Cleaning ref links, etc (#115) (#116)

* Cleanup --------- Co-authored-by: Ryan Xu <ryanxu@wustl.edu>
2026-06-08 11:36:36 +00:00 · 2023-08-18 16:30:16 -04:00
parent 96538d8107
commit 57d470ab4c
44 changed files with 87 additions and 83 deletions
@@ -44,9 +44,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[5]](#5). This method is similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique. This method is also related to Unprotect techniques U1316 and U1317.|
 |**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.|
 |**Product Key/ID Testing**|[B0007.005](#b0007005-snippet)|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
-|**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.|
-|**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.|
-|**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.|
 |**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox. This method is related to Unprotect technique U1315.|
 |**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name. This method is related to Unprotect technique U1303.|
 |**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments. This method is related to Unprotect technique U1005.|
@@ -128,7 +125,7 @@ mov     bl, 1

 <a name="5">[5]</a> https://github.com/LordNoteworthy/al-khaser

-<a name="6">[6]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
+<a name="6">[6]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf

 <a name="7">[7]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

@@ -61,8 +61,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
 |**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
 |**Instruction Testing**|[B0009.029](#b0009029-snippet)|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type.|
-|**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
 |**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type. This method is related to Unprotect technqiue U1324.|
 |**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) This method is related to Unprotect technique U1323.|
 |**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
@@ -94,7 +92,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
 |[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.018|GravityRAT determines the machine is a VM if the core count is 1. [[3]](#3)|
 |[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.023|GravityRAT checks if the manufacturer field in the Win32_Computer entry (in WMI) contains "Virtual," "Vmware," or "Virtualbox." [[3]](#3)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.024|GravityRAT creates a WMI request to identify the BIOS version. [[3]](#3)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.024|GravityRAT creates a WMI request to identify the BIOS version. [[13]](#13)|
 |[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.028|GravityRAT checks if the MAC address starts with a well-known hexadecimal number used by various VM developers. [[3]](#3)|
 |[**WebCobra**](../xample-malware/webcobra.md)|2018|B0009.022|WebCobra injects malicious code in to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in a VM. [[4]](#4)|
 |[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip detects VMWare, Virtual PC, and Virtual Box. It also detects VM environments in general by considering time lapses. [[6]](#6)|
@@ -159,7 +157,7 @@ jmp short loc_401CBB

 <a name="2">[2]</a> https://search.unprotect.it/map/sandbox-evasion/

-<a name="3">[3]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
+<a name="3">[3]</a> https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html

 <a name="4">[4]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

@@ -178,3 +176,5 @@ jmp short loc_401CBB
 <a name="11">[11]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques

 <a name="12">[12]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="12">[12]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
@@ -125,7 +125,7 @@ jmp short loc_401326

 ## References

-<a name="1">[1]</a> https://blogs.cisco.com/security/talos/rombertik
+<a name="1">[1]</a> https://insights.sei.cmu.edu/blog/api-hashing-tool-imagine-that/

 <a name="2">[2]</a> https://cofense.com/blog/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/

@@ -135,7 +135,7 @@ jmp short loc_401326

 <a name="5">[5]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality

-<a name="6">[6]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+<a name="6">[6]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant

 <a name="7">[7]</a> https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html

@@ -73,7 +73,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software

 <a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

-<a name="4">[4]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
+<a name="4">[4]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/

 <a name="5">[5]</a> http://www.csl.sri.com/users/vinod/papers/Conficker/

@@ -122,7 +122,7 @@ jmp short loc_4019A2

 <a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

-<a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
+<a name="3">[3]</a> https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf

 <a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/

@@ -136,7 +136,7 @@ jmp short loc_4019A2

 <a name="9">[9]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke

-<a name="10">[10]</a>https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
+<a name="10">[10]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/

 <a name="11">[11]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking

@@ -152,7 +152,7 @@ jmp short loc_4019A2

 <a name="17">[17]</a> https://blogs.cisco.com/security/talos/rombertik

-<a name="18">[18]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="18">[18]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection

 <a name="19">[19]</a> capa v4.0, analyzed at MITRE on 10/12/2022

@@ -47,7 +47,7 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques
 |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware downloads DLLs from the hardcoded URL/remote server. [[7]](#7) [[8]](#8)|
 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can download additional files and update itself. [[9]](#9)|
 |[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut receives files from the C2. [[10]](#10)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 downloads files from the C2. [[10]](#10)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 downloads files from the C2. [[11]](#11)|


 ## References
@@ -74,4 +74,6 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques

 <a name="9">[9]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

-<a name="10">[10]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
+<a name="10">[10]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
+
+<a name="11">[11]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
@@ -37,7 +37,7 @@ While the definition of fileless malware can be ambiguous, here it represents ma
 
 |Name|ID|Description|
 |---|---|---|
-|**Fileless Malware**|B0027.001|Stores itself in memory. This method is related to Unprotect technique U1205.|
+|**Fileless Malware**|B0027.001|Stores itself in memory. This method is related to Unprotect technique U1205 and ATT&CK sub-technique Obfuscated Files or Information: Fileless Storage [T1027.011](https://attack.mitre.org/techniques/T1027/011/). |
 |**Registry Install**|B0027.002|Stores itself in the Windows registry.|

 ## Use in Malware
@@ -50,7 +50,7 @@ While the definition of fileless malware can be ambiguous, here it represents ma

 ## References

-<a name="1">[1]</a> "How to remove the Kovter Trojan (Removal Guide)," bleepingcomputer.com, 23 Mar. 2016. [Online]. Available: https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan.
+<a name="1">[1]</a> https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem.

 <a name="2">[2]</a> J. Glazova,"CosmicStrand: A UEFI Rootkit," Kaspersky, blog, 26 Jul. 2022. [Online]. Available: https://usa.kaspersky.com/blog/cosmicstrand-uefi-rootkit/26807/.

@@ -73,7 +73,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
 ## References
 <a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process

-<a name="2">[2]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
+<a name="2">[2]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf

 <a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser

@@ -57,6 +57,6 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630

 <a name="2">[2]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke

-<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="3">[3]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection

 <a name="4">[4]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
@@ -30,13 +30,13 @@

 Malware may gather information about itself, such as its filename or size on disk. 

-# Methods
+## Methods

 |Name|ID|Description|
 |---|---|---|
-|**Use Hashquine**|B0038.001| Malware uses a hashquine (the file contains it's own hash) for use as an integrity check. [[1]](#1)|
-|**Check Magic String**|B0038.002| Malware checks a static value (i.e., magic string or number) to verify integrity. [[2]](#2)|
-|**Check Section Length**|B0038.003| Malware checks the length of a section to verify integrity. [[2]](#2)|
+|**Use Hashquine**|B0038.001|Malware uses a hashquine (the file contains it's own hash) for use as an integrity check. [[1]](#1)|
+|**Check Magic String**|B0038.002|Malware checks a static value (i.e., magic string or number) to verify integrity. [[2]](#2)|
+|**Check Section Length**|B0038.003|Malware checks the length of a section to verify integrity. [[2]](#2)|

 ## Use in Malware

@@ -77,7 +77,7 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or

 <a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022

-<a name="10">[10]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="10">[10]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection

 <a name="11">[11]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

@@ -56,7 +56,7 @@ Some aspects of this Conditional Execution behavior are related to the [Executio
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The malware executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)|
-|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker A variant has a routine that causes the process to suicide exit if the keyboard language is set to Ukranian. [[5]](#5)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker A variant has a routine that causes the process to suicide exit if the keyboard language is set to Ukranian. [[8]](#8)|
 |[**Conficker**](../xample-malware/conficker.md)|2008|B0025.001|Conficker B variant has significantly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts. [[5]](#5)|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|B0025.004|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.). [[3]](#3)|
 |[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware only proceeds if it detects the BIOS ROM is Award BIOS. [[4]](#4)|
@@ -81,3 +81,4 @@ Some aspects of this Conditional Execution behavior are related to the [Executio

 <a name="7">[7]</a> capa v4.0, analyzed at MITRE on 10/12/2022

+<a name="8">[8]</a> https://en.wikipedia.org/wiki/Conficker
@@ -94,7 +94,7 @@ Droppers may be described as “single stage” or “two stage.” While the fo

 <a name="15">[15]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/

-<a name="16">[16]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="16">[16]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection

 <a name="17">[17]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/

@@ -52,10 +52,10 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq

 <a name="2">[2]</a> https://blogs.cisco.com/security/talos/rombertik

-<a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
+<a name="3">[3]</a> https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf

 <a name="4">[4]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/

 <a name="5">[5]</a> https://www.secureworks.com/research/cryptolocker-ransomware

-<a name="6">[6]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="6">[6]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
@@ -47,4 +47,4 @@ See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org

 ## References

-<a name="1">[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf
+<a name="1">[1]</a> https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf
@@ -25,9 +25,9 @@ Behaviors that enable malware to manipulate, interrupt, or destroy systems and d
 * **Denial of Service** [B0033](../impact/denial-of-service.md)
 * **Destroy Hardware** [B0017](../impact/destroy-hardware.md)
 * **Disk Wipe** [F0014](../impact/disk-wipe.md)
-* **Exploit Kit Behavior** [E1190](../impact/exploit-kit.md)
+* **Exploit Kit** [E1190](../impact/exploit-kit.md)
 * **Exploitation for Client Execution** [E1203](../execution/exploitation-for-client-execution.md)
-* **Generate Network Traffic from Victim** [E1643](../impact/generate-traffic-from-victim.md)
+* **Generate Traffic from Victim** [E1643](../impact/generate-traffic-from-victim.md)
 * **Manipulate Network Traffic** [B0019](../impact/manipulate-network-traffic.md)
 * **Modify Hardware** [B0042](../impact/modify-hardware.md)	
 * **Remote Access** [B0022](../impact/remote-access.md)
@@ -56,7 +56,7 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni

 ## References

-<a name="1">[1]</a> https://www.secureworks.com/research/cryptowall-ransomware
+<a name="1">[1]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/

 <a name="2">[2]</a> https://www.secureworks.com/research/cryptolocker-ransomware

@@ -47,7 +47,7 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni

 ## References

-<a name="1">[1]</a> http://pds15.egloos.com/pds/201001/01/66/BlackEnergy_DDoS_Bot_Analysis.pdf
+<a name="1">[1]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf

 <a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

@@ -47,6 +47,6 @@ The related **Data Manipulation: Transmitted Data Manipulation ([T1565.002](http
 ## References
 <a name="1">[1]</a> B. Feeley and B. Stone-Gross,"New Evidence Proves Ongoing WIZARD SPIDER / LUNAR SPIDER Collaboration," CrowdStrike, blog, 20 Mar. 2019. [Online]. Available: https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module. 

-<a name="2">[2]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="2">[2]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection

 <a name="3">[3]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
@@ -50,5 +50,5 @@ The supply chain may be compromised to enable initial malware infection. MBC obj

 <a name="1">[1]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/

-<a name="2">[2]</a> 
+<a name="2">[2]</a> https://eclypsium.com/wp-content/uploads/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf

@@ -138,7 +138,7 @@ retn

 <a name="3">[3]</a> https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html

-<a name="4">[4]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
+<a name="4">[4]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf

 <a name="5">[5]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf

@@ -39,7 +39,7 @@ Malware checks a mutex.

 ## References

-<a name="1">[1]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+<a name="1">[1]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant

 <a name="2">[2]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

@@ -44,7 +44,7 @@ Malware creates a mutex.

 ## References

-<a name="1">[1]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+<a name="1">[1]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant

 <a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en

@@ -54,6 +54,7 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol
 |[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Malware adds registry keys to enable startup after reboot. [[15]](#15)|
 |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip persists via a Run registry key. [[17]](#17)|
 |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry creates two registry run keys to ensure persistence. [[18]](#18)|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|A copy of Crytowall is placed in the startup folder and a directory at the root of the system drive. Also adds multiple "autostart" registry keys. [[19]](#19)|


 ## References
@@ -92,4 +93,6 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol

 <a name="17">[17]</a> capa v4.0, analyzed at MITRE on 10/12/2022

-<a name="18">[18]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
+<a name="18">[18]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
+
+<a name="19">[19]</a> https://www.secureworks.com/research/cryptowall-ransomware
@@ -38,5 +38,5 @@ Malware may install a certificate to gain access to https traffic.

 ## References

-<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="1">[1]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection

@@ -67,8 +67,8 @@
          "url": "https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection"
        },
        {
-          "source_name": "Malware Behavior Catalogue",
-          "description": "GitHub",
+          "source_name": "MBC",
+          "description": "Malware corpus",
          "url": "https://github.com/MBCProject/mbc-markdown/blob/main/xample-malware/searchawesome.md"
        }
      ]
@@ -34,7 +34,7 @@ See ATT&CK: [Attor - Techniques Used](https://attack.mitre.org/software/S0438/).

 |Name|Use|
 |---|---|
-|[Exfiltration::Automated Exfiltration (E1020)](../exfiltration/automated-exfiltration.md) | Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server [[1]](#1)|
+|[Exfiltration::Automated Exfiltration (E1020)](../exfiltration/automated-exfiltration.md)|Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server [[1]](#1)|


 ## Indicators of Compromise
@@ -49,4 +49,4 @@ SHA1 Hashes

 ## References

-<a name="1">[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf
+<a name="1">[1]</a> https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf
@@ -30,16 +30,16 @@ BadUSB is an attack that exploits an inherent vulnerability in USB firmware. Suc

 |Name|Use|
 |---|---|
-[Command and Control::Communication Through Removable Media (T1092)](https://attack.mitre.org/techniques/T1092/) | A USB interface is able to connect to many different devices, including cameras, keyboards, modems, webcams, wireless networking devices, and others. BadUSB leverages these devices. [[1]](#1) |
-|[Initial Access :: Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/)| BadUSB can be used as a means of gaining initial access to a target machine by exploiting vulnerabilities in the USB firmware or by tricking the user into plugging in an infected USB device. [[1]](#1) |
-|[Collection::Data from Local System (T1005)](https://attack.mitre.org/techniques/T1005/) | BadUSB can steal sensitive data from an infected machine (e.g., login credentials) and transmit it to a remote C2 server. [[3]](#3) |
+[Command and Control::Communication Through Removable Media (T1092)](https://attack.mitre.org/techniques/T1092/)|A USB interface is able to connect to many different devices, including cameras, keyboards, modems, webcams, wireless networking devices, and others. BadUSB leverages these devices. [[1]](#1)|
+|[Initial Access :: Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/)| BadUSB can be used as a means of gaining initial access to a target machine by exploiting vulnerabilities in the USB firmware or by tricking the user into plugging in an infected USB device. [[1]](#1)|
+|[Collection::Data from Local System (T1005)](https://attack.mitre.org/techniques/T1005/)|BadUSB can steal sensitive data from an infected machine (e.g., login credentials) and transmit it to a remote C2 server. [[3]](#3)|


 ## MBC Behaviors

 |Name|Use|
 |---|---|
-|[Impact::Modify Hardware (B0042)](../impact/modify-hardware.md) | BadUSB can modify USB drives. [[4]](#4)|
+|[Impact::Modify Hardware (B0042)](../impact/modify-hardware.md)|BadUSB can modify USB drives. [[4]](#4)|


 ## Indicators of Compromise
@@ -58,7 +58,7 @@ See ATT&CK: [BlackEnergy - Techniques Used](https://attack.mitre.org/software/S0
 |---|---|
 |[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|Malware was originally built to launch a distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
 |[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|Malware-infected bots receive commands from botmaster to load plugins associated with botmaster's goals. [[1]](#1)|
-|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|BlackEnergy contains obfuscated stack strings. [[4]](#4) |
+|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|BlackEnergy contains obfuscated stack strings. [[4]](#4)|
 |[Communication::HTTP Communication::Extract Body (C0002.011)](../micro-behaviors/communication/http-communication.md)|BlackEnergy extracts the HTTP body. [[4]](#4)|
 |[Communication::HTTP Communication::IWebBrowser (C0002.010)](../micro-behaviors/communication/http-communication.md)|The malware initializes IWebBrowser2. [[4]](#4)|
 |[Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|BlackEnergy hashes data via WinCrypt. [[4]](#4)|
@@ -47,7 +47,7 @@ See ATT&CK: [CHOPSTICK - Techniques Used](https://attack.mitre.org/software/S002

 |Name|Use|
 |---|---|
-|[Micro-Objective::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|CHOPSTICK encrypts the configuration block using RC4 encryption. [[1]](#1)|
+|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|CHOPSTICK encrypts the configuration block using RC4 encryption. [[1]](#1)|

 ## Indicators of Compromise

@@ -46,6 +46,7 @@ CryptoWall is a family of ransomware. [[1]](#1)
 |[Impact::Data Encrypted for Impact::Ransom Note (E1486.001)](../impact/data-encrypted-for-impact.md)|The malware launches Internet Explorer to show ransom notes. [[1]](#1)|
 |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware searches for user files before encrypting them. [[1]](#1)|
 |[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects code into a new svchost process. [[1]](#1)|
+|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|A copy of Crytowall is placed in the startup folder and a directory at the root of the system drive. Also adds multiple "autostart" registry keys. [[2]](#2)|


 ## MBC Behaviors
@@ -37,8 +37,8 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev

 |Name|Use|
 |---|---|
-|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[3]](#3) |
-|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[3]](#3) |
+|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[3]](#3)|
+|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[3]](#3)|

 ## Enhanced ATT&CK Techniques

@@ -34,7 +34,7 @@ See ATT&CK: [Drovorub - Techniques Used](https://attack.mitre.org/software/S0502

 |Name|Use|
 |---|---|
-|[Persistence::Kernel Modules and Extensions (F0010)](../persistence/kernel-modules-and-extensions.md) | Drovorub uses a kernel module rootkit for loading and persistence. [[1]](#1)|
+|[Persistence::Kernel Modules and Extensions (F0010)](../persistence/kernel-modules-and-extensions.md)|Drovorub uses a kernel module rootkit for loading and persistence. [[1]](#1)|


 ## Indicators of Compromise
@@ -29,7 +29,7 @@ DYEPACK is a malware suite that manipulates local information regarding SWIFT tr

 |Name|Use|
 |---|---|
-|[Impact::Compromise Data Integrity (B0016)](../impact/compromise-data-integrity.md) | DYEPACK alters records in databases used for SWIFT transactions. [[1]](#1)|
+|[Impact::Compromise Data Integrity (B0016)](../impact/compromise-data-integrity.md)|DYEPACK alters records in databases used for SWIFT transactions. [[1]](#1)|

 ## References

@@ -29,26 +29,26 @@ ElectroRAT is used to steal cryptocurrency from wallets.

 |Name|Use|
 |---|---|
-|[Execution::User execution (T1240)](https://attack.mitre.org/techniques/T1204/) | ElectroRat makes the user execute the malware. [[1]](#1)|
-|[Command and Control::Web Service (T1102)](https://attack.mitre.org/techniques/T1102) | EletroRat uses HTTP for C&C and exfiltration. [[1]](#1)|
-|[Execution::Command and Scripting Interpreter (T1059)](https://attack.mitre.org/techniques/T1059) | ElectroRat uses Python to embed additional binares. [[1]](#1)|
-|[Discovery::System Information Discovery (T1082)](https://attack.mitre.org/techniques/T1082) | ElectroRat detects the OS to determine which plugins to download. [[1]](#1)|
-|[Persistence::Boot or Logon Autostart Execution (T1547)](https://attack.mitre.org/techniques/T1547/) | ElectroRat enables auto start on bootup.  [[1]](#1)|
+|[Execution::User Execution (T1204)](https://attack.mitre.org/techniques/T1204/)|ElectroRat makes the user execute the malware. [[1]](#1)|
+|[Command and Control::Web Service (T1102)](https://attack.mitre.org/techniques/T1102)|EletroRat uses HTTP for C&C and exfiltration. [[1]](#1)|
+|[Execution::Command and Scripting Interpreter (T1059)](https://attack.mitre.org/techniques/T1059)|ElectroRat uses Python to embed additional binares. [[1]](#1)|
+|[Discovery::System Information Discovery (T1082)](https://attack.mitre.org/techniques/T1082)|ElectroRat detects the OS to determine which plugins to download. [[1]](#1)|
+|[Persistence::Boot or Logon Autostart Execution (T1547)](https://attack.mitre.org/techniques/T1547/)|ElectroRat enables auto start on bootup.  [[1]](#1)|

 ## Enhanced ATT&CK Techniques

 |Name|Use|
 |---|---|
-|[Collection::Input Capture (E1056)](../collection/input-capture.md) | ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[1]](#1)|
-|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md) | ElectroRat looks for wallets to steal cryptocurrency  [[1]](#1)|
+|[Collection::Input Capture (E1056)](../collection/input-capture.md)|ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[1]](#1)|
+|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|ElectroRat looks for wallets to steal cryptocurrency  [[1]](#1)|

 ## MBC Behaviors

 |Name|Use|
 |---|---|
-|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md) | Upon execution, ElectroRat downloads additional executables. [[1]](#1)|
-|[Collection::Cryptocurrency (B0028)](../impact/clipboard-modification.md) | ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)| 
-|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md) | ElectroRat communicates to a Pastebin site via HTTP. [[1]](#1)|
+|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Upon execution, ElectroRat downloads additional executables. [[1]](#1)|
+|[Collection::Cryptocurrency (B0028)](../impact/clipboard-modification.md)|ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)| 
+|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|ElectroRat communicates to a Pastebin site via HTTP. [[1]](#1)|

 ## Indicators of Compromise

@@ -43,10 +43,10 @@ Emotet is a banking trojan. [[1]](#1)

 |Name|Use|
 |---|---|
-|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2) |
-|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2) |
-|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1) |
-|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6) |
+|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2)|
+|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2)|
+|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1)|
+|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6)|

 ## MBC Behaviors

@@ -61,7 +61,7 @@ Gamut is a spamming botnet.
 |[Impact::Spamming (B0039)](../impact/spamming.md)|If port 25 is open, the bot uses a spam template and email list to send spam. [[1]](#1)|
 |[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Gamut hashes data with CRC32. [[3]](#3)|
 |[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Gamut encodes data using XOR. [[3]](#3)|
-|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[3]](#3) |
+|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[3]](#3)|
 |[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Gamut contains an embedded PE file. [[3]](#3)|
 |[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Gamut creates directories. [[3]](#3)|
 |[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Gamut deletes directories. [[3]](#3)|
@@ -64,7 +64,7 @@ From [[1]](#1), “The malware installs two instances of itself on the system. T
 |[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[1]](#1)|
 |[Collection::Screen Capture (E1113)](../collection/screen-capture.md)|GoBotKR is capable of capturing screenshots. [[1]](#1)|
 |[Execution::User Execution (E1204)](../execution/user-execution.md)|GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)|
-|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|GoBotKR can download additional files and update itself. [[1]](#1) |
+|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|GoBotKR can download additional files and update itself. [[1]](#1)|
 |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|GoBotKR uses wmic, systeminfo, and ver commands to collect information about the system and the installed software and queries environment variables. [[1]](#1) [[2]](#2)|
 |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|GoBotKR checks if a file exists. [[2]](#2)|

@@ -49,7 +49,7 @@ See ATT&CK: [GravityRAT - Techniques Used](https://attack.mitre.org/software/S02
 |---|---|
 |[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware checks the system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[1]](#1)|
 |[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware creates a WMI request to identify the BIOS version. [[1]](#1)|
-|[Micro-Objective::Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|GravityRAT v3 supports AES file encryption. [[2]](#2)|
+|[Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|GravityRAT v3 supports AES file encryption. [[2]](#2)|
 |[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware checks if the manufacturer field in the Win32_Computer entry (in WMI) contains "Virtual", "Vmware", or "Virtualbox." [[2]](#2)|
 |[Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Processor count (B0009.018)](../anti-behavioral-analysis/virtual-machine-detection.md)|GravityRAT determines the machine to be a VM if the core count is 1. [[2]](#2)|
 |[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - MAC Address (B0009.028)](../anti-behavioral-analysis/virtual-machine-detection.md)|GravityRAT checks if the MAC address starts with a well-known hexadecimal number used by various VM developer. [[2]](#2)|
@@ -46,7 +46,7 @@ A family of bots.

 |Name|Use|
 |---|---|
-|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| Kraken uses a domain name generator to provide new domains. [[1]](#1)|
+|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|Kraken uses a domain name generator to provide new domains. [[1]](#1)|
 |[Anti-Behavioral Analysis::Memory Dump Evasion (B0006)](../anti-behavioral-analysis/memory-dump-evasion.md)|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[1]](#1)|
 |[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Kraken encrypts data using RC4 PRGA. [[2]](#2)|
 |[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Kraken encodes data using XOR. [[2]](#2)|
@@ -71,4 +71,4 @@ Attack flow for SearchAwesome based on [[1]](#1).

 ## References

-<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="1">[1]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
@@ -86,7 +86,7 @@ SHA256 Hashes

 ## Attack Flow

-Attack flow for Shamoon based on [[3]](#3).
+Attack flow for Shamoon based on [[2]](#2).

 ![Screenshot of Attack Flow for Shamoon based on McAfee article.](/xample-malware/AttackFlow/Shamoon.png)

@@ -30,7 +30,7 @@ The Snake malware is an information-stealing malware that is implemented in the

 |Name|Use|
 |---|---|
-|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md) | Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
+|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)|Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|

 ## References

@@ -33,18 +33,18 @@ See ATT&CK: [WannaCry - Techniques Used](https://attack.mitre.org/software/S0366

 |Name|Use|
 |---|---|
-|[Defense Evasion:: Hidden Files and Directories(F0005.003)](../defense-evasion/hidden-files-and-directories.md) | WannaCry uses the +h attribute to hide its files. [[1]](#1)|
-|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md) | WannaCry creates two registry run keys to ensure persistence. [[1]](#1)|
-|[Defense-Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md) | WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[1]](#1)|
+|[Defense Evasion:: Hidden Files and Directories(F0005.003)](../defense-evasion/hidden-files-and-directories.md)|WannaCry uses the +h attribute to hide its files. [[1]](#1)|
+|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|WannaCry creates two registry run keys to ensure persistence. [[1]](#1)|
+|[Defense-Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[1]](#1)|

 ## MBC Behaviors

 |Name|Use|
 |---|---|
-|[Discovery::Self Discovery (B0038)](../discovery/self-discovery.md) | WannaCry checks the size of the file it loads into memory. [[1]](#1)|
-|[Discovery::Self Discovery (B0038.002)](../discovery/self-discovery.md) | WannaCry checks a string, keylen and a magic number before decrypting a dll. [[1]](#1)|
-|[Discovery::Self Discovery (B0038.003)](../discovery/self-discovery.md) | WannaCry checks the data lengh of a section before decypting a dll. [[1]](#1)|
-|[Impact::Data Encrypted for Impact (B0025)](../impact/data-encrypted-for-impact.md) | WannaCry encrypts files for ransom. [[1]](#1)|
+|[Discovery::Self Discovery (B0038)](../discovery/self-discovery.md)|WannaCry checks the size of the file it loads into memory. [[1]](#1)|
+|[Discovery::Self Discovery (B0038.002)](../discovery/self-discovery.md)|WannaCry checks a string, keylen and a magic number before decrypting a dll. [[1]](#1)|
+|[Discovery::Self Discovery (B0038.003)](../discovery/self-discovery.md)|WannaCry checks the data lengh of a section before decypting a dll. [[1]](#1)|
+|[Impact::Data Encrypted for Impact (B0025)](../impact/data-encrypted-for-impact.md)|WannaCry encrypts files for ransom. [[1]](#1)|


 ## Indicators of Compromise