admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

small malware fixes (#129)

Browse Source
This commit is contained in:
Ryan Xu
2023-10-26 11:33:17 -04:00
committed by GitHub
parent c2df3d4e10
commit 74d28a9ef9
2 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xample-malware/conti.md
+6 -6
View File
@@ -34,17 +34,17 @@ See ATT&CK: [Conti - Techniques Used](https://attack.mitre.org/software/S0575/).
|Name|Use|
|---|---|
|[Process Injection::Process Hollowing (E1055.012)](../defense-evasion/process-injection.md)|Conti creates a process in a suspended state and unmaps or removes the PE image layout from a given process space.|
|[Process Injection::Process Hollowing (E1055.012)](../defense-evasion/process-injection.md)|Conti creates a process in a suspended state and unmaps or removes the PE image layout from a given process space. [[1]](#1)|
## MBC Behaviors
|Name|Use|
|---|---|
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|As a part of process hollowing, Conti creates a process in a suspended state.|
|[Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)| As part of process hollowing, Conti resumes the execution of the suspended process.|
|[Process::Set Thread Context (C0072)](../micro-behaviors/process/set-thread-context.md)| As part of process hollowing, Conti sets thread context.|
|[Process::Unmap Section View (C0070)](../micro-behaviors/process/unmap-section-view.md)|As part of process hollowing, Conti unmaps a view of a section from the virtual address space of a subject process.|
|[Process::Write Process Memory (C0071)](../micro-behaviors/process/write-process-memory.md)|As part of process hollowing, Conti writes data to an area of memory in a specified process.|
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|As a part of process hollowing, Conti creates a process in a suspended state. [[1]](#1)|
|[Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)| As part of process hollowing, Conti resumes the execution of the suspended process. [[1]](#1)|
|[Process::Set Thread Context (C0072)](../micro-behaviors/process/set-thread-context.md)| As part of process hollowing, Conti sets thread context. [[1]](#1)|
|[Process::Unmap Section View (C0070)](../micro-behaviors/process/unmap-section-view.md)|As part of process hollowing, Conti unmaps a view of a section from the virtual address space of a subject process. [[1]](#1)|
|[Process::Write Process Memory (C0071)](../micro-behaviors/process/write-process-memory.md)|As part of process hollowing, Conti writes data to an area of memory in a specified process. [[1]](#1)|
## Attack Flow
xample-malware/kraken.md
-1
View File
@@ -56,7 +56,6 @@ A family of bots.
SHA256 Hashes
- 466892a38785c1a499140d208a101f908e7c9589f126b87e9e20d8c916555306
- 1b17ce735512f3104557afe3becacd05ac802b2af79dab5bb1a7ac8d10dccffd
## References