admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

New Malware Examples + Editing References (#105)

Browse Source 
* New malware examples (#103)

* fix typos

* add new Use in Malware entries to behaviors

* new corpus entries

* remove extraneous ref

* restore original IDs

* fix typos

* Update registry.md (#101)

Update C0036.001 per "Registry micro-behavior" Discussion.

* Update registry.md (#102)

Update C0036.001 per "Registry micro-behavior" Discussion.

* correct modified date

* fix PR comments on formatting

* Editing references (#104)

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
This commit is contained in:
Ryan Xu
2023-06-12 10:30:56 -04:00
committed by ryan
parent 39a49dca38
commit 275c8feec3
86 changed files with 699 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-behavioral-analysis/README.md
+1 -1
View File
@@ -32,6 +32,6 @@ Behaviors that prevent, obstruct, or evade behavioral analysis of malware--for e
## References
<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map
<a name="1">[1]</a> https://search.unprotect.it/map/
<a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
anti-behavioral-analysis/debugger-detection.md
+1 -1
View File
@@ -115,7 +115,7 @@ Details on detecting debuggers are given in the references.
<a name="3">[3]</a> Peter Ferrie, "The 'Ultimate' Anti-Debugging Reference," 4 May 2011. https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf.
<a name="4">[4]</a> Atif Mushtaq, FireEye, "The Dead Giveaways of VM-Aware Malware," 27 January 2011. https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html.
<a name="4">[4]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="5">[5]</a> Ayoub Faouzi (LordNoteworthy), Al-Khaser v0.79. https://github.com/LordNoteworthy/al-khaser
anti-behavioral-analysis/debugger-evasion.md
+1 -1
View File
@@ -89,6 +89,6 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
<a name="2">[2]</a> https://web.archive.org/web/20210225195315/https://www.synack.com/blog/analyzing-the-anti-analysis-logic-of-an-adware-installer/
<a name="3">[3]</a> Atif Mushtaq, FireEye, "The Dead Giveaways of VM-Aware Malware," 27 January 2011. https://web.archive.org/web/20161025013916/https:/www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="4">[4]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
anti-behavioral-analysis/dynamic-analysis-evasion.md
+1 -1
View File
@@ -76,7 +76,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
## References
<a name="1">[1]</a> https://joesecurity.org/blog/43104088277279070
<a name="1">[1]</a> https://www.joesecurity.org/blog/4310408827727907098
<a name="2">[2]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
anti-static-analysis/README.md
+1 -1
View File
@@ -28,6 +28,6 @@ Behaviors and code characteristics that prevent or hinder static analysis of the
## References
<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map/sandbox-evasion/
<a name="1">[1]</a> https://search.unprotect.it/map/sandbox-evasion/
<a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
anti-static-analysis/call-graph-generation-evasion.md
+6 -3
View File
@@ -17,7 +17,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -25,7 +25,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>4 May 2023</b></td>
<td><b>3 June 2023</b></td>
</tr>
</table>
@@ -40,6 +40,7 @@ Malicious code evades accurate call graph generation, which can be used for malw
|---|---|---|
|**Invoke NTDLL System Calls via Encoded Table**|B0010.002|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[5]](#5)|
|**Two-layer Function Return**|B0010.001|Two layer jumping confuses tools plotting call graphs. [[5]](#5)|
|**Shadow Process Communication**|B0010.003| Uses multiple processes (instead of one process) to make behavior detection more difficult. [[6]](#6)|
## References
@@ -51,4 +52,6 @@ Malicious code evades accurate call graph generation, which can be used for malw
<a name="4">[4]</a> J. Kinable, "Malware Detection Through Call Graphs," Master thesis, Department of Telematics, Norwegian University of Science and Technology, Norway, June 2010. [Online]. Available: https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/262290/353049_FU LLTEXT01.pdf?sequence=1&isAllowed=y.
<a name="5">[5]</a> http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html
<a name="5">[5]</a> http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html
<a name="6">[6]</a> Weiqin Ma, Pu Duan, Sanmin Liu, Guofei Gu and Jyh-Charn Liu,"Shadow Attacks: Automatically Evading System-Call-Behavior Based Malware Detection" https://people.engr.tamu.edu/guofei/paper/ShadowAttacks_final-onecolumn.pdf
anti-static-analysis/disassembler-evasion.md
+1 -1
View File
@@ -53,7 +53,7 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented
## References
<a name="1">[1]</a> Practical Malware Analysis by Michael Sikorski, Andrew Honig, February 2012, Publisher(s): No Starch Press.
<a name="1">[1]</a> M. Sikorski and A. Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, No Starch Press, 2012.
<a name="2">[2]</a> https://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf
anti-static-analysis/software-packing.md
+1 -1
View File
@@ -71,7 +71,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
<a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771
<a name="3">[3]</a> Atif Mushtaq, FireEye, "The Dead Giveaways of VM-Aware Malware," 27 January 2011. https://web.archive.org/web/20161025013916/https:/www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="4">[4]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
collection/cryptocurrency.md
+12 -3
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,11 +21,10 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
<td><b>3 June 2023</b></td>
</tr>
</table>
# Cryptocurrency
Malware accesses files that contain sensitive data or credentials related to Bitcoin and other cryptocurrency wallets.
@@ -37,3 +36,13 @@ Malware accesses files that contain sensitive data or credentials related to Bit
|**Bitcoin**|B0028.001|Access Bitcoin data.|
|**Ethereum**|B0028.002|Access Ethereum data.|
|**Zcash**|B0028.003|Access Zcash data.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
collection/input-capture.md
+5 -2
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>21 November 2022</b></td>
<td><b>6 June 2023</b></td>
</tr>
</table>
@@ -46,6 +46,7 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056),
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware injects HTML into a browser session to collect sensitive online banking information when the victim performs their online banking. [[2]](#2)|
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy can capture audio and video. [[4]](#4)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [[5]](#5)|
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[6]](#6)|
## References
@@ -60,3 +61,5 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056),
<a name="5">[5]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
<a name="6">[6]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
command-and-control/c2-communication.md
+6 -3
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>21 November 2022</b></td>
<td><b>6 June 2023</b></td>
</tr>
</table>
@@ -90,6 +90,7 @@ As "server" and "client" are confusing terminology, we use the terms "controller
|[**Kovter**](../xample-malware/kovter.md)|2016|B0030.001|The malware sends data to the C2. [[19]](#19)|
|[**Kovter**](../xample-malware/kovter.md)|2016|B0030.002|The malware receives data from the C2. [[19]](#19)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|B0030.002|The malware receives data from the C2 server. [[18]](#18)|
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat communicates to a Pastebin site via HTTP. [[20]](#20)|
## Code Snippets
@@ -121,7 +122,7 @@ jmp short loc_4019A2
<a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
<a name="3">[3]</a> https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes
<a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
<a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
@@ -154,3 +155,5 @@ jmp short loc_4019A2
<a name="18">[18]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
<a name="19">[19]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="20">[20]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
defense-evasion/bootkit.md
+1 -1
View File
@@ -44,5 +44,5 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma
<a name="1">[1]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
<a name="2">[2]</a> https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf
<a name="2">[2]</a> https://eclypsium.com/wp-content/uploads/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf
defense-evasion/bypass-data-execution-prevention.md
+1 -3
View File
@@ -38,6 +38,4 @@ Malware may bypass Data Execution Prevention (DEP).
## References
<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce
<a name="2">[2]</a> https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce
defense-evasion/hidden-files-and-directories.md
+5 -2
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>21 November 2022</b></td>
<td><b>6 June 2023</b></td>
</tr>
</table>
@@ -54,6 +54,7 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://
|[**Vobfus**](../xample-malware/vobfus.md)|2016|F0005.002|Vobfus is located on external drives or network shares and attaches itself to ZIP and RAR files, other removable drives, and network shares. Vobfus hides folders on the external drive and drops an executable with the same name and a disguised folder icon. [[4]](#4)|
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.002|Malware looks for a specific folder on the victim. If the folder doesn't exist, the malware creates the folder on the victim by calling CreateDirectoryA and downloads the remote file into the new folder. [[5]](#5) [[6]](#6)|
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.001|The malware also appends the filename and extension .ocx to the ProgramData folder path. [[5]](#5) [[6]](#6)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|F0005.003|WannaCry uses the +h attribute to hide its files. [[7]](#7)|
## References
@@ -69,3 +70,5 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://
<a name="5">[5]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
<a name="6">[6]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
<a name="7">[7]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
defense-evasion/process-injection.md
+1 -1
View File
@@ -73,7 +73,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
## References
<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
defense-evasion/rootkit.md
+1 -1
View File
@@ -65,7 +65,7 @@ Rootkits can also be detected via memory dump analysis or virtual machine intros
<a name="1">[1]</a> https://en.wikipedia.org/wiki/Rootkit
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
<a name="3">[3]</a> https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml
defense-evasion/self-deletion.md
+5 -2
View File
@@ -12,7 +12,7 @@
<td><b>Indicator Removal on Host: Uninstall Malicious Application (<a href="https://attack.mitre.org/techniques/T1630/001/">T1630.001</a>), Indicator Removal on Host: File Deletion (<a href="https://attack.mitre.org/techniques/T1070/004/">T1070.004</a>)</b></td>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -20,7 +20,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>21 November 2022</b></td>
<td><b>6 June 2023</b></td>
</tr>
</table>
@@ -48,6 +48,7 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
|[**Terminator**](../xample-malware/terminator.md)|2013|F0007.001|The RAT evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[1]](#1)|
|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[2]](#2)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[4]](#4)|
## References
@@ -57,3 +58,5 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
<a name="2">[2]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
<a name="4">[4]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
discovery/file-and-directory-discovery.md
+5 -2
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>21 November 2022</b></td>
<td><b>6 June 2022</b></td>
</tr>
</table>
@@ -61,6 +61,7 @@ Malware may enumerate files and directories or may search for specific files or
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets a file size. [[6]](#6)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware gets the file version info. [[6]](#6)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets a common file path. [[6]](#6)|
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[7]](#7)|
## References
@@ -76,3 +77,5 @@ Malware may enumerate files and directories or may search for specific files or
<a name="5">[5]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
<a name="6">[6]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="7">[7]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
discovery/self-discovery.md
+25 -2
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
<td><b>3 June 2023</b></td>
</tr>
</table>
@@ -29,3 +29,26 @@
# Self Discovery
Malware may gather information about itself, such as its filename or size on disk.
# Methods
|Name|ID|Description|
|---|---|---|
|**Use Hashquine**|B0038.001| Malware uses a hashquine (the file contains it's own hash) for use as an integrity check. [[1]](#1)|
|**Check Magic String**|B0038.002| Malware checks a static value (i.e., magic string or number) to verify integrity. [[2]](#2)|
|**Check Section Length**|B0038.003| Malware checks the length of a section to verify integrity. [[2]](#2)|
## Use in Malware
Name|Date|Method|Description|
|---|---|---|---|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry checks the size of the file it loads into memory. [[1]](#1)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.002|WannaCry checks a string, keylen and a magic number before decrypting a dll. [[2]](#2)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.003|WannaCry checks the data lengh of a section before decypting a dll. [[2]](#2)|
## References
<a name="1">[1]</a> https://github.com/Rogdham/gif-md5-hashquine
<a name="2">[2]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
discovery/smtp-connection-discovery.md
+12 -2
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
<td><b>3 June 2023</b></td>
</tr>
</table>
@@ -29,3 +29,13 @@
# SMTP Connection Discovery
Malware may test whether an outgoing SMTP connection can be made from the system on which the malware instance is executing to some SMTP server, by sending a test SMTP transaction.
## Use in Malware
Name|Date|Method|Description|
|---|---|---|---|
|[**Snake**](../xample-malware/snake.md)|2004|--|Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
execution/command-and-scripting-interpreter.md
+1 -1
View File
@@ -59,7 +59,7 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or
## References
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
<a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
execution/execution-dependency.md
+14 -2
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
<td><b>3 June 2023</b></td>
</tr>
</table>
@@ -29,3 +29,15 @@
# Execution Dependency
Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in **Conditional Execution ([B0025](../execution/conditional-execution.md))**, this dependency is not because of an explicit check coded into the malware by the author.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Adwind jRAT**](../xample-malware/adwindjrat.md)|2019|--|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/
execution/install-additional-program.md
+6 -3
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>01 May 2023</b></td>
<td><b>6 June 2023</b></td>
</tr>
</table>
@@ -60,6 +60,7 @@ Droppers may be described as “single stage” or “two stage.” While the fo
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware contains an embedded PE file. [[19]](#19)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut contains an embedded PE file. [[19]](#19)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip contains an embedded PE file. [[19]](#19)|
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[20]](#20)|
## References
@@ -99,4 +100,6 @@ Droppers may be described as “single stage” or “two stage.” While the fo
<a name="18">[18]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
<a name="19">[19]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="19">[19]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="20">[20]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
execution/send-email.md
+1 -1
View File
@@ -43,7 +43,7 @@ This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/tec
## References
<a name="1">[1]</a> https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/
<a name="1">[1]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
<a name="2">[2]</a> https://en.wikipedia.org/wiki/Bagle_(computer_worm)
execution/system-services.md
+1 -1
View File
@@ -41,4 +41,4 @@ See ATT&CK: **System Services ([T1569](https://attack.mitre.org/techniques/T1569
## References
<a name="1">[1]</a> https://support.resolver.com/hc/en-ca/articles/207161116-Configure-Microsoft-Distributed-Transaction-Coordinator-MSDTC-
<a name="1">[1]</a> https://cyware.com/news/catb-ransomware-exploits-msdtc-service-to-steal-data-3bb46fc0
execution/user-execution.md
+1 -1
View File
@@ -52,7 +52,7 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq
<a name="2">[2]</a> https://blogs.cisco.com/security/talos/rombertik
<a name="3">[3]</a> https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes
<a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
<a name="4">[4]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
exfiltration/automated-exfiltration.md
+13 -2
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
<td><b>4 June 2023</b></td>
</tr>
</table>
@@ -37,3 +37,14 @@ See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org
|Name|ID|Description|
|---|---|---|
|**Exfiltrate via File Hosting Service**|E1020.m01|Malware may exfiltrate files to a file hosting location.|
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Attor**](../xample-malware/attor.md)|2013|--|Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server.[[1]](#1)|
## References
<a name="1">[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf
impact/compromise-data-integrity.md
+12 -3
View File
@@ -17,7 +17,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -25,7 +25,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>4 May 2023</b></td>
<td><b>3 June 2023</b></td>
</tr>
</table>
@@ -36,6 +36,15 @@ Data stored on the file system of a compromised system is manipulated to comprom
The related **Data Manipulation: Stored Data Manipulation ([T1565.001](https://attack.mitre.org/techniques/T1565/001/))** ATT&CK sub-technique was defined subsequent to this MBC behavior.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**DYEPACK**](../xample-malware/dyepack.md)|2015|--|DYEPACK alters records in databases used for SWIFT transactions. [[2]](#2)|
## References
<a name="1">[1]</a> "TRISIS Malware: Analysis of Safety System Targeted Malware, version 1.20171213," Dragos, 13 Dec. 2017. [Online]. Available: https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf.
<a name="1">[1]</a> "TRISIS Malware: Analysis of Safety System Targeted Malware, version 1.20171213," Dragos, 13 Dec. 2017. [Online]. Available: https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf.
<a name="2">[2]</a> https://content.fireeye.com/apt/rpt-apt38
impact/data-encrypted-for-impact.md
+5 -2
View File
@@ -17,7 +17,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -25,7 +25,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>21 November 2022</b></td>
<td><b>6 June 2023</b></td>
</tr>
</table>
@@ -51,6 +51,7 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart encrypts files for ransom without any connection to the Internet. [[3]](#3)|
|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam encrypts data to hold for ransom. [[4]](#4)|
|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker encrypts files for ransom. [[5]](#5)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0025|WannaCry encrypts files for ransom. [[6]](#6)|
## References
@@ -65,3 +66,5 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni
<a name="5">[5]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
<a name="6">[6]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
impact/generate-traffic-from-victim.md
+1 -3
View File
@@ -52,7 +52,7 @@ Malware may generate traffic from the victim system such as clicks of advertisin
## References
<a name="1">[1]</a> https://www.itworld.com/article/2734253/security/behind-the--massive--malware-ad-revenue-fraud-case.html
<a name="1">[1]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
<a name="2">[2]</a> https://www.fipp.com/news/insightnews/what-are-the-nine-types-of-digital-ad-fraud
@@ -61,5 +61,3 @@ Malware may generate traffic from the victim system such as clicks of advertisin
<a name="4">[4]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
<a name="5">[5]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
<a name="6">[6]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
impact/modify-hardware.md
+13 -3
View File
@@ -17,7 +17,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -25,7 +25,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
<td><b>6 June 2023</b></td>
</tr>
</table>
@@ -40,4 +40,14 @@ Malware modifies hardware.
|---|---|---|
|**CDROM**|B0042.001|The CD-ROM is modified.|
|**Mouse**|B0042.002|The mouse is modified.|
|**Printer**|B0042.003|The printer is modified.|
|**Printer**|B0042.003|The printer is modified.|
## Use in Malware
Name|Date|Method|Description|
|---|---|---|---|
|[**BadUSB**](../xample-malware/badusb.md)|2014|--| BadUSB can modify USB drives. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
impact/remote-access.md
+1 -1
View File
@@ -57,7 +57,7 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu
<a name="1">[1]</a> https://en.wikipedia.org/wiki/Remote_access_trojan
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
<a name="3">[3]</a> https://en.wikipedia.org/wiki/DarkComet
lateral-movement/supply-chain-compromise.md
+1 -1
View File
@@ -50,5 +50,5 @@ The supply chain may be compromised to enable initial malware infection. MBC obj
<a name="1">[1]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
<a name="2">[2]</a> https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf
<a name="2">[2]</a>
micro-behaviors/operating-system/registry.md
+2 -2
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
<td><b>24 May 2023</b></td>
</tr>
</table>
persistence/README.md
+1 -1
View File
@@ -20,7 +20,7 @@ Behaviors that enable malware to remain on a system regardless of system events,
* **Bootkit** [F0013](../defense-evasion/bootkit.md)
* **Component Firmware** [F0009](../persistence/component-firmware.md)
* **Hide Artifacts** [E1564](../defense-evasion/hide-artifacts.md)
* **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files-and-directories.md) This method is related to Unprotect technique U1230.
* **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files-and-directories.md)
* **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md)
* **Install Insecure or Malicious Configuration** [B0047](../defense-evasion/install-insecure-or-malicious-configuration.md)
* **Kernel Modules and Extensions** [F0010](../persistence/kernel-modules-and-extensions.md)
persistence/component-firmware.md
+2 -8
View File
@@ -46,16 +46,10 @@ See ATT&CK: **Pre-OS Boot: Component Firmware ([T1542.002](https://attack.mitre.
|Name|Date|Method|Description|
|---|---|---|---|
|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|F0009.001|SYNful Knock is a stealthy modification of the router's firmware image that can be used to maintain persistence within a victim's network. [[2]](#2)|
|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|F0009.001|SYNful Knock is a stealthy modification of the router's firmware image that can be used to maintain persistence within a victim's network. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.scmagazine.com/home/opinions/are-synful-knock-style-router-attacks-set-to-become-the-new-normal/
<a name="2">[2]</a> https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html
<a name="3">[3]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
<a name="4">[4]</a> https://www.mandiant.com/resources/synful-knock-acis
<a name="1">[1]</a> https://www.mandiant.com/resources/synful-knock-acis
persistence/kernel-modules-and-extensions.md
+13 -2
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 October 2022</b></td>
<td><b>3 June 2023</b></td>
</tr>
</table>
@@ -37,3 +37,14 @@ See ATT&CK: **Boot or Logon Autostart Execution: Kernel Modules and Extensions (
|Name|ID|Description|
|---|---|---|
|**Device Driver**|F0010.001|Allows kernel to access hardware connected to the system.|
# Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Drovorub**](../xample-malware/drovorub.md)|2020|--|Drovorub uses a kernel module rootkit for loading and for persistence. [[1]](#1)|
## References
<a name="1">[1]</a> https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
persistence/modify-existing-service.md
+1 -1
View File
@@ -45,7 +45,7 @@ See ATT&CK: **Create or Modify System Process::Windows Service ([T1543.003](http
## References
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
<a name="2">[2]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
persistence/registry-run-keys-startup-folder.md
+6 -3
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>2.1</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,7 +21,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>19 May 2023</b></td>
<td><b>6 June 2023</b></td>
</tr>
</table>
@@ -53,13 +53,14 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol
|[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle adds registry keys to enable its automatic execution at every system startup. [[14]](#14)|
|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Malware adds registry keys to enable startup after reboot. [[15]](#15)|
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip persists via a Run registry key. [[17]](#17)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry creates two registry run keys to ensure persistence. [[18]](#18)|
## References
<a name="1">[1]</a> https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
<a name="3">[3]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HUPIGON
@@ -90,3 +91,5 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol
<a name="16">[16]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
<a name="17">[17]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="18">[18]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
xample-malware/README.md
+46 -38
View File
@@ -10,44 +10,52 @@ The MBC malware corpus comprises a variety of malware where each entry is decomp
Please see [Poison-Ivy X0014](../xample-malware/poison-ivy.md) and [Kovter X0009](../xample-malware/kovter.md) for examples of malware entries included and *not* included in ATT&CK's collection, respectively.
* **Adwind jRAT** [X0048](../xample-malware/adwindjrat.md)
* **Attor** [X0049](../xample-malware/attor.md)
* **BadUSB** [X0046](../xample-malware/badusb.md)
* **Bagle** [X0001](../xample-malware/bagle.md)
* **Black Energy** [X0002](../xample-malware/blackenergy.md)
* **Chopstick** [X0003](../xample-malware/chopstick.md)
* **Clipminer** [X0004](../xample-malware/clipminer.md)
* **Conficker** [X0005](../xample-malware/conficker.md)
* **CozyCar** [X0006](../xample-malware/cozycar.md)
* **CryptoLocker** [X0007](../xample-malware/cryptolocker.md)
* **CryptoWall** [X0008](../xample-malware/cryptowall.md)
* **Dark Comet** [X0009](../xample-malware/dark-comet.md)
* **DNSChanger** [X0010](../xample-malware/dnschanger.md)
* **Emotet** [X0011](../xample-malware/emotet.md)
* **EvilBunny** [X0012](../xample-malware/evilbunny.md)
* **Gamut** [X0013](../xample-malware/gamut.md)
* **Geneio** [X0014](../xample-malware/geneio.md)
* **GoBotKR** [X0015](../xample-malware/gobotkr.md)
* **GravityRAT** [X0016](../xample-malware/gravity-rat.md)
* **Heriplor** [X0017](../xample-malware/heriplor.md)
* **Hupigon** [X0018](../xample-malware/hupigon.md)
* **Kovter** [X0019](../xample-malware/kovter.md)
* **Kraken** [X0020](../xample-malware/kraken.md)
* **Locky Bart** [X0021](../xample-malware/locky-bart.md)
* **Matanbuchus** [X0022](../xample-malware/matanbuchus.md)
* **Mazarbot** [X0023](../xample-malware/mazarbot.md)
* **Mebromi** [X0024](../xample-malware/mebromi.md)
* **Netwalker** [X0025](../xample-malware/netwalker.md)
* **Poison-Ivy** [X0026](../xample-malware/poison-ivy.md)
* **Redhip** [X0027](../xample-malware/rebhip.md)
* **Rombertik** [X0028](../xample-malware/rombertik.md)
* **SamSam** [X0029](../xample-malware/samsam.md)
* **SearchAwesome** [X0030](../xample-malware/searchawesome.md)
* **Shamoon** [X0031](../xample-malware/shamoon.md)
* **Stuxnet** [X0032](../xample-malware/stuxnet.md)
* **SYNful Knock** [X0033](../xample-malware/synful-knock.md)
* **Teardrop** [X0034](../xample-malware/teardrop.md)
* **Terminator** [X0035](../xample-malware/terminator.md)
* **TrickBot** [X0036](../xample-malware/trickbot.md)
* **UP007** [X0037](../xample-malware/up007.md)
* **Ursnif** [X0038](../xample-malware/ursnif.md)
* **Chopstick** [X0035](../xample-malware/chopstick.md)
* **Clipminer** [X0038](../xample-malware/clipminer.md)
* **Conficker** [X0003](../xample-malware/conficker.md)
* **CozyCar** [X0034](../xample-malware/cozycar.md)
* **CryptoLocker** [X0030](../xample-malware/cryptolocker.md)
* **CryptoWall** [X0029](../xample-malware/cryptowall.md)
* **Dark Comet** [X0004](../xample-malware/dark-comet.md)
* **DNSChanger** [X0005](../xample-malware/dnschanger.md)
* **Drovorub** [X0045](../xample-malware/drovorub.md)
* **DYEPACK** [X0042](../xample-malware/dyepack.md)
* **ElectroRAT** [X0044](../xample-malware/electrorat.md)
* **Emotet** [X0028](../xample-malware/emotet.md)
* **EvilBunny** [X0036](../xample-malware/evilbunny.md)
* **Gamut** [X0006](../xample-malware/gamut.md)
* **Geneio** [X0007](../xample-malware/geneio.md)
* **GoBotKR** [X0027](../xample-malware/gobotkr.md)
* **GravityRAT** [X0032](../xample-malware/gravity-rat.md)
* **Heriplor** [X0026](../xample-malware/heriplor.md)
* **Hupigon** [X0008](../xample-malware/hupigon.md)
* **Kovter** [X0009](../xample-malware/kovter.md)
* **Kraken** [X0010](../xample-malware/kraken.md)
* **Locky Bart** [X0011](../xample-malware/locky-bart.md)
* **Matanbuchus** [X0040](../xample-malware/matanbuchus.md)
* **Mazarbot** [X0012](../xample-malware/mazarbot.md)
* **Mebromi** [X0013](../xample-malware/mebromi.md)
* **Netwalker** [X0037](../xample-malware/netwalker.md)
* **Poison-Ivy** [X0014](../xample-malware/poison-ivy.md)
* **Redhip** [X0015](../xample-malware/redhip.md)
* **Rombertik** [X0031](../xample-malware/rombertik.md)
* **SamSam** [X0016](../xample-malware/samsam.md)
* **SearchAwesome** [X0017](../xample-malware/searchawesome.md)
* **Shamoon** [X0018](../xample-malware/shamoon.md)
* **Snake** [X0047](../xample-malware/snake.md)
* **Stuxnet** [X0019](../xample-malware/stuxnet.md)
* **SYNful Knock** [X0020](../xample-malware/synful-knock.md)
* **TEARDROP** [X0041](../xample-malware/teardrop.md)
* **Terminator** [X0021](../xample-malware/terminator.md)
* **TrickBot** [X0025](../xample-malware/trickbot.md)
* **UP007** [X0033](../xample-malware/up007.md)
* **Ursnif** [X0022](../xample-malware/ursnif.md)
* **Vobfus** [X0039](../xample-malware/vobfus.md)
* **WebCobra** [X0040](../xample-malware/webcobra.md)
* **YiSpecter** [X0041](../xample-malware/yispecter.md)
* **WannaCry** [X0043](../xample-malware/wannacry.md)
* **WebCobra** [X0023](../xample-malware/webcobra.md)
* **YiSpecter** [X0024](../xample-malware/yispecter.md)
xample-malware/adwind-jrat.md
+41
View File
@@ -0,0 +1,41 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0048</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Platforms</b></td>
<td><b>Windows, Linus, macOS</b></td>
</tr>
<tr>
<td><b>Year</b></td>
<td><b>2019</b></td>
</tr>
<tr>
<td><b>Associated ATT&CK Software</b></td>
<td><b><a href="https://attack.mitre.org/software/S0283/">jRAT</a></b></td>
</tr>
</table>
# Adwind jRAT
Adwind jRAT is a remote access Trojan that uses Java to take control and collect data from a user's machine. [[1]](#1)
## ATT&CK Techniques
See ATT&CK: [jRAT - Techniques Used](https://attack.mitre.org/software/S0283/).
## MBC Behaviors
|Name|Use|
|---|---|
|[Execution::Execution Dependency (B0044)](../execution/execution-dependency.md)|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/
xample-malware/attor.md
+52
View File
@@ -0,0 +1,52 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0049</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Platforms</b></td>
<td><b>X0042</b></td>
</tr>
<tr>
<td><b>Year</b></td>
<td><b>2013</b></td>
</tr>
<tr>
<td><b>Associated ATT&CK Software</b></td>
<td><b><a href="https://attack.mitre.org/software/S0438/">Attor</a></b></td>
</tr>
</table>
# Attor
Attor is a Windows-based espionage platform used in targeted attacks since 2013. Attor has a loadable plugin architecture to customize functionality for specific targets. [[1]](#1)
## ATT&CK Techniques
See ATT&CK: [Attor - Techniques Used](https://attack.mitre.org/software/S0438/).
## Enhanced ATT&CK Techniques
|Name|Use|
|---|---|
|[Exfiltration::Automated Exfiltration (E1020)](../exfiltration/automated-exfiltration.md) | Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server [[1]](#1)|
## Indicators of Compromise
SHA1 Hashes
- 47dc997d08d53e55b8450940d9de94e2b5db631e
- 52213cab4954c850a1ac51974a24b878ca88eb59
- 8a6829b8615c5f6661a84ea3af0e15ab28c5840c
- d0528b8777d556809ac64935fa6247164aaabb4f
- f7e30a3fa186361794699d7a4fac6a9b85ccbf40
## References
<a name="1">[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf
xample-malware/badusb.md
+66
View File
@@ -0,0 +1,66 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0046</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Platforms</b></td>
<td><b>Windows</b></td>
</tr>
<tr>
<td><b>Year</b></td>
<td><b>2014</b></td>
</tr>
<tr>
<td><b>Associated ATT&CK Software</b></td>
<td><b>None</b></td>
</tr>
</table>
# BadUSB
BadUSB is an attack that exploits an inherent vulnerability in USB firmware. Such an attack reprograms a USB device, causing it to act as a human interface device; once re-engineered, the USB device is used to discreetly execute commands or run malicious programs on the victim's computer. [[1]](#1)
## ATT&CK Techniques
|Name|Use|
|---|---|
[Command and Control::Communication Through Removable Media (T1092)](https://attack.mitre.org/techniques/T1092/) | A USB interface is able to connect to many different devices, including cameras, keyboards, modems, webcams, wireless networking devices, and others. BadUSB leverages these devices. [[1]](#1) |
|[Initial Access :: Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/)| BadUSB can be used as a means of gaining initial access to a target machine by exploiting vulnerabilities in the USB firmware or by tricking the user into plugging in an infected USB device. [[1]](#1) |
|[Collection::Data from Local System (T1005)](https://attack.mitre.org/techniques/T1005/) | BadUSB can steal sensitive data from an infected machine (e.g., login credentials) and transmit it to a remote C2 server. [[3]](#3) |
## MBC Behaviors
|Name|Use|
|---|---|
|[Impact::Modify Hardware (B0042)](../impact/modify-hardware.md) | BadUSB can modify USB drives. [[4]](#4)|
## Indicators of Compromise
MD5 Hashes
- 0022c1fe1d6b036de2a08d50ac5446a5
- 0155738045b331f44d300f4a7d08cf21
- 0275585c3b871405dd299d458724db3d
## References
<a name="1">[1]</a> https://www.manageengine.com/data-security/security-threats/bad-usb.html
<a name="2">[2]</a> https://arstechnica.com/information-technology/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/
<a name="3">[3]</a> https://radetskiy.files.wordpress.com/2014/08/srlabs-badusb-blackhat-v1.pdf
<a name="4">[4]</a> https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
<a name="5">[5]</a> https://www.darkreading.com/endpoint/when-good-usb-devices-go-bad
<a name="6">[6]</a> https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
xample-malware/chopstick.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0003</b></td>
<td><b>X0035</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/clipminer.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0004</b></td>
<td><b>X0038</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/conficker.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0005</b></td>
<td><b>X0003</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/cozycar.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0006</b></td>
<td><b>X0034</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/cryptolocker.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0007</b></td>
<td><b>X0030</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/cryptowall.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0008</b></td>
<td><b>X0029</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/dark-comet.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0009</b></td>
<td><b>X0004</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/dnschanger.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0010</b></td>
<td><b>X0005</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/drovorub.md
+51
View File
@@ -0,0 +1,51 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0045</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Platforms</b></td>
<td><b>Windows</b></td>
</tr>
<tr>
<td><b>Year</b></td>
<td><b>2020</b></td>
</tr>
<tr>
<td><b>Associated ATT&CK Software</b></td>
<td><b><a href="https://attack.mitre.org/software/S0502/">Drovorub</a></b></td>
</tr>
</table>
# Drovorub
Drovorub is a Linux malware toolset consisting of an implant coupled with a kernel module rootkit, a file transfer and port forwarding tool, and a Command and Control (C2) server. [[1]](#1)
## ATT&CK Techniques
See ATT&CK: [Drovorub - Techniques Used](https://attack.mitre.org/software/S0502/).
## Enhanced ATT&CK Techniques
|Name|Use|
|---|---|
|[Persistence::Kernel Modules and Extensions (F0010)](../persistence/kernel-modules-and-extensions.md) | Drovorub uses a kernel module rootkit for loading and persistence. [[1]](#1)|
## Indicators of Compromise
SHA256 Hashes
- 92610f217e86134c695dfd11d4a81feb4f4760ef05d57407d33a7c09dfe071da
- 53dede6856e46a2fbda8cb415ac96de18e751c3bf5749e596a6d844c2c9cb707
- 1c0d14b530632307329de7bfb3546a91f6ebfd0256664c33a92f2b6e8ad88626
- 17bf00b67487164d1822ea48f36d62bf6f4ff9b2388cab2c0757644fdf30e5bd
## References
<a name="1">[1]</a> https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
xample-malware/dyepack.md
+36
View File
@@ -0,0 +1,36 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0042</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Platforms</b></td>
<td><b>Windows, Linux</b></td>
</tr>
<tr>
<td><b>Year</b></td>
<td><b>2015</b></td>
</tr>
<tr>
<td><b>Associated ATT&CK Software</b></td>
<td><b>None</b></td>
</tr>
</table>
# DYEPACK
DYEPACK is a malware suite that manipulates local information regarding SWIFT transaction activity. [[1]](#1)
## MBC Behaviors
|Name|Use|
|---|---|
|[Impact::Compromise Data Integrity (B0016)](../impact/compromise-data-integrity.md) | DYEPACK alters records in databases used for SWIFT transactions. [[1]](#1)|
## References
<a name="1">[1]</a> https://content.fireeye.com/apt/rpt-apt38
xample-malware/electrorat.md
+79
View File
@@ -0,0 +1,79 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0044</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Platforms</b></td>
<td><b>Windows, Linux, macOS</b></td>
</tr>
<tr>
<td><b>Year</b></td>
<td><b>2020</b></td>
</tr>
<tr>
<td><b>Associated ATT&CK Software</b></td>
<td><b>None</b></td>
</tr>
</table>
# ElectroRAT
ElectroRAT is used to steal cryptocurrency from wallets.
## ATT&CK Techniques
|Name|Use|
|---|---|
|[Execution::User execution (T1240)](https://attack.mitre.org/techniques/T1204/) | ElectroRat makes the user execute the malware. [[1]](#1)|
|[Command and Control::Web Service (T1102)](https://attack.mitre.org/techniques/T1102) | EletroRat uses HTTP for C&C and exfiltration. [[1]](#1)|
|[Execution::Command and Scripting Interpreter (T1059)](https://attack.mitre.org/techniques/T1059) | ElectroRat uses Python to embed additional binares. [[1]](#1)|
|[Discovery::System Information Discovery (T1082)](https://attack.mitre.org/techniques/T1082) | ElectroRat detects the OS to determine which plugins to download. [[1]](#1)|
|[Persistence::Boot or Logon Autostart Execution (T1547)](https://attack.mitre.org/techniques/T1547/) | ElectroRat enables auto start on bootup. [[1]](#1)|
## Enhanced ATT&CK Techniques
|Name|Use|
|---|---|
|[Collection::Input Capture (E1056)](../collection/input-capture.md) | ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[1]](#1)|
|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md) | ElectroRat looks for wallets to steal cryptocurrency [[1]](#1)|
## MBC Behaviors
|Name|Use|
|---|---|
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md) | Upon execution, ElectroRat downloads additional executables. [[1]](#1)|
|[Collection::Cryptocurrency (B0028)](../impact/clipboard-modification.md) | ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)|
|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md) | ElectroRat communicates to a Pastebin site via HTTP. [[1]](#1)|
## Indicators of Compromise
Command-and-Control Servers
- 193.38.55.131
- 193.38.55.4
- 213.226.100.140
- kintum.io
- daopoker.com
- jamm.to
- pastebin.com/raw/r12wBrC7
- pastebin.com/raw/DF8Gikrk
- pastebin.com/raw/bfQiiqyv
- pastebin.com/raw/UbTZx6kd
- pastebin.com/raw/U45SvK4K
- pastebin.com/raw/zrZA4L3e
SHA256 Hashes
- 170cb5ea1a6b4af3c27358ba267a1309ed5118481619fc874f717262cb91fb77
- 881be95a9632fa44deeeca23e4e19390d600ad817b2f66671d3f21453a16c7b7
- e9b83d5cdefd4486b32a927d7505cdeebb43e6977759ba069d9373e46ca7d0f2
- e547872761d81c3afc9c2a42cac3931e2a1defc2c56a0a3c57b28ea91e7686cd
- 17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
- 5c884be3635eb55ce02e141d6fb07f760b6dbcace54f2217c69f287292ce59f6
## References
<a name="1">[1]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
xample-malware/emotet.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0011</b></td>
<td><b>X0028</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/evilbunny.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0012</b></td>
<td><b>X0036</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/gamut.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0013</b></td>
<td><b>X0006</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/geneio.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0014</b></td>
<td><b>X0007</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/gobotkr.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0015</b></td>
<td><b>X0027</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/gravity-rat.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0016</b></td>
<td><b>X0032</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/heriplor.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0017</b></td>
<td><b>X0026</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/hupigon.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0018</b></td>
<td><b>X0008</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/kovter.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0019</b></td>
<td><b>X0009</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/kraken.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0020</b></td>
<td><b>X0010</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/locky-bart.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0021</b></td>
<td><b>X0011</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/matanbuchus.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0022</b></td>
<td><b>X0040</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/mazarbot.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0023</b></td>
<td><b>X0012</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/mebromi.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0024</b></td>
<td><b>X0013</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/netwalker.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0025</b></td>
<td><b>X0037</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/poison-ivy.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0026</b></td>
<td><b>X0014</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/redhip.md
+2 -2
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0027</b></td>
<td><b>X0015</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
@@ -94,7 +94,7 @@ SHA256 Hashes
## References
<a name="1">[1]</a> Atif Mushtaq, FireEye, "The Dead Giveaways of VM-Aware Malware," 27 January 2011. https://web.archive.org/web/20161025013916/https:/www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
<a name="2">[2]</a> capa v4.0, analyzed at MITRE on 10/12/2022
xample-malware/rombertik.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0028</b></td>
<td><b>X0031</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/samsam.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0029</b></td>
<td><b>X0016</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/searchawesome.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0030</b></td>
<td><b>X0017</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/shamoon.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0031</b></td>
<td><b>X0018</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/snake.md
+37
View File
@@ -0,0 +1,37 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0047</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Platforms</b></td>
<td><b>Windows</b></td>
</tr>
<tr>
<td><b>Year</b></td>
<td><b>2004</b></td>
</tr>
<tr>
<td><b>Associated ATT&CK Software</b></td>
<td><b>None</b></td>
</tr>
</table>
# Snake
The Snake malware is an information-stealing malware that is implemented in the .NET programming language. It has been in use since 2004 and is one of the most sophisticated cyber espionage tools designed and used by Russia's FSB for long-term intelligence collection. [[1]](#1)
## MBC Behaviors
|Name|Use|
|---|---|
|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md) | Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
xample-malware/stuxnet.md
+3 -5
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0032</b></td>
<td><b>X0019</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
@@ -57,7 +57,7 @@ See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/
|Name|Use|
|---|---|
|[Impact::Destroy Hardware (B0017)](../impact/destroy-hardware.md)|Stuxnet made the centrifuges at Iran's nuclear plant spin dangerously fast for 15 minutes, before returning to normal speed. About a month later, it slowed the centrifuges down for 50 minutes. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1) [[3]](#3)|
|[Impact::Destroy Hardware (B0017)](../impact/destroy-hardware.md)|Stuxnet made the centrifuges at Iran's nuclear plant spin dangerously fast for 15 minutes, before returning to normal speed. About a month later, it slowed the centrifuges down for 50 minutes. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)|
|[Micro-behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[1]](#1)|
|[Micro-behaviors::Process::Create Process::Create Process via WMI (C0017.002)](../micro-behaviors/process/create-process.md)|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)|
|[Execution::Conditional Execution::Host Fingerprint Check (B0025.004)](../execution/conditional-execution.md)|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[1]](#1)|
@@ -79,6 +79,4 @@ SHA256 Hashes
<a name="1">[1]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
<a name="2">[2]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="3">[3]</a> https://www.bbc.com/timelines/zc6fbk7
<a name="2">[2]</a> capa v4.0, analyzed at MITRE on 10/12/2022
xample-malware/synful-knock.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0033</b></td>
<td><b>X0020</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/teardrop.md
+2 -8
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0034</b></td>
<td><b>X0041</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
@@ -25,14 +25,13 @@
# TEARDROP
TEARDROP is a memory-only loader that is associated with the Solarwinds supply chain compromise.
TEARDROP is a memory-only dropper associated with the SolarWinds supply chain compromise.
## ATT&CK Techniques
See ATT&CK: [TEARDROP - Techniques Used](https://attack.mitre.org/software/S0560/).
## Enhanced ATT&CK Techniques
|Name|Use|
@@ -40,8 +39,6 @@ See ATT&CK: [TEARDROP - Techniques Used](https://attack.mitre.org/software/S0560
|[Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)](../defense-evasion/obfuscated-files-or-information.md)|Malware decrypts an embedded code buffer using an XOR-based stream cipher. [[1]](#1)|
|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|Malware executes the decrypted, embedded code buffer, which is a Cobalt Strike Remote Access Tool (RAT). [[1]](#1)|
## MBC Behaviors
|Name|Use|
@@ -49,9 +46,6 @@ See ATT&CK: [TEARDROP - Techniques Used](https://attack.mitre.org/software/S0560
|[Anti-Behavioral Analysis::Capture Evasion::Memory-only Payload (B0036.001)](../anti-behavioral-analysis/capture-evasion.md)|Malware loads its payload into memory. [[1]](#1)|
## Indicators of Compromise
## References
<a name="1">[1]</a> https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b/
xample-malware/terminator.md
+2 -2
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0035</b></td>
<td><b>X0021</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
@@ -60,6 +60,6 @@ SHA256 Hashes
## References
<a name="1">[1]</a> https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes
<a name="1">[1]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
<a name="2">[2]</a> https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf
xample-malware/trickbot.md
+2 -2
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0036</b></td>
<td><b>X0025</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
@@ -95,7 +95,7 @@ Yara Rules
<a name="4">[4]</a> https://www.bitdefender.com/blog/labs/trickbot-is-dead-long-live-trickbot/
<a name="5">[5]</a> https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf
<a name="5">[5]</a> https://eclypsium.com/wp-content/uploads/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf
<a name="6">[6]</a> https://www.joesecurity.org/blog/498839998833561473
xample-malware/up007.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0037</b></td>
<td><b>X0033</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/ursnif.md
+1 -1
View File
@@ -1,7 +1,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0038</b></td>
<td><b>X0022</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/wannacry.md
+60
View File
@@ -0,0 +1,60 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0043</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
<tr>
<td><b>Platforms</b></td>
<td><b>Windows</b></td>
</tr>
<tr>
<td><b>Year</b></td>
<td><b>2017</b></td>
</tr>
<tr>
<td><b>Associated ATT&CK Software</b></td>
<td><b><a href="https://attack.mitre.org/software/S0366">WannaCry</a></b></td>
</tr>
</table>
# WannaCry
WannaCry is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries. It contains worm-like features to spread across a computer network using the SMBv1 exploit EternalBlue. [[1]](#1)
## ATT&CK Techniques
See ATT&CK: [WannaCry - Techniques Used](https://attack.mitre.org/software/S0366/).
## Enhanced ATT&CK Techniques
|Name|Use|
|---|---|
|[Defense Evasion:: Hidden Files and Directories(F0005.003)](../defense-evasion/hidden-files-and-directories.md) | WannaCry uses the +h attribute to hide its files. [[1]](#1)|
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md) | WannaCry creates two registry run keys to ensure persistence. [[1]](#1)|
|[Defense-Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md) | WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[1]](#1)|
## MBC Behaviors
|Name|Use|
|---|---|
|[Discovery::Self Discovery (B0038)](../discovery/self-discovery.md) | WannaCry checks the size of the file it loads into memory. [[1]](#1)|
|[Discovery::Self Discovery (B0038.002)](../discovery/self-discovery.md) | WannaCry checks a string, keylen and a magic number before decrypting a dll. [[1]](#1)|
|[Discovery::Self Discovery (B0038.003)](../discovery/self-discovery.md) | WannaCry checks the data lengh of a section before decypting a dll. [[1]](#1)|
|[Impact::Data Encrypted for Impact (B0025)](../impact/data-encrypted-for-impact.md) | WannaCry encrypts files for ransom. [[1]](#1)|
## Indicators of Compromise
MD5 Hashes
- db349b97c37d22f5ea1d1841e3c89eb4
- 84c82835a5d21bbcf75a61706d8ab549
- f351e1fcca0c4ea05fc44d15a17f8b36
- 7bf2b57f2a205768755c07f238fb32cc
## References
<a name="1">[1]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
xample-malware/webcobra.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0040</b></td>
<td><b>X0023</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
xample-malware/yispecter.md
+1 -1
View File
@@ -2,7 +2,7 @@
<table>
<tr>
<td><b>ID</b></td>
<td><b>X0041</b></td>
<td><b>X0024</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>