mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Added 'Enhanced ATT&CK Techniques' section
This commit is contained in:
ryan
@@ -11,13 +11,18 @@ Bagle
|
||||
=====
|
||||
A mass-mailing computer worm affecting Microsoft Windows. [[1]](#1)
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Adds registry keys to enable its automatic execution at every system startup [[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Prevent Concurrent Execution (B0024)](../execution/prevent-concurrent-execution.md)|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system [[1]](#1)|
|
||||
|[Execution::Send Email (B0020)](../execution/send-email.md)|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer [[2]](#2)|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Adds registry keys to enable its automatic execution at every system startup [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -11,23 +11,33 @@ BlackEnergy
|
||||
===========
|
||||
An HTTP-based botnet used mostly for DDoS attacks. [[1]](#1)
|
||||
|
||||
MBC Behaviors
|
||||
|
||||
ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [BlackEnergy - Techniques Used](https://attack.mitre.org/software/S0089/).
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|Originally built to launch distributed denial of service attacks that can target more than one IP address per hostname [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection::Injection using Shims (E1055.m05)](../defense-evasion/process-injection.md)|Bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution [[1]](#1)|
|
||||
|[Defense Evasion::Install Insecure or Malicious Configuration (E1479)](../defense-evasion/install-insecure-or-malicious-configuration.md)|Configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component [1] [[1]](#1)|
|
||||
|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|Clears windows event logs and removes the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevent strings in the user32.dll.mui of the system [[1]](#1)|
|
||||
|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Locates an inactive driver service to Hijack and set it to start automatically [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|injects its dll component into svchost.exe [[1]](#1)|
|
||||
|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|infected bots receive commands from botmaster to load plugins associated with botmaster's goals [[1]](#1)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|uses Systeminfo to gather OS version, system configuration, BIOS, the motherboard, and processor [ [[1]](#1)|
|
||||
|[Collection::Keylogging (F0002)](../collection/keylogging.md)|Keylogger plugin allows for collection of keystrokes [[2]](#2)|
|
||||
|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)|Screenshot plugin allows for collection of screenshots [[2]](#2)|
|
||||
|[Persistence::Registy Run Keys / Startup folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder [[1]](#1)|
|
||||
|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|BlackEnergy 2 variant contains a Destroy plugin that destroys data stored on victim hard drives by overwriting file contents [[3]](#3)|
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|Originally built to launch distributed denial of service attacks that can target more than one IP address per hostname [[1]](#1)|
|
||||
|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|infected bots receive commands from botmaster to load plugins associated with botmaster's goals [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
MD5 Hashes
|
||||
|
||||
@@ -11,18 +11,23 @@ Conficker
|
||||
=========
|
||||
A worm targeting Microsoft Windows operations systems.
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Persistence::Registy Run Keys / Startup folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, the virus saces a copy of its DLL form to a random filename in the Windows system folder, then adds registry keys to have svchost.exe invoke that DLL as an invisible network service [[1]](#1)|
|
||||
|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Copies itself into the $systemroot%\system32 directory and registers as a service [[1]](#1)|
|
||||
|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|Terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software [[1]](#1)|
|
||||
|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|resets system restore points and deletes backup files [[1]](#1)|
|
||||
|[Anti-Static Analysis::Software Packing::UPX (F0001.008)](../anti-static-analysis/software-packing.md)|Conficker is propagated as a DLL which has been backed using the UPX packer [[2]](#2)|
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|Uses a domain name generator seeded by the current date to ensure that every copy of the virus generates the same names on their respective days [[1]](#1)|
|
||||
|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Conficker A has routine that causes the process to suicide exit if the keyboard language layout is set to Ukranian [[1]](#1)|
|
||||
|[Persistence::Registy Run Keys / Startup folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, the virus saces a copy of its DLL form to a random filename in the Windows system folder, then adds registry keys to have svchost.exe invoke that DLL as an invisible network service [[1]](#1)|
|
||||
|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Copies itself into the $systemroot%\system32 directory and registers as a service [[1]](#1)|
|
||||
|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|Terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software [[1]](#1)|
|
||||
|[Micro-Behavior::Memory::Overflow Buffer (C0010)](../micro-behaviors/memory/overflow-buffer.md)|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer [[1]](#1)|
|
||||
|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|resets system restore points and deletes backup files [[1]](#1)|
|
||||
|[Anti-Static Analysis::Software Packing::UPX (F0001.008)](../anti-static-analysis/software-packing.md)|Conficker is propagated as a DLL which has been backed using the UPX packer [[2]](#2)|
|
||||
|[Execution::Conditional Execution::Suicide Exit (B0025.001)](../execution/conditional-execution.md)|Conficker B has significatnly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts [[2]](#2)|
|
||||
|
||||
References
|
||||
|
||||
@@ -20,18 +20,23 @@ ATT&CK Techniques
|
||||
|[Command and Control::Encrypted Channel::Asymmetric Cryptography (T1573.002)](https://attack.mitre.org/techniques/T1573/002/)|The malware encrypts messages with a public RSA key [[1]](#1)|
|
||||
|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses http to communicate with C2 [[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Data Encrypted for Impact::Ransom Note (E1486.001)](../impact/data-encrypted-for-impact.md)|The malware launches Internet Explorer to show ransom notes [[1]](#1)|
|
||||
|[Command and Control::Send Data (B0030.001)](../command-and-control/domain-name-generation.md)|The malware sends a hash value generated from system information [[1]](#1)|
|
||||
|[Command and Control::Receive Data (B0030.002)](../command-and-control/ingress-tool-transfer.md)|The malware receives a public key from the C2 [[1]](#1)|
|
||||
|[Discovery:File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware searches for user files before encrypting them [[1]](#1)|
|
||||
|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|The malware uses an internal domain generation algorithm [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Authenticate (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a phone-home message with encryption to start [[1]](#1)|
|
||||
|[Persistence::Registry Run Keys/Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware creates an "autorun" registry key [[1]](#1)|
|
||||
|[Execution::User Interaction (E1204)](../execution/user-execution.md)|The malware relies on victims to execute [[1]](#1)|
|
||||
|[Discovery:File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware searches for user files before encrypting them [[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Command and Control::Send Data (B0030.001)](../command-and-control/domain-name-generation.md)|The malware sends a hash value generated from system information [[1]](#1)|
|
||||
|[Command and Control::Receive Data (B0030.002)](../command-and-control/ingress-tool-transfer.md)|The malware receives a public key from the C2 [[1]](#1)|
|
||||
|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|The malware uses an internal domain generation algorithm [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Authenticate (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a phone-home message with encryption to start [[1]](#1)|
|
||||
|
||||
|
||||
References
|
||||
|
||||
@@ -21,16 +21,21 @@ ATT&CK Techniques
|
||||
|[Command and Control:Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|The malware tries to connect to I2P proxies [[1]](#1)|
|
||||
|[Impact::Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/)|The malware encrypts files [[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Data Encrypted for Impact::Ransom Note (E1486.001)](../impact/data-encrypted-for-impact.md)|The malware launches Internet Explorer to show ransom notes [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a hash value generated from system information [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives a public key from the C2 [[1]](#1)|
|
||||
|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)| The malware searches for user files before encrypting them [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects code into a new svchost process [[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Command and Control::Command and Control Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a hash value generated from system information [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives a public key from the C2 [[1]](#1)|
|
||||
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -11,11 +11,14 @@ Dark Comet
|
||||
==========
|
||||
A Remote Access Trojan (RAT) that allows a user to control the system via a GUI. It has many features which allows a user to use it as administrative remote help tool; however, DarkComet has many features which can be used maliciously. DarkComet is commonly used to spy on the victims by taking screen captures, key-logging, or password stealing. [[1]](#1)
|
||||
|
||||
MBC Behaviors
|
||||
ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [Dark Comet - Techniques Used](https://attack.mitre.org/software/S0334/).
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Remote Access (B0022)](../impact/remote-access.md)|Allows an attacker to control the system via a GUI [[1]](#1)|
|
||||
|[Collection::Keylogging (F0002)](../collection/keylogging.md)|DarkComet can capture keystrokes [[2]](#2)|
|
||||
|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)|Can take screenshots of victim's computer [[2]](#2)|
|
||||
|[Persistence::Registy Run Keys / Startup folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|adds several registry entries to enable automatic execution at startup [[2]](#2)|
|
||||
@@ -24,6 +27,13 @@ MBC Behaviors
|
||||
|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)|Has the option to compress its payload using UPX or MPRESS [[2]](#2)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Can collect information about the compter, resources, and operating system version [[2]](#2)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Remote Access (B0022)](../impact/remote-access.md)|Allows an attacker to control the system via a GUI [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://en.wikipedia.org/wiki/DarkComet
|
||||
|
||||
@@ -11,12 +11,12 @@ DNSChanger
|
||||
==========
|
||||
Used to change DNS settings to generate fraudulent advertising revenue.
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Generate Traffic from Victim::Advertisement Replacement Fraud (E1643)](../impact/generate-traffic-from-victim.md)|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
|
||||
|[Disable or Evade Security Tools](../defense-evasion/disable-or-evade-security-tools.md)|Prevents the infected system from installing anti-virus software updates. [[1]](#1)|
|
||||
|[Defense Evasion::Disable or Evade Security Tools (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|Prevents the infected system from installing anti-virus software updates. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -11,15 +11,21 @@ Emotet
|
||||
=====
|
||||
Emotet is a banking trojan. [[1]](#1)
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads [[2]](#2)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|collects information related to OS, processes, and sometimes mail client information and sends it to c2 [[2]](#2)|
|
||||
|[Persistence::Registy Run Keys / Startup folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Anti-Static Analysis::Executable Code Obfuscation::Junk Code Insertion (B0032.007)](../anti-static-analysis/executable-code-obfuscation.md)|Emotet macros are heavily obfuscated with junk functions and string substitutions [[1]](#1)|
|
||||
|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads [[2]](#2)|
|
||||
|[Micro-objective::Cryptography::Encrypt Data::RSA::Encrypt Data (C0027.011)](../micro-behaviors/cryptography/encrypt-data.md)|Emotet uses RSA to encrypt network traffic to its C2 [[2]](#2)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|collects information related to OS, processes, and sometimes mail client information and sends it to c2 [[2]](#2)|
|
||||
|[Persistence::Registy Run Keys / Startup folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1)|
|
||||
|[Discovery::Analysis Tool Discovery::Process detection::Debuggers (B0013.002)](../discovery/anlaysis-tool-discovery.md)|If it recieves a response from the c2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the ShellExecuteW function and exits [[3]](#3)|
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection::Guest Process Testing (B0009.010)](../anti-behavioral-analysis/virtual-machine-detection.md)|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names [[4]](#4)|
|
||||
|[Command and Control::Command and Control Communication::Request Email Address List (B0030.010)](../command-and-control/c2-communication.md)| new email addresses are collected automatically from the victim's address books [[4]](#4)|
|
||||
|
||||
@@ -19,12 +19,18 @@ ATT&CK Techniques
|
||||
|[Command and Control::Ingress Tool Transfer (T1105)](https://attack.mitre.org/techniques/T1105/)|The malware receives files from C2 [[1]](#1)|
|
||||
|[Command and Control::Application Layer Protocol:Web Protocol (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP for command and control [[1]](#1)|
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds a registry key [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Send Email](../execution/send-email.md)|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
|
||||
|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds a registry key [[1]](#1)|
|
||||
|[Execution::Send Email (B0020)](../execution/send-email.md)|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
|
||||
|[Anti-Behavioral-Analysis::Debugger Detection::Interruption (B0001.006)](../anti-behavioral-analysis/debugger-detection.md)|The malware detects debuggers using an INT 03h trap [[1]](#1)|
|
||||
|[Anti-Behavioral-Analysis::Debugger Detection::IsDebuggerPresent (B0001.008)](../anti-behavioral-analysis/debugger-detection.md)|The malware detects debuggers using IsDebuggerPresent [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives data from C2 [[1]](#1)|
|
||||
|
||||
@@ -37,22 +37,28 @@ ATT&CK Techniques
|
||||
|[Command and Control::Standard Application Layer Protocol (T1071)](https://attack.mitre.org/techniques/T1071/)|GoBotKR uses HTTP or HTTPS for C&C. [[1]](#1)|
|
||||
|[Command and Control::Uncommonly Used Port (T1571)](https://attack.mitre.org/techniques/T1571/)|GoBotKR uses non-standard ports, such as 6446, 6556 and 7777, for C&C. [[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|GotBotKR reinstalls its running instance if it is removed. [[1]](#1)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|GoBotKR uses cmd.exe to execute commands. [[1]](#1)|
|
||||
|[Persistence::Registry Run Keys/Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)| GoBotKR installs itself under registry run keys to establish persistence. [[1]](#1)|
|
||||
|[Defense Evasion::Hidden Files and Directories (F0005)](../defense-evasion/hidden-files-and-directories.md)| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)|
|
||||
|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)|
|
||||
|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[1]](#1)|
|
||||
|[Anti-Behavioral-Analysis::Detect Sandbox (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[1]](#1)|
|
||||
|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)| GoBotKR is capable of capturing screenshots. [[1]](#1)|
|
||||
|[Execution::User Interaction (E1204)](../execution/user-execution.md)| GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|GotBotKR reinstalls its running instance if it is removed. [[1]](#1)|
|
||||
|[Anti-Behavioral-Analysis::Detect Sandbox (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|GoBotKR receives data from the C2 [[1]](#1)|
|
||||
|[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[1]](#1)|
|
||||
|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[1]](#1)|
|
||||
|[Execution::User Interaction (E1204)](../execution/user-execution.md)| GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|**Aliases**||
|
||||
|**Platforms**|Windows|
|
||||
|**Year**|2018|
|
||||
|**Associated ATT&CK Software**|None|
|
||||
|**Associated ATT&CK Software**|[GravityRAT](https://attack.mitre.org/software/S0237/)|
|
||||
|
||||
|
||||
GravityRAT
|
||||
@@ -14,8 +14,13 @@ Evades detection by checking current CPU temperature.
|
||||
|
||||
ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [GravityRAT - Techniques Used](https://attack.mitre.org/software/S0237/).
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)](../defense-evasion/hijack-execution-flow.md)| Abuses Microsoft's Dynamic Data Exchange (DDE) protocol [[2]](#2)|
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
@@ -23,7 +28,6 @@ MBC Behaviors
|
||||
|---|---|
|
||||
|[Anti-Behavioral Analysis::VM Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|Checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::VM Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)](../anti-behavioral-analysis/virtual-machine-detection.md)|Creates a WMI request to identify the BIOS version. [[1]](#1)|
|
||||
|[Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)](../defense-evasion/hijack-execution-flow.md)| Abuses Microsoft's Dynamic Data Exchange (DDE) protocol [[2]](#2)|
|
||||
|[Micro-Objective::Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)| GravityRat v3 supports file AES file encryption [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::VM Detection::Unique Hardware/Firmware Check (B0009.023)](../anti-behavioral-analysis/virtual-machine-detection.md)|Checks if the manufacturer field in the Win32_Computer entry in WMI contains "Virtual", "Vmware", or "Virtualbox" [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::VM Detection::Moder Specs Check - Processor count (B0009.018)](../anti-behavioral-analysis/virtual-machine-detection.md)|Determines the machine to be a VM if the core count is 1 [[2]](#2)|
|
||||
|
||||
@@ -18,16 +18,22 @@ ATT&CK Techniques
|
||||
|---|---|
|
||||
|[Defense Evasion::Obfuscated Files or Information:Software Packing (T1027.002)](https://attack.mitre.org/techniques/T1027/002/)|The malware may be packed with UPX [[2]](#2)|
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects itself into processes such as cmd.exe, notepad.exe [[2]](#2)|
|
||||
|[Defense Evasion::Rootkit (E1014)](../defense-evasion/rootkit.md)| Certain variants of the malware may have rootkit functionality [[2]](#2)|
|
||||
|[Collection::Keylogging (F0002)](../collection/keylogging.md)|Certain variants of the malware may have keylogging functionality [[2]](#2)|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[1]](#1)|
|
||||
|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds many entries to the registry [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[1]](#1)|
|
||||
|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds many entries to the registry [[1]](#1)|
|
||||
|[Impact::Remote Access (B0022)](../impact/remote-access.md)|The malware acts as a backdoor [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects itself into processes such as cmd.exe, notepad.exe [[2]](#2)|
|
||||
|[Defense Evasion::Rootkit (E1014)](../defense-evasion/rootkit.md)| Certain variants of the malware may have rootkit functionality [[2]](#2)|
|
||||
|[Collection::Keylogging (F0002)](../collection/keylogging.md)|Certain variants of the malware may have keylogging functionality [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -20,18 +20,24 @@ ATT&CK Techniques
|
||||
|[Execution::User Execution::Malicious File (T1204.002)](https://attack.mitre.org/techniques/T1204/002/)|The malware relies on a victim to execute itself [[2]](#2)|
|
||||
|[Defense Evasion::System Binary Proxy Execution:Mshta (T1218.005)](https://attack.mitre.org/techniques/T1218/005/)| The malware uses mshta.exe to run Javascript [[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Generate Traffic from Victim (E1643)](../impact/generate-traffic-from-victim.md)|Performs click-fraud. [[1]](#1)|
|
||||
|[Persistence::Registry Run Keys/Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware writes an autorun registry entry [[2]](#2)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The malware executes malicious javascript and powershell [[1]](#1)|
|
||||
|[Defense Evasion::Alternative Installation Location::Registry Install (B0027.002)](../defense-evasion/alternative-installation-location.md)|Stores malware files in the Registry instead of the hard drive [[2]](#2)|
|
||||
|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware modifies the registry during execution [[2]](#2)|
|
||||
|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|The malware will use a key to decrypt text from a URL to create more malicious code [[1]](#1)|
|
||||
|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)|The malware comes packed by a crypter/FUD [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Alternative Installation Location::Registry Install (B0027.002)](../defense-evasion/alternative-installation-location.md)|Stores malware files in the Registry instead of the hard drive [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
|
||||
|
||||
@@ -11,14 +11,25 @@ Locky Bart
|
||||
==========
|
||||
Locky Bart is ransomware. [[1]](#1)
|
||||
|
||||
ATT&CK Techniques
|
||||
-----------------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057/)|Gathers information from the victim's machine to create an encryption key.|
|
||||
|[Discovery::System Time Discovery (T1057)](https://attack.mitre.org/techniques/T1124/)|Gathers information from the victim's machine to create an encryption key.|
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|Encrypts files for ransom without any connection to the Internet.|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Process Discovery](https://attack.mitre.org/techniques/T1057/)|Gathers information from the victim's machine to create an encryption key.|
|
||||
|[System Time Discovery](https://attack.mitre.org/techniques/T1124/)|Gathers information from the victim's machine to create an encryption key.|
|
||||
|[Data Encrypted for Impact](../impact/data-encrypted-for-impact.md)|Encrypts files for ransom without any connection to the Internet.|
|
||||
|[Executable Code Virtualization](../anti-static-analysis/executable-code-virtualization.md)|Code virtualization is added to the Locky Bart binary using WPProtect. [[1]](#1)|
|
||||
|[Anti-Static Analysis::Executable Code Virtualization (B0008)](../anti-static-analysis/executable-code-virtualization.md)|Code virtualization is added to the Locky Bart binary using WPProtect. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -11,6 +11,17 @@ MazarBot
|
||||
==========
|
||||
Targets Android phones via a poisoned text message.
|
||||
|
||||
ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [MazarBOT - Techniques Used](https://attack.mitre.org/software/S0303/).
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|Can erase phone data [[3]](#3)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
@@ -18,8 +29,6 @@ MBC Behaviors
|
||||
|[Impact::Manipulate Network Traffic (B0019)](../impact/manipulate-network-traffic.md)|Intercepts data coming into and going out of device [[1]](#1)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Installs a backdoor [[1]](#1)|
|
||||
|[Execution::Send Poisoned Text Message (B0021)](../execution/send-poisoned-text-message.md)|Can send SMS messages [[2]](#2)|
|
||||
|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|Can erase phone data [[3]](#3)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
|
||||
|
||||
@@ -16,13 +16,18 @@ ATT&CK Techniques
|
||||
-----------------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Pre-OS Boot::System Firmware (T1542.001)](https://attack.mitre.org/techniques/T1542/001/)|Malware performs BIOS modification and can download and execute a file as well as protect itself from removal [[1]](#1)|
|
||||
See ATT&CK: [Mebromi - Techniques Used](https://attack.mitre.org/software/S0001/).
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Bootkit (F0013)](../defense-evasion/bootkit.md)|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::bootkit (F0013)](../defense-evasion/bootkit.md)|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
|
||||
|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Malware only proceeds if it detects the BIOS ROM is Award BIOS [[1]](#1)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Malware contains a dropper that installs additional programs like Cbrom.exe [[1]](#1)|
|
||||
|
||||
|
||||
@@ -15,24 +15,29 @@ ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [Poison Ivy - Techniques Used](https://attack.mitre.org/software/S0012/).
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Code is injected into explorer.exe [[2]](#2)|
|
||||
|[Collection::Input Capture (E1056)](../collection/input-capture.md)|Can capture audio and video [[2]](#2)|
|
||||
|[Collection::Keylogging (F0002)](../collection/keylogging.md)|Can capture keystrokes [[2]](#2)|
|
||||
|[Persistence::Registy Run Keys / Startup folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Poison Ivy adds registry entries [[4]](#4)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|After the Poison-Ivy server is running on the target machine, the attacker uses a Windows GUI client to control the target computer [[1]](#1)|
|
||||
|[Anti-Static Analysis::Obfuscated Files or Information::Encryption of Data (E1027.m07)](../anti-static-analysis/executable-code-obfuscation.md)|Poison Ivy variant encrypts all its strings [[3]](#3)|
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Remote Access (B0022)](../impact/remote-access.md)|After the Poison-Ivy server is running on the target machine, the attacker uses a Windows GUI client to control the target computer [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Code is injected into explorer.exe [[2]](#2)|
|
||||
|[Micro-objective::Cryptography::Encrypt Data::Camellia (C0027.003)](../micro-behaviors/cryptography/encrypt-data.md)|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key [[2]](#2)|
|
||||
|[Collection::Input Capture (E1056)](../collection/input-capture.md)|Can capture audio and video [[2]](#2)|
|
||||
|[Collection::Keylogging (F0002)](../collection/keylogging.md)|Can capture keystrokes [[2]](#2)|
|
||||
|[Micro-objective::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Poison Ivy has a default process mutex, but can be altered at build time [2] [[3]](#3)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::Hardware Breakpoints (B0001.005)](../anti-behavioral-analysis/debugger-detection.md)|Poison Ivy Variant checks for breakpoints and exits immediately if found [[3]](#3)|
|
||||
|[Discovery::Analysis Tool Discovery (B0013)](../discovery/anlaysis-tool-discovery.md)|Poison Ivy Variant runs a threat to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one fo the analysis tools is running. [[3]](#3)|
|
||||
|[Discovery::Analysis Tool Discovery::Known Window Class Name (B0013.010)](../discovery/anlaysis-tool-discovery.md)|Poison Ivy variant goes through all the running program windows to check if any windows class name contains a special string to determine if an analysis tool is running [[3]](#3)|
|
||||
|[Process::Micro-objective::Check Mutex (C0043)](../micro-behaviors/process/check-mutex.md)|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists [[3]](#3)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::IsDebuggerPresent (B0001.008)](../anti-behavioral-analysis/debugger-detection.md)|Poison Ivy variant uses the IsDebuggerPresent API function call to check if the process is running in a debugger [[3]](#3)|
|
||||
|[Persistence::Registy Run Keys / Startup folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Poison Ivy adds registry entries [[4]](#4)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|After the Poison-Ivy server is running on the target machine, the attacker uses a Windows GUI client to control the target computer [[1]](#1)|
|
||||
|[Anti-Static Analysis::Obfuscated Files or Information::Encryption of Data (E1027.m07)](../anti-static-analysis/executable-code-obfuscation.md)|Poison Ivy variant encrypts all its strings [[3]](#3)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -11,16 +11,21 @@ Redhip
|
||||
======
|
||||
An information stealer.
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)|Redhip samples are packed with different custom packers. [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Sandbox Detection](../anti-behavioral-analysis/sandbox-detection.md)|Redhip detects all publicly available automated malware analysis workbenches (ThreatExpert, JoeBox, etc.). [[1]](#1)|
|
||||
|[Virtual Machine Detection](../anti-behavioral-analysis/virtual-machine-detection.md)|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[1]](#1)|
|
||||
|[Debugger Detection](../anti-behavioral-analysis/debugger-detection.md)|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[1]](#1)|
|
||||
|[Debugger Evasion](../anti-behavioral-analysis/debugger-evasion.md)|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[1]](#1)|
|
||||
|[Software Packing](../anti-static-analysis/software-packing.md)|Redhip samples are packed with different custom packers. [[1]](#1)|
|
||||
|
||||
|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|Redhip detects all publicly available automated malware analysis workbenches (ThreatExpert, JoeBox, etc.). [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection (B0001)](../anti-behavioral-analysis/debugger-detection.md)|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Debugger Evasion (B0002)](../anti-behavioral-analysis/debugger-evasion.md)|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[1]](#1)|
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
|
||||
|
||||
@@ -23,6 +23,16 @@ ATT&CK Techniques
|
||||
|[Command and Control::Data Encoding::Standard Encoding (T1132.001)](https://attack.mitre.org/techniques/T1132/001/)|The malware transmits Base64 encoded data to C2 [[1]](#1)|
|
||||
|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware transmits data over HTTP [[1]](#1)|
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::User Interaction (E1204)](../execution/user-execution.md)|The malware relies on a victim to execute itself [[1]](#1)|
|
||||
|[Persistence::Startup Folder (F0012)](../persistence/modify-existing-service.md)|it will proceed to install itself in order to ensure persistence across system reboots before continuing on to execute the payload. To install itself, Rombertik first creates a VBS script named “fgf.vbs”, which is used to kick off
|
||||
|[Collection::Input Capture (E1056)](../collection/input-capture.md)|The malware injects itself into a browser and captures user input data [[1]](#1)|
|
||||
|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the User's home folder [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
@@ -31,13 +41,9 @@ MBC Behaviors
|
||||
|[Anti-Behavior Analysis::Dynamic Analysis Evasion::Data Flood (B0003.002)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The malware stalls by writing a byte of random data to memory 960 million times which complicates analysis. It also calls specific Windows API functions [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Sandbox Detection::Test API Routines (B0007.010)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware check for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::OutputDebugString (B0001.016)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware calls the Windows API OutputDebugString function 335,000 times [[1]](#1)|
|
||||
|[Anti-Behavior Analysis::Debugger Detection::Check Processes (B0001.038)](../anti-behavioral-analysis/virtual-machine-detection.md)|an anti-analysis function within the packer is called to check the username and filename of the executing process for strings like “malwar”, “sampl”, “viru”, and “sandb”. [[1]](#1)|
|
||||
|[Execution::User Interaction (E1204)](../execution/user-execution.md)|The malware relies on a victim to execute itself [[1]](#1)|
|
||||
|[Persistence::Startup Folder (F0012)](../persistence/modify-existing-service.md)|it will proceed to install itself in order to ensure persistence across system reboots before continuing on to execute the payload. To install itself, Rombertik first creates a VBS script named “fgf.vbs”, which is used to kick off Rombertik every time the user logs in, and places the script into the user’s Startup folder. [[1]](#1)|
|
||||
|[Anti-Behavior Analysis::Debugger Detection::Check Processes (B0001.038)](../anti-behavioral-analysis/virtual-machine-detection.md)|an anti-analysis function within the packer is called to check the username and filename of the executing process for strings like “malwar”, “sampl”, “viru”, and “sandb”. [[1]](#1)|Rombertik every time the user logs in, and places the script into the user’s Startup folder. [[1]](#1)|
|
||||
|[Anti-Behavioral Anlaysis::Dynamic Analysis Evasion::Code Integrity Check (B0003.011)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The function computes a 32-bit hash of a resource in memory, and compares it to the PE Compile Timestamp of the unpacked sample. If the resource or compile time has been altered, the malware acts destructively [[1]](#1)|
|
||||
|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/domain-name-generation.md)|The malware sends data to the C2 [[1]](#1)|
|
||||
|[Collection::Input Capture (E1056)](../collection/input-capture.md)|The malware injects itself into a browser and captures user input data [[1]](#1)|
|
||||
|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the User's home folder [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
|
||||
@@ -16,7 +16,7 @@ ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [SamSam - Techniques Used](https://attack.mitre.org/software/S0370/).
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|
||||
@@ -21,6 +21,14 @@ ATT&CK Techniques
|
||||
|[Collection::Adversary-in-the-Middle (T1557)](https://attack.mitre.org/techniques/T1557/)|After installing a certificate, the malware inserts inself into a chain of custody, typically within network packets. [[1]](#1)|
|
||||
|[Execution:Command and Scripting Interpreter (T1059.007)](https://attack.mitre.org/techniques/T1059/007/)|The malware installs a script to inject JavaScript script and modify web traffic. [[1]](#1)|
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::User Execution (E1204)](../execution/user-execution.md)||
|
||||
|[Defense Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|The malware will monitor if a specific file gets deleted, and then will delete itself. [[1]](#1)|
|
||||
|[Privilege Escalation::Install Certificate (E1608)](../privilege-escalation/install-certificate.md)|The malware installs a certificate. [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
@@ -29,9 +37,6 @@ MBC Behaviors
|
||||
|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)| The malware receives data from the C2 server. [[1]](#1)|
|
||||
|[Impact::Manipulate Network Traffic (B0019)](../impact/manipulate-network-traffic.md)|Intercepts encrypted web traffic to inject adds. [[1]](#1)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|The malware installs an open-source program called mitmproxy. [[1]](#1)|
|
||||
|[Execution::User Execution (E1204)](../execution/user-execution.md)||
|
||||
|[Defense Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|The malware will monitor if a specific file gets deleted, and then will delete itself. [[1]](#1)|
|
||||
|[Privilege Escalation::Install Certificate (E1608)](../privilege-escalation/install-certificate.md)|The malware installs a certificate. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
|
||||
@@ -16,7 +16,7 @@ ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [Shamoon - Techniques Used](https://attack.mitre.org/software/S0140/).
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|
||||
+14
-10
@@ -16,24 +16,28 @@ ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/).
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Hijack Execution Flow::Import Address Table Hooking (F0015.003)](../defense-evasion/hijack-execution-flow.md)|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet. [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001)](../defense-evasion/process-injection.md)|Stuxnet injects the entire DLL into another process and then just calls the particular export [[1]](#1)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the net to spread itself [[1]](#1)|
|
||||
|[Anti-Static Analysis::Obfuscated Files or Information::Encoding (E1027.m01)](../anti-static-analysis/executable-code-obfuscation.md)|The configuration data block is encoded with a NOT XOR 0xFF operation [[1]](#1)|
|
||||
|[Defense Evasion::Rootkit::Kernel Mode Rootkit (E1014.m17)](../defense-evasion/rootkit.md)|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection::Injection and Persistence via Registry Modification (E1055.m05)](../defense-evasion/process-injection.md)|The driver Stuxnet uses for persistence Mrxcls.sys is registered as a boot start service creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys" [[1]](#1)|
|
||||
|[Exfiltration::Archive Collected Data::Encoding - Custom Encoding (E1560.m04)](../exfiltration/archive-collected-data.md)|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers [[1]](#1)|
|
||||
|[Defense Evasion::Hidden Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removalbe drives [[1]](#1)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell [[1]](#1)|
|
||||
|[Defense Evasion::Hijack Execution Flow::Procedure Hooking (F0015.007)](../defense-evasion/hijack-execution-flow.md)|WTR4141.tmp hooks APIs from kernel32.dll and Ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Destroy Hardware (B0017)](../impact/destroy-hardware.md)|Stuxnet made the centrifuges at Iran's nuclear plant spin dangerously fast for 15 minutes, before returning to normal speed. About a month later, it slowed the centrifuges down for 50 minutes. This was repeated for several months, and over the strain destroyed the machines [[1]](#1)|
|
||||
|[Defense Evasion::Hijack Execution Flow::Import Address Table Hooking (F0015.003)](../defense-evasion/hijack-execution-flow.md)|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet. [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001)](../defense-evasion/process-injection.md)|Stuxnet injects the entire DLL into another process and then just calls the particular export [[1]](#1)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the net to spread itself [[1]](#1)|
|
||||
|[Anti-Static Analysis::Obfuscated Files or Information::Encoding (E1027.m01)](../anti-static-analysis/executable-code-obfuscation.md)|The configuration data block is encoded with a NOT XOR 0xFF operation [[1]](#1)|
|
||||
|[Defense Evasion::Rootkit::Kernel Mode Rootkit (E1014.m17)](../defense-evasion/rootkit.md)|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate [[1]](#1)|
|
||||
|[Micro-Objective::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Creates global mutexes signal that rootkit installation has occurred successfully [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection::Injection and Persistence via Registry Modification (E1055.m05)](../defense-evasion/process-injection.md)|The driver Stuxnet uses for persistence Mrxcls.sys is registered as a boot start service creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys" [[1]](#1)|
|
||||
|[Exfiltration::Archive Collected Data::Encoding - Custom Encoding (E1560.m04)](../exfiltration/archive-collected-data.md)|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers [[1]](#1)|
|
||||
|[Defense Evasion::Hidden Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removalbe drives [[1]](#1)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell [[1]](#1)|
|
||||
|[Micro-Objective::Process::Create Process::Create Process via WMI (C0017.002)](../micro-behaviors/process/create-process.md)|Stuxnet will use WMI operations with the explorere.exe token in order to copy itself and exscute on the remote share [[1]](#1)|
|
||||
|[Defense Evasion::Hijack Execution Flow::Procedure Hooking (F0015.007)](../defense-evasion/hijack-execution-flow.md)|WTR4141.tmp hooks APIs from kernel32.dll and Ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Conditional Execution::Host Fingerprint Check (B0025.004)](../anti-behavioral-analysis/emulator-detection.md)|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution [[1]](#1)|
|
||||
|
||||
References
|
||||
|
||||
@@ -11,13 +11,19 @@ SYNful Knock
|
||||
============
|
||||
A modification of the router's firmware images used to maintain persistence. [[1]](#1)
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Persistence::Component Firmware::Router Firmware (F0009.001)](../persistence/component-firmware.md)|Modification of the router's firmware image that can be used to maintain persistence within a victim's network [[1]](#1)|
|
||||
|[Micro-Objective::Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|Modifies the translation lookaside buffer (TLB) Read/Write attributes [[1]](#1)|
|
||||
|[Defense Evasion::Hijack Execution Flow (F0015)](../defense-evasion/hijack-execution-flow.md)|Hooks IOS functions to call and initialize the malware [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Micro-Objective::Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|Modifies the translation lookaside buffer (TLB) Read/Write attributes [[1]](#1)|
|
||||
|[Micro-objective::Communication::Socket Communication::Send TCP Data (C0001.014)](../micro-behaviors/communication/socket-communication.md)|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router [[1]](#1)|
|
||||
|[Defense Evasion::Alternative Installation Location::Fileless Malware (B0027.001)](../defense-evasion/alternative-installation-location.md)|100 memory-resident modules can be installed [[1]](#1)|
|
||||
|
||||
|
||||
@@ -18,15 +18,21 @@ ATT&CK Techniques
|
||||
|---|---|
|
||||
|[Defense Evasion::Virtualization/Sandbox Evasion: User Activity Based Checks (T1497)](https://attack.mitre.org/techniques/T1497/)|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[2]](#2)|
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Self Deletion (F0007.001)](../defense-evasion/self-deletion.md)|Evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[2]](#2)|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Sets "2019" as Windows' startup folder by modifying a registry value. [[1]](#1)|
|
||||
|[Execution::User Interaction (E1204)](../execution/user-execution.md)|The malware relies on user interaction to execute [[2]](#2)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Command and Control::Command and Control Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends data to C2 [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution (B0003.003)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[1]](#1)|
|
||||
|[Defense Evasion::Self Deletion (F0007.001)](../defense-evasion/self-deletion.md)|Evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[2]](#2)|
|
||||
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Sets "2019" as Windows' startup folder by modifying a registry value. [[1]](#1)|
|
||||
|[Execution::User Interaction (E1204)](../execution/user-execution.md)|The malware relies on user interaction to execute [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -16,7 +16,7 @@ ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/).
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
@@ -26,10 +26,16 @@ MBC Behaviors
|
||||
|[Persistence::Registy Run Keys / Startup folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|has an auto-start service that allows it to run whenever the machine boots [[3]](#3)|
|
||||
|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|Terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV) [[3]](#3)|
|
||||
|[Exfiltration::Archive Collected Data::Encryption (E1560.m02)](../exfiltration/archive-collected-data.md)|Uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt [[4]](#4)|
|
||||
|[Defense Evasion::Bootkit (F0013)](../defense-evasion/bootkit.md)|Can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware [[5]](#5)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Can collect info
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|Receives various commands from c2 server. [[2]](#2)|
|
||||
|[Micro-Objective::Cryptography::Encrypt Data:AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|Uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files [[1]](#1)|
|
||||
|[Defense Evasion::Bootkit (F0013)](../defense-evasion/bootkit.md)|Can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware [[5]](#5)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Can collect information about the compter, resources, services, installed programs, firmware, and operating system version [[1]](#1)|
|
||||
rmation about the compter, resources, services, installed programs, firmware, and operating system version [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Evade Dynamic Analysis (B0003.012)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|Uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering) [[6]](#6)|
|
||||
|
||||
|
||||
|
||||
+10
-3
@@ -23,6 +23,16 @@ ATT&CK Techniques
|
||||
|[Command and Control::Ingress Tool Transfer (T1105)](https://attack.mitre.org/techniques/T1105/)|The malware downloads files from C2 [[1]](#1)|
|
||||
|[Command and Control::Application Layer Protocol: Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware communicates to the C2 server using HTTP [[1]](#1)|
|
||||
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Collection::Keylogging (F0002)](../collection/keylogging.md)|The malware logs keystrokes to a file [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055)](../defense-evasion/process-injection.md)|The malware loads multiple DLLs into memory [[1]](#1)|
|
||||
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
@@ -30,9 +40,6 @@ MBC Behaviors
|
||||
|[Command and Control::Command and Control Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives payloads [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends harded HTTP headers disguised as Microsoft Update traffic [[1]](#1)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|The malware is a dropper that creates multiple files [[1]](#1)|
|
||||
|[Collection::Keylogging (F0002)](../collection/keylogging.md)|The malware logs keystrokes to a file [[1]](#1)|
|
||||
|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055)](../defense-evasion/process-injection.md)|The malware loads multiple DLLs into memory [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
MD5 Hashes
|
||||
|
||||
@@ -11,6 +11,21 @@ Ursnif
|
||||
======
|
||||
A banking trojan that uses malware macros to evade sandbox detection. Variant of Gozi.
|
||||
|
||||
ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [Ursnif - Techniques Used](https://attack.mitre.org/software/S0386/).
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Persistance::Registry Run Keys/ Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Adds registry entries to ensure automatic execution at every system startup [[4]](#4)|
|
||||
|[Defense Evasion::Hijack Execution Flow (F0015)](../defense-evasion/hijack-execution-flow.md)|Hooks various DLL exported functions when the component is loaded in their respective Browser application process is running to monitor network traffic [[4]](#4)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Uses windows command prompt commands to gather system info, task list, installed drivers, and installed programs [[4]](#4)|
|
||||
|[Collection::Input Capture (E1056)](../collection/input-capture.md)|Injects HTML into browser session to collect sensitive online banking information when the victim performs their online banking [[5]](#5)|
|
||||
|[Anti-Static Analysis::Obfuscated Files or Information (E1027)](../anti-static-analysis/executable-code-obfuscation.md)|Creates an encrypted Registry key called TorClient to store its data [[2]](#2)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
@@ -22,12 +37,7 @@ MBC Behaviors
|
||||
|[Command and Control::Command and Control Communication::Authenticate (B0030.011)](../command-and-control/c2-communication.md)|Ursnif variant Dreambot authenticates and encrypts traffic to C2 server using TOR [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::TLS Callbacks (B0001.028)](../anti-behavioral-analysis/debugger-detection.md)|Manipulates TLS Callbacks while injecting to child process [[3]](#3)|
|
||||
|[Micro-Behavior::Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|Changes the PE header of the child process to enable write access to that page, writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe process executable in the target child process. Then changes the region protection back to "read only" to avoid suspicion [[3]](#3)|
|
||||
|[Persistance::Registry Run Keys/ Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Adds registry entries to ensure automatic execution at every system startup [[4]](#4)|
|
||||
|[Defense Evasion::Hijack Execution Flow (F0015)](../defense-evasion/hijack-execution-flow.md)|Hooks various DLL exported functions when the component is loaded in their respective Browser application process is running to monitor network traffic [[4]](#4)|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Uses windows command prompt commands to gather system info, task list, installed drivers, and installed programs [[4]](#4)|
|
||||
|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|Commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, upload a log file which contains stolen information [[5]](#5)|
|
||||
|[Collection::Input Capture (E1056)](../collection/input-capture.md)|Injects HTML into browser session to collect sensitive online banking information when the victim performs their online banking [[5]](#5)|
|
||||
|[Anti-Static Analysis::Obfuscated Files or Information (E1027)](../anti-static-analysis/executable-code-obfuscation.md)|Creates an encrypted Registry key called TorClient to store its data [[2]](#2)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
|
||||
@@ -23,21 +23,27 @@ ATT&CK Techniques
|
||||
|[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)|[[1]](#1)|
|
||||
|[Defense Evasion::Indicator Removal on Host::File Deletion (T1070.004)](https://attack.mitre.org/techniques/T1070/004/)|[[1]](#1)|
|
||||
|
||||
MBC Behaviors
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Learns about the system so it can drop compatible miner software. [[1]](#1)|
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
|
||||
|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|[[1]](#1)|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Injects miner code into a running process.|
|
||||
|[Defense Evasion::Disable or Evade Security Tools (E1089)](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Downloads and executes Claymore's Zcash miner from a remote server. [[1]](#1)|
|
||||
|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)|
|
||||
|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|Drops software that mines for cryptocurrency: Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Dynamic Analysis Evasion (B0003)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|[[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Emulator Evasion (B0005)](../anti-behavioral-analysis/emulator-evasion.md)|[[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment. [[1]](#1)|
|
||||
|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|[[1]](#1)|
|
||||
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Injects miner code into a running process.|
|
||||
|[Defense Evasion::Disable or Evade Security Tools (E1089)](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -11,18 +11,28 @@ YiSpecter
|
||||
=========
|
||||
YiSpecter is Apple iOS malware that can download, install and launch arbitrary iOS apps, replace existing apps with those it downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmarks and opened pages, and upload device information to a C2 server. It uses tricks to hide its icons from iOS’s SpringBoard, which prevents the user from finding and deleting it. The components also use the same name and logos of system apps to trick iOS power users. [[1]](#1)
|
||||
|
||||
ATT&CK Techniques
|
||||
-----------------
|
||||
See ATT&CK: [YiSpecter - Techniques Used](https://attack.mitre.org/software/S0311/).
|
||||
|
||||
Enhanced ATT&CK Techniques
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Defense Evasion::Hidden Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users [[1]](#1)|
|
||||
|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Hijacks other installed applications' launch routines to use "ADPage" (an installed malicious app) to display advertisements [[1]](#1)|
|
||||
|[Lateral Movement::Supply Chain Compromise:Exploit Private APIs (E1195.m02)](../lateral-movement/supply-chain-compromise.md)|Use of the private api allowed both Installation of malicious apps and uninstallation of legitimate apps without user notification [[1]](#1)|
|
||||
|[Lateral Movement::Supply Chain Compromise:Abuse Enterprise Certificates (E1195.m01)](../lateral-movement/supply-chain-compromise.md)|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution [[1]](#1)|
|
||||
|[Impact::Generate Fraudulent Advertising Revenue::Advertisement Replacement Fraud (E1472.m02)](../persistence/component-firmware.md)|Displays brief advertisements whenever the user opens applications on their phone [[1]](#1)|
|
||||
|
||||
|
||||
MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Can download and install arbitrary iOS apps [[1]](#1)|
|
||||
|[Defense Evasion::Hidden Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Send System Information (B0030.006)](../command-and-control/c2-communication.md)|Connects to the command and control server using HTTP to send device information [[1]](#1)|
|
||||
|[Defense Evasion::Install Insecure or Malicious Configuration (B0047)](../defense-evasion/install-insecure-or-malicious-configuration.md)|Changes iOS Safari's default configuration [[1]](#1)|
|
||||
|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Hijacks other installed applications' launch routines to use "ADPage" (an installed malicious app) to display advertisements [[1]](#1)|
|
||||
|[Lateral Movement::Supply Chain Compromise:Exploit Private APIs (E1195.m02)](../lateral-movement/supply-chain-compromise.md)|Use of the private api allowed both Installation of malicious apps and uninstallation of legitimate apps without user notification [[1]](#1)|
|
||||
|[Lateral Movement::Supply Chain Compromise:Abuse Enterprise Certificates (E1195.m01)](../lateral-movement/supply-chain-compromise.md)|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution [[1]](#1)|
|
||||
|[Impact::Generate Fraudulent Advertising Revenue::Advertisement Replacement Fraud (E1472.m02)](../persistence/component-firmware.md)|Displays brief advertisements whenever the user opens applications on their phone [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
|
||||
Reference in New Issue
Block a user