mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Syntax change (#109)
This commit is contained in:
Ryan Xu
@@ -39,7 +39,7 @@ A mass-mailing computer worm affecting Microsoft Windows. [[1]](#1)
|
||||
|---|---|
|
||||
|[Execution::Prevent Concurrent Execution (B0024)](../execution/prevent-concurrent-execution.md)|Some Bagle variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [[1]](#1)|
|
||||
|[Execution::Send Email (B0020)](../execution/send-email.md)|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
|
||||
|[Micro-Behaviors::Data::Decompress Data::aPLib (C0025.003)](../micro-behaviors/data/decompress-data.md)|Bagle decompresses data using aPLib. [[4]](#4)|
|
||||
|[Data::Decompress Data::aPLib (C0025.003)](../micro-behaviors/data/decompress-data.md)|Bagle decompresses data using aPLib. [[4]](#4)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -59,20 +59,20 @@ See ATT&CK: [BlackEnergy - Techniques Used](https://attack.mitre.org/software/S0
|
||||
|[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|Malware was originally built to launch a distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
|
||||
|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|Malware-infected bots receive commands from botmaster to load plugins associated with botmaster's goals. [[1]](#1)|
|
||||
|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|BlackEnergy contains obfuscated stack strings. [[4]](#4) |
|
||||
|[Micro-Behaviors::Communication::HTTP Communication::Extract Body (C0002.011)](../micro-behaviors/communication/http-communication.md)|BlackEnergy extracts the HTTP body. [[4]](#4)|
|
||||
|[Micro-Behaviors::Communication::HTTP Communication::IWebBrowser (C0002.010)](../micro-behaviors/communication/http-communication.md)|The malware initializes IWebBrowser2. [[4]](#4)|
|
||||
|[Micro-Behaviors::Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|BlackEnergy hashes data via WinCrypt. [[4]](#4)|
|
||||
|[Micro-Behaviors::Cryptography::Cryptographic Hash::MD5 (C0029.001)](../micro-behaviors/cryptography/cryptographic-hash.md)|BlackEnergy hashes data with MD5. [[4]](#4)|
|
||||
|[Micro-Behaviors::Cryptography::Cryptographic Hash::SHA1 (C0029.002)](../micro-behaviors/cryptography/cryptographic-hash.md)|BlackEnergy hashes data using SHA1. [[4]](#4)|
|
||||
|[Micro-Behaviors::Cryptography::Decrypt Data (C0031)](../micro-behaviors/cryptography/decrypt-data.md)|BlackEnergy encrypts or decrypts via WinCrypt. [[4]](#4)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|BlackEnergy encrypts data using RC4 via WinAPI. [[4]](#4)|
|
||||
|[Micro-Behaviors::Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|BlackEnergy creates new key via CryptAcquireContext. [[4]](#4)|
|
||||
|[Micro-Behaviors::Cryptography::Generate Pseudo-random Sequence::Use API (C0021.003)](../micro-behaviors/cryptography/generate-pseudorandom-sequence.md)|BlackEnergy generates random numbers via WinAPI. [[4]](#4)|
|
||||
|[Communication::HTTP Communication::Extract Body (C0002.011)](../micro-behaviors/communication/http-communication.md)|BlackEnergy extracts the HTTP body. [[4]](#4)|
|
||||
|[Communication::HTTP Communication::IWebBrowser (C0002.010)](../micro-behaviors/communication/http-communication.md)|The malware initializes IWebBrowser2. [[4]](#4)|
|
||||
|[Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|BlackEnergy hashes data via WinCrypt. [[4]](#4)|
|
||||
|[Cryptography::Cryptographic Hash::MD5 (C0029.001)](../micro-behaviors/cryptography/cryptographic-hash.md)|BlackEnergy hashes data with MD5. [[4]](#4)|
|
||||
|[Cryptography::Cryptographic Hash::SHA1 (C0029.002)](../micro-behaviors/cryptography/cryptographic-hash.md)|BlackEnergy hashes data using SHA1. [[4]](#4)|
|
||||
|[Cryptography::Decrypt Data (C0031)](../micro-behaviors/cryptography/decrypt-data.md)|BlackEnergy encrypts or decrypts via WinCrypt. [[4]](#4)|
|
||||
|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|BlackEnergy encrypts data using RC4 via WinAPI. [[4]](#4)|
|
||||
|[Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|BlackEnergy creates new key via CryptAcquireContext. [[4]](#4)|
|
||||
|[Cryptography::Generate Pseudo-random Sequence::Use API (C0021.003)](../micro-behaviors/cryptography/generate-pseudorandom-sequence.md)|BlackEnergy generates random numbers via WinAPI. [[4]](#4)|
|
||||
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|BlackEnergy enumerates PE sections. [[4]](#4)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|BlackEnergy queries or enumerates a registry key. [[4]](#4)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|BlackEnergy queries or enumerates a registry value. [[4]](#4)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|BlackEnergy creates a process on Windows. [[4]](#4)|
|
||||
|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|BlackEnergy terminates a process via fastfail. [[4]](#4)|
|
||||
|[Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|BlackEnergy queries or enumerates a registry key. [[4]](#4)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|BlackEnergy queries or enumerates a registry value. [[4]](#4)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|BlackEnergy creates a process on Windows. [[4]](#4)|
|
||||
|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|BlackEnergy terminates a process via fastfail. [[4]](#4)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -44,7 +44,7 @@ A worm targeting Microsoft Windows operations systems.
|
||||
|---|---|
|
||||
|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|Conficker uses a domain name generator seeded by the current date to ensure that every copy of the virus generates the same names on their respective days. [[1]](#1)|
|
||||
|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Conficker A variant has a routine that causes the process to suicide exit if the keyboard language layout is set to Ukranian. [[1]](#1)|
|
||||
|[Micro-Behaviors::Memory::Overflow Buffer (C0010)](../micro-behaviors/memory/overflow-buffer.md)|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer. [[1]](#1)|
|
||||
|[Memory::Overflow Buffer (C0010)](../micro-behaviors/memory/overflow-buffer.md)|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer. [[1]](#1)|
|
||||
|[Execution::Conditional Execution::Suicide Exit (B0025.001)](../execution/conditional-execution.md)|Conficker B variant has significantly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts. [[2]](#2)|
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -58,11 +58,11 @@ CryptoLocker is a family of ransomware. [[1]](#1)
|
||||
|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives a public key from the C2. [[1]](#1)|
|
||||
|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|The malware uses an internal domain generation algorithm. [[1]](#1)|
|
||||
|[Command and Control::C2 Communication::Authenticate (B0030.011)](../command-and-control/c2-communication.md)|The malware sends a phone-home message with encryption to start. [[1]](#1)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|CryptoLocker encodes data using XOR. [[2]](#2)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|CryptoLocker encodes data using XOR. [[2]](#2)|
|
||||
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|CryptoLocker enumerates PE sections. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Writes File (C0052)](../micro-behaviors/file-system/writes-file.md)|CryptoLocker writes Fileon Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|CryptoLocker allocates RWX memory. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|CryptoLocker resumes thread. [[2]](#2)|
|
||||
|[File System::Writes File (C0052)](../micro-behaviors/file-system/writes-file.md)|CryptoLocker writes Fileon Windows. [[2]](#2)|
|
||||
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|CryptoLocker allocates RWX memory. [[2]](#2)|
|
||||
|[Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|CryptoLocker resumes thread. [[2]](#2)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -68,27 +68,27 @@ See ATT&CK: [Dark Comet - Techniques Used](https://attack.mitre.org/software/S03
|
||||
|[Impact::Remote Access (B0022)](../impact/remote-access.md)|DarkComet allows an attacker to control the system via a GUI. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|DarkComet checks for a time delay via GetTickCount. [[4]](#4)|
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection::Human User Check (B0009.012)](../anti-behavioral-analysis/virtual-machine-detection.md)|DarkComet checks for an unmoving mouse cursor. [[4]](#4)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|DarkComet encrypts data using RC4 PRGA. [[4]](#4)|
|
||||
|[Micro-Behaviors::Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|DarkComet hashes data with CRC32. [[4]](#4)|
|
||||
|[Micro-Behaviors::Data::Compression Library (C0060)](../micro-behaviors/data/compression-library.md)|DarkComet linked against ZLIB. [[4]](#4)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|DarkComet encodes data using XOR. [[4]](#4)|
|
||||
|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|DarkComet encrypts data using RC4 PRGA. [[4]](#4)|
|
||||
|[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|DarkComet hashes data with CRC32. [[4]](#4)|
|
||||
|[Data::Compression Library (C0060)](../micro-behaviors/data/compression-library.md)|DarkComet linked against ZLIB. [[4]](#4)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|DarkComet encodes data using XOR. [[4]](#4)|
|
||||
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|DarkComet enumerates PE sections. [[4]](#4)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|DarkComet contains an embedded PE file. [[4]](#4)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|DarkComet deletes files. [[4]](#4)|
|
||||
|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|DarkComet gets file attributes. [[4]](#4)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|DarkComet reads files on Windows. [[4]](#4)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|DarkComet writes Fileon Windows. [[4]](#4)|
|
||||
|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|DarkComet allocates RWX memory. [[4]](#4)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|DarkComet deletes registry keys. [[4]](#4)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|DarkComet deletes registry values. [[4]](#4)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|DarkComet queries or enumerates registry keys. [[4]](#4)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|DarkComet queries or enumerates registry values. [[4]](#4)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|DarkComet sets registry values. [[4]](#4)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|DarkComet creates a process on Windows. [[4]](#4)|
|
||||
|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|DarkComet creates a thread. [[4]](#4)|
|
||||
|[Micro-Behaviors::Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|DarkComet resumes a thread. [[4]](#4)|
|
||||
|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|DarkComet set thread local storage values. [[4]](#4)|
|
||||
|[Micro-Behaviors::Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|DarkComet suspends threads. [[4]](#4)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|DarkComet deletes files. [[4]](#4)|
|
||||
|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|DarkComet gets file attributes. [[4]](#4)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|DarkComet reads files on Windows. [[4]](#4)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|DarkComet writes Fileon Windows. [[4]](#4)|
|
||||
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|DarkComet allocates RWX memory. [[4]](#4)|
|
||||
|[Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|DarkComet deletes registry keys. [[4]](#4)|
|
||||
|[Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|DarkComet deletes registry values. [[4]](#4)|
|
||||
|[Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|DarkComet queries or enumerates registry keys. [[4]](#4)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|DarkComet queries or enumerates registry values. [[4]](#4)|
|
||||
|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|DarkComet sets registry values. [[4]](#4)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|DarkComet creates a process on Windows. [[4]](#4)|
|
||||
|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|DarkComet creates a thread. [[4]](#4)|
|
||||
|[Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|DarkComet resumes a thread. [[4]](#4)|
|
||||
|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|DarkComet set thread local storage values. [[4]](#4)|
|
||||
|[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|DarkComet suspends threads. [[4]](#4)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -53,15 +53,15 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev
|
||||
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|DNSChanger encrypts data using RC4 PRGA. [[3]](#3)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|DNSChanger encodes data using XOR. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|DNSChanger gets file attributes. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|DNSChanger reads files on Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|DNSChanger sets file attributes. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|DNSChanger writes Fileon Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|DNSChanger allocates RWX memory. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|DNSChanger queries or enumerates registry values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|DNSChanger sets registry keys. [[3]](#3)|
|
||||
|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|DNSChanger encrypts data using RC4 PRGA. [[3]](#3)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|DNSChanger encodes data using XOR. [[3]](#3)|
|
||||
|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|DNSChanger gets file attributes. [[3]](#3)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|DNSChanger reads files on Windows. [[3]](#3)|
|
||||
|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|DNSChanger sets file attributes. [[3]](#3)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|DNSChanger writes Fileon Windows. [[3]](#3)|
|
||||
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|DNSChanger allocates RWX memory. [[3]](#3)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|DNSChanger queries or enumerates registry values. [[3]](#3)|
|
||||
|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|DNSChanger sets registry keys. [[3]](#3)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -53,13 +53,13 @@ Emotet is a banking trojan. [[1]](#1)
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Anti-Static Analysis::Executable Code Obfuscation::Junk Code Insertion (B0032.007)](../anti-static-analysis/executable-code-obfuscation.md)|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[1]](#1)|
|
||||
|[Micro-behaviors::Cryptography::Encrypt Data::RSA (C0027.011)](../micro-behaviors/cryptography/encrypt-data.md)|Emotet uses RSA to encrypt network traffic to its C2. [[2]](#2)|
|
||||
|[Cryptography::Encrypt Data::RSA (C0027.011)](../micro-behaviors/cryptography/encrypt-data.md)|Emotet uses RSA to encrypt network traffic to its C2. [[2]](#2)|
|
||||
|[Discovery::Analysis Tool Discovery::Process detection - Debuggers (B0013.002)](../discovery/analysis-tool-discovery.md)|If it receives a response from the C2 server stating a debugging-related tool is in the list of running processes, it receives an "upgrade" command which calls the ShellExecuteW function and exits. [[3]](#3)|
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection::Guest Process Testing (B0009.010)](../anti-behavioral-analysis/virtual-machine-detection.md)|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names. [[4]](#4)|
|
||||
|[Command and Control::C2 Communication::Request Email Address List (B0030.010)](../command-and-control/c2-communication.md)|New email addresses are collected automatically from the victim's address books. [[4]](#4)|
|
||||
|[Execution::Send Email (B0020)](../execution/send-email.md)|Spam email with the Emotet loader is sent automatically. [[4]](#4)|
|
||||
|[Micro-Behaviors::Communication::HTTP Communication::Create Request (C0002.012)](../micro-behaviors/communication/http-communication.md)|Emotet creates a HTTP request. [[6]](#6)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Emotet encrypts data using RC4 PRGA. [[6]](#6)|
|
||||
|[Communication::HTTP Communication::Create Request (C0002.012)](../micro-behaviors/communication/http-communication.md)|Emotet creates a HTTP request. [[6]](#6)|
|
||||
|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Emotet encrypts data using RC4 PRGA. [[6]](#6)|
|
||||
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Emotet enumerates PE sections. [[6]](#6)|
|
||||
|
||||
|
||||
|
||||
+17
-17
@@ -59,25 +59,25 @@ Gamut is a spamming botnet.
|
||||
|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives data from C2. [[1]](#1)|
|
||||
|[Command and Control::C2 Communication::Server to Client File Transfer (B0030.003)](../command-and-control/c2-communication.md)|The malware receives files from C2. [[1]](#1)|
|
||||
|[Impact::Spamming (B0039)](../impact/spamming.md)|If port 25 is open, the bot uses a spam template and email list to send spam. [[1]](#1)|
|
||||
|[Micro-Behaviors::Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Gamut hashes data with CRC32. [[3]](#3)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Gamut encodes data using XOR. [[3]](#3)|
|
||||
|[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Gamut hashes data with CRC32. [[3]](#3)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Gamut encodes data using XOR. [[3]](#3)|
|
||||
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[3]](#3) |
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Gamut contains an embedded PE file. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Gamut creates directories. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Gamut deletes directories. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Gamut deletes file. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Gamut gets file attributes. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Gamut moves files. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Gamut reads files on Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Gamut sets file attributes. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Gamut writes files on Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Gamut deletes registry keys. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Gamut deletes registry values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|Gamut queries or enumerates registry keys. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Gamut queries or enumerates registry values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Gamut sets registry values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Gamut creates processes on Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Gamut sets thread local storage values. [[3]](#3)|
|
||||
|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Gamut creates directories. [[3]](#3)|
|
||||
|[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Gamut deletes directories. [[3]](#3)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Gamut deletes file. [[3]](#3)|
|
||||
|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Gamut gets file attributes. [[3]](#3)|
|
||||
|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Gamut moves files. [[3]](#3)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Gamut reads files on Windows. [[3]](#3)|
|
||||
|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Gamut sets file attributes. [[3]](#3)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Gamut writes files on Windows. [[3]](#3)|
|
||||
|[Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Gamut deletes registry keys. [[3]](#3)|
|
||||
|[Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Gamut deletes registry values. [[3]](#3)|
|
||||
|[Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|Gamut queries or enumerates registry keys. [[3]](#3)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Gamut queries or enumerates registry values. [[3]](#3)|
|
||||
|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Gamut sets registry values. [[3]](#3)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Gamut creates processes on Windows. [[3]](#3)|
|
||||
|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Gamut sets thread local storage values. [[3]](#3)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -78,14 +78,14 @@ From [[1]](#1), “The malware installs two instances of itself on the system. T
|
||||
|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|GoBotKR receives data from the C2. [[1]](#1) [[2]](#2)|
|
||||
|[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[1]](#1)|
|
||||
|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[1]](#1)|
|
||||
|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|GoBotKR copies files. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|GoBotKR creates directories. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|GoBotKR deletes files. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|GoBotKR queries or enumerates registry values. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|GoBotKR creates processes on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|GoBotKR creates threads. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|GoBotKR suspends threads. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|GoBotKR terminates processes. [[2]](#2)|
|
||||
|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|GoBotKR copies files. [[2]](#2)|
|
||||
|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|GoBotKR creates directories. [[2]](#2)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|GoBotKR deletes files. [[2]](#2)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|GoBotKR queries or enumerates registry values. [[2]](#2)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|GoBotKR creates processes on Windows. [[2]](#2)|
|
||||
|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|GoBotKR creates threads. [[2]](#2)|
|
||||
|[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|GoBotKR suspends threads. [[2]](#2)|
|
||||
|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|GoBotKR terminates processes. [[2]](#2)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -54,12 +54,12 @@ See ATT&CK: [GravityRAT - Techniques Used](https://attack.mitre.org/software/S02
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Processor count (B0009.018)](../anti-behavioral-analysis/virtual-machine-detection.md)|GravityRAT determines the machine to be a VM if the core count is 1. [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - MAC Address (B0009.028)](../anti-behavioral-analysis/virtual-machine-detection.md)|GravityRAT checks if the MAC address starts with a well-known hexadecimal number used by various VM developer. [[2]](#2)|
|
||||
|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|GravityRAT receives data. [[4]](#4)|
|
||||
|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|GravityRAT creates directories. [[4]](#4)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|GravityRAT deletes files. [[4]](#4)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|GravityRAT reads files on Windows. [[4]](#4)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|GravityRAT writes files on Windows. [[4]](#4)|
|
||||
|[Micro-Behaviors::Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|GravityRAT suspends threads. [[4]](#4)|
|
||||
|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|GravityRAT terminates processes. [[4]](#4)|
|
||||
|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|GravityRAT creates directories. [[4]](#4)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|GravityRAT deletes files. [[4]](#4)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|GravityRAT reads files on Windows. [[4]](#4)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|GravityRAT writes files on Windows. [[4]](#4)|
|
||||
|[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|GravityRAT suspends threads. [[4]](#4)|
|
||||
|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|GravityRAT terminates processes. [[4]](#4)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
+28
-28
@@ -81,35 +81,35 @@ A family of backdoors.
|
||||
|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|Hupigon contains obfuscated stack strings. [[3]](#3)|
|
||||
|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Hupigon receives data. [[3]](#3)|
|
||||
|[Command And Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|Hupigon sends data. [[3]](#3)|
|
||||
|[Micro-Behaviors::Communication::DNS Communication::Resolve (C0011.001)](../micro-behaviors/communication/dns-communication.md)|Hupigon resolves DNS. [[3]](#3)|
|
||||
|[Micro-Behaviors::Communication::Interprocess Communication::Create Pipe (C0003.001)](../micro-behaviors/communication/interprocess-communication.md)|Hupigon creates two anonymous pipes. [[3]](#3)|
|
||||
|[Micro-Behaviors::Communication::Interprocess Communication::Write Pipe (C0003.004)](../micro-behaviors/communication/interprocess-communication.md)|Hupigon writes pipes. [[3]](#3)|
|
||||
|[Micro-Behaviors::Communication::Socket Communication::Create UDP Socket (C0001.010)](../micro-behaviors/communication/socket-communication.md)|Hupigon creates UDP sockets. [[3]](#3)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::3DES (C0027.004)](../micro-behaviors/cryptography/encrypt-data.md)|Hupigon encrypts data using DES. [[3]](#3)|
|
||||
|[Micro-Behaviors::Data::Compression Library (C0060)](../micro-behaviors/data/compression-library.md)|Hupigon linked against ZLIB. [[3]](#3)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Hupigon encodes data using XOR. [[3]](#3)|
|
||||
|[Communication::DNS Communication::Resolve (C0011.001)](../micro-behaviors/communication/dns-communication.md)|Hupigon resolves DNS. [[3]](#3)|
|
||||
|[Communication::Interprocess Communication::Create Pipe (C0003.001)](../micro-behaviors/communication/interprocess-communication.md)|Hupigon creates two anonymous pipes. [[3]](#3)|
|
||||
|[Communication::Interprocess Communication::Write Pipe (C0003.004)](../micro-behaviors/communication/interprocess-communication.md)|Hupigon writes pipes. [[3]](#3)|
|
||||
|[Communication::Socket Communication::Create UDP Socket (C0001.010)](../micro-behaviors/communication/socket-communication.md)|Hupigon creates UDP sockets. [[3]](#3)|
|
||||
|[Cryptography::Encrypt Data::3DES (C0027.004)](../micro-behaviors/cryptography/encrypt-data.md)|Hupigon encrypts data using DES. [[3]](#3)|
|
||||
|[Data::Compression Library (C0060)](../micro-behaviors/data/compression-library.md)|Hupigon linked against ZLIB. [[3]](#3)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Hupigon encodes data using XOR. [[3]](#3)|
|
||||
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Hupigon enumerates PE sections. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Hupigon copies files. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Hupigon creates directories. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Hupigon deletes directories. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Hupigon deletes files. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Hupigon gets file attributes. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Hupigon moves files. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Hupigon reads files on Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Hupigon sets file attributes. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Hupigon writes files on Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Hupigon allocates RWX memory. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Hupigon deletes registry keys. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Hupigon deletes registry values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|Hupigon queries or enumerates registry keys. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Hupigon queries or enumerates registry values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Hupigon sets registry values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Hupigon creates mutexes. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Hupigon creates processes on Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Hupigon creates threads. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Hupigon sets thread local storage values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|Hupigon suspends threads. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Hupigon terminates processes. [[3]](#3)|
|
||||
|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Hupigon copies files. [[3]](#3)|
|
||||
|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Hupigon creates directories. [[3]](#3)|
|
||||
|[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Hupigon deletes directories. [[3]](#3)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Hupigon deletes files. [[3]](#3)|
|
||||
|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Hupigon gets file attributes. [[3]](#3)|
|
||||
|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Hupigon moves files. [[3]](#3)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Hupigon reads files on Windows. [[3]](#3)|
|
||||
|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Hupigon sets file attributes. [[3]](#3)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Hupigon writes files on Windows. [[3]](#3)|
|
||||
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Hupigon allocates RWX memory. [[3]](#3)|
|
||||
|[Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Hupigon deletes registry keys. [[3]](#3)|
|
||||
|[Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Hupigon deletes registry values. [[3]](#3)|
|
||||
|[Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|Hupigon queries or enumerates registry keys. [[3]](#3)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Hupigon queries or enumerates registry values. [[3]](#3)|
|
||||
|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Hupigon sets registry values. [[3]](#3)|
|
||||
|[Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Hupigon creates mutexes. [[3]](#3)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Hupigon creates processes on Windows. [[3]](#3)|
|
||||
|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Hupigon creates threads. [[3]](#3)|
|
||||
|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Hupigon sets thread local storage values. [[3]](#3)|
|
||||
|[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|Hupigon suspends threads. [[3]](#3)|
|
||||
|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Hupigon terminates processes. [[3]](#3)|
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
|
||||
+20
-20
@@ -65,26 +65,26 @@ A trojan that performs click-fraud.
|
||||
|[Defense Evasion::Alternative Installation Location::Registry Install (B0027.002)](../defense-evasion/alternative-installation-location.md)|Kovter stores malware files in the Registry instead of on the hard drive. [[2]](#2)|
|
||||
|[Command And Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|Kovter sends data. [[3]](#3)|
|
||||
|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Kovter receives data. [[3]](#3)|
|
||||
|[Micro-Behaviors::Communication::HTTP Communication::Connect to Server (C0002.009)](../micro-behaviors/communication/http-communication.md)|Kovter connects to a HTTP server. [[3]](#3)|
|
||||
|[Micro-Behaviors::Communication::HTTP Communication::Create Request (C0002.012)](../micro-behaviors/communication/http-communication.md)|Kovter creates HTTP requests. [[3]](#3)|
|
||||
|[Micro-Behaviors::Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|Kovter hashes data via WinCrypt. [[3]](#3)|
|
||||
|[Micro-Behaviors::Cryptography::Decrypt Data (C0031)](../micro-behaviors/cryptography/decrypt-data.md)|Kovter encrypts or decrypts via WinCrypt. [[3]](#3)|
|
||||
|[Micro-Behaviors::Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|Kovter creates new keys via CryptAcquireContext. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Kovter copies files. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Kovter creates directories. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Kovter deletes directories. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Kovter deletes files. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Kovter moves files. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Kovter reads files on Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Kovter sets file attributes. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Environment Variable::Set Variable (C0034.001)](../micro-behaviors/operating-system/environment-variable.md)|Kovter sets environment variables. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Create Registry Key (C0036.004)](../micro-behaviors/operating-system/registry.md)|Kovter creates or opens registry keys. [[3]](#3)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Kovter queries or enumerates registry values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Allocate Thread Local Storage (C0040)](../micro-behaviors/process/allocate-thread-local-storage.md)|Kovter allocates thread local storage. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Kovter creates mutexes. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Kovter creates processes on Windows. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Kovter sets thread local storage values. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Kovter terminates processes. [[3]](#3)|
|
||||
|[Communication::HTTP Communication::Connect to Server (C0002.009)](../micro-behaviors/communication/http-communication.md)|Kovter connects to a HTTP server. [[3]](#3)|
|
||||
|[Communication::HTTP Communication::Create Request (C0002.012)](../micro-behaviors/communication/http-communication.md)|Kovter creates HTTP requests. [[3]](#3)|
|
||||
|[Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|Kovter hashes data via WinCrypt. [[3]](#3)|
|
||||
|[Cryptography::Decrypt Data (C0031)](../micro-behaviors/cryptography/decrypt-data.md)|Kovter encrypts or decrypts via WinCrypt. [[3]](#3)|
|
||||
|[Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|Kovter creates new keys via CryptAcquireContext. [[3]](#3)|
|
||||
|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Kovter copies files. [[3]](#3)|
|
||||
|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Kovter creates directories. [[3]](#3)|
|
||||
|[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Kovter deletes directories. [[3]](#3)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Kovter deletes files. [[3]](#3)|
|
||||
|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Kovter moves files. [[3]](#3)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Kovter reads files on Windows. [[3]](#3)|
|
||||
|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Kovter sets file attributes. [[3]](#3)|
|
||||
|[Operating System::Environment Variable::Set Variable (C0034.001)](../micro-behaviors/operating-system/environment-variable.md)|Kovter sets environment variables. [[3]](#3)|
|
||||
|[Operating System::Registry::Create Registry Key (C0036.004)](../micro-behaviors/operating-system/registry.md)|Kovter creates or opens registry keys. [[3]](#3)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Kovter queries or enumerates registry values. [[3]](#3)|
|
||||
|[Process::Allocate Thread Local Storage (C0040)](../micro-behaviors/process/allocate-thread-local-storage.md)|Kovter allocates thread local storage. [[3]](#3)|
|
||||
|[Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Kovter creates mutexes. [[3]](#3)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Kovter creates processes on Windows. [[3]](#3)|
|
||||
|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Kovter sets thread local storage values. [[3]](#3)|
|
||||
|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Kovter terminates processes. [[3]](#3)|
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
|
||||
@@ -48,8 +48,8 @@ A family of bots.
|
||||
|---|---|
|
||||
|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| Kraken uses a domain name generator to provide new domains. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Memory Dump Evasion (B0006)](../anti-behavioral-analysis/memory-dump-evasion.md)|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[1]](#1)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Kraken encrypts data using RC4 PRGA. [[2]](#2)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Kraken encodes data using XOR. [[2]](#2)|
|
||||
|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Kraken encrypts data using RC4 PRGA. [[2]](#2)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Kraken encodes data using XOR. [[2]](#2)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -51,17 +51,17 @@ The OASIS Collaborative Automated Course of Action Operations [(CACAO)](https://
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Anti-Static Analysis::Executable Code Virtualization (B0008)](../anti-static-analysis/executable-code-virtualization.md)|Code virtualization is added to the Locky Bart binary using WPProtect. [[1]](#1)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Locky Bart encrypts data using RC4 PRGA. [[2]](#2)|
|
||||
|[Micro-Behaviors::Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|Locky Bart creates a new key via CryptAcquireContext. [[2]](#2)|
|
||||
|[Micro-Behaviors::Cryptography::Generate Pseudo-random Sequence::Use API (C0021.003)](../micro-behaviors/cryptography/generate-pseudorandom-sequence.md)|Locky Bart generates random numbers via WinAPI. [[2]](#2)|
|
||||
|[Micro-Behaviors::Data::Check String (C0019)](../micro-behaviors/data/check-string.md)|Locky Bart references Base64 strings. [[2]](#2)|
|
||||
|[Micro-Behaviors::Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Locky Bart hashes data with CRC32. [[2]](#2)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Locky Bart encodes data using XOR. [[2]](#2)|
|
||||
|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Locky Bart encrypts data using RC4 PRGA. [[2]](#2)|
|
||||
|[Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|Locky Bart creates a new key via CryptAcquireContext. [[2]](#2)|
|
||||
|[Cryptography::Generate Pseudo-random Sequence::Use API (C0021.003)](../micro-behaviors/cryptography/generate-pseudorandom-sequence.md)|Locky Bart generates random numbers via WinAPI. [[2]](#2)|
|
||||
|[Data::Check String (C0019)](../micro-behaviors/data/check-string.md)|Locky Bart references Base64 strings. [[2]](#2)|
|
||||
|[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Locky Bart hashes data with CRC32. [[2]](#2)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Locky Bart encodes data using XOR. [[2]](#2)|
|
||||
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Locky Bart enumerates PE sections. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Locky Bart reads files on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Locky Bart writes files on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Locky Bart sets registry values. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Locky Bart creates threads. [[2]](#2)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Locky Bart reads files on Windows. [[2]](#2)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Locky Bart writes files on Windows. [[2]](#2)|
|
||||
|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Locky Bart sets registry values. [[2]](#2)|
|
||||
|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Locky Bart creates threads. [[2]](#2)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -57,7 +57,7 @@ A commercial loader that consists of 2 stages used to download and execute paylo
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection::Check Processes (B0009.003)](../anti-behavioral-analysis/virtual-machine-detection.md)|Malware checks if it is running in a sandbox. If it is running in a sandbox, the malware exits. [[1]](#1)|
|
||||
|[Micro-Behaviors::Process::Check Mutex (C0043)](../micro-behaviors/process/check-mutex.md)|Malware checks if multiple instances of the same mutex is running. If multiple instances are running, the malware exits. [[1]](#1)|
|
||||
|[Process::Check Mutex (C0043)](../micro-behaviors/process/check-mutex.md)|Malware checks if multiple instances of the same mutex is running. If multiple instances are running, the malware exits. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Capture Evasion::Multiple Stages of Loaders (B0036.003)](../anti-behavioral-analysis/capture-evasion.md)|Malware consists of 2 loaders. [[2]](#2)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Malware drops the first loader which is responsible for loading the main loader into memory. [[1]](#1)|
|
||||
|[Anti-Static Analysis::Executable Code Obfuscation::API Hashing (B0032.001)](../anti-static-analysis/executable-code-obfuscation.md)|The function to import APIs uses a hash value and the DLL name of the target API. The API address returned from the function is stored into a global variance. API calls are obfuscated in the same manner as the stack strings and are resolved dynamically as the malware needs to use them. The malware encodes data in a stack string and copies that data into a global character buffer as a form of string obfuscation. [[1]](#1) [[2]](#2)|
|
||||
@@ -65,7 +65,7 @@ A commercial loader that consists of 2 stages used to download and execute paylo
|
||||
|[Anti-Static Analysis::Executable Code Obfuscation::Entry Point Obfuscation (B0032.009)](../anti-static-analysis/executable-code-obfuscation.md)|The malware has 4 different export functions. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|The malware calls GetTickCount64 to retrieve timestamp. The malware executes Sleep and Beep in a repeated loop for 10 times. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Capture Evasion::Memory-Only Payload (B0036.001)](../anti-behavioral-analysis/capture-evasion.md)|Malware downloads multiple payloads (as files and DLLs) that are stored in a memory buffer. [[1]](#1) [[2]](#2)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Malware loader decrypts inner configurations (C2 server address, C2 server's gate, and a string for the RC4 encryption key for communication between the malware and the C2 server) stored in the binary. The malware also encrypts the value of each JSON key with RC4 and encodes the value with Base64. [[2]](#2)|
|
||||
|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Malware loader decrypts inner configurations (C2 server address, C2 server's gate, and a string for the RC4 encryption key for communication between the malware and the C2 server) stored in the binary. The malware also encrypts the value of each JSON key with RC4 and encodes the value with Base64. [[2]](#2)|
|
||||
|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|Malware sends collected data about the system to C2 server. [[2]](#2)|
|
||||
|[Execution::Remote Commands::Sleep (B0011.005)](../execution/remote-commands.md)|If malware fails to send its collected data, then it sleeps. If the malware fails to execute any command, it sleeps for 4 minutes. [[2]](#2)|
|
||||
|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|C2 server returns Base64 encoded data containing the information about the next command for the loader. [[2]](#2)|
|
||||
|
||||
@@ -56,13 +56,13 @@ See ATT&CK: [Mebromi - Techniques Used](https://attack.mitre.org/software/S0001/
|
||||
|---|---|
|
||||
|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Malware only proceeds if it detects the BIOS ROM is Award BIOS. [[1]](#1)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Malware contains a dropper that installs additional programs like Cbrom.exe. [[1]](#1)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Mebromi encodes data using XOR. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Mebromi copies files. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Mebromi deletes files. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Mebromi moves files. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Mebromi reads files on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Mebromi allocates RWX memory. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Mebromi creates a process on Windows. [[2]](#2)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Mebromi encodes data using XOR. [[2]](#2)|
|
||||
|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Mebromi copies files. [[2]](#2)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Mebromi deletes files. [[2]](#2)|
|
||||
|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Mebromi moves files. [[2]](#2)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Mebromi reads files on Windows. [[2]](#2)|
|
||||
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Mebromi allocates RWX memory. [[2]](#2)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Mebromi creates a process on Windows. [[2]](#2)|
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
|
||||
@@ -50,17 +50,17 @@ See ATT&CK: [Poison Ivy - Techniques Used](https://attack.mitre.org/software/S00
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Remote Access (B0022)](../impact/remote-access.md)|After the Poison Ivy server is running on the target machine, the attacker uses a Windows GUI client to control the target computer. [[1]](#1)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::Camellia (C0027.003)](../micro-behaviors/cryptography/encrypt-data.md)|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Poison Ivy has a default process mutex, but it can be altered at build time. [[3]](#3)|
|
||||
|[Cryptography::Encrypt Data::Camellia (C0027.003)](../micro-behaviors/cryptography/encrypt-data.md)|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key. [[2]](#2)|
|
||||
|[Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Poison Ivy has a default process mutex, but it can be altered at build time. [[3]](#3)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::Hardware Breakpoints (B0001.005)](../anti-behavioral-analysis/debugger-detection.md)|A Poison Ivy variant checks for breakpoints and exits immediately if found. [[3]](#3)|
|
||||
|[Discovery::Analysis Tool Discovery (B0013)](../discovery/analysis-tool-discovery.md)|A Poison Ivy variant runs a thread to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one of the analysis tools is running. [[3]](#3)|
|
||||
|[Discovery::Analysis Tool Discovery::Known Windows Class Name (B0013.010)](../discovery/analysis-tool-discovery.md)|A Poison Ivy variant goes through all the running program windows to check if any Windows class name contains a special string to determine if an analysis tool is running. [[3]](#3)|
|
||||
|[Micro-Behaviors::Process::Check Mutex (C0043)](../micro-behaviors/process/check-mutex.md)|A Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists. [[3]](#3)|
|
||||
|[Process::Check Mutex (C0043)](../micro-behaviors/process/check-mutex.md)|A Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists. [[3]](#3)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::IsDebuggerPresent (B0001.008)](../anti-behavioral-analysis/debugger-detection.md)|A Poison Ivy variant uses the IsDebuggerPresent API function call to check if the process is running in a debugger. [[3]](#3)|
|
||||
|[Micro-Behaviors::Communication::Interprocess Communication::Write Pipe (C0003.004)](../micro-behaviors/communication/interprocess-communication.md)|Poison Ivy writes pipes. [[5]](#5)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Poison Ivy reads files on Windows. [[5]](#5)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Poison Ivy writes files on Windows. [[5]](#5)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Poison Ivy queries or enumerates registry values. [[5]](#5)|
|
||||
|[Communication::Interprocess Communication::Write Pipe (C0003.004)](../micro-behaviors/communication/interprocess-communication.md)|Poison Ivy writes pipes. [[5]](#5)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Poison Ivy reads files on Windows. [[5]](#5)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Poison Ivy writes files on Windows. [[5]](#5)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Poison Ivy queries or enumerates registry values. [[5]](#5)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
+19
-19
@@ -62,28 +62,28 @@ Redhip is an information stealer.
|
||||
|[Anti-Behavioral Analysis::Debugger Evasion (B0002)](../anti-behavioral-analysis/debugger-evasion.md)|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::Process Environment Block BeingDebugged (B0001.035)](../anti-behavioral-analysis/debugger-detection.md)|Redhip checks for PEB BeingDebugged flag. [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|Redhip checks for time delay via GetTickCount. [[2]](#2)|
|
||||
|[Micro-Behaviors::Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|Redhip hashes data via WinCrypt. [[2]](#2)|
|
||||
|[Micro-Behaviors::Cryptography::Cryptographic Hash::SHA1 (C0029.002)](../micro-behaviors/cryptography/cryptographic-hash.md)|Redhip hashes data using SHA1. [[2]](#2)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data (C0027)](../micro-behaviors/cryptography/encrypt-data.md)|Redhip encrypts data using DPAPI. [[2]](#2)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Redhip encodes data using XOR. [[2]](#2)|
|
||||
|[Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|Redhip hashes data via WinCrypt. [[2]](#2)|
|
||||
|[Cryptography::Cryptographic Hash::SHA1 (C0029.002)](../micro-behaviors/cryptography/cryptographic-hash.md)|Redhip hashes data using SHA1. [[2]](#2)|
|
||||
|[Cryptography::Encrypt Data (C0027)](../micro-behaviors/cryptography/encrypt-data.md)|Redhip encrypts data using DPAPI. [[2]](#2)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Redhip encodes data using XOR. [[2]](#2)|
|
||||
|[Discovery::Code Discovery::Inspect Section Memory Permissions (B0046.002)](../discovery/code-discovery.md)|Redhip inspects section memory permissions. [[2]](#2)|
|
||||
|[Discovery::Taskbar Discovery (B0043)](../discovery/taskbar-discovery.md)|Redhip finds taskbars. [[2]](#2)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Redhip contains an embedded PE file. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Redhip copies files. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Redhip creates directories. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Redhip deletes files. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Redhip gets file attributes. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Redhip reads files on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Redhip sets file attributes. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Redhip writes files on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Redhip spawns threads to RWX shellcode. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Redhip deletes registry keys. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Redhip queries or enumerates registry values. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Redhip sets registry values. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Redhip creates a mutex. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Redhip creates a process on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Process::Create Suspended Process (C0017.003)](../micro-behaviors/process/create-process.md)|Redhip creates a suspended process. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Redhip sets thread local storage values. [[2]](#2)|
|
||||
|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Redhip copies files. [[2]](#2)|
|
||||
|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Redhip creates directories. [[2]](#2)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Redhip deletes files. [[2]](#2)|
|
||||
|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Redhip gets file attributes. [[2]](#2)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Redhip reads files on Windows. [[2]](#2)|
|
||||
|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Redhip sets file attributes. [[2]](#2)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Redhip writes files on Windows. [[2]](#2)|
|
||||
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Redhip spawns threads to RWX shellcode. [[2]](#2)|
|
||||
|[Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Redhip deletes registry keys. [[2]](#2)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Redhip queries or enumerates registry values. [[2]](#2)|
|
||||
|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Redhip sets registry values. [[2]](#2)|
|
||||
|[Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Redhip creates a mutex. [[2]](#2)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Redhip creates a process on Windows. [[2]](#2)|
|
||||
|[Process::Create Process::Create Suspended Process (C0017.003)](../micro-behaviors/process/create-process.md)|Redhip creates a suspended process. [[2]](#2)|
|
||||
|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Redhip sets thread local storage values. [[2]](#2)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
+14
-14
@@ -78,20 +78,20 @@ This family of malware steals data the user enters into a browser and uses a var
|
||||
|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Rombertik receives data. [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|Rombertik checks for time delay via GetTickCount. [[2]](#2)|
|
||||
|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|Rombertik contains obfuscated stack strings. [[2]](#2)|
|
||||
|[Micro-Behaviors::Communication::Socket Communication::Create TCP Socket (C0001.011)](../micro-behaviors/communication/socket-communication.md)|Rombertik creates TCP sockets. [[2]](#2)|
|
||||
|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Rombertik encrypts data using RC4 PRGA. [[2]](#2)|
|
||||
|[Micro-Behaviors::Cryptography::Encryption Key::RC4 KSA (C0028.002)](../micro-behaviors/cryptography/encryption-key.md)|Rombertik encrypts data using RC4 KSA. [[2]](#2)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Rombertik encodes data using XOR. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Rombertik deletes files. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Rombertik reads files on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Rombertik writes files on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Rombertik allocates RWX memory. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Rombertik deletes registry keys. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Rombertik queries or enumerates registry values. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Rombertik sets registry values. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Rombertik creates a mutex. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Rombertik creates a thread. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Rombertik sets thread local storage values. [[2]](#2)|
|
||||
|[Communication::Socket Communication::Create TCP Socket (C0001.011)](../micro-behaviors/communication/socket-communication.md)|Rombertik creates TCP sockets. [[2]](#2)|
|
||||
|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Rombertik encrypts data using RC4 PRGA. [[2]](#2)|
|
||||
|[Cryptography::Encryption Key::RC4 KSA (C0028.002)](../micro-behaviors/cryptography/encryption-key.md)|Rombertik encrypts data using RC4 KSA. [[2]](#2)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Rombertik encodes data using XOR. [[2]](#2)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Rombertik deletes files. [[2]](#2)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Rombertik reads files on Windows. [[2]](#2)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Rombertik writes files on Windows. [[2]](#2)|
|
||||
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Rombertik allocates RWX memory. [[2]](#2)|
|
||||
|[Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Rombertik deletes registry keys. [[2]](#2)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Rombertik queries or enumerates registry values. [[2]](#2)|
|
||||
|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Rombertik sets registry values. [[2]](#2)|
|
||||
|[Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Rombertik creates a mutex. [[2]](#2)|
|
||||
|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Rombertik creates a thread. [[2]](#2)|
|
||||
|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Rombertik sets thread local storage values. [[2]](#2)|
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
|
||||
@@ -47,8 +47,8 @@ See ATT&CK: [SamSam - Techniques Used](https://attack.mitre.org/software/S0370/)
|
||||
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|SamSam deletes files. [[4]](#4)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|SamSam reads files on Windows. [[4]](#4)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|SamSam deletes files. [[4]](#4)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|SamSam reads files on Windows. [[4]](#4)|
|
||||
|
||||
|
||||
|
||||
|
||||
+14
-14
@@ -62,20 +62,20 @@ See ATT&CK: [Shamoon - Techniques Used](https://attack.mitre.org/software/S0140/
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Conditional Execution::Runs as Service (B0025.007)](../execution/conditional-execution.md)|Shamoon runs as a service. [[5]](#5)|
|
||||
|[Micro-Behaviors::Communication::DNS Communication::Resolve (C0011.001)](../micro-behaviors/communication/dns-communication.md)|Shamoon resolves DNS. [[5]](#5)|
|
||||
|[Micro-Behaviors::Communication::Socket Communication::Initialize Winsock Library (C0001.009)](../micro-behaviors/communication/socket-communication.md)|Shamoon initializes a Winsock library. [[5]](#5)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Shamoon encodes data using XOR. [[5]](#5)|
|
||||
|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Shamoon copies files. [[5]](#5)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Shamoon deletes files. [[5]](#5)|
|
||||
|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Shamoon moves files. [[5]](#5)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Shamoon reads files on Windows. [[5]](#5)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Shamoon writes files on Windows. [[5]](#5)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Shamoon deletes registry values. [[5]](#5)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Shamoon queries or enumerates registry values. [[5]](#5)|
|
||||
|[Micro-Behaviors::Process::Allocate Thread Local Storage (C0040)](../micro-behaviors/process/allocate-thread-local-storage.md)|Shamoon allocates thread local storage. [[5]](#5)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Shamoon creates a process on Windows. [[5]](#5)|
|
||||
|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Shamoon creates a thread. [[5]](#5)|
|
||||
|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Shamoon terminates processes. [[5]](#5)|
|
||||
|[Communication::DNS Communication::Resolve (C0011.001)](../micro-behaviors/communication/dns-communication.md)|Shamoon resolves DNS. [[5]](#5)|
|
||||
|[Communication::Socket Communication::Initialize Winsock Library (C0001.009)](../micro-behaviors/communication/socket-communication.md)|Shamoon initializes a Winsock library. [[5]](#5)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Shamoon encodes data using XOR. [[5]](#5)|
|
||||
|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Shamoon copies files. [[5]](#5)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Shamoon deletes files. [[5]](#5)|
|
||||
|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Shamoon moves files. [[5]](#5)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Shamoon reads files on Windows. [[5]](#5)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Shamoon writes files on Windows. [[5]](#5)|
|
||||
|[Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Shamoon deletes registry values. [[5]](#5)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Shamoon queries or enumerates registry values. [[5]](#5)|
|
||||
|[Process::Allocate Thread Local Storage (C0040)](../micro-behaviors/process/allocate-thread-local-storage.md)|Shamoon allocates thread local storage. [[5]](#5)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Shamoon creates a process on Windows. [[5]](#5)|
|
||||
|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Shamoon creates a thread. [[5]](#5)|
|
||||
|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Shamoon terminates processes. [[5]](#5)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -58,15 +58,15 @@ See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Impact::Destroy Hardware (B0017)](../impact/destroy-hardware.md)|Stuxnet made the centrifuges at Iran's nuclear plant spin dangerously fast for 15 minutes, before returning to normal speed. About a month later, it slowed the centrifuges down for 50 minutes. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)|
|
||||
|[Micro-behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[1]](#1)|
|
||||
|[Micro-behaviors::Process::Create Process::Create Process via WMI (C0017.002)](../micro-behaviors/process/create-process.md)|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)|
|
||||
|[Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[1]](#1)|
|
||||
|[Process::Create Process::Create Process via WMI (C0017.002)](../micro-behaviors/process/create-process.md)|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)|
|
||||
|[Execution::Conditional Execution::Host Fingerprint Check (B0025.004)](../execution/conditional-execution.md)|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Emulator Detection (B0004)](../anti-behavioral-analysis/emulator-detection.md)|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[1]](#1)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Stuxnet encodes data using XOR. [[2]](#2)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Stuxnet encodes data using XOR. [[2]](#2)|
|
||||
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Stuxnet enumerates PE sections. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Stuxnet deletes files. [[2]](#2)|
|
||||
|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Stuxnet allocates RWX memory. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Stuxnet terminates processes. [[2]](#2)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Stuxnet deletes files. [[2]](#2)|
|
||||
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Stuxnet allocates RWX memory. [[2]](#2)|
|
||||
|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Stuxnet terminates processes. [[2]](#2)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -40,8 +40,8 @@ SYNful Knock is a modification of the router's firmware images used to maintain
|
||||
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Micro-behaviors::Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|SYNful Knock modifies the translation lookaside buffer (TLB) Read/Write attributes. [[1]](#1)|
|
||||
|[Micro-behaviors::Communication::Socket Communication::Send TCP Data (C0001.014)](../micro-behaviors/communication/socket-communication.md)|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router. [[1]](#1)|
|
||||
|[Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|SYNful Knock modifies the translation lookaside buffer (TLB) Read/Write attributes. [[1]](#1)|
|
||||
|[Communication::Socket Communication::Send TCP Data (C0001.014)](../micro-behaviors/communication/socket-communication.md)|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router. [[1]](#1)|
|
||||
|[Defense Evasion::Alternative Installation Location::Fileless Malware (B0027.001)](../defense-evasion/alternative-installation-location.md)|100 memory-resident modules can be installed. [[1]](#1)|
|
||||
|
||||
|
||||
|
||||
@@ -57,15 +57,15 @@ See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|The malware receives various commands from the C2 server. [[2]](#2)|
|
||||
|[Micro-behaviors::Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|The malware uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files. [[1]](#1)|
|
||||
|[Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|The malware uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Dynamic Analysis Evasion (B0003.012)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The malware uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering). [[6]](#6)|
|
||||
|[Impact::Spamming (B0039)](../impact/spamming.md)|In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[8]](#8)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|TrickBot encodes data using XOR. [[7]](#7)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|TrickBot encodes data using XOR. [[7]](#7)|
|
||||
|[Discovery::Code Discovery::Inspect Section Memory Permissions (B0046.002)](../discovery/code-discovery.md)|TrickBot inspects section memory permissions. [[7]](#7)|
|
||||
|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|TrickBot allocates RWX memory. [[7]](#7)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|TrickBot creates a process on Windows. [[7]](#7)|
|
||||
|[Micro-Behaviors::Process::Create Process::Create Suspended Process (C0017.003)](../micro-behaviors/process/create-process.md)|TrickBot creates a suspended process. [[7]](#7)|
|
||||
|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|TrickBot terminates processes. [[7]](#7)|
|
||||
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|TrickBot allocates RWX memory. [[7]](#7)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|TrickBot creates a process on Windows. [[7]](#7)|
|
||||
|[Process::Create Process::Create Suspended Process (C0017.003)](../micro-behaviors/process/create-process.md)|TrickBot creates a suspended process. [[7]](#7)|
|
||||
|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|TrickBot terminates processes. [[7]](#7)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
+15
-15
@@ -67,21 +67,21 @@ UP007 is a dropper used in an espionage campaign targeting Hong Kong democracy a
|
||||
|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives payloads. [[1]](#1)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|The malware is a dropper that creates multiple files. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|UP007 checks for a time delay via GetTickCount. [[2]](#2)|
|
||||
|[Micro-Behaviors::Cryptography::Cryptographic Hash::SHA1 (C0029.002)](../micro-behaviors/cryptography/cryptographic-hash.md)|UP007 hashes data using SHA1. [[2]](#2)|
|
||||
|[Micro-Behaviors::Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|UP007 hashes data with CRC32. [[2]](#2)|
|
||||
|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|UP007 encodes data using XOR. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|UP007 creates directories. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|UP007 deletes files. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|UP007 gets file attributes. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|UP007 moves files. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|UP007 reads files on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|UP007 sets file attributes. [[2]](#2)|
|
||||
|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|UP007 writes files on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Environment Variable::Set Variable (C0034.001)](../micro-behaviors/operating-system/environment-variable.md)|UP007 sets environment variables. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|UP007 queries or enumerates registry values. [[2]](#2)|
|
||||
|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|UP007 sets registry values. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|UP007 creates a process on Windows. [[2]](#2)|
|
||||
|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|UP007 terminates processes. [[2]](#2)|
|
||||
|[Cryptography::Cryptographic Hash::SHA1 (C0029.002)](../micro-behaviors/cryptography/cryptographic-hash.md)|UP007 hashes data using SHA1. [[2]](#2)|
|
||||
|[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|UP007 hashes data with CRC32. [[2]](#2)|
|
||||
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|UP007 encodes data using XOR. [[2]](#2)|
|
||||
|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|UP007 creates directories. [[2]](#2)|
|
||||
|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|UP007 deletes files. [[2]](#2)|
|
||||
|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|UP007 gets file attributes. [[2]](#2)|
|
||||
|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|UP007 moves files. [[2]](#2)|
|
||||
|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|UP007 reads files on Windows. [[2]](#2)|
|
||||
|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|UP007 sets file attributes. [[2]](#2)|
|
||||
|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|UP007 writes files on Windows. [[2]](#2)|
|
||||
|[Operating System::Environment Variable::Set Variable (C0034.001)](../micro-behaviors/operating-system/environment-variable.md)|UP007 sets environment variables. [[2]](#2)|
|
||||
|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|UP007 queries or enumerates registry values. [[2]](#2)|
|
||||
|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|UP007 sets registry values. [[2]](#2)|
|
||||
|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|UP007 creates a process on Windows. [[2]](#2)|
|
||||
|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|UP007 terminates processes. [[2]](#2)|
|
||||
|
||||
|
||||
## Indicators of Compromise
|
||||
|
||||
@@ -58,7 +58,7 @@ See ATT&CK: [Ursnif - Techniques Used](https://attack.mitre.org/software/S0386/)
|
||||
|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|Previous interations of Ursnif have used a Domain Name Generation algorithm. [[2]](#2)|
|
||||
|[Command and Control::C2 Communication::Authenticate (B0030.011)](../command-and-control/c2-communication.md)|Ursnif variant Dreambot authenticates and encrypts traffic to the C2 server using TOR. [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::TLS Callbacks (B0001.028)](../anti-behavioral-analysis/debugger-detection.md)|The malware manipulates TLS Callbacks while injecting into a child process. [[3]](#3)|
|
||||
|[Micro-Behaviors::Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|The malware changes the PE header of the child process to enable write access to that page and writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe in the target child process. The region protection is changed back to "read only" to avoid suspicion. [[3]](#3)|
|
||||
|[Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|The malware changes the PE header of the child process to enable write access to that page and writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe in the target child process. The region protection is changed back to "read only" to avoid suspicion. [[3]](#3)|
|
||||
|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|The malware commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download and execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, and upload a log file which contains stolen information. [[5]](#5)|
|
||||
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Ursnif enumerates PE sections. [[6]](#6)|
|
||||
|
||||
|
||||
Reference in New Issue
Block a user