode data using XOR (This capa rule had 4 matches) [[1]](#1)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|C0026.002|Encode data using XOR (This capa rule had 2 matches) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0026.002|Encode data using XOR (This capa rule had 5 matches) [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0026.002|Encode data using XOR (This capa rule had 3 matches) [[1]](#1)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0026.002|Encode data using XOR (This capa rule had 2 matches) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0026.002|Encode data using XOR (This capa rule had 13 matches) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/data/noncryptographic-hash.md
+2 -1
View File
@@ -38,4 +38,5 @@ Malware may use a non-cryptographic hash.
|**Fast-Hash**|C0030.003|Malware uses the Fast-Hash hash function.|
|**FNV**|C0030.005|Malware uses the FNV hash function.|
|**MurmurHash**|C0030.001|Malware uses the MurmurHash hash function.|
|**pHash**|C0030.002|Malware uses the pHash hash function.|
|**pHash**|C0030.002|Malware uses the pHash hash function.|
|**djb2**|C0030.006|Malware uses the djb2 hash function.|
micro-behaviors/file-system/README.md
+1 -1
View File
@@ -28,4 +28,4 @@ Micro-behaviors related to file manipulation.
* **Read File** [C0051](../file-system/read-file.md)
* **Read Virtual Disk** [C0056](../file-system/read-virtual-disk.md)
* **Set File Attributes** [C0050](../file-system/set-file-attributes.md)
* **Write File** [C0052](../file-system/write-file.md)
* **Writes File** [C0052](../file-system/writes-file.md)
micro-behaviors/file-system/copy-file.md
+16 -1
View File
@@ -28,4 +28,19 @@
# Copy File
Malware copies a file.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Copy file (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Copy file (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Copy file (This capa rule had 5 matches) [[1]](#1)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Copy file (This capa rule had 2 matches) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Copy file (This capa rule had 2 matches) [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Copy file (This capa rule had 2 matches) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/create-directory.md
+17 -1
View File
@@ -28,4 +28,20 @@
# Create Directory
Malware creates a directory.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Create directory (This capa rule had 1 match) [[1]](#1)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Create directory (This capa rule had 1 match) [[1]](#1)|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Create directory (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Create directory (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Create directory (This capa rule had 14 matches) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Create directory (This capa rule had 1 match) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Create directory (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/delete-directory.md
+13 -1
View File
@@ -28,4 +28,16 @@
# Delete Directory
Malware deletes a directory.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/delete-file.md
+23 -1
View File
@@ -28,4 +28,26 @@
# Delete File
Malware deletes a file.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Delete file (This capa rule had 1 match) [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Delete file (This capa rule had 4 matches) [[1]](#1)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Delete file (This capa rule had 1 match) [[1]](#1)|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Delete file (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Delete file (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Delete file (This capa rule had 2 matches) [[1]](#1)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Delete file (This capa rule had 5 matches) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Delete file (This capa rule had 2 matches) [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Delete file (This capa rule had 1 match) [[1]](#1)|
|[**SamSam**](../xample-malware/samsam.md)|2015|--|Delete file (This capa rule had 1 match) [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Delete file (This capa rule had 6 matches) [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Delete file (This capa rule had 1 match) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Delete file (This capa rule had 2 matches) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/get-file-attributes.md
+16 -1
View File
@@ -28,4 +28,19 @@
# Get File Attributes
Malware gets the attributes of a file.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Get file attributes (This capa rule had 2 matches) [[1]](#1)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Get file attributes (This capa rule had 1 match) [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Get file attributes (This capa rule had 10 matches) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Get file attributes (This capa rule had 3 matches) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Get file attributes (This capa rule had 2 matches) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Get file attributes (This capa rule had 7 matches) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/move-file.md
+16 -1
View File
@@ -28,4 +28,19 @@
# Move File
Malware moves a file.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Move file (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Move file (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Move file (This capa rule had 24 matches) [[1]](#1)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Move file (This capa rule had 2 matches) [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Move file (This capa rule had 2 matches) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Move file (This capa rule had 2 matches) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/read-file.md
+24 -1
View File
@@ -28,4 +28,27 @@
# Read File
Malware reads a file.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Read file on Windows (This capa rule had 7 matches) [[1]](#1)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Read file on Windows (This capa rule had 3 matches) [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Read file on Windows (This capa rule had 2 matches) [[1]](#1)|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Read file on Windows (This capa rule had 9 matches) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Read file on Windows (This capa rule had 4 matches) [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Read file on Windows (This capa rule had 2 matches) [[1]](#1)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Read file on Windows (This capa rule had 3 matches) [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Read file on Windows (This capa rule had 3 matches) [[1]](#1)|
|[**SamSam**](../xample-malware/samsam.md)|2015|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/set-file-attributes.md
+16 -1
View File
@@ -28,4 +28,19 @@
# Set File Attributes
Malware sets or modifies the attributes of a file.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Set file attributes (This capa rule had 1 match) [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Set file attributes (This capa rule had 2 matches) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Set file attributes (This capa rule had 1 match) [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Set file attributes (This capa rule had 3 matches) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Set file attributes (This capa rule had 1 match) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Set file attributes (This capa rule had 4 matches) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/write-file.md
-31
View File
@@ -1,31 +0,0 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>C0052</b></td>
</tr>
<tr>
<td><b>Objective(s)</b></td>
<td><b><a href="../file-system">File System</a></b></td>
</tr>
<tr>
<td><b>Related ATT&CK Techniques</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
</tr>
<tr>
<td><b>Created</b></td>
<td><b>4 December 2020</b></td>
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
</tr>
</table>
# Writes File
Malware writes to a file. Writing to a file enables file modification.
micro-behaviors/file-system/writes-file.md
+52
View File
@@ -0,0 +1,52 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>C0052</b></td>
</tr>
<tr>
<td><b>Objective(s)</b></td>
<td><b><a href="../file-system">File System</a></b></td>
</tr>
<tr>
<td><b>Related ATT&CK Techniques</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
</tr>
<tr>
<td><b>Created</b></td>
<td><b>4 December 2020</b></td>
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
</tr>
</table>
# Writes File
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|Writes Fileon Windows (This capa rule had 1 match) [[1]](#1)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Writes Fileon Windows (This capa rule had 5 matches) [[1]](#1)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Writes Fileon Windows (This capa rule had 2 matches) [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Writes file on Windows (This capa rule had 3 matches) [[1]](#1)|
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Write file on Windows (This capa rule had 7 matches) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Write file on Windows (This capa rule had 4 matches) [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Write file on Windows (This capa rule had 3 matches) [[1]](#1)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Write file on Windows (This capa rule had 1 match) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Write file on Windows (This capa rule had 1 match) [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Write file on Windows (This capa rule had 4 matches) [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Write file on Windows (This capa rule had 1 match) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Write file on Windows (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/memory/allocate-memory.md
+19
View File
@@ -29,3 +29,22 @@
# Allocate Memory
Malware allocates memory, often to unpack itself.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|Allocate RWX memory (This capa rule had 1 match) [[1]](#1)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Allocate RWX memory (This capa rule had 1 match) [[1]](#1)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Allocate RWX memory (This capa rule had 2 matches) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Allocate RWX memory (This capa rule had 4 matches) [[1]](#1)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Allocate RWX memory (This capa rule had 1 match) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Spawn thread to RWX shellcode (This capa rule had 1 match) [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Allocate RWX memory (This capa rule had 2 matches) [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Allocate RWX memory (This capa rule had 1 match) [[1]](#1)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Allocate RWX memory (This capa rule had 7 matches) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/memory/change-memory-protection.md
+2 -1
View File
@@ -43,10 +43,11 @@ Malware may change memory protection. For example, read-write memory may be chan
|Name|Date|Method|Description|
|---|---|---|---|
|[**Ursnif**](../../xample-malware/ursnif.md)|2016|--|Changes the PE header of the child process to enable write access to that page, writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe process executable in the target child process. Then changes the region protection back to "read only" to avoid suspicion [[1]](#1)|
|[**SYNfulKnock**](../../xample-malware/synful-knock.md)|2015|--|Modifies the translation lookaside buffer (TLB) Read/Write attributes [[2]](#2)|
|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|--|Modifies the translation lookaside buffer (TLB) Read/Write attributes [[2]](#2)|
## References
<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
<a name="2">[2]</a> https://www.mandiant.com/resources/synful-knock-acis
micro-behaviors/memory/overflow-buffer.md
+1 -1
View File
@@ -37,7 +37,7 @@ Malware may overflow the buffer for various purposes.
|---|---|---|---|
|[**Conficker**](../../xample-malware/conficker.md)|2008|--|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer [[1]](#1)|
## References
<a name="1">[1]</a> https://en.wikipedia.org/wiki/Conficker
micro-behaviors/operating-system/environment-variable.md
+12 -1
View File
@@ -35,4 +35,15 @@ Malware modifies environment variables.
|Name|ID|Description|
|---|---|---|
|**Set Variable**|C0034.001|Malware sets an environment variable.|
|**Get Variable**|C0034.002|Malware gets an environment variable.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Kovter**](../xample-malware/kovter.md)|2016|C0034.001|Set environment variable (This capa rule had 3 matches) [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0034.001|Set environment variable (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/operating-system/registry.md
+23
View File
@@ -41,3 +41,26 @@ Malware modifies the registry.
|**Query Registry Key**|C0036.005|Malware queries a registry key.|
|**Query Registry Value**|C0036.006|Malware queries a registry value.|
|**Set Registry Key**|C0036.001|Malware sets a registry key.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0036.005, C0036.006|Please see the BlackEnergy malware page for details. [[1]](#1)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.002, C0036.007, C0036.005, C0036.006, C0036.001|Please see the Dark Comet malware page for details. [[1]](#1)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0036.006, C0036.001|Please see the DNSChanger malware page for details. [[1]](#1)|
|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.002, C0036.007, C0036.005, C0036.006, C0036.001|Please see the Gamut malware page for details. [[1]](#1)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|C0036.006|Query or enumerate registry value (This capa rule had 1 match) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.002, C0036.007, C0036.005, C0036.006, C0036.001|Please see the Hupigon malware page for details. [[1]](#1)|
|[**Kovter**](../xample-malware/kovter.md)|2016|C0036.004, C0036.006|Please see the Kovter malware page for details. [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0036.001|Set registry value (This capa rule had 1 match) [[1]](#1)|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|C0036.006|Query or enumerate registry value (This capa rule had 1 match) [[1]](#1)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.002, C0036.006, C0036.001|Please see the Redhip malware page for details. [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.002, C0036.006, C0036.001|Please see the Rombertik malware page for details. [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0036.007, C0036.006|Please see the Shamoon malware page for details. [[1]](#1)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0036.006, C0036.001|Please see the UP007 Malware Family malware page for details. [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/process/allocate-thread-local-storage.md
+12 -1
View File
@@ -30,4 +30,15 @@
Malware allocates thread local storage.
This micro behavior is a lower level counterpart to ATT&CK's [**Process Injection::Thread Local Storage**](https://attack.mitre.org/techniques/T1055/005) technique.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Allocate thread local storage (This capa rule had 3 matches) [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Allocate thread local storage (This capa rule had 1 match) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/process/check-mutex.md
+3 -1
View File
@@ -36,7 +36,9 @@ Malware checks a mutex.
|---|---|---|---|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists [[1]](#1)|
## References
<a name="1">[1]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
<a name="2">[2]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
micro-behaviors/process/create-mutex.md
+9
View File
@@ -36,9 +36,18 @@ Malware creates a mutex.
|---|---|---|---|
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy has a default process mutex, but can be altered at build time [2] [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Creates global mutexes signal that rootkit installation has occurred successfully [[2]](#2)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Create mutex (This capa rule had 1 match) [[3]](#3)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Create mutex (This capa rule had 2 matches) [[3]](#3)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Create mutex (This capa rule had 1 match) [[3]](#3)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Create mutex (This capa rule had 1 match) [[3]](#3)|
## References
<a name="1">[1]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
<a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
<a name="3">[3]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="4">[4]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
micro-behaviors/process/create-process.md
+15 -2
View File
@@ -43,9 +43,22 @@ Malware creates a process.
|Name|Date|Method|Description|
|---|---|---|---|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet will use WMI operations with the explorere.exe token in order to copy itself and exscute on the remote share [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0017.002|Stuxnet will use WMI operations with the explorere.exe token in order to copy itself and exscute on the remote share [[1]](#1)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Create process on Windows (This capa rule had 2 matches) [[2]](#2)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Create process on Windows (This capa rule had 6 matches) [[2]](#2)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Create process on Windows (This capa rule had 4 matches) [[2]](#2)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Create process on Windows (This capa rule had 4 matches) [[2]](#2)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Create process on Windows (This capa rule had 9 matches) [[2]](#2)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Create process on Windows (This capa rule had 22 matches) [[2]](#2)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Create process on Windows (This capa rule had 1 match) [[2]](#2)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0017, C0017.003|Please see the Redhip malware page for details. [[2]](#2)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Create process on Windows (This capa rule had 2 matches) [[2]](#2)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0017, C0017.003|Please see the TrickBot malware page for details. [[2]](#2)|
|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Create process on Windows (This capa rule had 3 matches) [[2]](#2)|
## References
<a name="1">[1]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
<a name="2">[2]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/process/create-thread.md
+16 -1
View File
@@ -28,4 +28,19 @@
# Create Thread
Malware creates a thread.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Create thread (This capa rule had 3 matches) [[1]](#1)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Create thread (This capa rule had 2 matches) [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Create thread (This capa rule had 6 matches) [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Create thread (This capa rule had 1 match) [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Create thread (This capa rule had 1 match) [[1]](#1)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Create thread (This capa rule had 2 matches) [[1]](#1)|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022

Some files were not shown because too many files have changed in this diff Show More