diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md index 57d5322..05a1a6b 100644 --- a/anti-behavioral-analysis/sandbox-detection.md +++ b/anti-behavioral-analysis/sandbox-detection.md @@ -44,9 +44,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[5]](#5). This method is similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique. This method is also related to Unprotect techniques U1316 and U1317.| |**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.| |**Product Key/ID Testing**|[B0007.005](#b0007005-snippet)|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.| -|**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.| -|**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.| -|**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.| |**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox. This method is related to Unprotect technique U1315.| |**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name. This method is related to Unprotect technique U1303.| |**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments. This method is related to Unprotect technique U1005.| @@ -128,7 +125,7 @@ mov bl, 1 [5] https://github.com/LordNoteworthy/al-khaser -[6] https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/ +[6] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf [7] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md index 1f352c5..92dd356 100644 --- a/anti-behavioral-analysis/virtual-machine-detection.md +++ b/anti-behavioral-analysis/virtual-machine-detection.md @@ -61,8 +61,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.| |**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.| |**Instruction Testing**|[B0009.029](#b0009029-snippet)|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| -|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type.| -|**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| |**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type. This method is related to Unprotect technqiue U1324.| |**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) This method is related to Unprotect technique U1323.| |**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| @@ -94,7 +92,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)| |[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.018|GravityRAT determines the machine is a VM if the core count is 1. [[3]](#3)| |[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.023|GravityRAT checks if the manufacturer field in the Win32_Computer entry (in WMI) contains "Virtual," "Vmware," or "Virtualbox." [[3]](#3)| -|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.024|GravityRAT creates a WMI request to identify the BIOS version. [[3]](#3)| +|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.024|GravityRAT creates a WMI request to identify the BIOS version. [[13]](#13)| |[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.028|GravityRAT checks if the MAC address starts with a well-known hexadecimal number used by various VM developers. [[3]](#3)| |[**WebCobra**](../xample-malware/webcobra.md)|2018|B0009.022|WebCobra injects malicious code in to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in a VM. [[4]](#4)| |[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip detects VMWare, Virtual PC, and Virtual Box. It also detects VM environments in general by considering time lapses. [[6]](#6)| @@ -159,7 +157,7 @@ jmp short loc_401CBB [2] https://search.unprotect.it/map/sandbox-evasion/ -[3] https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/ +[3] https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html [4] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ @@ -178,3 +176,5 @@ jmp short loc_401CBB [11] https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques [12] capa v4.0, analyzed at MITRE on 10/12/2022 + +[12] https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/ diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md index ddd270d..bd336c7 100644 --- a/anti-static-analysis/executable-code-obfuscation.md +++ b/anti-static-analysis/executable-code-obfuscation.md @@ -125,7 +125,7 @@ jmp short loc_401326 ## References -[1] https://blogs.cisco.com/security/talos/rombertik +[1] https://insights.sei.cmu.edu/blog/api-hashing-tool-imagine-that/ [2] https://cofense.com/blog/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/ @@ -135,7 +135,7 @@ jmp short loc_401326 [5] https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality -[6] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf +[6] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant [7] https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index ad8840e..6b2870d 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -73,7 +73,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software [3] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html -[4] https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan +[4] https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ [5] http://www.csl.sri.com/users/vinod/papers/Conficker/ diff --git a/command-and-control/c2-communication.md b/command-and-control/c2-communication.md index 210ccf4..64e2bee 100644 --- a/command-and-control/c2-communication.md +++ b/command-and-control/c2-communication.md @@ -122,7 +122,7 @@ jmp short loc_4019A2 [2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ -[3] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf +[3] https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf [4] https://citizenlab.ca/2016/04/between-hong-kong-and-burma/ @@ -136,7 +136,7 @@ jmp short loc_4019A2 [9] https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke -[10]https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/ +[10] https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/ [11] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking @@ -152,7 +152,7 @@ jmp short loc_4019A2 [17] https://blogs.cisco.com/security/talos/rombertik -[18] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ +[18] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection [19] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/command-and-control/ingress-tool-transfer.md b/command-and-control/ingress-tool-transfer.md index a63be9b..5c8337a 100644 --- a/command-and-control/ingress-tool-transfer.md +++ b/command-and-control/ingress-tool-transfer.md @@ -47,7 +47,7 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware downloads DLLs from the hardcoded URL/remote server. [[7]](#7) [[8]](#8)| |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can download additional files and update itself. [[9]](#9)| |[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut receives files from the C2. [[10]](#10)| -|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 downloads files from the C2. [[10]](#10)| +|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 downloads files from the C2. [[11]](#11)| ## References @@ -74,4 +74,6 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques [9] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ -[10] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/ \ No newline at end of file +[10] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/ + +[11] https://citizenlab.ca/2016/04/between-hong-kong-and-burma/ diff --git a/defense-evasion/alternative-installation-location.md b/defense-evasion/alternative-installation-location.md index 7a791da..b0eaafd 100644 --- a/defense-evasion/alternative-installation-location.md +++ b/defense-evasion/alternative-installation-location.md @@ -37,7 +37,7 @@ While the definition of fileless malware can be ambiguous, here it represents ma |Name|ID|Description| |---|---|---| -|**Fileless Malware**|B0027.001|Stores itself in memory. This method is related to Unprotect technique U1205.| +|**Fileless Malware**|B0027.001|Stores itself in memory. This method is related to Unprotect technique U1205 and ATT&CK sub-technique Obfuscated Files or Information: Fileless Storage [T1027.011](https://attack.mitre.org/techniques/T1027/011/). | |**Registry Install**|B0027.002|Stores itself in the Windows registry.| ## Use in Malware @@ -50,7 +50,7 @@ While the definition of fileless malware can be ambiguous, here it represents ma ## References -[1] "How to remove the Kovter Trojan (Removal Guide)," bleepingcomputer.com, 23 Mar. 2016. [Online]. Available: https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan. +[1] https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem. [2] J. Glazova,"CosmicStrand: A UEFI Rootkit," Kaspersky, blog, 26 Jul. 2022. [Online]. Available: https://usa.kaspersky.com/blog/cosmicstrand-uefi-rootkit/26807/. diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md index 15f3213..5c594d1 100644 --- a/defense-evasion/process-injection.md +++ b/defense-evasion/process-injection.md @@ -73,7 +73,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan ## References [1] Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process -[2] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy +[2] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf [3] https://github.com/LordNoteworthy/al-khaser diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index d32ab76..7d71c35 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -57,6 +57,6 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 [2] https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke -[3] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ +[3] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection [4] https://www.mandiant.com/resources/blog/wannacry-malware-profile \ No newline at end of file diff --git a/discovery/self-discovery.md b/discovery/self-discovery.md index 75cc3fc..5e6c7de 100644 --- a/discovery/self-discovery.md +++ b/discovery/self-discovery.md @@ -30,13 +30,13 @@ Malware may gather information about itself, such as its filename or size on disk. -# Methods +## Methods |Name|ID|Description| |---|---|---| -|**Use Hashquine**|B0038.001| Malware uses a hashquine (the file contains it's own hash) for use as an integrity check. [[1]](#1)| -|**Check Magic String**|B0038.002| Malware checks a static value (i.e., magic string or number) to verify integrity. [[2]](#2)| -|**Check Section Length**|B0038.003| Malware checks the length of a section to verify integrity. [[2]](#2)| +|**Use Hashquine**|B0038.001|Malware uses a hashquine (the file contains it's own hash) for use as an integrity check. [[1]](#1)| +|**Check Magic String**|B0038.002|Malware checks a static value (i.e., magic string or number) to verify integrity. [[2]](#2)| +|**Check Section Length**|B0038.003|Malware checks the length of a section to verify integrity. [[2]](#2)| ## Use in Malware diff --git a/execution/command-and-scripting-interpreter.md b/execution/command-and-scripting-interpreter.md index e26746f..b80642f 100644 --- a/execution/command-and-scripting-interpreter.md +++ b/execution/command-and-scripting-interpreter.md @@ -77,7 +77,7 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or [9] capa v4.0, analyzed at MITRE on 10/12/2022 -[10] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ +[10] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection [11] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ diff --git a/execution/conditional-execution.md b/execution/conditional-execution.md index 48ad50f..d0882ce 100644 --- a/execution/conditional-execution.md +++ b/execution/conditional-execution.md @@ -56,7 +56,7 @@ Some aspects of this Conditional Execution behavior are related to the [Executio |Name|Date|Method|Description| |---|---|---|---| |[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The malware executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)| -|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker A variant has a routine that causes the process to suicide exit if the keyboard language is set to Ukranian. [[5]](#5)| +|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker A variant has a routine that causes the process to suicide exit if the keyboard language is set to Ukranian. [[8]](#8)| |[**Conficker**](../xample-malware/conficker.md)|2008|B0025.001|Conficker B variant has significantly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts. [[5]](#5)| |[**Ursnif**](../xample-malware/ursnif.md)|2016|B0025.004|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.). [[3]](#3)| |[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware only proceeds if it detects the BIOS ROM is Award BIOS. [[4]](#4)| @@ -81,3 +81,4 @@ Some aspects of this Conditional Execution behavior are related to the [Executio [7] capa v4.0, analyzed at MITRE on 10/12/2022 +[8] https://en.wikipedia.org/wiki/Conficker diff --git a/execution/install-additional-program.md b/execution/install-additional-program.md index d185328..02627af 100644 --- a/execution/install-additional-program.md +++ b/execution/install-additional-program.md @@ -94,7 +94,7 @@ Droppers may be described as “single stage” or “two stage.” While the fo [15] https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/ -[16] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ +[16] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection [17] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ diff --git a/execution/user-execution.md b/execution/user-execution.md index bbbca2f..ea671c3 100644 --- a/execution/user-execution.md +++ b/execution/user-execution.md @@ -52,10 +52,10 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq [2] https://blogs.cisco.com/security/talos/rombertik -[3] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf +[3] https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf [4] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/ [5] https://www.secureworks.com/research/cryptolocker-ransomware -[6] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ +[6] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection diff --git a/exfiltration/automated-exfiltration.md b/exfiltration/automated-exfiltration.md index ac094f8..34b730f 100644 --- a/exfiltration/automated-exfiltration.md +++ b/exfiltration/automated-exfiltration.md @@ -47,4 +47,4 @@ See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org ## References -[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf \ No newline at end of file +[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf \ No newline at end of file diff --git a/impact/README.md b/impact/README.md index c84b529..41ec20f 100644 --- a/impact/README.md +++ b/impact/README.md @@ -25,9 +25,9 @@ Behaviors that enable malware to manipulate, interrupt, or destroy systems and d * **Denial of Service** [B0033](../impact/denial-of-service.md) * **Destroy Hardware** [B0017](../impact/destroy-hardware.md) * **Disk Wipe** [F0014](../impact/disk-wipe.md) -* **Exploit Kit Behavior** [E1190](../impact/exploit-kit.md) +* **Exploit Kit** [E1190](../impact/exploit-kit.md) * **Exploitation for Client Execution** [E1203](../execution/exploitation-for-client-execution.md) -* **Generate Network Traffic from Victim** [E1643](../impact/generate-traffic-from-victim.md) +* **Generate Traffic from Victim** [E1643](../impact/generate-traffic-from-victim.md) * **Manipulate Network Traffic** [B0019](../impact/manipulate-network-traffic.md) * **Modify Hardware** [B0042](../impact/modify-hardware.md) * **Remote Access** [B0022](../impact/remote-access.md) diff --git a/impact/data-encrypted-for-impact.md b/impact/data-encrypted-for-impact.md index 2eafc13..5067e77 100644 --- a/impact/data-encrypted-for-impact.md +++ b/impact/data-encrypted-for-impact.md @@ -56,7 +56,7 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni ## References -[1] https://www.secureworks.com/research/cryptowall-ransomware +[1] https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/ [2] https://www.secureworks.com/research/cryptolocker-ransomware diff --git a/impact/denial-of-service.md b/impact/denial-of-service.md index 0f7cca5..3cca080 100644 --- a/impact/denial-of-service.md +++ b/impact/denial-of-service.md @@ -47,7 +47,7 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni ## References -[1] http://pds15.egloos.com/pds/201001/01/66/BlackEnergy_DDoS_Bot_Analysis.pdf +[1] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf [2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/impact/manipulate-network-traffic.md b/impact/manipulate-network-traffic.md index 2a5cb8e..b63ed88 100644 --- a/impact/manipulate-network-traffic.md +++ b/impact/manipulate-network-traffic.md @@ -47,6 +47,6 @@ The related **Data Manipulation: Transmitted Data Manipulation ([T1565.002](http ## References [1] B. Feeley and B. Stone-Gross,"New Evidence Proves Ongoing WIZARD SPIDER / LUNAR SPIDER Collaboration," CrowdStrike, blog, 20 Mar. 2019. [Online]. Available: https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module. -[2] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ +[2] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection [3] https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html diff --git a/lateral-movement/supply-chain-compromise.md b/lateral-movement/supply-chain-compromise.md index e6db6d5..4a8837d 100644 --- a/lateral-movement/supply-chain-compromise.md +++ b/lateral-movement/supply-chain-compromise.md @@ -50,5 +50,5 @@ The supply chain may be compromised to enable initial malware infection. MBC obj [1] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ -[2] +[2] https://eclypsium.com/wp-content/uploads/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf diff --git a/micro-behaviors/cryptography/encrypt-data.md b/micro-behaviors/cryptography/encrypt-data.md index 65bab9c..8265282 100644 --- a/micro-behaviors/cryptography/encrypt-data.md +++ b/micro-behaviors/cryptography/encrypt-data.md @@ -138,7 +138,7 @@ retn [3] https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html -[4] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy +[4] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf [5] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf diff --git a/micro-behaviors/process/check-mutex.md b/micro-behaviors/process/check-mutex.md index 2c20c44..286783b 100644 --- a/micro-behaviors/process/check-mutex.md +++ b/micro-behaviors/process/check-mutex.md @@ -39,7 +39,7 @@ Malware checks a mutex. ## References -[1] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf +[1] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant [2] https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/ diff --git a/micro-behaviors/process/create-mutex.md b/micro-behaviors/process/create-mutex.md index b0848bf..b78d534 100644 --- a/micro-behaviors/process/create-mutex.md +++ b/micro-behaviors/process/create-mutex.md @@ -44,7 +44,7 @@ Malware creates a mutex. ## References -[1] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf +[1] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant [2] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/persistence/registry-run-keys-startup-folder.md b/persistence/registry-run-keys-startup-folder.md index 2a367cd..fa9b8f7 100644 --- a/persistence/registry-run-keys-startup-folder.md +++ b/persistence/registry-run-keys-startup-folder.md @@ -54,6 +54,7 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol |[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Malware adds registry keys to enable startup after reboot. [[15]](#15)| |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip persists via a Run registry key. [[17]](#17)| |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry creates two registry run keys to ensure persistence. [[18]](#18)| +|[**CryptoWall**](../xample-malware/cryptowall.md)|A copy of Crytowall is placed in the startup folder and a directory at the root of the system drive. Also adds multiple "autostart" registry keys. [[19]](#19)| ## References @@ -92,4 +93,6 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol [17] capa v4.0, analyzed at MITRE on 10/12/2022 -[18] https://www.mandiant.com/resources/blog/wannacry-malware-profile \ No newline at end of file +[18] https://www.mandiant.com/resources/blog/wannacry-malware-profile + +[19] https://www.secureworks.com/research/cryptowall-ransomware diff --git a/privilege-escalation/install-certificate.md b/privilege-escalation/install-certificate.md index fe4193f..bd38a3e 100644 --- a/privilege-escalation/install-certificate.md +++ b/privilege-escalation/install-certificate.md @@ -38,5 +38,5 @@ Malware may install a certificate to gain access to https traffic. ## References -[1] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ +[1] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection diff --git a/xample-malware/AttackFlow/SearchAwesome_Adware.json b/xample-malware/AttackFlow/SearchAwesome_Adware.json index 24b6081..7bbe784 100644 --- a/xample-malware/AttackFlow/SearchAwesome_Adware.json +++ b/xample-malware/AttackFlow/SearchAwesome_Adware.json @@ -67,8 +67,8 @@ "url": "https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection" }, { - "source_name": "Malware Behavior Catalogue", - "description": "GitHub", + "source_name": "MBC", + "description": "Malware corpus", "url": "https://github.com/MBCProject/mbc-markdown/blob/main/xample-malware/searchawesome.md" } ] diff --git a/xample-malware/attor.md b/xample-malware/attor.md index fa09f55..6bf936b 100644 --- a/xample-malware/attor.md +++ b/xample-malware/attor.md @@ -34,7 +34,7 @@ See ATT&CK: [Attor - Techniques Used](https://attack.mitre.org/software/S0438/). |Name|Use| |---|---| -|[Exfiltration::Automated Exfiltration (E1020)](../exfiltration/automated-exfiltration.md) | Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server [[1]](#1)| +|[Exfiltration::Automated Exfiltration (E1020)](../exfiltration/automated-exfiltration.md)|Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server [[1]](#1)| ## Indicators of Compromise @@ -49,4 +49,4 @@ SHA1 Hashes ## References -[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf \ No newline at end of file +[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf \ No newline at end of file diff --git a/xample-malware/badusb.md b/xample-malware/badusb.md index 0bb87de..6404ac7 100644 --- a/xample-malware/badusb.md +++ b/xample-malware/badusb.md @@ -30,16 +30,16 @@ BadUSB is an attack that exploits an inherent vulnerability in USB firmware. Suc |Name|Use| |---|---| -[Command and Control::Communication Through Removable Media (T1092)](https://attack.mitre.org/techniques/T1092/) | A USB interface is able to connect to many different devices, including cameras, keyboards, modems, webcams, wireless networking devices, and others. BadUSB leverages these devices. [[1]](#1) | -|[Initial Access :: Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/)| BadUSB can be used as a means of gaining initial access to a target machine by exploiting vulnerabilities in the USB firmware or by tricking the user into plugging in an infected USB device. [[1]](#1) | -|[Collection::Data from Local System (T1005)](https://attack.mitre.org/techniques/T1005/) | BadUSB can steal sensitive data from an infected machine (e.g., login credentials) and transmit it to a remote C2 server. [[3]](#3) | +[Command and Control::Communication Through Removable Media (T1092)](https://attack.mitre.org/techniques/T1092/)|A USB interface is able to connect to many different devices, including cameras, keyboards, modems, webcams, wireless networking devices, and others. BadUSB leverages these devices. [[1]](#1)| +|[Initial Access :: Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/)| BadUSB can be used as a means of gaining initial access to a target machine by exploiting vulnerabilities in the USB firmware or by tricking the user into plugging in an infected USB device. [[1]](#1)| +|[Collection::Data from Local System (T1005)](https://attack.mitre.org/techniques/T1005/)|BadUSB can steal sensitive data from an infected machine (e.g., login credentials) and transmit it to a remote C2 server. [[3]](#3)| ## MBC Behaviors |Name|Use| |---|---| -|[Impact::Modify Hardware (B0042)](../impact/modify-hardware.md) | BadUSB can modify USB drives. [[4]](#4)| +|[Impact::Modify Hardware (B0042)](../impact/modify-hardware.md)|BadUSB can modify USB drives. [[4]](#4)| ## Indicators of Compromise diff --git a/xample-malware/blackenergy.md b/xample-malware/blackenergy.md index d216b65..042b983 100644 --- a/xample-malware/blackenergy.md +++ b/xample-malware/blackenergy.md @@ -58,7 +58,7 @@ See ATT&CK: [BlackEnergy - Techniques Used](https://attack.mitre.org/software/S0 |---|---| |[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|Malware was originally built to launch a distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)| |[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|Malware-infected bots receive commands from botmaster to load plugins associated with botmaster's goals. [[1]](#1)| -|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|BlackEnergy contains obfuscated stack strings. [[4]](#4) | +|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|BlackEnergy contains obfuscated stack strings. [[4]](#4)| |[Communication::HTTP Communication::Extract Body (C0002.011)](../micro-behaviors/communication/http-communication.md)|BlackEnergy extracts the HTTP body. [[4]](#4)| |[Communication::HTTP Communication::IWebBrowser (C0002.010)](../micro-behaviors/communication/http-communication.md)|The malware initializes IWebBrowser2. [[4]](#4)| |[Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|BlackEnergy hashes data via WinCrypt. [[4]](#4)| diff --git a/xample-malware/chopstick.md b/xample-malware/chopstick.md index fabb889..a632d65 100644 --- a/xample-malware/chopstick.md +++ b/xample-malware/chopstick.md @@ -47,7 +47,7 @@ See ATT&CK: [CHOPSTICK - Techniques Used](https://attack.mitre.org/software/S002 |Name|Use| |---|---| -|[Micro-Objective::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|CHOPSTICK encrypts the configuration block using RC4 encryption. [[1]](#1)| +|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|CHOPSTICK encrypts the configuration block using RC4 encryption. [[1]](#1)| ## Indicators of Compromise diff --git a/xample-malware/cryptowall.md b/xample-malware/cryptowall.md index c3a88a6..11e7adf 100644 --- a/xample-malware/cryptowall.md +++ b/xample-malware/cryptowall.md @@ -46,6 +46,7 @@ CryptoWall is a family of ransomware. [[1]](#1) |[Impact::Data Encrypted for Impact::Ransom Note (E1486.001)](../impact/data-encrypted-for-impact.md)|The malware launches Internet Explorer to show ransom notes. [[1]](#1)| |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware searches for user files before encrypting them. [[1]](#1)| |[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects code into a new svchost process. [[1]](#1)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|A copy of Crytowall is placed in the startup folder and a directory at the root of the system drive. Also adds multiple "autostart" registry keys. [[2]](#2)| ## MBC Behaviors diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md index 1ee29ff..fbfd150 100644 --- a/xample-malware/dnschanger.md +++ b/xample-malware/dnschanger.md @@ -37,8 +37,8 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev |Name|Use| |---|---| -|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[3]](#3) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[3]](#3) | +|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[3]](#3)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[3]](#3)| ## Enhanced ATT&CK Techniques diff --git a/xample-malware/drovorub.md b/xample-malware/drovorub.md index 2c3da21..b4fc94b 100644 --- a/xample-malware/drovorub.md +++ b/xample-malware/drovorub.md @@ -34,7 +34,7 @@ See ATT&CK: [Drovorub - Techniques Used](https://attack.mitre.org/software/S0502 |Name|Use| |---|---| -|[Persistence::Kernel Modules and Extensions (F0010)](../persistence/kernel-modules-and-extensions.md) | Drovorub uses a kernel module rootkit for loading and persistence. [[1]](#1)| +|[Persistence::Kernel Modules and Extensions (F0010)](../persistence/kernel-modules-and-extensions.md)|Drovorub uses a kernel module rootkit for loading and persistence. [[1]](#1)| ## Indicators of Compromise diff --git a/xample-malware/dyepack.md b/xample-malware/dyepack.md index 6b5b110..27b75e2 100644 --- a/xample-malware/dyepack.md +++ b/xample-malware/dyepack.md @@ -29,7 +29,7 @@ DYEPACK is a malware suite that manipulates local information regarding SWIFT tr |Name|Use| |---|---| -|[Impact::Compromise Data Integrity (B0016)](../impact/compromise-data-integrity.md) | DYEPACK alters records in databases used for SWIFT transactions. [[1]](#1)| +|[Impact::Compromise Data Integrity (B0016)](../impact/compromise-data-integrity.md)|DYEPACK alters records in databases used for SWIFT transactions. [[1]](#1)| ## References diff --git a/xample-malware/electrorat.md b/xample-malware/electrorat.md index 5019f44..372fedf 100644 --- a/xample-malware/electrorat.md +++ b/xample-malware/electrorat.md @@ -29,26 +29,26 @@ ElectroRAT is used to steal cryptocurrency from wallets. |Name|Use| |---|---| -|[Execution::User execution (T1240)](https://attack.mitre.org/techniques/T1204/) | ElectroRat makes the user execute the malware. [[1]](#1)| -|[Command and Control::Web Service (T1102)](https://attack.mitre.org/techniques/T1102) | EletroRat uses HTTP for C&C and exfiltration. [[1]](#1)| -|[Execution::Command and Scripting Interpreter (T1059)](https://attack.mitre.org/techniques/T1059) | ElectroRat uses Python to embed additional binares. [[1]](#1)| -|[Discovery::System Information Discovery (T1082)](https://attack.mitre.org/techniques/T1082) | ElectroRat detects the OS to determine which plugins to download. [[1]](#1)| -|[Persistence::Boot or Logon Autostart Execution (T1547)](https://attack.mitre.org/techniques/T1547/) | ElectroRat enables auto start on bootup. [[1]](#1)| +|[Execution::User Execution (T1204)](https://attack.mitre.org/techniques/T1204/)|ElectroRat makes the user execute the malware. [[1]](#1)| +|[Command and Control::Web Service (T1102)](https://attack.mitre.org/techniques/T1102)|EletroRat uses HTTP for C&C and exfiltration. [[1]](#1)| +|[Execution::Command and Scripting Interpreter (T1059)](https://attack.mitre.org/techniques/T1059)|ElectroRat uses Python to embed additional binares. [[1]](#1)| +|[Discovery::System Information Discovery (T1082)](https://attack.mitre.org/techniques/T1082)|ElectroRat detects the OS to determine which plugins to download. [[1]](#1)| +|[Persistence::Boot or Logon Autostart Execution (T1547)](https://attack.mitre.org/techniques/T1547/)|ElectroRat enables auto start on bootup. [[1]](#1)| ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Collection::Input Capture (E1056)](../collection/input-capture.md) | ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[1]](#1)| -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md) | ElectroRat looks for wallets to steal cryptocurrency [[1]](#1)| +|[Collection::Input Capture (E1056)](../collection/input-capture.md)|ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[1]](#1)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|ElectroRat looks for wallets to steal cryptocurrency [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md) | Upon execution, ElectroRat downloads additional executables. [[1]](#1)| -|[Collection::Cryptocurrency (B0028)](../impact/clipboard-modification.md) | ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)| -|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md) | ElectroRat communicates to a Pastebin site via HTTP. [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Upon execution, ElectroRat downloads additional executables. [[1]](#1)| +|[Collection::Cryptocurrency (B0028)](../impact/clipboard-modification.md)|ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)| +|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|ElectroRat communicates to a Pastebin site via HTTP. [[1]](#1)| ## Indicators of Compromise diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md index ef6dc0f..5d9a30c 100644 --- a/xample-malware/emotet.md +++ b/xample-malware/emotet.md @@ -43,10 +43,10 @@ Emotet is a banking trojan. [[1]](#1) |Name|Use| |---|---| -|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2) | -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1) | -|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6) | +|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1)| +|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6)| ## MBC Behaviors diff --git a/xample-malware/gamut.md b/xample-malware/gamut.md index dab726d..6e73028 100644 --- a/xample-malware/gamut.md +++ b/xample-malware/gamut.md @@ -61,7 +61,7 @@ Gamut is a spamming botnet. |[Impact::Spamming (B0039)](../impact/spamming.md)|If port 25 is open, the bot uses a spam template and email list to send spam. [[1]](#1)| |[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Gamut hashes data with CRC32. [[3]](#3)| |[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Gamut encodes data using XOR. [[3]](#3)| -|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[3]](#3) | +|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[3]](#3)| |[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Gamut contains an embedded PE file. [[3]](#3)| |[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Gamut creates directories. [[3]](#3)| |[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Gamut deletes directories. [[3]](#3)| diff --git a/xample-malware/gobotkr.md b/xample-malware/gobotkr.md index e234620..b900fca 100644 --- a/xample-malware/gobotkr.md +++ b/xample-malware/gobotkr.md @@ -64,7 +64,7 @@ From [[1]](#1), “The malware installs two instances of itself on the system. T |[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[1]](#1)| |[Collection::Screen Capture (E1113)](../collection/screen-capture.md)|GoBotKR is capable of capturing screenshots. [[1]](#1)| |[Execution::User Execution (E1204)](../execution/user-execution.md)|GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)| -|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|GoBotKR can download additional files and update itself. [[1]](#1) | +|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|GoBotKR can download additional files and update itself. [[1]](#1)| |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|GoBotKR uses wmic, systeminfo, and ver commands to collect information about the system and the installed software and queries environment variables. [[1]](#1) [[2]](#2)| |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|GoBotKR checks if a file exists. [[2]](#2)| diff --git a/xample-malware/gravity-rat.md b/xample-malware/gravity-rat.md index 5038f67..342a53b 100644 --- a/xample-malware/gravity-rat.md +++ b/xample-malware/gravity-rat.md @@ -49,7 +49,7 @@ See ATT&CK: [GravityRAT - Techniques Used](https://attack.mitre.org/software/S02 |---|---| |[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware checks the system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[1]](#1)| |[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware creates a WMI request to identify the BIOS version. [[1]](#1)| -|[Micro-Objective::Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|GravityRAT v3 supports AES file encryption. [[2]](#2)| +|[Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|GravityRAT v3 supports AES file encryption. [[2]](#2)| |[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware checks if the manufacturer field in the Win32_Computer entry (in WMI) contains "Virtual", "Vmware", or "Virtualbox." [[2]](#2)| |[Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Processor count (B0009.018)](../anti-behavioral-analysis/virtual-machine-detection.md)|GravityRAT determines the machine to be a VM if the core count is 1. [[2]](#2)| |[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - MAC Address (B0009.028)](../anti-behavioral-analysis/virtual-machine-detection.md)|GravityRAT checks if the MAC address starts with a well-known hexadecimal number used by various VM developer. [[2]](#2)| diff --git a/xample-malware/kraken.md b/xample-malware/kraken.md index 4fa6df1..d9dbadf 100644 --- a/xample-malware/kraken.md +++ b/xample-malware/kraken.md @@ -46,7 +46,7 @@ A family of bots. |Name|Use| |---|---| -|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| Kraken uses a domain name generator to provide new domains. [[1]](#1)| +|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|Kraken uses a domain name generator to provide new domains. [[1]](#1)| |[Anti-Behavioral Analysis::Memory Dump Evasion (B0006)](../anti-behavioral-analysis/memory-dump-evasion.md)|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[1]](#1)| |[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Kraken encrypts data using RC4 PRGA. [[2]](#2)| |[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Kraken encodes data using XOR. [[2]](#2)| diff --git a/xample-malware/searchawesome.md b/xample-malware/searchawesome.md index 615e3bb..5a9c3ec 100644 --- a/xample-malware/searchawesome.md +++ b/xample-malware/searchawesome.md @@ -71,4 +71,4 @@ Attack flow for SearchAwesome based on [[1]](#1). ## References -[1] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ +[1] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection diff --git a/xample-malware/shamoon.md b/xample-malware/shamoon.md index 052ca04..cf0f250 100644 --- a/xample-malware/shamoon.md +++ b/xample-malware/shamoon.md @@ -86,7 +86,7 @@ SHA256 Hashes ## Attack Flow -Attack flow for Shamoon based on [[3]](#3). +Attack flow for Shamoon based on [[2]](#2). ![Screenshot of Attack Flow for Shamoon based on McAfee article.](/xample-malware/AttackFlow/Shamoon.png) diff --git a/xample-malware/snake.md b/xample-malware/snake.md index 25377c2..149b675 100644 --- a/xample-malware/snake.md +++ b/xample-malware/snake.md @@ -30,7 +30,7 @@ The Snake malware is an information-stealing malware that is implemented in the |Name|Use| |---|---| -|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md) | Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)| +|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)|Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)| ## References diff --git a/xample-malware/wannacry.md b/xample-malware/wannacry.md index 518b71b..e9d1b9a 100644 --- a/xample-malware/wannacry.md +++ b/xample-malware/wannacry.md @@ -33,18 +33,18 @@ See ATT&CK: [WannaCry - Techniques Used](https://attack.mitre.org/software/S0366 |Name|Use| |---|---| -|[Defense Evasion:: Hidden Files and Directories(F0005.003)](../defense-evasion/hidden-files-and-directories.md) | WannaCry uses the +h attribute to hide its files. [[1]](#1)| -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md) | WannaCry creates two registry run keys to ensure persistence. [[1]](#1)| -|[Defense-Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md) | WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[1]](#1)| +|[Defense Evasion:: Hidden Files and Directories(F0005.003)](../defense-evasion/hidden-files-and-directories.md)|WannaCry uses the +h attribute to hide its files. [[1]](#1)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|WannaCry creates two registry run keys to ensure persistence. [[1]](#1)| +|[Defense-Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Discovery::Self Discovery (B0038)](../discovery/self-discovery.md) | WannaCry checks the size of the file it loads into memory. [[1]](#1)| -|[Discovery::Self Discovery (B0038.002)](../discovery/self-discovery.md) | WannaCry checks a string, keylen and a magic number before decrypting a dll. [[1]](#1)| -|[Discovery::Self Discovery (B0038.003)](../discovery/self-discovery.md) | WannaCry checks the data lengh of a section before decypting a dll. [[1]](#1)| -|[Impact::Data Encrypted for Impact (B0025)](../impact/data-encrypted-for-impact.md) | WannaCry encrypts files for ransom. [[1]](#1)| +|[Discovery::Self Discovery (B0038)](../discovery/self-discovery.md)|WannaCry checks the size of the file it loads into memory. [[1]](#1)| +|[Discovery::Self Discovery (B0038.002)](../discovery/self-discovery.md)|WannaCry checks a string, keylen and a magic number before decrypting a dll. [[1]](#1)| +|[Discovery::Self Discovery (B0038.003)](../discovery/self-discovery.md)|WannaCry checks the data lengh of a section before decypting a dll. [[1]](#1)| +|[Impact::Data Encrypted for Impact (B0025)](../impact/data-encrypted-for-impact.md)|WannaCry encrypts files for ransom. [[1]](#1)| ## Indicators of Compromise