| ID | -X0035 | +X0003 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -35,19 +35,19 @@ See ATT&CK: [CHOPSTICK - Techniques Used](https://attack.mitre.org/software/S002 |Name|Use| |---|---| -|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|CHOPSTICK may encrypt and store configuration data inside a registry key [[1]](#1)| -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|CHOPSTICK collects information from the host including Windows version, CPU architecture, and UAC settings [[1]](#1)| -|[Defense Evasion::Hidden Files and Directories (F0005)](../defense-evasion/hidden-files-and-directories.md)|CHOPSTICK creates a hidden file for temporary storage [[1]](#1)| -|[Collection::Keylogging (F0002)](../collection/keylogging.md)|CHOPSTICK collects user keystrokes [[1]](#1)| -|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)|CHOPSTICK takes snapshots of deskop and window contents [[1]](#1)| -|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|CHOPSTICK sends data to the C2 server using HTTP POST requests [[1]](#1)| +|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|CHOPSTICK may encrypt and store configuration data inside a registry key. [[1]](#1)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|CHOPSTICK collects information from the host including Windows version, CPU architecture, and UAC settings. [[1]](#1)| +|[Defense Evasion::Hidden Files and Directories (F0005)](../defense-evasion/hidden-files-and-directories.md)|CHOPSTICK creates a hidden file for temporary storage. [[1]](#1)| +|[Collection::Keylogging (F0002)](../collection/keylogging.md)|CHOPSTICK collects user keystrokes. [[1]](#1)| +|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)|CHOPSTICK takes snapshots of deskop and window contents. [[1]](#1)| +|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|CHOPSTICK sends data to the C2 server using HTTP POST requests. [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Micro-Objective::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|CHOPSTICK encrypts the configuration block using RC4 encryption [[1]](#1)| +|[Micro-Objective::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|CHOPSTICK encrypts the configuration block using RC4 encryption. [[1]](#1)| ## Indicators of Compromise diff --git a/xample-malware/clipminer.md b/xample-malware/clipminer.md index 475b3c0..c32e3dd 100644 --- a/xample-malware/clipminer.md +++ b/xample-malware/clipminer.md @@ -2,7 +2,7 @@
| ID | -X0038 | +X0004 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -25,32 +25,32 @@ # Clipminer -Malware used for cryptocurrency mining and clipboard hijacking +Malware used for cryptocurrency mining and clipboard hijacking. ## ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::Masquerading (T1036)](https://attack.mitre.org/techniques/T1036/)|Clipminer drops a file masquerading as a Control Panel (CPL) file [[1]](#1)| -|[Persistence::Scheduled Task/Job (T1053)](https://attack.mitre.org/techniques/T1053/)|Clipminer creates scheduled tasks for persistence [[1]](#1)| +|[Defense Evasion::Masquerading (T1036)](https://attack.mitre.org/techniques/T1036/)|Clipminer drops a file masquerading as a Control Panel (CPL) file. [[1]](#1)| +|[Persistence::Scheduled Task/Job (T1053)](https://attack.mitre.org/techniques/T1053/)|Clipminer creates scheduled tasks for persistence. [[1]](#1)| ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|Clipminer edits the registry [[1]](#1)| -|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|Clipminer communicates to a Tor Onion Service via HTTP [[1]](#1)| -|[Collection::Input Capture (E1056)](../collection/input-capture.md)|Clipminer monitors keyboard and mouse activity to determine if the machine is in use [[1]](#1)| -|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Clipminer monitors the clipboard for cryptocurrency addresses and replaces them with ones controlled by the adversary [[1]](#1)| +|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|Clipminer edits the registry. [[1]](#1)| +|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|Clipminer communicates to a Tor Onion Service via HTTP. [[1]](#1)| +|[Collection::Input Capture (E1056)](../collection/input-capture.md)|Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [[1]](#1)| +|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Clipminer monitors the clipboard for cryptocurrency addresses and replaces them with ones controlled by the adversary. [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)| Upon execution, ClipMiner drops a Control Panel file [[1]](#1)| -|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|Clipminer uses sytem resources to mine for cryptocurrency [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)| Upon execution, Clipminer drops a file masquerading as a Control Panel (CPL) file. [[1]](#1)| +|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|Clipminer uses sytem resources to mine for cryptocurrency. [[1]](#1)| ## Indicators of Compromise diff --git a/xample-malware/conficker.md b/xample-malware/conficker.md index def881a..b8f7605 100644 --- a/xample-malware/conficker.md +++ b/xample-malware/conficker.md @@ -2,7 +2,7 @@
| ID | -X0003 | +X0005 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -31,20 +31,21 @@ A worm targeting Microsoft Windows operations systems. |Name|Use| |---|---| -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, the virus saces a copy of its DLL form to a random filename in the Windows system folder, then adds registry keys to have svchost.exe invoke that DLL as an invisible network service [[1]](#1)| -|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Copies itself into the $systemroot%\system32 directory and registers as a service [[1]](#1)| -|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|Terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software [[1]](#1)| -|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|resets system restore points and deletes backup files [[1]](#1)| -|[Anti-Static Analysis::Software Packing::UPX (F0001.008)](../anti-static-analysis/software-packing.md)|Conficker is propagated as a DLL which has been backed using the UPX packer [[2]](#2) | +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, the virus saves a copy of its DLL form to a random filename in the Windows system folder, then adds registry keys to have svchost.exe invoke that DLL as an invisible network service. [[1]](#1)| +|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|The malware copies itself into the $systemroot%\system32 directory and registers as a service. [[1]](#1)| +|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|The malware terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software. [[1]](#1)| +|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|The malware resets system restore points and deletes backup files. [[1]](#1)| +|[Anti-Static Analysis::Software Packing::UPX (F0001.008)](../anti-static-analysis/software-packing.md)|Conficker is propagated as a DLL which has been backed using the UPX packer. [[2]](#2)| + ## MBC Behaviors |Name|Use| |---|---| -|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|Uses a domain name generator seeded by the current date to ensure that every copy of the virus generates the same names on their respective days [[1]](#1)| -|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Conficker A has routine that causes the process to suicide exit if the keyboard language layout is set to Ukranian [[1]](#1)| -|[Micro-Behavior::Memory::Overflow Buffer (C0010)](../micro-behaviors/memory/overflow-buffer.md)|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer [[1]](#1)| -|[Execution::Conditional Execution::Suicide Exit (B0025.001)](../execution/conditional-execution.md)|Conficker B has significantly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts [[2]](#2)| +|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|Conficker uses a domain name generator seeded by the current date to ensure that every copy of the virus generates the same names on their respective days. [[1]](#1)| +|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Conficker A variant has a routine that causes the process to suicide exit if the keyboard language layout is set to Ukranian. [[1]](#1)| +|[Micro-Behaviors::Memory::Overflow Buffer (C0010)](../micro-behaviors/memory/overflow-buffer.md)|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer. [[1]](#1)| +|[Execution::Conditional Execution::Suicide Exit (B0025.001)](../execution/conditional-execution.md)|Conficker B variant has significantly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts. [[2]](#2)| ## Indicators of Compromise diff --git a/xample-malware/cozycar.md b/xample-malware/cozycar.md index 39bcddd..18ed180 100644 --- a/xample-malware/cozycar.md +++ b/xample-malware/cozycar.md @@ -2,7 +2,7 @@
| ID | -X0034 | +X0006 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -35,16 +35,17 @@ See ATT&CK: [CozyCar - Techniques Used](https://attack.mitre.org/software/S0046/ |Name|Use| |---|---| -|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|CozyCar requests a file using SSL to a C2 domain [[1]](#1)| -|[Defense Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary [[1]](#1)| -|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|CozyCar communicates with a C2 server [[1]](#1)| +<<<<<<< HEAD +|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|CozyCar requests a file using SSL to a C2 domain. [[1]](#1)| +|[Defense Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[1]](#1)| +|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|CozyCar communicates with a C2 server. [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)| Upon execution, CozyCar drops a decoy file and a secondary dropper [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)| Upon execution, CozyCar drops a decoy file and a secondary dropper. [[1]](#1)| ## Indicators of Compromise diff --git a/xample-malware/cryptolocker.md b/xample-malware/cryptolocker.md index 29c5e62..b272995 100644 --- a/xample-malware/cryptolocker.md +++ b/xample-malware/cryptolocker.md @@ -1,7 +1,7 @@
| ID | -X0030 | +X0007 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -31,36 +31,39 @@ CryptoLocker is a family of ransomware. [[1]](#1) |Name|Use| |---|---| -|[Initial Access::Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)|The malware is sent to victims as an attachment [[1]](#1) | -|[Command and Control::Encrypted Channel::Asymmetric Cryptography (T1573.002)](https://attack.mitre.org/techniques/T1573/002/)|The malware encrypts messages with a public RSA key [[1]](#1) | -|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses http to communicate with C2 [[1]](#1) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Link many functions at runtime (This capa rule had 1 match) [[2]](#2) | +|[Initial Access::Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)|The malware is sent to victims as an attachment. [[1]](#1)| +|[Command and Control::Encrypted Channel::Asymmetric Cryptography (T1573.002)](https://attack.mitre.org/techniques/T1573/002/)|The malware encrypts messages with a public RSA key. [[1]](#1)| +|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses http to communicate with C2. [[1]](#1)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|The malware links many functions at runtime. [[2]](#2)| + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Impact::Data Encrypted for Impact::Ransom Note (E1486.001)](../impact/data-encrypted-for-impact.md)|The malware launches Internet Explorer to show ransom notes [[1]](#1) | -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware creates an "autorun" registry key [[1]](#1) | -|[Execution::User Execution (E1204)](../execution/user-execution.md)|The malware relies on victims to execute [[1]](#1) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware searches for user files before encrypting them [[1]](#1) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 1 match) [[2]](#2) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Query environment variable (This capa rule had 1 match) [[2]](#2) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Accept command line arguments (This capa rule had 2 matches) [[2]](#2) | +|[Impact::Data Encrypted for Impact::Ransom Note (E1486.001)](../impact/data-encrypted-for-impact.md)|The malware launches Internet Explorer to show ransom notes. [[1]](#1)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware creates an "autorun" registry key. [[1]](#1)| +|[Execution::User Execution (E1204)](../execution/user-execution.md)|The malware relies on victims to execute. [[1]](#1)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware searches for user files before encrypting them. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|CryptoLocker encodes data using XOR. [[2]](#2)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|CryptoLocker queries environment variables. [[2]](#2)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|CryptoLocker accepts command line arguments. [[2]](#2)| + ## MBC Behaviors |Name|Use| |---|---| -|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a hash value generated from system information [[1]](#1) | -|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives a public key from the C2 [[1]](#1) | -|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|The malware uses an internal domain generation algorithm [[1]](#1) | -|[Command and Control::C2 Communication::Authenticate (B0030.011)](../command-and-control/c2-communication.md)|The malware sends a phone-home message with encryption to start [[1]](#1) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 1 match) [[2]](#2) | -|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[2]](#2) | -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Writes Fileon Windows (This capa rule had 1 match) [[2]](#2) | -|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Allocate RWX memory (This capa rule had 1 match) [[2]](#2) | -|[Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|Resume thread (This capa rule had 1 match) [[2]](#2) | +|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a hash value generated from system information. [[1]](#1)| +|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives a public key from the C2. [[1]](#1)| +|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|The malware uses an internal domain generation algorithm. [[1]](#1)| +|[Command and Control::C2 Communication::Authenticate (B0030.011)](../command-and-control/c2-communication.md)|The malware sends a phone-home message with encryption to start. [[1]](#1)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|CryptoLocker encodes data using XOR. [[2]](#2)| +|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|CryptoLocker enumerates PE sections. [[2]](#2)| +|[Micro-Behaviors::File System::Writes File (C0052)](../micro-behaviors/file-system/writes-file.md)|CryptoLocker writes Fileon Windows. [[2]](#2)| +|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|CryptoLocker allocates RWX memory. [[2]](#2)| +|[Micro-Behaviors::Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|CryptoLocker resumes thread. [[2]](#2)| + ## Indicators of Compromise diff --git a/xample-malware/cryptowall.md b/xample-malware/cryptowall.md index f8e175e..ce38db5 100644 --- a/xample-malware/cryptowall.md +++ b/xample-malware/cryptowall.md @@ -2,7 +2,7 @@
| ID | -X0029 | +X0008 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -32,24 +32,28 @@ CryptoWall is a family of ransomware. [[1]](#1) |Name|Use| |---|---| -|[Initial Access::Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)| The malware file is sent as an attachment [[1]](#1)| -|[Impact::Inhibit System Recovery (T1490)](https://attack.mitre.org/techniques/T1490/)|The malware deletes volume shadow copies using vssadmin.exe [[1]](#1)| -|[Command and Control::Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|The malware tries to connect to I2P proxies [[1]](#1)| +|[Initial Access::Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)| The malware file is sent as an attachment. [[1]](#1)| +|[Impact::Inhibit System Recovery (T1490)](https://attack.mitre.org/techniques/T1490/)|The malware deletes volume shadow copies using vssadmin.exe. [[1]](#1)| +|[Command and Control::Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|The malware tries to connect to I2P proxies. [[1]](#1)| +|[Impact::Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/)|The malware encrypts files. [[1]](#1)| +|[Command and Control::Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|The malware tries to connect to I2P proxies. [[1]](#1)| + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Impact::Data Encrypted for Impact::Ransom Note (E1486.001)](../impact/data-encrypted-for-impact.md)|The malware launches Internet Explorer to show ransom notes [[1]](#1)| -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware searches for user files before encrypting them [[1]](#1)| -|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects code into a new svchost process [[1]](#1)| +|[Impact::Data Encrypted for Impact::Ransom Note (E1486.001)](../impact/data-encrypted-for-impact.md)|The malware launches Internet Explorer to show ransom notes. [[1]](#1)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware searches for user files before encrypting them. [[1]](#1)| +|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects code into a new svchost process. [[1]](#1)| + ## MBC Behaviors |Name|Use| |---|---| -|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a hash value generated from system information [[1]](#1)| -|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives a public key from the C2 [[1]](#1)| +|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a hash value generated from system information. [[1]](#1)| +|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives a public key from the C2. [[1]](#1)| ## Indicators of Compromise diff --git a/xample-malware/dark-comet.md b/xample-malware/dark-comet.md index af20fc2..a19f535 100644 --- a/xample-malware/dark-comet.md +++ b/xample-malware/dark-comet.md @@ -1,7 +1,7 @@
| ID | -X0004 | +X0009 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -30,14 +30,14 @@ A Remote Access Trojan (RAT) that allows a user to control the system via a GUI. |Name|Use| |---|---| -|[Collection::Clipboard Data (T1115)](https://attack.mitre.org/techniques/T1115)|Read clipboard data (This capa rule had 8 matches) [[4]](#4) | -|[Defense Evasion::Hide Artifacts::Hidden Window (T1564.003)](https://attack.mitre.org/techniques/T1564/003)|Hide graphical window (This capa rule had 8 matches) [[4]](#4) | -|[Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks (T1497.002)](https://attack.mitre.org/techniques/T1497/002)|Check for unmoving mouse cursor (This capa rule had 1 match) [[4]](#4) | -|[Discovery::Application Window Discovery (T1010)](https://attack.mitre.org/techniques/T1010)|Enumerate gui resources (This capa rule had 3 matches) [[4]](#4) | -|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057)|Get process heap force flags (This capa rule had 1 match) [[4]](#4) | -|[Discovery::System Location Discovery (T1614)](https://attack.mitre.org/techniques/T1614)|Get geographical location (This capa rule had 5 matches) [[4]](#4) | -|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Get keyboard layout (This capa rule had 4 matches) [[4]](#4) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Parse PE header (This capa rule had 1 match) [[4]](#4) | +|[Collection::Clipboard Data (T1115)](https://attack.mitre.org/techniques/T1115)|The malware reads clipboard data. [[4]](#4)| +|[Defense Evasion::Hide Artifacts::Hidden Window (T1564.003)](https://attack.mitre.org/techniques/T1564/003)|The malware hides a graphical window. [[4]](#4)| +|[Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks (T1497.002)](https://attack.mitre.org/techniques/T1497/002)|The malware checks for an unmoving mouse cursor. [[4]](#4)| +|[Discovery::Application Window Discovery (T1010)](https://attack.mitre.org/techniques/T1010)|The malware enumerates GUI resources. [[4]](#4)| +|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057)|The malware gets process heap force flags. [[4]](#4)| +|[Discovery::System Location Discovery (T1614)](https://attack.mitre.org/techniques/T1614)|The malware gets the geographical location. [[4]](#4)| +|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|The malware gets the keyboard layout. [[4]](#4)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|The malware parses PE headers. [[4]](#4)| See ATT&CK: [Dark Comet - Techniques Used](https://attack.mitre.org/software/S0334/). @@ -45,48 +45,51 @@ See ATT&CK: [Dark Comet - Techniques Used](https://attack.mitre.org/software/S03 |Name|Use| |---|---| -|[Collection::Keylogging (F0002)](../collection/keylogging.md)|DarkComet can capture keystrokes [[2]](#2) | -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Adds several registry entries to enable automatic execution at startup [[2]](#2) | -|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|Can disable security center functions like anti-virus and firewall [[2]](#2) | -|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|Can download files from remote repository upon instruction [[2]](#2) | -|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)|Has the option to compress its payload using UPX or MPRESS [[2]](#2) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Can collect information about the computer, resources, and operating system version [[2]](#2) Get disk size (This capa rule had 1 match) [[4]](#4)| -|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Log keystrokes via polling (This capa rule had 10 matches) [[4]](#4) | -|[Collection::Screen Capture::WinAPI (E1113.m01)](../collection/screen-capture.md)|Capture screenshot (This capa rule had 1 match) [[4]](#4) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 13 matches) [[4]](#4) | -|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|Get graphical window text (This capa rule had 2 matches) [[4]](#4) | -|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (This capa rule had 4 matches) [[4]](#4) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Get file version info (This capa rule had 1 match) [[4]](#4) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Accept command line arguments (This capa rule had 2 matches) [[4]](#4) | +|[Collection::Keylogging (F0002)](../collection/keylogging.md)|DarkComet can capture keystrokes. [[2]](#2)| +|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|DarkComet logs keystrokes via polling. [[4]](#4)| +|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)|DarkComet can take screenshots of victim's computer. [[2]](#2)| +|[Collection::Screen Capture::WinAPI (E1113.m01)](../collection/screen-capture.md)|DarkComet captures screenshots. [[4]](#4)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|DarkComet adds several registry entries to enable automatic execution at startup. [[2]](#2)| +|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|DarkComet can disable security center functions like anti-virus and firewall. [[2]](#2)| +|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|DarkComet can download files from remote repository upon instruction. [[2]](#2)| +|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)|DarkComet has the option to compress its payload using UPX or MPRESS. [[2]](#2)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|DarkComet can collect information about the computer, resources, and operating system version and get disk size. [[2]](#2) [[4]](#4)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|DarkComet encodes data using XOR. [[4]](#4)| +|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|DarkComet gets graphical window text. [[4]](#4)| +|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|DarkComet writes clipboard data. [[4]](#4)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|DarkComet gets file version info. [[4]](#4)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|DarkComet accepts command line arguments. [[4]](#4)| + ## MBC Behaviors |Name|Use| |---|---| -|[Impact::Remote Access (B0022)](../impact/remote-access.md)|Allows an attacker to control the system via a GUI [[1]](#1) | -|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|Check for time delay via GetTickCount (This capa rule had 4 matches) [[4]](#4) | -|[Anti-Behavioral Analysis::Virtual Machine Detection::Human User Check (B0009.012)](../anti-behavioral-analysis/virtual-machine-detection.md)|Check for unmoving mouse cursor (This capa rule had 1 match) [[4]](#4) | -|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Encrypt data using RC4 PRGA (This capa rule had 3 matches) [[4]](#4) | -|[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Hash data with CRC32 (This capa rule had 5 matches) [[4]](#4) | -|[Data::Compression Library (C0060)](../micro-behaviors/data/compression-library.md)|Linked against ZLIB (This capa rule had 1 match) [[4]](#4) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 13 matches) [[4]](#4) | -|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 3 matches) [[4]](#4) | -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Contain an embedded PE file (This capa rule had 1 match) [[4]](#4) | -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 1 match) [[4]](#4) | -|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Get file attributes (This capa rule had 2 matches) [[4]](#4) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 7 matches) [[4]](#4) | -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Writes Fileon Windows (This capa rule had 5 matches) [[4]](#4) | -|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Allocate RWX memory (This capa rule had 1 match) [[4]](#4) | -|[Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Delete registry key (This capa rule had 1 match) [[4]](#4) | -|[Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Delete registry value (This capa rule had 1 match) [[4]](#4) | -|[Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry key (This capa rule had 3 matches) [[4]](#4) | -|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry value (This capa rule had 6 matches) [[4]](#4) | -|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Set registry value (This capa rule had 1 match) [[4]](#4) | -|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Create process on Windows (This capa rule had 6 matches) [[4]](#4) | -|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Create thread (This capa rule had 3 matches) [[4]](#4) | -|[Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|Resume thread (This capa rule had 2 matches) [[4]](#4) | -|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Set thread local storage value (This capa rule had 1 match) [[4]](#4) | -|[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|Suspend thread (This capa rule had 1 match) [[4]](#4) | +|[Impact::Remote Access (B0022)](../impact/remote-access.md)|DarkComet allows an attacker to control the system via a GUI. [[1]](#1)| +|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|DarkComet checks for a time delay via GetTickCount. [[4]](#4)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Human User Check (B0009.012)](../anti-behavioral-analysis/virtual-machine-detection.md)|DarkComet checks for an unmoving mouse cursor. [[4]](#4)| +|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|DarkComet encrypts data using RC4 PRGA. [[4]](#4)| +|[Micro-Behaviors::Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|DarkComet hashes data with CRC32. [[4]](#4)| +|[Micro-Behaviors::Data::Compression Library (C0060)](../micro-behaviors/data/compression-library.md)|DarkComet linked against ZLIB. [[4]](#4)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|DarkComet encodes data using XOR. [[4]](#4)| +|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|DarkComet enumerates PE sections. [[4]](#4)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|DarkComet contains an embedded PE file. [[4]](#4)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|DarkComet deletes files. [[4]](#4)| +|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|DarkComet gets file attributes. [[4]](#4)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|DarkComet reads files on Windows. [[4]](#4)| +|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|DarkComet writes Fileon Windows. [[4]](#4)| +|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|DarkComet allocates RWX memory. [[4]](#4)| +|[Micro-Behaviors::Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|DarkComet deletes registry keys. [[4]](#4)| +|[Micro-Behaviors::Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|DarkComet deletes registry values. [[4]](#4)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|DarkComet queries or enumerates registry keys. [[4]](#4)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|DarkComet queries or enumerates registry values. [[4]](#4)| +|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|DarkComet sets registry values. [[4]](#4)| +|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|DarkComet creates a process on Windows. [[4]](#4)| +|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|DarkComet creates a thread. [[4]](#4)| +|[Micro-Behaviors::Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|DarkComet resumes a thread. [[4]](#4)| +|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|DarkComet set thread local storage values. [[4]](#4)| +|[Micro-Behaviors::Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|DarkComet suspends threads. [[4]](#4)| + ## Indicators of Compromise @@ -103,4 +106,3 @@ SHA256 Hashes [3] https://bazaar.abuse.ch/browse/signature/DarkComet/ [4] capa v4.0, analyzed at MITRE on 10/12/2022 - diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md index fb4b4e7..d330c1a 100644 --- a/xample-malware/dnschanger.md +++ b/xample-malware/dnschanger.md @@ -1,7 +1,7 @@
| ID | -X0005 | +X0010 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -24,37 +24,38 @@ # DNSChanger -Used to change DNS settings to generate fraudulent advertising revenue. +DNSChanger is used to change DNS settings to generate fraudulent advertising revenue. ## ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[3]](#3) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[3]](#3) | +|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|DNSChanger sets file attributes. [[3]](#3)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|DNSChanger accesses PE headers. [[3]](#3)| ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Impact::Generate Traffic from Victim::Advertisement Replacement Fraud (E1643)](../impact/generate-traffic-from-victim.md)|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1) | -|[Defense Evasion::Disable or Evade Security Tools (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|Prevents the infected system from installing anti-virus software updates. [[1]](#1) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 1 match) [[3]](#3) | -|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Attach user process memory (This capa rule had 1 match) [[3]](#3) | +|[Impact::Generate Traffic from Victim::Advertisement Replacement Fraud (E1643.m02)](../impact/generate-traffic-from-victim.md)|The malware alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)| +|[Defense Evasion::Disable or Evade Security Tools (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|DNSChanger prevents the infected system from installing anti-virus software updates. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|DNSChanger encodes data using XOR. [[3]](#3)| +|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|DNSChanger attaches user process memory. [[3]](#3)| ## MBC Behaviors |Name|Use| |---|---| -|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Encrypt data using RC4 PRGA (This capa rule had 1 match) [[3]](#3) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 1 match) [[3]](#3) | -|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Get file attributes (This capa rule had 1 match) [[3]](#3) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 3 matches) [[3]](#3) | -|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Set file attributes (This capa rule had 1 match) [[3]](#3) | -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Writes Fileon Windows (This capa rule had 2 matches) [[3]](#3) | -|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Allocate RWX memory (This capa rule had 2 matches) [[3]](#3) | -|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry value (This capa rule had 1 match) [[3]](#3) | -|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Set registry value (This capa rule had 2 matches) [[3]](#3) | +|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|DNSChanger encrypts data using RC4 PRGA. [[3]](#3)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|DNSChanger encodes data using XOR. [[3]](#3)| +|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|DNSChanger gets file attributes. [[3]](#3)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|DNSChanger reads files on Windows. [[3]](#3)| +|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|DNSChanger sets file attributes. [[3]](#3)| +|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|DNSChanger writes Fileon Windows. [[3]](#3)| +|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|DNSChanger allocates RWX memory. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|DNSChanger queries or enumerates registry values. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|DNSChanger sets registry keys. [[3]](#3)| + ## Indicators of Compromise @@ -69,4 +70,3 @@ SHA256 Hashes [2] https://www.joesandbox.com/analysis/258032/0/html [3] capa v4.0, analyzed at MITRE on 10/12/2022 - diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md index f679a57..98279aa 100644 --- a/xample-malware/emotet.md +++ b/xample-malware/emotet.md @@ -1,7 +1,7 @@
| ID | -X0028 | +X0011 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -30,30 +30,32 @@ Emotet is a banking trojan. [[1]](#1) |Name|Use| |---|---| -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Parse pe header (this capa rule had 1 match) [[6]](#6) | +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Emotet parses PE headers. [[6]](#6)| ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2) | -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1) | -|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6) | +|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders, and then the loaders decrypt and load Emotet's main payloads. [[2]](#2)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Emotet collects information related to OS, processes, and sometimes mail client information and sends it to C2. [[2]](#2)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [[1]](#1)| +|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Emotet writes clipboard data. [[6]](#6)| + ## MBC Behaviors |Name|Use| |---|---| -|[Anti-Static Analysis::Executable Code Obfuscation::Junk Code Insertion (B0032.007)](../anti-static-analysis/executable-code-obfuscation.md)|Emotet macros are heavily obfuscated with junk functions and string substitutions [[1]](#1) | -|[Micro-objective::Cryptography::Encrypt Data::RSA (C0027.011)](../micro-behaviors/cryptography/encrypt-data.md)|Emotet uses rsa to encrypt network traffic to its c2 [[2]](#2) | -|[Discovery::Analysis Tool Discovery::Process detection - Debuggers (B0013.002)](../discovery/analysis-tool-discovery.md)|If it recieves a response from the c2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the shellexecutew function and exits [[3]](#3) | -|[Anti-Behavioral Analysis::Virtual Machine Detection::Guest Process Testing (B0009.010)](../anti-behavioral-analysis/virtual-machine-detection.md)|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names [[4]](#4) | -|[Command and Control::C2 Communication::Request Email Address List (B0030.010)](../command-and-control/c2-communication.md)| new email addresses are collected automatically from the victim's address books [[4]](#4) | -|[Execution::Send Email (B0020)](../execution/send-email.md)|Spam email with the emotet loader is sent automatically [[4]](#4) | -|[Communication::HTTP Communication::Create Request (C0002.012)](../micro-behaviors/communication/http-communication.md)|Create http request (this capa rule had 1 match) [[6]](#6) | -|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Encrypt data using rc4 prga (this capa rule had 4 matches) [[6]](#6) | -|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate pe sections (this capa rule had 1 match) [[6]](#6) | +|[Anti-Static Analysis::Executable Code Obfuscation::Junk Code Insertion (B0032.007)](../anti-static-analysis/executable-code-obfuscation.md)|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[1]](#1)| +|[Micro-behaviors::Cryptography::Encrypt Data::RSA (C0027.011)](../micro-behaviors/cryptography/encrypt-data.md)|Emotet uses RSA to encrypt network traffic to its C2. [[2]](#2)| +|[Discovery::Analysis Tool Discovery::Process detection - Debuggers (B0013.002)](../discovery/analysis-tool-discovery.md)|If it receives a response from the C2 server stating a debugging-related tool is in the list of running processes, it receives an "upgrade" command which calls the ShellExecuteW function and exits. [[3]](#3)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Guest Process Testing (B0009.010)](../anti-behavioral-analysis/virtual-machine-detection.md)|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names. [[4]](#4)| +|[Command and Control::C2 Communication::Request Email Address List (B0030.010)](../command-and-control/c2-communication.md)|New email addresses are collected automatically from the victim's address books. [[4]](#4)| +|[Execution::Send Email (B0020)](../execution/send-email.md)|Spam email with the Emotet loader is sent automatically. [[4]](#4)| +|[Micro-Behaviors::Communication::HTTP Communication::Create Request (C0002.012)](../micro-behaviors/communication/http-communication.md)|Emotet creates a HTTP request. [[6]](#6)| +|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Emotet encrypts data using RC4 PRGA. [[6]](#6)| +|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Emotet enumerates PE sections. [[6]](#6)| + ## Indicators of Compromise diff --git a/xample-malware/evilbunny.md b/xample-malware/evilbunny.md index 0f5d32f..c05df9d 100644 --- a/xample-malware/evilbunny.md +++ b/xample-malware/evilbunny.md @@ -2,7 +2,7 @@
| ID | -X0036 | +X0012 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -25,7 +25,7 @@ # EvilBunny -C++ malware designed to be an execution platform for Lua scripts +The malware is written in C++ and designed to be an execution platform for Lua scripts. ## ATT&CK Techniques @@ -35,15 +35,15 @@ See ATT&CK: [EvilBunny - Techniques Used](https://attack.mitre.org/software/S039 |Name|Use| |---|---| -|[Execution::Command and Scripting Interpreter (E1049)](../execution/command-and-scripting-interpreter.md)|EvilBunny executes Lua scripts [[1]](#1)| -|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|EvilBunny communicates C2 via HTTP [[1]](#1)| +|[Execution::Command and Scripting Interpreter (E1049)](../execution/command-and-scripting-interpreter.md)|EvilBunny executes Lua scripts. [[1]](#1)| +|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|EvilBunny communicates C2 via HTTP. [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|EvilBunny hooks time retrieval APIs and calls each API twice to calculate a delta. Execution aborts depending on the delta value [[1]](#1)| -|[Defense Evasion::Polymorphic Code (B0029)](../defense-evasion/polymorphic-code.md)|EvilBunny utilizes Lua scripts to exhibit polymorphism [[1]](#1)| +|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|EvilBunny hooks time retrieval APIs and calls each API twice to calculate a delta. Execution aborts depending on the delta value. [[1]](#1)| +|[Defense Evasion::Polymorphic Code (B0029)](../defense-evasion/polymorphic-code.md)|EvilBunny utilizes Lua scripts to exhibit polymorphism. [[1]](#1)| ## Indicators of Compromise diff --git a/xample-malware/gamut.md b/xample-malware/gamut.md index a9e9507..5ff5282 100644 --- a/xample-malware/gamut.md +++ b/xample-malware/gamut.md @@ -1,7 +1,7 @@
| ID | -X0006 | +X0013 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -24,58 +24,61 @@ # Gamut -A spamming botnet. +Gamut is a spamming botnet. ## ATT&CK Techniques |Name|Use| |---|---| +|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP for command and control. [[1]](#1)| +|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Gamut sets file attributes. [[3]](#3)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Gamut links functions at runtime on Windows. [[3]](#3)| -|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP for command and control [[1]](#1) | -|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 2 matches) [[3]](#3) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Link function at runtime on Windows (This capa rule had 1 match) [[3]](#3) | ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds a registry key [[1]](#1) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 1 match) [[3]](#3) | -|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|Get graphical window text (This capa rule had 1 match) [[3]](#3) | -|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|The malware receives files from C2 [[1]](#1) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Get common file path (This capa rule had 5 matches) [[3]](#3) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Query environment variable (This capa rule had 1 match) [[3]](#3) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Accept command line arguments (This capa rule had 1 match) [[3]](#3) | +|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds a registry key. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Gamut encodes data using XOR. [[3]](#3)| +|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|Gamut gets a graphical window text. [[3]](#3)| +|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|The malware receives files from C2. [[1]](#1)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Gamut gets common file paths. [[3]](#3)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Gamut queries environment variables. [[3]](#3)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Gamut accepts command line arguments. [[3]](#3)| + ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Send Email (B0020)](../execution/send-email.md)|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1) | -|[Anti-Behavioral-Analysis::Debugger Detection::Interruption (B0001.006)](../anti-behavioral-analysis/debugger-detection.md)|The malware detects debuggers using an INT 03h trap [[1]](#1) | -|[Anti-Behavioral-Analysis::Debugger Detection::IsDebuggerPresent (B0001.008)](../anti-behavioral-analysis/debugger-detection.md)|The malware detects debuggers using IsDebuggerPresent [[1]](#1) | -|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives data from C2 [[1]](#1) | -|[Impact::Spamming (B0039)](../impact/spamming.md)|If port 25 is open, the bot uses a spam template and email list to send spam. [[1]](#1) | -|[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Hash data with CRC32 (This capa rule had 1 match) [[3]](#3) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 1 match) [[3]](#3) | +|[Execution::Send Email (B0020)](../execution/send-email.md)|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)| +|[Anti-Behavioral-Analysis::Debugger Detection::Interruption (B0001.006)](../anti-behavioral-analysis/debugger-detection.md)|The malware detects debuggers using an INT 03h trap. [[1]](#1)| +|[Anti-Behavioral-Analysis::Debugger Detection::IsDebuggerPresent (B0001.008)](../anti-behavioral-analysis/debugger-detection.md)|The malware detects debuggers using IsDebuggerPresent. [[1]](#1)| +|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives data from C2. [[1]](#1)| +|[Command and Control::C2 Communication::Server to Client File Transfer (B0030.003)](../command-and-control/c2-communication.md)|The malware receives files from C2. [[1]](#1)| +|[Impact::Spamming (B0039)](../impact/spamming.md)|If port 25 is open, the bot uses a spam template and email list to send spam. [[1]](#1)| +|[Micro-Behaviors::Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Gamut hashes data with CRC32. [[3]](#3)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Gamut encodes data using XOR. [[3]](#3)| |[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[3]](#3) | -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Contain an embedded PE file (This capa rule had 1 match) [[3]](#3) | -|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Create directory (This capa rule had 1 match) [[3]](#3) | -|[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Delete directory (This capa rule had 1 match) [[3]](#3) | -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 4 matches) [[3]](#3) | -|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Get file attributes (This capa rule had 10 matches) [[3]](#3) | -|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Move file (This capa rule had 1 match) [[3]](#3) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 2 matches) [[3]](#3) | -|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Set file attributes (This capa rule had 2 matches) [[3]](#3) | -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Writes file on Windows (This capa rule had 3 matches) [[3]](#3) | -|[Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Delete registry key (This capa rule had 3 matches) [[3]](#3) | -|[Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Delete registry value (This capa rule had 1 match) [[3]](#3) | -|[Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry key (This capa rule had 1 match) [[3]](#3) | -|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry value (This capa rule had 2 matches) [[3]](#3) | -|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Set registry value (This capa rule had 3 matches) [[3]](#3) | -|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Create process on Windows (This capa rule had 4 matches) [[3]](#3) | -|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Set thread local storage value (This capa rule had 1 match) [[3]](#3) | +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Gamut contains an embedded PE file. [[3]](#3)| +|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Gamut creates directories. [[3]](#3)| +|[Micro-Behaviors::File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Gamut deletes directories. [[3]](#3)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Gamut deletes file. [[3]](#3)| +|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Gamut gets file attributes. [[3]](#3)| +|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Gamut moves files. [[3]](#3)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Gamut reads files on Windows. [[3]](#3)| +|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Gamut sets file attributes. [[3]](#3)| +|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Gamut writes files on Windows. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Gamut deletes registry keys. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Gamut deletes registry values. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|Gamut queries or enumerates registry keys. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Gamut queries or enumerates registry values. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Gamut sets registry values. [[3]](#3)| +|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Gamut creates processes on Windows. [[3]](#3)| +|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Gamut sets thread local storage values. [[3]](#3)| + ## Indicators of Compromise diff --git a/xample-malware/geneio.md b/xample-malware/geneio.md index 449041a..f02ab17 100644 --- a/xample-malware/geneio.md +++ b/xample-malware/geneio.md @@ -2,7 +2,7 @@
| ID | -X0007 | +X0014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -41,20 +41,21 @@ Next, the program changes the default search engine and homepage to the domain * The program then installs the browser extension *~/Library/Safari/Extensions/Omnibar.safariextz*. -When the user inputs a search query it will appear to be carried out using Google Search but the results will be from *genieo.com*. +When the user inputs a search query, it will appear to be carried out using Google Search, but the results will be from *genieo.com*. ## ATT&CK Techniques |Name|Use| |---|---| -|[Persistence::Browser Extensions (T1176)](https://attack.mitre.org/techniques/T1176/)|Geneio installs Safari Extensions that are adware [[1]](#1)| +|[Persistence::Browser Extensions (T1176)](https://attack.mitre.org/techniques/T1176/)|Geneio installs Safari Extensions that are adware. [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Geneio installs the browser extension ~/Library/Safari/Extensions/Omnibar.safariextz. It also creates app files. [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Malware tricks OS X keychain to create application files. Geneio installs the browser extension ~/Library/Safari/Extensions/Omnibar.safariextz. It also creates the app files listed in the description above. [[1]](#1)| + ## Indicators of Compromise diff --git a/xample-malware/gobotkr.md b/xample-malware/gobotkr.md index b603026..8a7bbc2 100644 --- a/xample-malware/gobotkr.md +++ b/xample-malware/gobotkr.md @@ -1,7 +1,7 @@
| ID | -X0027 | +X0015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -24,7 +24,7 @@ # GoBotKR -Modified version of a publicly available backdoor name GoBot2. Modifications are mainly evasion techniques specific to South Korea. [[1]](#1) +GoBotKR is a modified version of a publicly available backdoor, GoBot2. The modifications to GoBot2 are mainly evasion techniques specific to South Korea. [[1]](#1) From [[1]](#1), “The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system.” @@ -33,56 +33,60 @@ From [[1]](#1), “The malware installs two instances of itself on the system. T |Name|Use| |---|---| -|[Initial Access::Drive-by Compromise (T1189)](https://attack.mitre.org/techniques/T1189/)|GoBotKR has been distributed through torrent file-sharing websites to South Korean victims, using games or Korean movie/TV series as a lure. [[1]](#1) | -|[Persistence::Scheduled Task (T1053)](https://attack.mitre.org/techniques/T1053/)|GoBotKR schedules a task that adds a registry run key to establish malware persistence. [[1]](#1) | -|[Privilege Escalation::Abuse Elevation Control Mechanism::Bypass User Account Control (T1548.002)](https://attack.mitre.org/techniques/T1548/002/)|GoBotKR attempts to bypass UAC using Registry Hijacking. [[1]](#1) | -|[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)|GoBotKR has used base64 to obfuscate strings, commands and files. [[1]](#1) | -|[Defense Evasion::Indicator Removal (T1070)](https://attack.mitre.org/techniques/T1070/)|GoBotKR removes the Zone identifier from the ADS (Alternate Data Streams) of the file, to conceal the fact the file has been downloaded from the internet. [[1]](#1) | -|[Defense Evasion::Masquerading (T1036)](https://attack.mitre.org/techniques/T1036/)| GoBotKR uses filenames and registry key names associated with legitimate software. [[1]](#1) | -|[Discovery::Software Discovery::Security Software Discovery (T1518.001)](https://attack.mitre.org/techniques/T1518/001/)|GoBotKR checks for processes associated with security products and debugging tools, and terminates itself if any are detected. It can enumerate installed antivirus software using the wmic command. [[1]](#1) | -|[Discovery::System Network Configuration Discovery (T1016)](https://attack.mitre.org/techniques/T1016/)|GoBotKR uses netsh and ipconfig to collect information about the network configuration. It has used Naver and Daum portals to obtain the client IP address. [[1]](#1) | -|[Discovery::System Owner/User Discovery (T1033)](https://attack.mitre.org/techniques/T1033/)|GoBotKR uses whoami to obtain information about the victimized user. It runs tests to determine the privilege level of the compromised user. [[1]](#1) | -|[Discovery::System Time Discovery (T1124)](https://attack.mitre.org/techniques/T1124/)| GoBotKR can obtain the date and time of the compromised system. [[1]](#1) | -|[Lateral Movement::Ingress Tool Transfer (T1105)](https://attack.mitre.org/techniques/T1105/)| GoBotKR attempts to copy itself into public folders of cloud storage services (Google Drive, Dropbox, OneDrive). [[1]](#1) | -|[Lateral Movement::Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/)|GoBotKR can drop itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system. [[1]](#1) | -|[Command and Control::Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|GoBotKR can be used as a proxy server. [[1]](#1) | -|[Command and Control::Data Encoding (T1132)](https://attack.mitre.org/techniques/T1132/)|The communication with the C&C server is base64 encoded. [[1]](#1) | -|[Command and Control::Application Layer Protocol (T1071)](https://attack.mitre.org/techniques/T1071/)|GoBotKR uses HTTP or HTTPS for C&C. [[1]](#1) | -|[Command and Control::Non-Standard Port (T1571)](https://attack.mitre.org/techniques/T1571/)|GoBotKR uses non-standard ports, such as 6446, 6556 and 7777, for C&C. [[1]](#1) | +|[Initial Access::Drive-by Compromise (T1189)](https://attack.mitre.org/techniques/T1189/)|GoBotKR has been distributed through torrent file-sharing websites to South Korean victims, using games or Korean movie/TV series as a lure. [[1]](#1)| +|[Persistence::Scheduled Task (T1053)](https://attack.mitre.org/techniques/T1053/)|GoBotKR schedules a task that adds a registry run key to establish malware persistence. [[1]](#1)| +|[Privilege Escalation::Abuse Elevation Control Mechanism::Bypass User Account Control (T1548.002)](https://attack.mitre.org/techniques/T1548/002/)|GoBotKR attempts to bypass UAC using Registry Hijacking. [[1]](#1)| +|[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)|GoBotKR has used base64 to obfuscate strings, commands and files. [[1]](#1)| +|[Defense Evasion::Indicator Removal (T1070)](https://attack.mitre.org/techniques/T1070/)|GoBotKR removes the Zone identifier from the ADS (Alternate Data Streams) of the file, to conceal the fact the file has been downloaded from the internet. [[1]](#1)| +|[Defense Evasion::Masquerading (T1036)](https://attack.mitre.org/techniques/T1036/)|GoBotKR uses filenames and registry key names associated with legitimate software. [[1]](#1)| +|[Discovery::Software Discovery::Security Software Discovery (T1518.001)](https://attack.mitre.org/techniques/T1518/001/)|GoBotKR checks for processes associated with security products and debugging tools, and terminates itself if any are detected. It can enumerate installed antivirus software using the wmic command. [[1]](#1)| +|[Discovery::System Information Discovery (T1082)](https://attack.mitre.org/techniques/T1082/)|GoBotKR uses wmic, systeminfo and ver commands to collect information about the system and the installed software. [[1]](#1)| +|[Discovery::System Network Configuration Discovery (T1016)](https://attack.mitre.org/techniques/T1016/)|GoBotKR uses netsh and ipconfig to collect information about the network configuration. It has used Naver and Daum portals to obtain the client IP address. [[1]](#1)| +|[Discovery::System Owner/User Discovery (T1033)](https://attack.mitre.org/techniques/T1033/)|GoBotKR uses whoami to obtain information about the victimized user. It runs tests to determine the privilege level of the compromised user. [[1]](#1)| +|[Discovery::System Time Discovery (T1124)](https://attack.mitre.org/techniques/T1124/)|GoBotKR can obtain the date and time of the compromised system. [[1]](#1)| +|[Lateral Movement::Ingress Tool Transfer (T1105)](https://attack.mitre.org/techniques/T1105/)| GoBotKR attempts to copy itself into public folders of cloud storage services (Google Drive, Dropbox, OneDrive). [[1]](#1)| +|[Lateral Movement::Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/)|GoBotKR can drop itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system. [[1]](#1)| +|[Command and Control::Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|GoBotKR can be used as a proxy server. [[1]](#1)| +|[Command and Control::Data Encoding (T1132)](https://attack.mitre.org/techniques/T1132/)|The communication with the C&C server is Base64 encoded. [[1]](#1)| +|[Command and Control::Ingress Tool Transfer (T1105)](https://attack.mitre.org/techniques/T1105/)|GoBotKR can download additional files and update itself. [[1]](#1)| +|[Command and Control::Application Layer Protocol (T1071)](https://attack.mitre.org/techniques/T1071/)|GoBotKR uses HTTP or HTTPS for C&C. [[1]](#1)| +|[Command and Control::Non-Standard Port (T1571)](https://attack.mitre.org/techniques/T1571/)|GoBotKR uses non-standard ports, such as 6446, 6556 and 7777, for C&C. [[1]](#1)| + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|GoBotKR uses cmd.exe to execute commands. [[1]](#1) | -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)| GoBotKR installs itself under registry run keys to establish persistence. [[1]](#1) | -|[Defense Evasion::Hidden Files and Directories (F0005)](../defense-evasion/hidden-files-and-directories.md)| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1) | -|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1) | -|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[1]](#1) | -|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)| GoBotKR is capable of capturing screenshots. [[1]](#1) | -|[Execution::User Execution (E1204)](../execution/user-execution.md)| GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1) | +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|GoBotKR uses cmd.exe to execute commands. [[1]](#1)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|GoBotKR installs itself under registry run keys to establish persistence. [[1]](#1)| +|[Defense Evasion::Hidden Files and Directories (F0005)](../defense-evasion/hidden-files-and-directories.md)|GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)| +|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[1]](#1)| +|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)|GoBotKR is capable of capturing screenshots. [[1]](#1)| +|[Execution::User Execution (E1204)](../execution/user-execution.md)|GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)| |[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|GoBotKR can download additional files and update itself. [[1]](#1) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|GoBotKR uses wmic, systeminfo and ver commands to collect information about the system and the installed software. [[1]](#1) query environment variable (This capa rule had 2 matches) [[2]](#2) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Check if file exists (This capa rule had 1 match) [[2]](#2) | +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|GoBotKR uses wmic, systeminfo, and ver commands to collect information about the system and the installed software and queries environment variables. [[1]](#1) [[2]](#2)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|GoBotKR checks if a file exists. [[2]](#2)| + ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|GoBotKR reinstalls its running instance if it is removed. [[1]](#1) | -|[Anti-Behavioral-Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[1]](#1) | -|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|GoBotKR receives data from the C2 [[1]](#1) | -|[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[1]](#1) | -|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[1]](#1) | -|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Receive data (This capa rule had 2 matches) [[2]](#2) | -|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Copy file (This capa rule had 1 match) [[2]](#2) | -|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Create directory (This capa rule had 1 match) [[2]](#2) | -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 1 match) [[2]](#2) | -|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry value (This capa rule had 1 match) [[2]](#2) | -|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Create process on Windows (This capa rule had 4 matches) [[2]](#2) | -|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Create thread (This capa rule had 2 matches) [[2]](#2) | -|[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|Suspend thread (This capa rule had 2 matches) [[2]](#2) | -|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Terminate process (This capa rule had 1 match) [[2]](#2) | +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|GoBotKR reinstalls its running instance if it is removed. [[1]](#1)| +|[Anti-Behavioral-Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[1]](#1)| +|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|GoBotKR receives data from the C2. [[1]](#1) [[2]](#2)| +|[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[1]](#1)| +|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[1]](#1)| +|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|GoBotKR copies files. [[2]](#2)| +|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|GoBotKR creates directories. [[2]](#2)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|GoBotKR deletes files. [[2]](#2)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|GoBotKR queries or enumerates registry values. [[2]](#2)| +|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|GoBotKR creates processes on Windows. [[2]](#2)| +|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|GoBotKR creates threads. [[2]](#2)| +|[Micro-Behaviors::Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|GoBotKR suspends threads. [[2]](#2)| +|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|GoBotKR terminates processes. [[2]](#2)| + ## Indicators of Compromise diff --git a/xample-malware/gravity-rat.md b/xample-malware/gravity-rat.md index 14341ab..c26cb25 100644 --- a/xample-malware/gravity-rat.md +++ b/xample-malware/gravity-rat.md @@ -1,7 +1,7 @@
| ID | -X0032 | +X0016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -24,14 +24,14 @@ # GravityRAT -Evades detection by checking current CPU temperature. +GravityRAT evades detection by checking current CPU temperature. ## ATT&CK Techniques |Name|Use| |---|---| -|[Discovery::Account Discovery (T1087)](https://attack.mitre.org/techniques/T1087)|Get session user name (This capa rule had 1 match) [[4]](#4) | +|[Discovery::Account Discovery (T1087)](https://attack.mitre.org/techniques/T1087)|GravityRAT gets session user name. [[4]](#4)| See ATT&CK: [GravityRAT - Techniques Used](https://attack.mitre.org/software/S0237/). @@ -39,26 +39,28 @@ See ATT&CK: [GravityRAT - Techniques Used](https://attack.mitre.org/software/S02 |Name|Use| |---|---| -|[Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)](../defense-evasion/hijack-execution-flow.md)|Abuses Microsoft's Dynamic Data Exchange (DDE) protocol [[2]](#2) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Enumerate files on windows (This capa rule had 3 matches) [[4]](#4) | +|[Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)](../defense-evasion/hijack-execution-flow.md)|GravityRAT abuses Microsoft's Dynamic Data Exchange (DDE) protocol. [[2]](#2)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|GravityRAT enumerates files on Windows. [[4]](#4)| + ## MBC Behaviors |Name|Use| |---|---| -|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|Checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM [[1]](#1) | -|[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)](../anti-behavioral-analysis/virtual-machine-detection.md)|Creates a WMI request to identify the BIOS version. [[1]](#1) | -|[Micro-Objective::Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|GravityRat v3 supports file AES file encryption [[2]](#2) | -|[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)](../anti-behavioral-analysis/virtual-machine-detection.md)|Checks if the manufacturer field in the Win32_Computer entry in WMI contains "Virtual", "Vmware", or "Virtualbox" [[2]](#2) | -|[Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Processor count (B0009.018)](../anti-behavioral-analysis/virtual-machine-detection.md)|Determines the machine to be a VM if the core count is 1 [[2]](#2) | -|[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - MAC Address (B0009.028)](../anti-behavioral-analysis/virtual-machine-detection.md)|Checks if the MAC address starts by a well-known hexadecimal number used by various VM developers [[2]](#2) | -|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Receive data (This capa rule had 1 match) [[4]](#4) | -|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Create directory (This capa rule had 1 match) [[4]](#4) | -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 1 match) [[4]](#4) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 9 matches) [[4]](#4) | -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Write file on Windows (This capa rule had 7 matches) [[4]](#4) | -|[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|Suspend thread (This capa rule had 6 matches) [[4]](#4) | -|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Terminate process (This capa rule had 1 match) [[4]](#4) | +|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware checks the system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware creates a WMI request to identify the BIOS version. [[1]](#1)| +|[Micro-Objective::Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|GravityRAT v3 supports AES file encryption. [[2]](#2)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware checks if the manufacturer field in the Win32_Computer entry (in WMI) contains "Virtual", "Vmware", or "Virtualbox." [[2]](#2)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Processor count (B0009.018)](../anti-behavioral-analysis/virtual-machine-detection.md)|GravityRAT determines the machine to be a VM if the core count is 1. [[2]](#2)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - MAC Address (B0009.028)](../anti-behavioral-analysis/virtual-machine-detection.md)|GravityRAT checks if the MAC address starts with a well-known hexadecimal number used by various VM developer. [[2]](#2)| +|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|GravityRAT receives data. [[4]](#4)| +|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|GravityRAT creates directories. [[4]](#4)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|GravityRAT deletes files. [[4]](#4)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|GravityRAT reads files on Windows. [[4]](#4)| +|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|GravityRAT writes files on Windows. [[4]](#4)| +|[Micro-Behaviors::Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|GravityRAT suspends threads. [[4]](#4)| +|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|GravityRAT terminates processes. [[4]](#4)| + ## Indicators of Compromise diff --git a/xample-malware/heriplor.md b/xample-malware/heriplor.md index e617cd4..86315a6 100644 --- a/xample-malware/heriplor.md +++ b/xample-malware/heriplor.md @@ -1,7 +1,7 @@
| ID | -X0026 | +X0017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -30,7 +30,15 @@ This Trojan is associated with the Energetic Bear group [[1]](#1). |Name|Use| |---|---| -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PEB ldr_data (This capa rule had 1 match) [[3]](#3)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Heriplor accesses PEB ldr_data. [[3]](#3)| + + +## MBC Behaviors + +|Name|Use| +|---|---| +|[Anti-Static Analysis::Executable Code Obfuscation::API Hashing (B0032.001)](../anti-static-analysis/executable-code-obfuscation.md)|Malware uses API hashing method. [[1]](#1)| +|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Malware has the capability to connect with a C2 to download arbitrary code. [[2]](#2)| ## Indicators of Compromise diff --git a/xample-malware/hupigon.md b/xample-malware/hupigon.md index 86e7120..dcc0003 100644 --- a/xample-malware/hupigon.md +++ b/xample-malware/hupigon.md @@ -1,7 +1,7 @@
| ID | -X0008 | +X0018 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -31,84 +31,85 @@ A family of backdoors. |Name|Use| |---|---| -|[Collection::Clipboard Data (T1115)](https://attack.mitre.org/techniques/T1115)|Read clipboard data (This capa rule had 5 matches) [[3]](#3) | -|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[3]](#3) | -|[Defense Evasion::Hide Artifacts::Hidden Window (T1564.003)](https://attack.mitre.org/techniques/T1564/003)|Hide graphical window (This capa rule had 5 matches) [[3]](#3) | -|[Discovery::Application Window Discovery (T1010)](https://attack.mitre.org/techniques/T1010)|Enumerate gui resources (This capa rule had 2 matches) [[3]](#3) | -|[Discovery::System Location Discovery (T1614)](https://attack.mitre.org/techniques/T1614)|Get geographical location (This capa rule had 5 matches) [[3]](#3) | -|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Get keyboard layout (This capa rule had 2 matches) [[3]](#3) | -|[Discovery::System Network Configuration Discovery (T1016)](https://attack.mitre.org/techniques/T1016)|Get local IPv4 addresses (This capa rule had 2 matches) [[3]](#3) | -|[Discovery::System Service Discovery (T1007)](https://attack.mitre.org/techniques/T1007)|Query service status (This capa rule had 3 matches) [[3]](#3) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Link many functions at runtime (This capa rule had 4 matches) [[3]](#3) | -|[Execution::System Services::Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002)|Create service (This capa rule had 2 matches) [[3]](#3) | -|[Impact::Service Stop (T1489)](https://attack.mitre.org/techniques/T1489)|Stop service (This capa rule had 1 match) [[3]](#3) | -|[Impact::System Shutdown/Reboot (T1529)](https://attack.mitre.org/techniques/T1529)|Shutdown system (This capa rule had 1 match) [[3]](#3) | -|[Persistence::Create or Modify System Process::Windows Service (T1543.003)](https://attack.mitre.org/techniques/T1543/003)|Start service (This capa rule had 1 match) [[3]](#3) | -|[Privilege Escalation::Access Token Manipulation (T1134)](https://attack.mitre.org/techniques/T1134)|Acquire debug privileges (This capa rule had 2 matches) [[3]](#3) | +|[Collection::Clipboard Data (T1115)](https://attack.mitre.org/techniques/T1115)|Hupigon reads clipboard data. [[3]](#3)| +|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Hupigon sets file attributes. [[3]](#3)| +|[Defense Evasion::Hide Artifacts::Hidden Window (T1564.003)](https://attack.mitre.org/techniques/T1564/003)|Hupigon hides a graphical window. [[3]](#3)| +|[Discovery::Application Window Discovery (T1010)](https://attack.mitre.org/techniques/T1010)|Hupigon enumerates GUI resources. [[3]](#3)| +|[Discovery::System Location Discovery (T1614)](https://attack.mitre.org/techniques/T1614)|Hupigon gets geographical locations. [[3]](#3)| +|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Hupigon gets keyboard layouts. [[3]](#3)| +|[Discovery::System Network Configuration Discovery (T1016)](https://attack.mitre.org/techniques/T1016)|Hupigon gets local IPv4 addresses. [[3]](#3)| +|[Discovery::System Service Discovery (T1007)](https://attack.mitre.org/techniques/T1007)|Hupigon queries service status. [[3]](#3)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Hupigon links many functions at runtime. [[3]](#3)| +|[Execution::System Services::Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002)|Hupigon creates services. [[3]](#3)| +|[Impact::Service Stop (T1489)](https://attack.mitre.org/techniques/T1489)|Hupigon stops services. [[3]](#3)| +|[Impact::System Shutdown/Reboot (T1529)](https://attack.mitre.org/techniques/T1529)|Hupigon shutdowns systems. [[3]](#3)| +|[Persistence::Create or Modify System Process::Windows Service (T1543.003)](https://attack.mitre.org/techniques/T1543/003)|Hupigon starts services. [[3]](#3)| +|[Privilege Escalation::Access Token Manipulation (T1134)](https://attack.mitre.org/techniques/T1134)|Hupigon acquires debug privileges. [[3]](#3)| + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects itself into processes such as cmd.exe, notepad.exe [[2]](#2) | -|[Defense Evasion::Rootkit (E1014)](../defense-evasion/rootkit.md)| Certain variants of the malware may have rootkit functionality [[2]](#2) | -|[Collection::Keylogging (F0002)](../collection/keylogging.md)|Certain variants of the malware may have keylogging functionality [[2]](#2) | -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[1]](#1) | -|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds many entries to the registry [[1]](#1) | -|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Log keystrokes via polling (This capa rule had 6 matches) [[3]](#3) | -|[Collection::Screen Capture::WinAPI (E1113.m01)](../collection/screen-capture.md)|Capture screenshot (This capa rule had 2 matches) [[3]](#3) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 8 matches) [[3]](#3) | -|[Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)](../defense-evasion/obfuscated-files-or-information.md)|Encrypt data using DES (This capa rule had 1 match) [[3]](#3) | -|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|Get graphical window text (This capa rule had 1 match) [[3]](#3) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Enumerate files recursively (This capa rule had 1 match) [[3]](#3) | -|[Discovery::File and Directory Discovery::Log File (E1083.m01)](../discovery/file-and-directory-discovery.md)|Access the Windows event log (This capa rule had 1 match) [[3]](#3) | -|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Replace clipboard data (This capa rule had 1 match) [[3]](#3) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Query environment variable (This capa rule had 1 match) [[3]](#3) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Accept command line arguments (This capa rule had 2 matches) [[3]](#3) | -|[Persistence::Registry Run Keys / Startup Folder (E1547.001)](../persistence/registry-run-keys-startup-folder.md)|Persist via Run registry key (This capa rule had 1 match) [[3]](#3) | -|[Defense Evasion::Process Injection::Process Hollowing (E1055.012)](../defense-evasion/process-injection.md)|Use process replacement (This capa rule had 1 match) [[3]](#3) | +|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects itself into processes, such as cmd.exe and notepad.exe. [[2]](#2)| +|[Defense Evasion::Rootkit (E1014)](../defense-evasion/rootkit.md)|Certain Hupigon variants may have rootkit functionality. [[2]](#2)| +|[Collection::Keylogging (F0002)](../collection/keylogging.md)|Certain Hupigon variants may have keylogging functionality. [[2]](#2)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[1]](#1)| +|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds entries to the registry. [[1]](#1)| +|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Hupigon logs keystrokes via polling. [[3]](#3)| +|[Collection::Screen Capture::WinAPI (E1113.m01)](../collection/screen-capture.md)|Hupigon captures screenshots. [[3]](#3)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Hupigon encodes data using XOR. [[3]](#3)| +|[Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)](../defense-evasion/obfuscated-files-or-information.md)|Hupigon encrypts data using DES. [[3]](#3)| +|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|Hupigon gets graphical window text. [[3]](#3)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Hupigon enumerates files recursively. [[3]](#3)| +|[Discovery::File and Directory Discovery::Log File (E1083.m01)](../discovery/file-and-directory-discovery.md)|Hupigon accesses Windows event logs. [[3]](#3)| +|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Hupigon replaces clipboard data. [[3]](#3)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Hupigon queries environment variables. [[3]](#3)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Hupigon accepts command line arguments. [[3]](#3)| +|[Persistence::Registry Run Keys / Startup Folder (E1547.001)](../persistence/registry-run-keys-startup-folder.md)|Hupigon persists via Run registry key. [[3]](#3)| +|[Defense Evasion::Process Injection::Process Hollowing (E1055.012)](../defense-evasion/process-injection.md)|Hupigon uses process replacement. [[3]](#3)| ## MBC Behaviors |Name|Use| |---|---| -|[Impact::Remote Access (B0022)](../impact/remote-access.md)|The malware acts as a backdoor [[1]](#1) | -|[Anti-Behavioral Analysis::Conditional Execution::Runs as Service (B0025.007)](../execution/conditional-execution.md)|Run as service (This capa rule had 1 match) [[3]](#3) | -|[Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions (B0001.034)](../anti-behavioral-analysis/debugger-detection.md)|Execute anti-debugging instructions (This capa rule had 1 match) [[3]](#3) | -|[Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints (B0001.025)](../anti-behavioral-analysis/debugger-detection.md)|Check for software breakpoints (This capa rule had 2 matches) [[3]](#3) | -|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|Check for time delay via GetTickCount (This capa rule had 6 matches) [[3]](#3) | -|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|Contain obfuscated stackstrings (This capa rule had 1 match) [[3]](#3) | -|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Receive data (This capa rule had 2 matches) [[3]](#3) | -|[Command And Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|Send data (This capa rule had 2 matches) [[3]](#3) | -|[Communication::DNS Communication::Resolve (C0011.001)](../micro-behaviors/communication/dns-communication.md)|Resolve DNS (This capa rule had 1 match) [[3]](#3) | -|[Communication::Interprocess Communication::Create Pipe (C0003.001)](../micro-behaviors/communication/interprocess-communication.md)|Create two anonymous pipes (This capa rule had 1 match) [[3]](#3) | -|[Communication::Interprocess Communication::Write Pipe (C0003.004)](../micro-behaviors/communication/interprocess-communication.md)|Write pipe (This capa rule had 1 match) [[3]](#3) | -|[Communication::Socket Communication::Create UDP Socket (C0001.010)](../micro-behaviors/communication/socket-communication.md)|Create UDP socket (This capa rule had 1 match) [[3]](#3) | -|[Cryptography::Encrypt Data::3DES (C0027.004)](../micro-behaviors/cryptography/encrypt-data.md)|Encrypt data using DES (This capa rule had 1 match) [[3]](#3) | -|[Data::Compression Library (C0060)](../micro-behaviors/data/compression-library.md)|Linked against ZLIB (This capa rule had 1 match) [[3]](#3) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 8 matches) [[3]](#3) | -|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 3 matches) [[3]](#3) | -|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Copy file (This capa rule had 1 match) [[3]](#3) | -|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Create directory (This capa rule had 1 match) [[3]](#3) | -|[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Delete directory (This capa rule had 1 match) [[3]](#3) | -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 1 match) [[3]](#3) | -|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Get file attributes (This capa rule had 3 matches) [[3]](#3) | -|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Move file (This capa rule had 1 match) [[3]](#3) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 1 match) [[3]](#3) | -|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Set file attributes (This capa rule had 1 match) [[3]](#3) | -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Write file on Windows (This capa rule had 4 matches) [[3]](#3) | -|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Allocate RWX memory (This capa rule had 4 matches) [[3]](#3) | -|[Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Delete registry key (This capa rule had 1 match) [[3]](#3) | -|[Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Delete registry value (This capa rule had 3 matches) [[3]](#3) | -|[Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry key (This capa rule had 4 matches) [[3]](#3) | -|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry value (This capa rule had 8 matches) [[3]](#3) | -|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Set registry value (This capa rule had 2 matches) [[3]](#3) | -|[Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Create mutex (This capa rule had 1 match) [[3]](#3) | -|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Create process on Windows (This capa rule had 9 matches) [[3]](#3) | -|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Create thread (This capa rule had 6 matches) [[3]](#3) | -|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Set thread local storage value (This capa rule had 1 match) [[3]](#3) | -|[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|Suspend thread (This capa rule had 1 match) [[3]](#3) | -|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Terminate process (This capa rule had 3 matches) [[3]](#3) | +|[Impact::Remote Access (B0022)](../impact/remote-access.md)|The malware acts as a backdoor. [[1]](#1)| +|[Anti-Behavioral Analysis::Conditional Execution::Runs as Service (B0025.007)](../execution/conditional-execution.md)|Hupigon runs as a service. [[3]](#3)| +|[Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions (B0001.034)](../anti-behavioral-analysis/debugger-detection.md)|Hupigon executes anti-debugging instructions. [[3]](#3)| +|[Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints (B0001.025)](../anti-behavioral-analysis/debugger-detection.md)|Hupigon checks for software breakpoints. [[3]](#3)| +|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|Hupigon checks for a time delay via GetTickCount. [[3]](#3)| +|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|Hupigon contains obfuscated stack strings. [[3]](#3)| +|[Micro-Behaviors::Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Hupigon receives data. [[3]](#3)| +|[Micro-Behaviors::Command And Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|Hupigon sends data. [[3]](#3)| +|[Micro-Behaviors::Communication::DNS Communication::Resolve (C0011.001)](../micro-behaviors/communication/dns-communication.md)|Hupigon resolves DNS. [[3]](#3)| +|[Micro-Behaviors::Communication::Interprocess Communication::Create Pipe (C0003.001)](../micro-behaviors/communication/interprocess-communication.md)|Hupigon creates two anonymous pipes. [[3]](#3)| +|[Micro-Behaviors::Communication::Interprocess Communication::Write Pipe (C0003.004)](../micro-behaviors/communication/interprocess-communication.md)|Hupigon writes pipes. [[3]](#3)| +|[Micro-Behaviors::Communication::Socket Communication::Create UDP Socket (C0001.010)](../micro-behaviors/communication/socket-communication.md)|Hupigon creates UDP sockets. [[3]](#3)| +|[Micro-Behaviors::Cryptography::Encrypt Data::3DES (C0027.004)](../micro-behaviors/cryptography/encrypt-data.md)|Hupigon encrypts data using DES. [[3]](#3)| +|[Micro-Behaviors::Data::Compression Library (C0060)](../micro-behaviors/data/compression-library.md)|Hupigon linked against ZLIB. [[3]](#3)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Hupigon encodes data using XOR. [[3]](#3)| +|[Micro-Behaviors::Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Hupigon enumerates PE sections. [[3]](#3)| +|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Hupigon copies files. [[3]](#3)| +|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Hupigon creates directories. [[3]](#3)| +|[Micro-Behaviors::File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Hupigon deletes directories. [[3]](#3)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Hupigon deletes files. [[3]](#3)| +|[Micro-Behaviors::File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|Hupigon gets file attributes. [[3]](#3)| +|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Hupigon moves files. [[3]](#3)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Hupigon reads files on Windows. [[3]](#3)| +|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Hupigon sets file attributes. [[3]](#3)| +|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Hupigon writes files on Windows. [[3]](#3)| +|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Hupigon allocates RWX memory. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Hupigon deletes registry keys. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Hupigon deletes registry values. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Key (C0036.005)](../micro-behaviors/operating-system/registry.md)|Hupigon queries or enumerates registry keys. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Hupigon queries or enumerates registry values. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Hupigon sets registry values. [[3]](#3)| +|[Micro-Behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Hupigon creates mutexes. [[3]](#3)| +|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Hupigon creates processes on Windows. [[3]](#3)| +|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Hupigon creates threads. [[3]](#3)| +|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Hupigon sets thread local storage values. [[3]](#3)| +|[Micro-Behaviors::Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|Hupigon suspends threads. [[3]](#3)| +|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Hupigon terminates processes. [[3]](#3)| ## Indicators of Compromise diff --git a/xample-malware/kovter.md b/xample-malware/kovter.md index 04f51c9..01a3074 100644 --- a/xample-malware/kovter.md +++ b/xample-malware/kovter.md @@ -1,7 +1,7 @@
| ID | -X0009 | +X0019 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -31,59 +31,60 @@ A trojan that performs click-fraud. |Name|Use| |---|---| -|[Initial Access::Phishing::Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)|The malware is sent out to victims via an attachment [[2]](#2) | -|[Execution::User Execution::Malicious File (T1204.002)](https://attack.mitre.org/techniques/T1204/002/)|The malware relies on a victim to execute itself [[2]](#2) | -|[Defense Evasion::System Binary Proxy Execution::Mshta (T1218.005)](https://attack.mitre.org/techniques/T1218/005/)|The malware uses mshta.exe to run Javascript [[1]](#1) | -|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 3 matches) [[3]](#3) | -|[Discovery::Application Window Discovery (T1010)](https://attack.mitre.org/techniques/T1010)|Find graphical window (This capa rule had 11 matches) [[3]](#3) | -|[Discovery::System Location Discovery (T1614)](https://attack.mitre.org/techniques/T1614)|Get geographical location (This capa rule had 1 match) [[3]](#3) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Get ntdll base address (This capa rule had 2 matches) [[3]](#3) | -|[Execution::System Services::Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002)|Interact with driver via control codes (This capa rule had 3 matches) [[3]](#3) | +|[Initial Access::Phishing::Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)|The malware is sent out to victims via an attachment. [[2]](#2)| +|[Execution::User Execution::Malicious File (T1204.002)](https://attack.mitre.org/techniques/T1204/002/)|The malware relies on a victim to execute itself. [[2]](#2)| +|[Defense Evasion::System Binary Proxy Execution::Mshta (T1218.005)](https://attack.mitre.org/techniques/T1218/005/)|The malware uses mshta.exe to run Javascript. [[1]](#1)| +|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Kovter sets file attributes. [[3]](#3)| +|[Discovery::Application Window Discovery (T1010)](https://attack.mitre.org/techniques/T1010)|Kovter finds graphical windows. [[3]](#3)| +|[Discovery::System Location Discovery (T1614)](https://attack.mitre.org/techniques/T1614)|Kovter gets geographical locations. [[3]](#3)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Kovter gets ntdll base address. [[3]](#3)| +|[Execution::System Services::Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002)|Kovter interacts with drivers via control codes. [[3]](#3)| ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Impact::Generate Traffic from Victim (E1643)](../impact/generate-traffic-from-victim.md)|Performs click-fraud. [[1]](#1) | -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware writes an autorun registry entry [[2]](#2) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The malware executes malicious javascript and powershell [[1]](#1) | -|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware modifies the registry during execution [[2]](#2) | -|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|The malware will use a key to decrypt text from a URL to create more malicious code [[1]](#1) | -|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)|The malware comes packed by a crypter/FUD [[1]](#1) | -|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Log keystrokes via polling (This capa rule had 1 match) [[3]](#3) | -|[Collection::Screen Capture::WinAPI (E1113.m01)](../collection/screen-capture.md)|Capture screenshot (This capa rule had 1 match) [[3]](#3) | -|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|Get graphical window text (This capa rule had 2 matches) [[3]](#3) | -|[Discovery::File and Directory Discovery::Log File (E1083.m01)](../discovery/file-and-directory-discovery.md)|Access the Windows event log (This capa rule had 2 matches) [[3]](#3) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Get file version info (This capa rule had 3 matches) [[3]](#3) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Get disk information (This capa rule had 1 match) [[3]](#3) | +|[Impact::Generate Traffic from Victim (E1643)](../impact/generate-traffic-from-victim.md)|Kovter performs click-fraud. [[1]](#1)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware writes an autorun registry entry. [[2]](#2)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The malware executes malicious javascript and powershell. [[1]](#1)| +|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware modifies the registry during execution. [[2]](#2)| +|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|The malware will use a key to decrypt text from a URL to create additional malicious code. [[1]](#1)| +|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)|The malware comes packed by a crypter/FUD. [[1]](#1)| +|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Kovter logs keystrokes via polling. [[3]](#3)| +|[Collection::Screen Capture::WinAPI (E1113.m01)](../collection/screen-capture.md)|Kovter captures screenshots. [[3]](#3)| +|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|Kovter gets graphical window text. [[3]](#3)| +|[Discovery::File and Directory Discovery::Log File (E1083.m01)](../discovery/file-and-directory-discovery.md)|Kovter accesses Windows event logs. [[3]](#3)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Kovter gets file version info. [[3]](#3)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Kovter gets disk information. [[3]](#3)| + ## MBC Behaviors |Name|Use| |---|---| -|[Defense Evasion::Alternative Installation Location::Registry Install (B0027.002)](../defense-evasion/alternative-installation-location.md)|Stores malware files in the Registry instead of the hard drive [[2]](#2) | -|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Receive data (This capa rule had 16 matches) [[3]](#3) | -|[Command And Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|Send data (This capa rule had 1 match) [[3]](#3) | -|[Communication::HTTP Communication::Connect to Server (C0002.009)](../micro-behaviors/communication/http-communication.md)|Connect to HTTP server (This capa rule had 2 matches) [[3]](#3) | -|[Communication::HTTP Communication::Create Request (C0002.012)](../micro-behaviors/communication/http-communication.md)|Create HTTP request (This capa rule had 4 matches) [[3]](#3) | -|[Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|Hash data via WinCrypt (This capa rule had 22 matches) [[3]](#3) | -|[Cryptography::Decrypt Data (C0031)](../micro-behaviors/cryptography/decrypt-data.md)|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[3]](#3) | -|[Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|Create new key via CryptAcquireContext (This capa rule had 1 match) [[3]](#3) | -|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Copy file (This capa rule had 5 matches) [[3]](#3) | -|[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Create directory (This capa rule had 14 matches) [[3]](#3) | -|[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Delete directory (This capa rule had 4 matches) [[3]](#3) | -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 2 matches) [[3]](#3) | -|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Move file (This capa rule had 24 matches) [[3]](#3) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 4 matches) [[3]](#3) | -|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Set file attributes (This capa rule had 3 matches) [[3]](#3) | -|[Operating System::Environment Variable::Set Variable (C0034.001)](../micro-behaviors/operating-system/environment-variable.md)|Set environment variable (This capa rule had 3 matches) [[3]](#3) | -|[Operating System::Registry::Create Registry Key (C0036.004)](../micro-behaviors/operating-system/registry.md)|Create or open registry key (This capa rule had 14 matches) [[3]](#3) | -|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry value (This capa rule had 2 matches) [[3]](#3) | -|[Process::Allocate Thread Local Storage (C0040)](../micro-behaviors/process/allocate-thread-local-storage.md)|Allocate thread local storage (This capa rule had 3 matches) [[3]](#3) | -|[Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Create mutex (This capa rule had 2 matches) [[3]](#3) | -|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Create process on Windows (This capa rule had 22 matches) [[3]](#3) | -|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Set thread local storage value (This capa rule had 3 matches) [[3]](#3) | -|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Terminate process (This capa rule had 6 matches) [[3]](#3) | +|[Defense Evasion::Alternative Installation Location::Registry Install (B0027.002)](../defense-evasion/alternative-installation-location.md)|Kovter stores malware files in the Registry instead of on the hard drive. [[2]](#2)| +|[Command And Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|Kovter sends data. [[3]](#3)| +|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Kovter receives data. [[3]](#3)| +|[Micro-Behaviors::Communication::HTTP Communication::Connect to Server (C0002.009)](../micro-behaviors/communication/http-communication.md)|Kovter connects to a HTTP server. [[3]](#3)| +|[Micro-Behaviors::Communication::HTTP Communication::Create Request (C0002.012)](../micro-behaviors/communication/http-communication.md)|Kovter creates HTTP requests. [[3]](#3)| +|[Micro-Behaviors::Cryptography::Cryptographic Hash (C0029)](../micro-behaviors/cryptography/cryptographic-hash.md)|Kovter hashes data via WinCrypt. [[3]](#3)| +|[Micro-Behaviors::Cryptography::Decrypt Data (C0031)](../micro-behaviors/cryptography/decrypt-data.md)|Kovter encrypts or decrypts via WinCrypt. [[3]](#3)| +|[Micro-Behaviors::Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|Kovter creates new keys via CryptAcquireContext. [[3]](#3)| +|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Kovter copies files. [[3]](#3)| +|[Micro-Behaviors::File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Kovter creates directories. [[3]](#3)| +|[Micro-Behaviors::File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Kovter deletes directories. [[3]](#3)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Kovter deletes files. [[3]](#3)| +|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Kovter moves files. [[3]](#3)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Kovter reads files on Windows. [[3]](#3)| +|[Micro-Behaviors::File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|Kovter sets file attributes. [[3]](#3)| +|[Micro-Behaviors::Operating System::Environment Variable::Set Variable (C0034.001)](../micro-behaviors/operating-system/environment-variable.md)|Kovter sets environment variables. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Create Registry Key (C0036.004)](../micro-behaviors/operating-system/registry.md)|Kovter creates or opens registry keys. [[3]](#3)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Kovter queries or enumerates registry values. [[3]](#3)| +|[Micro-Behaviors::Process::Allocate Thread Local Storage (C0040)](../micro-behaviors/process/allocate-thread-local-storage.md)|Kovter allocates thread local storage. [[3]](#3)| +|[Micro-Behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Kovter creates mutexes. [[3]](#3)| +|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Kovter creates processes on Windows. [[3]](#3)| +|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Kovter sets thread local storage values. [[3]](#3)| +|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Kovter terminates processes. [[3]](#3)| ## Indicators of Compromise diff --git a/xample-malware/kraken.md b/xample-malware/kraken.md index 20590f6..8cb697f 100644 --- a/xample-malware/kraken.md +++ b/xample-malware/kraken.md @@ -1,7 +1,7 @@
| ID | -X0010 | +X0020 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -30,24 +30,27 @@ A family of bots. |Name|Use| |---|---| -|[Command and Control::Dynamic Resolution::Domain Generation Algorithms (T1568.002)](https://attack.mitre.org/techniques/T1568/002/)|Uses a domain name generator. [[1]](#1) | -|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP to communicate with C2 [[1]](#1) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PEB ldr_data (This capa rule had 1 match) [[2]](#2) | +|[Command and Control::Dynamic Resolution::Domain Generation Algorithms (T1568.002)](https://attack.mitre.org/techniques/T1568/002/)|Kraken uses a domain name generator to provide new domains. [[1]](#1)| +|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP to communicate with C2. [[1]](#1)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Kraken accesses PEB ldr_data. [[2]](#2)| + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 2 matches) [[2]](#2) | +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Kraken encodes data using XOR. [[2]](#2)| + ## MBC Behaviors |Name|Use| |---|---| -|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| Uses a domain name generator. [[1]](#1) | -|[Anti-Behavioral Analysis::Memory Dump Evasion (B0006)](../anti-behavioral-analysis/memory-dump-evasion.md)|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is wiped out. [[1]](#1) | -|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Encrypt data using RC4 PRGA (This capa rule had 2 matches) [[2]](#2) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 2 matches) [[2]](#2) | +|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| Kraken uses a domain name generator to provide new domains. [[1]](#1)| +|[Anti-Behavioral Analysis::Memory Dump Evasion (B0006)](../anti-behavioral-analysis/memory-dump-evasion.md)|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[1]](#1)| +|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Kraken encrypts data using RC4 PRGA. [[2]](#2)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Kraken encodes data using XOR. [[2]](#2)| + ## Indicators of Compromise diff --git a/xample-malware/locky-bart.md b/xample-malware/locky-bart.md index fc78cae..7c9af5b 100644 --- a/xample-malware/locky-bart.md +++ b/xample-malware/locky-bart.md @@ -1,7 +1,7 @@
| ID | -X0011 | +X0021 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -26,45 +26,49 @@ Locky Bart is ransomware. [[1]](#1) + ## ATT&CK Techniques |Name|Use| |---|---| -|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057/)|Gathers information from the victim's machine to create an encryption key. [[1]](#1) | -|[Discovery::System Time Discovery (T1057)](https://attack.mitre.org/techniques/T1124/)|Gathers information from the victim's machine to create an encryption key. [[1]](#1) | -|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Identify system language via API (This capa rule had 1 match) [[2]](#2) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Parse PE header (This capa rule had 2 matches) [[2]](#2) | +|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057/)|Locky Bart gathers information from the victim's machine to create an encryption key. [[1]](#1)| +|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Locky Bart identifies the system language via API. [[2]](#2)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Locky Bart parses PE headers. [[2]](#2)| + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|Encrypts files for ransom without any connection to the Internet [[1]](#1) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 4 matches) [[2]](#2) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Get file size (This capa rule had 1 match) [[2]](#2) | +|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|Locky Bart encrypts files for ransom without any connection to the Internet. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Locky Bart encodes data using XOR. [[2]](#2)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Locky Bart gets a file size. [[2]](#2)| + ## MBC Behaviors |Name|Use| |---|---| -|[Anti-Static Analysis::Executable Code Virtualization (B0008)](../anti-static-analysis/executable-code-virtualization.md)|Code virtualization is added to the Locky Bart binary using WPProtect. [[1]](#1) | -|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Encrypt data using RC4 PRGA (This capa rule had 1 match) [[2]](#2) | -|[Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|Create new key via CryptAcquireContext (This capa rule had 1 match) [[2]](#2) | -|[Cryptography::Generate Pseudo-random Sequence::Use API (C0021.003)](../micro-behaviors/cryptography/generate-pseudorandom-sequence.md)|Generate random numbers via WinAPI (This capa rule had 1 match) [[2]](#2) | -|[Data::Check String (C0019)](../micro-behaviors/data/check-string.md)|Reference Base64 string (This capa rule had 1 match) [[2]](#2) | -|[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Hash data with CRC32 (This capa rule had 2 matches) [[2]](#2) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 4 matches) [[2]](#2) | -|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 2 matches) [[2]](#2) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 2 matches) [[2]](#2) | -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Write file on Windows (This capa rule had 3 matches) [[2]](#2) | -|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Set registry value (This capa rule had 1 match) [[2]](#2) | -|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Create thread (This capa rule had 1 match) [[2]](#2) | +|[Anti-Static Analysis::Executable Code Virtualization (B0008)](../anti-static-analysis/executable-code-virtualization.md)|Code virtualization is added to the Locky Bart binary using WPProtect. [[1]](#1)| +|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Locky Bart encrypts data using RC4 PRGA. [[2]](#2)| +|[Micro-Behaviors::Cryptography::Encryption Key (C0028)](../micro-behaviors/cryptography/encryption-key.md)|Locky Bart creates a new key via CryptAcquireContext. [[2]](#2)| +|[Micro-Behaviors::Cryptography::Generate Pseudo-random Sequence::Use API (C0021.003)](../micro-behaviors/cryptography/generate-pseudorandom-sequence.md)|Locky Bart generates random numbers via WinAPI. [[2]](#2)| +|[Micro-Behaviors::Data::Check String (C0019)](../micro-behaviors/data/check-string.md)|Locky Bart references Base64 strings. [[2]](#2)| +|[Micro-Behaviors::Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Locky Bart hashes data with CRC32. [[2]](#2)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Locky Bart encodes data using XOR. [[2]](#2)| +|[Micro-Behaviors::Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Locky Bart enumerates PE sections. [[2]](#2)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Locky Bart reads files on Windows. [[2]](#2)| +|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Locky Bart writes files on Windows. [[2]](#2)| +|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Locky Bart sets registry values. [[2]](#2)| +|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Locky Bart creates threads. [[2]](#2)| + ## Indicators of Compromise SHA256 Hashes - c285e376201e2941154ec1a9acd8658cd5e0ea975c694a3fe3e9a9897efc2680 + ## References [1] https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/ diff --git a/xample-malware/matanbuchus.md b/xample-malware/matanbuchus.md new file mode 100644 index 0000000..f966096 --- /dev/null +++ b/xample-malware/matanbuchus.md @@ -0,0 +1,81 @@ + +
| ID | +X0022 | +
| Aliases | +None | +
| Platforms | +Windows | +
| Year | +2021 | +
| ID | -X0012 | +X0023 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -25,26 +25,28 @@ # MazarBot -Targets Android phones via a poisoned text message. +MazarBot targets Android phones via a poisoned text message. + ## ATT&CK Techniques See ATT&CK: [MazarBOT - Techniques Used](https://attack.mitre.org/software/S0303/). + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|Can erase phone data [[3]](#3)| +|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|MazarBot can erase phone data. [[3]](#3)| ## MBC Behaviors |Name|Use| |---|---| -|[Impact::Manipulate Network Traffic (B0019)](../impact/manipulate-network-traffic.md)|Intercepts data coming into and going out of device [[1]](#1)| -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Installs a backdoor [[1]](#1)| -|[Execution::Send Poisoned Text Message (B0021)](../execution/send-poisoned-text-message.md)|Can send SMS messages [[2]](#2)| +|[Impact::Manipulate Network Traffic (B0019)](../impact/manipulate-network-traffic.md)|MazarBot intercepts data coming into and going out of the device. [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|MazarBot installs a backdoor. [[1]](#1)| +|[Execution::Send Poisoned Text Message (B0021)](../execution/send-poisoned-text-message.md)|MazarBot is delivered via a poisoned SMS message. [[2]](#2)| ## Indicators of Compromise diff --git a/xample-malware/mebromi.md b/xample-malware/mebromi.md index 035c53b..f6555b4 100644 --- a/xample-malware/mebromi.md +++ b/xample-malware/mebromi.md @@ -1,7 +1,7 @@
| ID | -X0013 | +X0024 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -28,42 +28,41 @@ A BIOS bootkit. ## ATT&CK Techniques - |Name|Use| |---|---| - -|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057)|Enumerate processes (This capa rule had 1 match) [[2]](#2) | -|[Discovery::System Service Discovery (T1007)](https://attack.mitre.org/techniques/T1007)|Query service status (This capa rule had 1 match) [[2]](#2) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Link function at runtime on Windows (This capa rule had 1 match) [[2]](#2) | -|[Execution::System Services::Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002)|Interact with driver via control codes (This capa rule had 4 matches) [[2]](#2) | -|[Impact::Service Stop (T1489)](https://attack.mitre.org/techniques/T1489)|Stop service (This capa rule had 1 match) [[2]](#2) | -|[Persistence::Create or Modify System Process::Windows Service (T1543.003)](https://attack.mitre.org/techniques/T1543/003)|Start service (This capa rule had 1 match) [[2]](#2) | +|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057)|Mebromi enumerates processes. [[2]](#2)| +|[Discovery::System Service Discovery (T1007)](https://attack.mitre.org/techniques/T1007)|Mebromi queries a service status. [[2]](#2)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Mebromi links functions at runtime on Windows. [[2]](#2)| +|[Execution::System Services::Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002)|Mebromi interacts with a driver via control codes. [[2]](#2)| +|[Impact::Service Stop (T1489)](https://attack.mitre.org/techniques/T1489)|Mebromi stops services. [[2]](#2)| +|[Persistence::Create or Modify System Process::Windows Service (T1543.003)](https://attack.mitre.org/techniques/T1543/003)|Mebromi starts services. [[2]](#2)| See ATT&CK: [Mebromi - Techniques Used](https://attack.mitre.org/software/S0001/). + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::Bootkit (F0013)](../defense-evasion/bootkit.md)|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 2 matches) [[2]](#2) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Get file size (This capa rule had 1 match) [[2]](#2) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Check OS version (This capa rule had 1 match) [[2]](#2) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Accept command line arguments (This capa rule had 1 match) [[2]](#2) | +|[Defense Evasion::Bootkit (F0013)](../defense-evasion/bootkit.md)|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Mebromi encodes data using XOR. [[2]](#2)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Mebromi gets a file size. [[2]](#2)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Mebromi checks OS version. [[2]](#2)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Mebromi accepts command line arguments. [[2]](#2)| ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Malware only proceeds if it detects the BIOS ROM is Award BIOS [[1]](#1) | -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Malware contains a dropper that installs additional programs like Cbrom.exe [[1]](#1) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 2 matches) [[2]](#2) | -|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Copy file (This capa rule had 2 matches) [[2]](#2) | -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 5 matches) [[2]](#2) | -|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Move file (This capa rule had 2 matches) [[2]](#2) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 1 match) [[2]](#2) | -|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Allocate RWX memory (This capa rule had 1 match) [[2]](#2) | -|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Create process on Windows (This capa rule had 1 match) [[2]](#2) | +|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Malware only proceeds if it detects the BIOS ROM is Award BIOS. [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Malware contains a dropper that installs additional programs like Cbrom.exe. [[1]](#1)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Mebromi encodes data using XOR. [[2]](#2)| +|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Mebromi copies files. [[2]](#2)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Mebromi deletes files. [[2]](#2)| +|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Mebromi moves files. [[2]](#2)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Mebromi reads files on Windows. [[2]](#2)| +|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Mebromi allocates RWX memory. [[2]](#2)| +|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Mebromi creates a process on Windows. [[2]](#2)| ## Indicators of Compromise diff --git a/xample-malware/netwalker.md b/xample-malware/netwalker.md index 08ba9b0..a3c5811 100644 --- a/xample-malware/netwalker.md +++ b/xample-malware/netwalker.md @@ -2,7 +2,7 @@
| ID | -X0037 | +X0025 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -31,14 +31,15 @@ Fileless ransomware written in PowerShell and executed directly in memory. See ATT&CK: [Netwalker - Techniques Used](https://attack.mitre.org/software/S0457/). + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Execution::Command and Scripting Interpreter (E1049)](../execution/command-and-scripting-interpreter.md)|Netwalker is written and executed in Powershell [[1]](#1)| -|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as base64, hexademcimal, and XOR [[1]](#1)| -|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001)](../defense-evasion/process-injection.md)|Netwalker uses reflective DLL loading to inject from memory [[1]](#1)| -|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|Netwalker encrypts files for ransom [[1]](#1)| +|[Execution::Command and Scripting Interpreter (E1049)](../execution/command-and-scripting-interpreter.md)|Netwalker is written and executed in Powershell. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as Base64, hexademcimal, and XOR. [[1]](#1)| +|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001)](../defense-evasion/process-injection.md)|Netwalker uses reflective DLL loading to inject from memory. [[1]](#1)| +|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|Netwalker encrypts files for ransom. [[1]](#1)| ## Indicators of Compromise diff --git a/xample-malware/poison-ivy.md b/xample-malware/poison-ivy.md index 4f0eabc..7adc38c 100644 --- a/xample-malware/poison-ivy.md +++ b/xample-malware/poison-ivy.md @@ -1,7 +1,7 @@
| ID | -X0014 | +X0026 |
| Aliases | @@ -22,41 +22,46 @@
| ID | -X0015 | -
| Aliases | -None | -
| Platforms | -Windows | -
| Year | -2011 | -
| Associated ATT&CK Software | -None | -
| ID | +X0027 | +
| Aliases | +None | +
| Platforms | +Windows | +
| Year | +2011 | +
| Associated ATT&CK Software | +None | +
| ID | -X0031 | +X0028 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -31,72 +31,74 @@ This family of malware steals data the user enters into a browser and uses a var |Name|Use| |---|---| -|[Initial Access::Phishing::Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)|The malware is sent out to victims via an attachment [[1]](#1) | -|[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)|The malware will unpack its code in memory [[1]](#1) | -|[Impact::Disk Wipe (T1561)](https://attack.mitre.org/techniques/T1561/)|If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the User's home folder [[1]](#1) | -|[Command and Control::Data Encoding::Standard Encoding (T1132.001)](https://attack.mitre.org/techniques/T1132/001/)|The malware transmits Base64 encoded data to C2 [[1]](#1) | -|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware transmits data over HTTP [[1]](#1) | -|[Collection::Clipboard Data (T1115)](https://attack.mitre.org/techniques/T1115)|Read clipboard data (This capa rule had 1 match) [[2]](#2) | -|[Defense Evasion::Hide Artifacts::Hidden Window (T1564.003)](https://attack.mitre.org/techniques/T1564/003)|Hide graphical window (This capa rule had 7 matches) [[2]](#2) | -|[Discovery::Account Discovery (T1087)](https://attack.mitre.org/techniques/T1087)|Get session user name (This capa rule had 1 match) [[2]](#2) | -|[Discovery::Application Window Discovery (T1010)](https://attack.mitre.org/techniques/T1010)|Enumerate gui resources (This capa rule had 2 matches) [[2]](#2) | -|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057)|Get process heap force flags (This capa rule had 1 match) [[2]](#2) | -|[Discovery::System Location Discovery (T1614)](https://attack.mitre.org/techniques/T1614)|Get geographical location (This capa rule had 5 matches) [[2]](#2) | -|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Get keyboard layout (This capa rule had 2 matches) [[2]](#2) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PEB ldr_data (This capa rule had 8 matches) [[2]](#2) | +|[Initial Access::Phishing::Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)|The malware is sent out to victims via an attachment. [[1]](#1)| +|[Persistence::Boot or Logon Autostart Execution (T1547)](https://attack.mitre.org/techniques/T1547/)|The malware starts everytime a user logs in. [[1]](#1)| +|[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)|The malware will unpack its code in memory. [[1]](#1)| +|[Impact::Disk Wipe (T1561)](https://attack.mitre.org/techniques/T1561/)|If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the user's home folder. [[1]](#1)| +|[Command and Control::Data Encoding::Standard Encoding (T1132.001)](https://attack.mitre.org/techniques/T1132/001/)|The malware transmits Base64 encoded data to C2. [[1]](#1)| +|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware transmits data over HTTP. [[1]](#1)| +|[Collection::Clipboard Data (T1115)](https://attack.mitre.org/techniques/T1115)|Rombertik reads clipboard data. [[2]](#2)| +|[Defense Evasion::Hide Artifacts::Hidden Window (T1564.003)](https://attack.mitre.org/techniques/T1564/003)|Rombertik hides graphical windows. [[2]](#2)| +|[Discovery::Account Discovery (T1087)](https://attack.mitre.org/techniques/T1087)|Rombertik gets a session user name. [[2]](#2)| +|[Discovery::Application Window Discovery (T1010)](https://attack.mitre.org/techniques/T1010)|Rombertik enumerates GUI resources. [[2]](#2)| +|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057)|Rombertik gets process heap force flags. [[2]](#2)| +|[Discovery::System Location Discovery (T1614)](https://attack.mitre.org/techniques/T1614)|Rombertik gets geographical locations. [[2]](#2)| +|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Rombertik gets keyboard layout. [[2]](#2)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Rombertik accesses PEB ldr_data. [[2]](#2)| ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Execution::User Execution (E1204)](../execution/user-execution.md)|The malware relies on a victim to execute itself [[1]](#1) | -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware will proceed to install itself in order to ensure persistence across system reboots before continuing on to execute the payload. To install itself, Rombertik first creates a VBS script named “fgf.vbs”, which is used to kick off [[1]](#1) | -|[Collection::Input Capture (E1056)](../collection/input-capture.md)|The malware injects itself into a browser and captures user input data [[1]](#1) | -|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the User's home folder [[1]](#1) | -|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Log keystrokes via polling (This capa rule had 7 matches) [[2]](#2) | -|[Collection::Screen Capture::WinAPI (E1113.m01)](../collection/screen-capture.md)|Capture screenshot (This capa rule had 2 matches) [[2]](#2) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 5 matches) [[2]](#2) | -|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|Get graphical window text (This capa rule had 2 matches) [[2]](#2) | -|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Replace clipboard data (This capa rule had 1 match) [[2]](#2) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Get file version info (This capa rule had 1 match) [[2]](#2) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Get disk size (This capa rule had 1 match) [[2]](#2) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Accept command line arguments (This capa rule had 1 match) [[2]](#2) | +|[Execution::User Execution (E1204)](../execution/user-execution.md)|The malware relies on a victim to execute itself. [[1]](#1)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware will proceed to install itself in order to ensure persistence across system reboots before continuing on to execute the payload. To install itself, Rombertik first creates a VBS script named “fgf.vbs”, which is used to kick off Rombertik every time the user logs in, and places the script into the user’s Startup folder. [[1]](#1)| +|[Collection::Input Capture (E1056)](../collection/input-capture.md)|The malware injects itself into a browser and captures user input data. [[1]](#1)| +|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the user's home folder. [[1]](#1)| +|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Rombertik logs keystrokes via polling. [[2]](#2)| +|[Collection::Screen Capture::WinAPI (E1113.m01)](../collection/screen-capture.md)|Rombertik captures screenshots. [[2]](#2)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Rombertik encodes data using XOR. [[2]](#2)| +|[Discovery::Application Window Discovery::Window Text (E1010.m01)](../discovery/application-window-discovery.md)|Rombertik gets graphical window texts. [[2]](#2)| +|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Rombertik replaces clipboard data. [[2]](#2)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Rombertik gets file version info. [[2]](#2)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Rombertik gets disk sizes. [[2]](#2)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Rombertik accepts command line arguments. [[2]](#2)| + ## MBC Behaviors |Name|Use| |---|---| -|[Anti-Static Analysis::Executable Code Obfuscation::Code Insertion (B0032.002)](../anti-static-analysis/executable-code-obfuscation.md)|Most of the malware file consists of unnecessary code or unnecessary data [[1]](#1) | -|[Anti-Behavior Analysis::Dynamic Analysis Evasion::Data Flood (B0003.002)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The malware stalls by writing a byte of random data to memory 960 million times which complicates analysis. It also calls specific Windows API functions [[1]](#1) | -|[Anti-Behavioral Analysis::Sandbox Detection::Test API Routines (B0007.010)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware check for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[1]](#1) | -|[Anti-Behavioral Analysis::Debugger Detection::OutputDebugString (B0001.016)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware calls the Windows API OutputDebugString function 335,000 times [[1]](#1) | -|[Anti-Behavior Analysis::Debugger Detection::Check Processes (B0001.038)](../anti-behavioral-analysis/virtual-machine-detection.md)|An anti-analysis function within the packer is called to check the username and filename of the executing process for strings like “malwar”, “sampl”, “viru”, and “sandb”. [[1]](#1) | -|[Anti-Behavioral Anlaysis::Dynamic Analysis Evasion::Code Integrity Check (B0003.011)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The function computes a 32-bit hash of a resource in memory, and compares it to the PE Compile Timestamp of the unpacked sample. If the resource or compile time has been altered, the malware acts destructively [[1]](#1) | -|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/domain-name-generation.md)|The malware sends data to the C2 [[1]](#1) | -|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|Check for time delay via GetTickCount (This capa rule had 3 matches) [[2]](#2) | -|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|Contain obfuscated stackstrings (This capa rule had 1 match) [[2]](#2) | -|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Receive data (This capa rule had 6 matches) [[2]](#2) | -|[Command And Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|Send data (This capa rule had 1 match) [[2]](#2) | -|[Communication::Socket Communication::Create TCP Socket (C0001.011)](../micro-behaviors/communication/socket-communication.md)|Create TCP socket (This capa rule had 1 match) [[2]](#2) | -|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Encrypt data using RC4 PRGA (This capa rule had 1 match) [[2]](#2) | -|[Cryptography::Encryption Key::RC4 KSA (C0028.002)](../micro-behaviors/cryptography/encryption-key.md)|Encrypt data using RC4 KSA (This capa rule had 1 match) [[2]](#2) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 5 matches) [[2]](#2) | -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 1 match) [[2]](#2) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 3 matches) [[2]](#2) | -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Write file on Windows (This capa rule had 4 matches) [[2]](#2) | -|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Allocate RWX memory (This capa rule had 2 matches) [[2]](#2) | -|[Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Delete registry key (This capa rule had 1 match) [[2]](#2) | -|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry value (This capa rule had 5 matches) [[2]](#2) | -|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Set registry value (This capa rule had 1 match) [[2]](#2) | -|[Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Create mutex (This capa rule had 1 match) [[2]](#2) | -|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Create thread (This capa rule had 1 match) [[2]](#2) | -|[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Set thread local storage value (This capa rule had 1 match) [[2]](#2) | +|[Anti-Static Analysis::Executable Code Obfuscation::Code Insertion (B0032.002)](../anti-static-analysis/executable-code-obfuscation.md)|Most of the malware file consists of unnecessary code or unnecessary data. [[1]](#1)| +|[Anti-Behavior Analysis::Dynamic Analysis Evasion::Data Flood (B0003.002)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The malware stalls by writing a byte of random data to memory 960 million times which complicates analysis. It also calls specific Windows API functions. [[1]](#1)| +|[Anti-Behavioral Analysis::Sandbox Detection::Test API Routines (B0007.010)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware checks for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[1]](#1)| +|[Anti-Behavioral Analysis::Debugger Detection::OutputDebugString (B0001.016)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware calls the Windows API OutputDebugString function 335,000 times. [[1]](#1)| +|[Anti-Behavior Analysis::Debugger Detection::Check Processes (B0001.038)](../anti-behavioral-analysis/virtual-machine-detection.md)|An anti-analysis function within the packer is called to check the username and filename of the executing process for strings like “malwar”, “sampl”, “viru”, and “sandb”. [[1]](#1)| +|[Anti-Behavioral Anlaysis::Dynamic Analysis Evasion::Code Integrity Check (B0003.011)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The function computes a 32-bit hash of a resource in memory and compares it to the PE Compile Timestamp of the unpacked sample. If the resource or compile time has been altered, the malware acts destructively. [[1]](#1)| +|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/domain-name-generation.md)|The malware sends data to the C2. [[1]](#1) [[2]](#2)| +|[Command And Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Rombertik receives data. [[2]](#2)| +|[Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)](../anti-behavioral-analysis/debugger-detection.md)|Rombertik checks for time delay via GetTickCount. [[2]](#2)| +|[Anti-Static Analysis::Disassembler Evasion::Argument Obfuscation (B0012.001)](../anti-static-analysis/disassembler-evasion.md)|Rombertik contains obfuscated stack strings. [[2]](#2)| +|[Micro-Behaviors::Communication::Socket Communication::Create TCP Socket (C0001.011)](../micro-behaviors/communication/socket-communication.md)|Rombertik creates TCP sockets. [[2]](#2)| +|[Micro-Behaviors::Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Rombertik encrypts data using RC4 PRGA. [[2]](#2)| +|[Micro-Behaviors::Cryptography::Encryption Key::RC4 KSA (C0028.002)](../micro-behaviors/cryptography/encryption-key.md)|Rombertik encrypts data using RC4 KSA. [[2]](#2)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Rombertik encodes data using XOR. [[2]](#2)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Rombertik deletes files. [[2]](#2)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Rombertik reads files on Windows. [[2]](#2)| +|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Rombertik writes files on Windows. [[2]](#2)| +|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Rombertik allocates RWX memory. [[2]](#2)| +|[Micro-Behaviors::Operating System::Registry::Delete Registry Key (C0036.002)](../micro-behaviors/operating-system/registry.md)|Rombertik deletes registry keys. [[2]](#2)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Rombertik queries or enumerates registry values. [[2]](#2)| +|[Micro-Behaviors::Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Rombertik sets registry values. [[2]](#2)| +|[Micro-Behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Rombertik creates a mutex. [[2]](#2)| +|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Rombertik creates a thread. [[2]](#2)| +|[Micro-Behaviors::Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Rombertik sets thread local storage values. [[2]](#2)| ## Indicators of Compromise SHA256 Hashes - 0d11a13f54d6003a51b77df355c6aa9b1d9867a5af7661745882b61d9b75bccf - 77bacb44132eba894ff4cb9c8aa50c3e9c6a26a08f93168f65c48571fdf48e2a + Command-and-Control Servers - www.centozos[.]org[.]in diff --git a/xample-malware/samsam.md b/xample-malware/samsam.md index 8e7a8ed..8db0c30 100644 --- a/xample-malware/samsam.md +++ b/xample-malware/samsam.md @@ -1,7 +1,7 @@
| ID | -X0016 | +X0029 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -24,7 +24,7 @@ # SamSam -Ransomware. +SamSam is ransomware. ## ATT&CK Techniques @@ -35,19 +35,22 @@ See ATT&CK: [SamSam - Techniques Used](https://attack.mitre.org/software/S0370/) |Name|Use| |---|---| -|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|SamSam encrypts data to hold for ransom [[1]](#1) | -|[Execution::Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)](../execution/exploitation-for-client-execution.md)|SamSam uses RDP to maintain persistence [[1]](#1) | -|[Defense Evasion::Obfuscated Files or Information::Encryption of Code (E1027.m07)](../defense-evasion/obfuscated-files-or-information.md)|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV [[2]](#2) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|SamSam uses a batch file for executing the malware and deleting certain components [[3]](#3) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Enumerate files on windows (This capa rule had 1 match) [[4]](#4) | +|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|SamSam encrypts data to hold for ransom. [[1]](#1)| +|[Execution::Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)](../execution/exploitation-for-client-execution.md)|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[5]](#5)| +|[Anti-Static Analysis::Executable Code Obfuscation (B0032)](../anti-static-analysis/executable-code-obfuscation.md)|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [[2]](#2)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|SamSam uses a batch file for executing the malware and deleting certain components. [[3]](#3)| +|[Defense Evasion::Obfuscated Files or Information::Encryption of Code (E1027.m07)](../defense-evasion/obfuscated-files-or-information.md)|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [[2]](#2)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|SamSam enumerates files on Windows. [[4]](#4)| ## MBC Behaviors |Name|Use| |---|---| -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 1 match) [[4]](#4) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 1 match) [[4]](#4) | +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|SamSam deletes files. [[4]](#4)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|SamSam reads files on Windows. [[4]](#4)| + + ## Indicators of Compromise @@ -70,6 +73,7 @@ BTC Wallet Tor Onion Service - jcmi5n4c3mvgtyt5.onion + ## References [1] https://www.cisa.gov/uscert/ncas/alerts/AA18-337A @@ -80,3 +84,4 @@ Tor Onion Service [4] capa v4.0, analyzed at MITRE on 10/12/2022 +[5] https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/ diff --git a/xample-malware/searchawesome.md b/xample-malware/searchawesome.md index 65a80f9..7611748 100644 --- a/xample-malware/searchawesome.md +++ b/xample-malware/searchawesome.md @@ -2,7 +2,7 @@
| ID | -X0017 | +X0030 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -25,25 +25,26 @@ # SearchAwesome -Adware that intercepts encrypted web traffic to inject ads. +SearchAwesome adware intercepts encrypted web traffic to inject ads. ## ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::Subvert Trust Controls (T1553)](https://attack.mitre.org/techniques/T1553/)|The malware uses certificates to gain access to https traffic. [[1]](#1)| +|[Defense Evasion::Subvert Trust Controls (T1553)](https://attack.mitre.org/techniques/T1553/)|The malware uses certificates to gain access to HTTPS traffic. [[1]](#1)| |[Collection::Browser Session Hijacking (T1185)](https://attack.mitre.org/techniques/T1185/)|The malware can modify web traffic for the purpose of injecting Javascript. [[1]](#1)| |[Command and Control::Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|The malware uses mitmproxy to intercept and modify web traffic. [[1]](#1)| |[Collection::Adversary-in-the-Middle (T1557)](https://attack.mitre.org/techniques/T1557/)|After installing a certificate, the malware inserts inself into a chain of custody, typically within network packets. [[1]](#1)| + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Execution::User Execution (E1204)](../execution/user-execution.md)|A user must execute the malicious program. [[1]](#1)| -|[Defense Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|The malware will monitor if a specific file gets deleted, and then will delete itself. [[1]](#1)| +|[Execution::User Execution (E1204)](../execution/user-execution.md)|The user opens a disk image file which invisibly installs its components. [[1]](#1)| +|[Defense Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|The malware will monitor if a specific file gets deleted and then will delete itself. [[1]](#1)| |[Privilege Escalation::Install Certificate (E1608)](../privilege-escalation/install-certificate.md)|The malware installs a certificate. [[1]](#1)| -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The malware installs a script to inject JavaScript script and modify web traffic. [[1]](#1)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The malware installs a script to inject a JavaScript script and modify web traffic. [[1]](#1)| ## MBC Behaviors @@ -51,7 +52,7 @@ Adware that intercepts encrypted web traffic to inject ads. |Name|Use| |---|---| |[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)| The malware receives data from the C2 server. [[1]](#1)| -|[Impact::Manipulate Network Traffic (B0019)](../impact/manipulate-network-traffic.md)|Intercepts encrypted web traffic to inject adds. [[1]](#1)| +|[Impact::Manipulate Network Traffic (B0019)](../impact/manipulate-network-traffic.md)|SearchAwesome intercepts encrypted web traffic to inject ads. [[1]](#1)| |[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|The malware installs an open-source program called mitmproxy. [[1]](#1)| ## Indicators of Compromise @@ -62,9 +63,6 @@ Adware that intercepts encrypted web traffic to inject ads. - ~/Library/SPI/ - ~/.mitmproxy/ -SHA256 Hashes -- Unavailable - ## References diff --git a/xample-malware/shamoon.md b/xample-malware/shamoon.md index 28834a3..9a8e03c 100644 --- a/xample-malware/shamoon.md +++ b/xample-malware/shamoon.md @@ -1,7 +1,7 @@
| ID | -X0018 | +X0031 | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -24,56 +24,59 @@ # Shamoon -Data wiping malware. +Shamoon is a data wiping malware. ## ATT&CK Techniques |Name|Use| |---|---| -|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057)|Enumerate processes (This capa rule had 1 match) [[5]](#5) | -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Link many functions at runtime (This capa rule had 1 match) [[5]](#5) | -|[Execution::System Services::Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002)|Create service (This capa rule had 1 match) [[5]](#5) | -|[Persistence::Create or Modify System Process::Windows Service (T1543.003)](https://attack.mitre.org/techniques/T1543/003)|Start service (This capa rule had 1 match) [[5]](#5) | +|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057)|Shamoon enumerates processes. [[5]](#5)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Shamoon links many functions at runtime. [[5]](#5)| +|[Execution::System Services::Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002)|Shamoon creates services. [[5]](#5)| +|[Persistence::Create or Modify System Process::Windows Service (T1543.003)](https://attack.mitre.org/techniques/T1543/003)|Shamoon starts services. [[5]](#5)| See ATT&CK: [Shamoon - Techniques Used](https://attack.mitre.org/software/S0140/). + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery [[1]](#1) | -|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Shamoon enables the RemoteRegistry service to allow remote registry modification [[2]](#2) | -|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|Disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy [[2]](#2) | -|[Defense Evasion::Hidden Files and Directories::Timestamp (F0005.004)](../defense-evasion/hidden-files-and-directories.md)|Modifies target files' time to August 2012 as an antiforensic trick [[2]](#2) | -|[Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)](../defense-evasion/hijack-execution-flow.md)|Escalates privilege by impersonating the token. First uses LogonUser and ImpersonateLoggedOnUser, then ImpersonateNamedPipeClient. [[2]](#2) | -|[Impact::Disk Wipe (F0014)](../impact/disk-wipe.md)|An overwrite component will overwrite the MBR so that the compromised computer can no longer start [[4]](#4) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion [[2]](#2) | -|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|Creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory [[3]](#3) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 1 match) [[5]](#5) | -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Get common file path (This capa rule had 1 match) [[5]](#5) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Get hostname (This capa rule had 1 match) [[5]](#5) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Accept command line arguments (This capa rule had 1 match) [[5]](#5) | +|[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|A 2018 variant includes a component that erases files and then wipes the Master Boot Record (MBR), preventing file recovery. [[1]](#1)| +|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Shamoon enables the RemoteRegistry service to allow remote registry modification. [[2]](#2)| +|[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|Shamoon disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy. [[2]](#2)| +|[Defense Evasion::Hidden Files and Directories::Timestamp (F0005.004)](../defense-evasion/hidden-files-and-directories.md)|Shamoon modifies target files' time to August 2012 as an antiforensic trick. [[2]](#2)| +|[Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)](../defense-evasion/hijack-execution-flow.md)|Malware escalates privileges by impersonating the token through using LogonUser and ImpersonateLoggedOnUser then ImpersonateNamedPipeClient. [[2]](#2)| +|[Impact::Disk Wipe (F0014)](../impact/disk-wipe.md)|An overwrite component will overwrite the MBR so that the compromised computer can no longer start. [[4]](#4)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion. [[2]](#2)| +|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|Shamoon creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory. [[3]](#3)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Shamoon encodes data using XOR. [[5]](#5)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Shamoon gets a common file path. [[5]](#5)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Shamoon gets the hostname. [[5]](#5)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Shamoon accepts command line arguments. [[5]](#5)| + ## MBC Behaviors |Name|Use| |---|---| -|[Anti-Behavioral Analysis::Conditional Execution::Runs as Service (B0025.007)](../execution/conditional-execution.md)|Run as service (This capa rule had 1 match) [[5]](#5) | -|[Communication::DNS Communication::Resolve (C0011.001)](../micro-behaviors/communication/dns-communication.md)|Resolve DNS (This capa rule had 1 match) [[5]](#5) | -|[Communication::Socket Communication::Initialize Winsock Library (C0001.009)](../micro-behaviors/communication/socket-communication.md)|Initialize Winsock library (This capa rule had 1 match) [[5]](#5) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 1 match) [[5]](#5) | -|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Copy file (This capa rule had 2 matches) [[5]](#5) | -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 6 matches) [[5]](#5) | -|[File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Move file (This capa rule had 2 matches) [[5]](#5) | -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Read file on Windows (This capa rule had 1 match) [[5]](#5) | -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Write file on Windows (This capa rule had 1 match) [[5]](#5) | -|[Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Delete registry value (This capa rule had 1 match) [[5]](#5) | -|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Query or enumerate registry value (This capa rule had 1 match) [[5]](#5) | -|[Process::Allocate Thread Local Storage (C0040)](../micro-behaviors/process/allocate-thread-local-storage.md)|Allocate thread local storage (This capa rule had 1 match) [[5]](#5) | -|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Create process on Windows (This capa rule had 2 matches) [[5]](#5) | -|[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Create thread (This capa rule had 2 matches) [[5]](#5) | -|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Terminate process (This capa rule had 1 match) [[5]](#5) | +|[Execution::Conditional Execution::Runs as Service (B0025.007)](../execution/conditional-execution.md)|Shamoon runs as a service. [[5]](#5)| +|[Micro-Behaviors::Communication::DNS Communication::Resolve (C0011.001)](../micro-behaviors/communication/dns-communication.md)|Shamoon resolves DNS. [[5]](#5)| +|[Micro-Behaviors::Communication::Socket Communication::Initialize Winsock Library (C0001.009)](../micro-behaviors/communication/socket-communication.md)|Shamoon initializes a Winsock library. [[5]](#5)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Shamoon encodes data using XOR. [[5]](#5)| +|[Micro-Behaviors::File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)|Shamoon copies files. [[5]](#5)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Shamoon deletes files. [[5]](#5)| +|[Micro-Behaviors::File System::Move File (C0063)](../micro-behaviors/file-system/move-file.md)|Shamoon moves files. [[5]](#5)| +|[Micro-Behaviors::File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|Shamoon reads files on Windows. [[5]](#5)| +|[Micro-Behaviors::File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Shamoon writes files on Windows. [[5]](#5)| +|[Micro-Behaviors::Operating System::Registry::Delete Registry Value (C0036.007)](../micro-behaviors/operating-system/registry.md)|Shamoon deletes registry values. [[5]](#5)| +|[Micro-Behaviors::Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Shamoon queries or enumerates registry values. [[5]](#5)| +|[Micro-Behaviors::Process::Allocate Thread Local Storage (C0040)](../micro-behaviors/process/allocate-thread-local-storage.md)|Shamoon allocates thread local storage. [[5]](#5)| +|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Shamoon creates a process on Windows. [[5]](#5)| +|[Micro-Behaviors::Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Shamoon creates a thread. [[5]](#5)| +|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Shamoon terminates processes. [[5]](#5)| + ## Indicators of Compromise @@ -81,6 +84,7 @@ SHA256 Hashes - c617120895646f73bc880c0aca18990deda3db9be03f6b3564013e26dedfa3f9 - 4f02a9fcd2deb3936ede8ff009bd08662bdb1f365c0f4a78b3757a98c2f40400 + ## References [1] https://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow diff --git a/xample-malware/stuxnet.md b/xample-malware/stuxnet.md index c13e615..eff2804 100644 --- a/xample-malware/stuxnet.md +++ b/xample-malware/stuxnet.md @@ -1,7 +1,7 @@
| ID | -X0019 | +X0032 | ||||||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -24,14 +24,14 @@ # Stuxnet -A malicious worm targeting SCADA systems. +Stuxnet is a malicious worm targeting SCADA systems. ## ATT&CK Techniques |Name|Use| |---|---| -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Parse PE header (This capa rule had 2 matches) [[2]](#2) | +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Stuxnet parses PE headers. [[2]](#2)| See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/). @@ -39,32 +39,35 @@ See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/ |Name|Use| |---|---| -|[Defense Evasion::Hijack Execution Flow::Import Address Table Hooking (F0015.003)](../defense-evasion/hijack-execution-flow.md)|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet. [[1]](#1) | -|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001)](../defense-evasion/process-injection.md)|Stuxnet injects the entire DLL into another process and then just calls the particular export [[1]](#1) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the net to spread itself [[1]](#1) | -|[Anti-Static Analysis::Obfuscated Files or Information::Encoding (E1027.m01)](../defense-evasion/obfuscated-files-or-information.md)|The configuration data block is encoded with a NOT XOR 0xFF operation [[1]](#1) | -|[Defense Evasion::Rootkit::Kernel Mode Rootkit (E1014.m17)](../defense-evasion/rootkit.md)|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate [[1]](#1) | -|[Defense Evasion::Process Injection::Injection and Persistence via Registry Modification (E1055.m05)](../defense-evasion/process-injection.md)|The driver Stuxnet uses for persistence Mrxcls.sys is registered as a boot start service creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys" [[1]](#1) | -|[Exfiltration::Archive Collected Data::Encoding - Custom Encoding (E1560.m04)](../exfiltration/archive-collected-data.md)|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers [[1]](#1) | -|[Defense Evasion::Hide Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removalbe drives [[1]](#1) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell [[1]](#1) | -|[Defense Evasion::Hijack Execution Flow::Procedure Hooking (F0015.007)](../defense-evasion/hijack-execution-flow.md)|WTR4141.tmp hooks APIs from kernel32.dll and Ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[1]](#1) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 3 matches) [[2]](#2) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Check OS version (This capa rule had 1 match) [[2]](#2) | +|[Defense Evasion::Hijack Execution Flow::Import Address Table Hooking (F0015.003)](../defense-evasion/hijack-execution-flow.md)|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names, which are mapped to a location specified by Stuxnet. [[1]](#1)| +|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001)](../defense-evasion/process-injection.md)|Stuxnet injects the entire DLL into another process and then calls the particular export. [[1]](#1)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Stuxnet gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the network to spread itself. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information::Encoding (E1027.m01)](../defense-evasion/obfuscated-files-or-information.md)|The configuration data block is encoded with a NOT XOR 0xFF operation. [[1]](#1)| +|[Defense Evasion::Rootkit::Kernel Mode Rootkit (E1014.m16)](../defense-evasion/rootkit.md)|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate. [[1]](#1)| +|[Defense Evasion::Process Injection::Injection and Persistence via Registry Modification (E1055.m02)](../defense-evasion/process-injection.md)|Stuxnet uses Mrxcls.sys driver for persistence. It is registered as a boot start service by creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys". [[1]](#1)| +|[Exfiltration::Archive Collected Data::Encoding - Custom Encoding (E1560.m04)](../exfiltration/archive-collected-data.md)|Stuxnet exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers. [[1]](#1)| +|[Defense Evasion::Hide Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications, such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removable drives. [[1]](#1)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell. [[1]](#1)| +|[Defense Evasion::Hijack Execution Flow::Procedure Hooking (F0015.007)](../defense-evasion/hijack-execution-flow.md)|WTR4141.tmp hooks APIs from kernel32.dll and ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Stuxnet encodes data using XOR. [[2]](#2)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Stuxnet checks OS version. [[2]](#2)| + ## MBC Behaviors |Name|Use| |---|---| -|[Impact::Destroy Hardware (B0017)](../impact/destroy-hardware.md)|Stuxnet made the centrifuges at Iran's nuclear plant spin dangerously fast for 15 minutes, before returning to normal speed. About a month later, it slowed the centrifuges down for 50 minutes. This was repeated for several months, and over the strain destroyed the machines [[1]](#1)| -|[Micro-Objective::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Creates global mutexes signal that rootkit installation has occurred successfully [[1]](#1)| -|[Micro-Objective::Process::Create Process::Create Process via WMI (C0017.002)](../micro-behaviors/process/create-process.md)|Stuxnet will use WMI operations with the explorere.exe token in order to copy itself and exscute on the remote share [[1]](#1)| -|[Execution::Conditional Execution::Host Fingerprint Check (B0025.004)](../execution/conditional-execution.md)|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution [[1]](#1)| -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 3 matches) [[2]](#2)| -|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[2]](#2)| -|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Delete file (This capa rule had 1 match) [[2]](#2)| -|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Allocate RWX memory (This capa rule had 1 match) [[2]](#2)| -|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Terminate process (This capa rule had 1 match) [[2]](#2)| +|[Impact::Destroy Hardware (B0017)](../impact/destroy-hardware.md)|Stuxnet made the centrifuges at Iran's nuclear plant spin dangerously fast for 15 minutes, before returning to normal speed. About a month later, it slowed the centrifuges down for 50 minutes. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1) [[3]](#3)| +|[Micro-behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[1]](#1)| +|[Micro-behaviors::Process::Create Process::Create Process via WMI (C0017.002)](../micro-behaviors/process/create-process.md)|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)| +|[Execution::Conditional Execution::Host Fingerprint Check (B0025.004)](../execution/conditional-execution.md)|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[1]](#1)| +|[Anti-Behavioral Analysis::Emulator Detection (B0004)](../anti-behavioral-analysis/emulator-detection.md)|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[1]](#1)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Stuxnet encodes data using XOR. [[2]](#2)| +|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Stuxnet enumerates PE sections. [[2]](#2)| +|[Micro-Behaviors::File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)|Stuxnet deletes files. [[2]](#2)| +|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Stuxnet allocates RWX memory. [[2]](#2)| +|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Stuxnet terminates processes. [[2]](#2)| + ## Indicators of Compromise @@ -78,3 +81,4 @@ SHA256 Hashes [2] capa v4.0, analyzed at MITRE on 10/12/2022 +[3] https://www.bbc.com/timelines/zc6fbk7 \ No newline at end of file diff --git a/xample-malware/synful-knock.md b/xample-malware/synful-knock.md index 5c55fb7..8fe10b1 100644 --- a/xample-malware/synful-knock.md +++ b/xample-malware/synful-knock.md @@ -2,7 +2,7 @@
| ID | -X0020 | +X0033 | ||||||||||||||||||||||||||||||||||||||||||
| Aliases | @@ -25,28 +25,25 @@ # SYNful Knock -A modification of the router's firmware images used to maintain persistence. [[1]](#1) +SYNful Knock is a modification of the router's firmware images used to maintain persistence. [[1]](#1) + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Persistence::Component Firmware::Router Firmware (F0009.001)](../persistence/component-firmware.md)|Modification of the router's firmware image that can be used to maintain persistence within a victim's network [[1]](#1)| -|[Defense Evasion::Hijack Execution Flow (F0015)](../defense-evasion/hijack-execution-flow.md)|Hooks IOS functions to call and initialize the malware [[1]](#1)| +|[Persistence::Component Firmware::Router Firmware (F0009.001)](../persistence/component-firmware.md)|SYNful Knock is a stealthy modification of the router's firmware image that can be used to maintain persistence within a victim's network. [[1]](#1)| +|[Defense Evasion::Hijack Execution Flow (F0015)](../defense-evasion/hijack-execution-flow.md)|SYNful Knock hooks iOS functions to call and initialize the malware. [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Micro-Objective::Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|Modifies the translation lookaside buffer (TLB) Read/Write attributes [[1]](#1)| -|[Micro-objective::Communication::Socket Communication::Send TCP Data (C0001.014)](../micro-behaviors/communication/socket-communication.md)|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router [[1]](#1)| -|[Defense Evasion::Alternative Installation Location::Fileless Malware (B0027.001)](../defense-evasion/alternative-installation-location.md)|100 memory-resident modules can be installed [[1]](#1)| +|[Micro-behaviors::Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|SYNful Knock modifies the translation lookaside buffer (TLB) Read/Write attributes. [[1]](#1)| +|[Micro-behaviors::Communication::Socket Communication::Send TCP Data (C0001.014)](../micro-behaviors/communication/socket-communication.md)|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router. [[1]](#1)| +|[Defense Evasion::Alternative Installation Location::Fileless Malware (B0027.001)](../defense-evasion/alternative-installation-location.md)|100 memory-resident modules can be installed. [[1]](#1)| -## Indicators of Compromise - -SHA256 Hashes -- Unavailable ## References diff --git a/xample-malware/teardrop.md b/xample-malware/teardrop.md new file mode 100644 index 0000000..69aaed7 --- /dev/null +++ b/xample-malware/teardrop.md @@ -0,0 +1,59 @@ + +
| ID | +X0034 | +
| Aliases | +None | +
| Platforms | +Windows | +
| Year | +2018 | +
| Associated ATT&CK Software | +TEARDROP | +
| ID | -X0021 | +X0035 | ||||||||||||||||||||||||||||
| Aliases | @@ -25,30 +25,33 @@ # Terminator -A remote access tool (RAT). +Terminator is a remote access tool (RAT). ## ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks (T1497)](https://attack.mitre.org/techniques/T1497/)|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[2]](#2)| +|[Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks (T1497)](https://attack.mitre.org/techniques/T1497/)|The Terminator RAT evades sandboxes by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[2]](#2)| + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::Self Deletion (F0007.001)](../defense-evasion/self-deletion.md)|Evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[2]](#2)| -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Sets "2019" as Windows' startup folder by modifying a registry value. [[1]](#1)| -|[Execution::User Execution (E1204)](../execution/user-execution.md)|The malware relies on user interaction to execute [[2]](#2)| +|[Defense Evasion::Self Deletion (F0007.001)](../defense-evasion/self-deletion.md)|The RAT evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[2]](#2)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The RAT sets "2019" as a Windows' startup folder by modifying a registry value. [[1]](#1)| +|[Execution::User Execution (E1204)](../execution/user-execution.md)|The malware relies on user interaction to execute. [[2]](#2)| ## MBC Behaviors |Name|Use| |---|---| -|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends data to C2 [[2]](#2)| -|[Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution (B0003.003)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[1]](#1)| +|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends data to the C2. [[2]](#2)| +|[Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution (B0003.003)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[1]](#1)| +|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[1]](#1)| + ## Indicators of Compromise diff --git a/xample-malware/trickbot.md b/xample-malware/trickbot.md index fd41ad9..5f4c284 100644 --- a/xample-malware/trickbot.md +++ b/xample-malware/trickbot.md @@ -1,7 +1,7 @@
| ID | -X0025 | +X0036 | ||||||||||||||||||||||||
| Aliases | @@ -24,14 +24,14 @@ # TrickBot -Trojan spyware program that has mainly been used for targeting banking sites. TrickBot is written in the C++ programming language. +TrickBot is a trojan spyware program that has mainly been used for targeting banking sites. TrickBot is written in the C++ programming language. ## ATT&CK Techniques |Name|Use| |---|---| -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Parse PE header (This capa rule had 2 matches) [[7]](#7) | +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|TrickBot parses PE headers. [[7]](#7)| See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/). @@ -39,36 +39,40 @@ See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266 |Name|Use| |---|---| -|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Collects local files with specified file extensions and information from the victim's machine [[1]](#1) | -|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)|Has a custom packer to obfuscate itself [[1]](#1) | -|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Injects itself into svchost.exe [[2]](#2) | -|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Has an auto-start service that allows it to run whenever the machine boots [[3]](#3) | -|[Defense Evasion::Indicator Blocking (F0006)](../defense-evasion/indicator-blocking.md)|Terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV) [[3]](#3) | -|[Exfiltration::Archive Collected Data::Encryption (E1560.m02)](../exfiltration/archive-collected-data.md)|Uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt [[4]](#4) | -|[Defense Evasion::Bootkit (F0013)](../defense-evasion/bootkit.md)|Can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware [[5]](#5) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Can collect information about the compter, resources, services, installed programs, firmware, and operating system version [[1]](#1) | -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Encode data using XOR (This capa rule had 2 matches) [[7]](#7) | -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Accept command line arguments (This capa rule had 1 match) [[7]](#7) | +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware collects machine information and local files with specified file extensions. [[1]](#1)| +|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)|The malware has a custom packer to obfuscate itself. [[1]](#1)| +|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects itself into svchost.exe. [[2]](#2)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware has an auto-start service that allows it to run whenever the machine boots. [[3]](#3)| +|[Defense Evasion::Disable or Evade Security Tool (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|The malware terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [[3]](#3)| +|[Exfiltration::Archive Collected Data::Encryption (E1560.m02)](../exfiltration/archive-collected-data.md)|The malware uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt. [[4]](#4)| +|[Defense Evasion::Bootkit (F0013)](../defense-evasion/bootkit.md)|The malware can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware. [[5]](#5)| +|[Lateral Movement::Supply Chain Compromise (E1195)](../lateral-movement/supply-chain-compromise.md)|TrickBot comes with a signed downloader component. [[5]](#5)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|The malware collects information about the computer, resources, services, installed programs, firmware, and operating system versions. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|TrickBot encodes data using XOR. [[7]](#7)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|TrickBot accepts command line arguments. [[7]](#7)| + ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|Receives various commands from c2 server. [[2]](#2) | -|[Micro-Objective::Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|Uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files [[1]](#1) | -|[Anti-Behavioral Analysis::Dynamic Analysis Evasion (B0003.012)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|Uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering) [[6]](#6) | -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Encode data using XOR (This capa rule had 2 matches) [[7]](#7) | -|[Discovery::Code Discovery::Inspect Section Memory Permissions (B0046.002)](../discovery/code-discovery.md)|Inspect section memory permissions (This capa rule had 2 matches) [[7]](#7) | -|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Allocate RWX memory (This capa rule had 7 matches) [[7]](#7) | -|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Create process on Windows (This capa rule had 1 match) [[7]](#7) | -|[Process::Create Process::Create Suspended Process (C0017.003)](../micro-behaviors/process/create-process.md)|Create process suspended (This capa rule had 1 match) [[7]](#7) | -|[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Terminate process (This capa rule had 1 match) [[7]](#7) | -|[Impact::Spamming (B0039)](../impact/spamming.md)|TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails [[8]](#8)| +|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|The malware receives various commands from the C2 server. [[2]](#2)| +|[Micro-behaviors::Cryptography::Encrypt Data::AES (C0027.001)](../micro-behaviors/cryptography/encrypt-data.md)|The malware uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files. [[1]](#1)| +|[Anti-Behavioral Analysis::Dynamic Analysis Evasion (B0003.012)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The malware uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering). [[6]](#6)| +|[Impact::Spamming (B0039)](../impact/spamming.md)|In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[8]](#8)| +|[Micro-Behaviors::Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|TrickBot encodes data using XOR. [[7]](#7)| +|[Discovery::Code Discovery::Inspect Section Memory Permissions (B0046.002)](../discovery/code-discovery.md)|TrickBot inspects section memory permissions. [[7]](#7)| +|[Micro-Behaviors::Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|TrickBot allocates RWX memory. [[7]](#7)| +|[Micro-Behaviors::Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|TrickBot creates a process on Windows. [[7]](#7)| +|[Micro-Behaviors::Process::Create Process::Create Suspended Process (C0017.003)](../micro-behaviors/process/create-process.md)|TrickBot creates a suspended process. [[7]](#7)| +|[Micro-Behaviors::Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|TrickBot terminates processes. [[7]](#7)| + ## Indicators of Compromise SHA256 Hashes - a162bb9219a09b302b90bc6f908e117e3fb2c722560336d378fd76a8f22f78f8 + MD5 Hashes - 28661ea73413822c3b5b7de1bef0b246 - 218613f0f1d2780f08e754be9e6f8c64 @@ -76,6 +80,7 @@ MD5 Hashes - 719578c91b4985d1f955f6adb688314f - 132c4338cdc46a0a286abf574d68e2e0 - e8e7b0a8f274cad7bdaedd5a91b5164d + Yara Rules - rule MALW_trickbot_bankBot : Trojan { meta: author = "Marc Salinas @Bondey_m" description = "Detects Trickbot Banking Trojan" strings: $str_trick_01 = "moduleconfig" $str_trick_02 = "Start" $str_trick_03 = "Control" $str_trick_04 = "FreeBuffer" $str_trick_05 = "Release" condition: all of ($str_trick_*) } - rule MALW_systeminfo_trickbot_module : Trojan { meta: author = "Marc Salinas @Bondey_m" description = "Detects systeminfo module from Trickbot Trojan" strings: $str_systeminf_01 = "" $str_systeminf_02 = "" $str_systeminf_03 = "" $str_systeminf_04 = "GetSystemInfo.pdb" $str_systeminf_05 = "" $str_systeminf_06 = "" condition: all of ($str_ systeminf_*) } @@ -99,3 +104,4 @@ Yara Rules [7] capa v4.0, analyzed at MITRE on 10/12/2022 [8] https://techcrunch.com/2019/07/12/trickbot-spam-millions-emails/ + diff --git a/xample-malware/up007.md b/xample-malware/up007.md index c68cf81..46f0e23 100644 --- a/xample-malware/up007.md +++ b/xample-malware/up007.md @@ -1,7 +1,7 @@
| ID | -X0033 | +X0037 |
| Aliases | @@ -22,64 +22,67 @@
| ID | -X0022 | +X0038 | ||||||||||||||||
| Aliases | @@ -24,13 +24,14 @@ # Ursnif -A banking trojan that uses malware macros to evade sandbox detection. Variant of Gozi. +Ursnif is a variant of Gozi. It is a banking trojan that uses malware macros to evade sandbox detection. + ## ATT&CK Techniques |Name|Use| |---|---| -|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Get keyboard layout (This capa rule had 1 match) [[6]](#6) | +|[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Ursnif gets keyboard layouts. [[6]](#6)| See ATT&CK: [Ursnif - Techniques Used](https://attack.mitre.org/software/S0386/). @@ -38,26 +39,29 @@ See ATT&CK: [Ursnif - Techniques Used](https://attack.mitre.org/software/S0386/) |Name|Use| |---|---| -|[Persistance::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Adds registry entries to ensure automatic execution at every system startup [[4]](#4) | -|[Defense Evasion::Hijack Execution Flow (F0015)](../defense-evasion/hijack-execution-flow.md)|Hooks various DLL exported functions when the component is loaded in their respective Browser application process is running to monitor network traffic [[4]](#4) | -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Uses windows command prompt commands to gather system info, task list, installed drivers, and installed programs [[4]](#4) | -|[Collection::Input Capture (E1056)](../collection/input-capture.md)|Injects HTML into browser session to collect sensitive online banking information when the victim performs their online banking [[5]](#5) | -|[Anti-Static Analysis::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|Creates an encrypted Registry key called TorClient to store its data [[2]](#2) | -|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Log keystrokes via polling (This capa rule had 1 match) [[6]](#6) | +|[Persistance::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware adds registry entries to ensure automatic execution at system startup. [[4]](#4)| +|[Defense Evasion::Hijack Execution Flow (F0015)](../defense-evasion/hijack-execution-flow.md)|The malware hooks various DLL exported functions when the DLL component is loaded into their respective browser application to monitor network traffic. [[4]](#4)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|The malware uses Window's command prompt commands to gather system info, task list, installed drivers, and installed programs. [[4]](#4)| +|[Collection::Input Capture (E1056)](../collection/input-capture.md)|The malware injects HTML into a browser session to collect sensitive online banking information when the victim performs their online banking. [[5]](#5)| +|[Defense Evasion::Obfuscated Files or Information (E1027)](../anti-static-analysis/executable-code-obfuscation.md)|The malware creates an encrypted Registry key called TorClient to store its data. [[2]](#2)| +|[Impact::Exploit Kit (E1190)](../impact/exploit-kit.md)|Ursnif is sometimes delivered via exploit kit. [[7]](#7)| +|[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Ursnif logs keystrokes via polling. [[6]](#6)| + ## MBC Behaviors |Name|Use| |---|---| -|[Anti-Behavioral Analysis::Sandbox Detection::Self Check (B0007.007)](../anti-behavioral-analysis/sandbox-detection.md)|Ursnif uses malware macros to evade sandbox detection - checking whether the filename contains only hexadecimal characters before the extension [[1]](#1) | -|[Execution::Conditional Execution (B0025.004)](../execution/conditional-execution.md)|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.) [1] [[1]](#1) | -|[Anti-Behavioral Analysis::Virtual Machine Detection::Check Processes (B0009.004)](../anti-behavioral-analysis/virtual-machine-detection.md)|Checks if there are virtual machine processes running (Vbox, vmware, etc) [[1]](#1) | -|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|Ursnif has used a Domain name generation algorithm in the past [[2]](#2) | -|[Command and Control::C2 Communication::Authenticate (B0030.011)](../command-and-control/c2-communication.md)|Ursnif variant Dreambot authenticates and encrypts traffic to C2 server using TOR [[2]](#2) | -|[Anti-Behavioral Analysis::Debugger Detection::TLS Callbacks (B0001.028)](../anti-behavioral-analysis/debugger-detection.md)|Manipulates TLS Callbacks while injecting to child process [[3]](#3) | -|[Micro-Behavior::Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|Changes the PE header of the child process to enable write access to that page, writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe process executable in the target child process. Then changes the region protection back to "read only" to avoid suspicion [[3]](#3) | -|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|Commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, upload a log file which contains stolen information [[5]](#5) | -|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[6]](#6) | +|[Anti-Behavioral Analysis::Sandbox Detection::Self Check (B0007.007)](../anti-behavioral-analysis/sandbox-detection.md)|Ursnif uses malware macros to evade sandbox detection - checking whether the filename contains only hexadecimal characters before the extension. [[1]](#1)| +|[Execution::Conditional Execution (B0025.004)](../execution/conditional-execution.md)|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.). [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Check Processes (B0009.004)](../anti-behavioral-analysis/virtual-machine-detection.md)|The malware checks if there are virtual machine processes running (Vbox, vmware, etc). [[1]](#1)| +|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|Previous interations of Ursnif have used a Domain Name Generation algorithm. [[2]](#2)| +|[Command and Control::C2 Communication::Authenticate (B0030.011)](../command-and-control/c2-communication.md)|Ursnif variant Dreambot authenticates and encrypts traffic to the C2 server using TOR. [[2]](#2)| +|[Anti-Behavioral Analysis::Debugger Detection::TLS Callbacks (B0001.028)](../anti-behavioral-analysis/debugger-detection.md)|The malware manipulates TLS Callbacks while injecting into a child process. [[3]](#3)| +|[Micro-Behaviors::Memory::Change Memory Protection (C0008)](../micro-behaviors/memory/change-memory-protection.md)|The malware changes the PE header of the child process to enable write access to that page and writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe in the target child process. The region protection is changed back to "read only" to avoid suspicion. [[3]](#3)| +|[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|The malware commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download and execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, and upload a log file which contains stolen information. [[5]](#5)| +|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Ursnif enumerates PE sections. [[6]](#6)| + ## Indicators of Compromise @@ -65,6 +69,7 @@ SHA256 Hashes - 6464cf93832a5188d102cce498b4f3be0525ea1b080fec9c4e12fae912984057 - 0b05fb5b97bfc3c82f46b8259a88ae656b1ad294e4c1324d8e8ffd59219005ac - 9350609c8c806a9c1a667fd53926ea85745e1da239df7f3c2aad3e3527bd48d1 + URLS, IPs, and Domains - hxxp://62.138.9[.]11/30030u - hxxp://62.138.9[.]11/vnc32.dll @@ -92,3 +97,4 @@ URLS, IPs, and Domains [6] capa v4.0, analyzed at MITRE on 10/12/2022 +[7] https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif diff --git a/xample-malware/vobfus.md b/xample-malware/vobfus.md new file mode 100644 index 0000000..f7adb3a --- /dev/null +++ b/xample-malware/vobfus.md @@ -0,0 +1,83 @@ + +
| ID | +X0039 | +
| Aliases | +None | +
| Platforms | +Windows | +
| Year | +2016 | +
| Associated ATT&CK Software | +None | +
| ID | -X0023 | +X0040 | ||
| Aliases | @@ -25,39 +25,44 @@ # WebCobra -Cryptojacking malware. [[1]](#1) +WebCobra is cryptojacking malware. [[1]](#1) ## ATT&CK Techniques |Name|Use| |---|---| -|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057/)| [[1]](#1)| -|[Discovery::System Time Discovery (T1124)](https://attack.mitre.org/techniques/T1124/)| [[1]](#1)| -|[Discovery::Software Discovery::Security Software Discovery (T1518.001)](https://attack.mitre.org/techniques/T1518/001/)|Learns about security software. [[1]](#1)| -|[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)| [[1]](#1)| -|[Defense Evasion::Indicator Removal on Host::File Deletion (T1070.004)](https://attack.mitre.org/techniques/T1070/004/)| [[1]](#1)| +|[Discovery::File and Directory Discovery (T1083)](https://attack.mitre.org/techniques/T1083/)|The malware searches for various files and directories. [[1]](#1)| +|[Discovery::Query Registry (T1012)](https://attack.mitre.org/techniques/T1012/)|The malware queries certain registry keys. [[1]](#1)| +|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057/)|The malware identifies running processes on the system. [[1]](#1)| +|[Discovery::System Time Discovery (T1124)](https://attack.mitre.org/techniques/T1124/)|The malware identifies the time/time zone on the system. [[1]](#1)| +|[Discovery::Software Discovery::Security Software Discovery (T1518.001)](https://attack.mitre.org/techniques/T1518/001/)|The malware learns about security software on the system. [[1]](#1)| +|[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)|The malware drops encrypted files and decrypts them on the system. [[1]](#1)| +|[Defense Evasion::Indicator Removal on Host::File Deletion (T1070.004)](https://attack.mitre.org/techniques/T1070/004/)|The malware deletes files to evade detection. [[1]](#1)| + ## Enhanced ATT&CK Techniques |Name|Use| |---|---| -|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Learns about the system so it can drop compatible miner software. [[1]](#1)| -|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)| -|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|Obfuscates files. [[1]](#1)| -|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Injects miner code into a running process. [[1]](#1)| -|[Defense Evasion::Disable or Evade Security Tools (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Malware learns about the system so it can drop compatible miner software. [[1]](#1)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|From the command line, the malware drops and unzips a password-protected Cabinet archive file. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|The dropped file is password-protected. Once unzipped, the file contains a DLL file to decrypt the second file (a bin file with an encrypted malicious payload). [[1]](#1)| +|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects miner code into a running process. [[1]](#1)| +|[Defense Evasion::Disable or Evade Security Tools (E1089)](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being identified by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Downloads and executes Claymore's Zcash miner from a remote server. [[1]](#1)| -|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)| -|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|Drops software that mines for cryptocurrency: Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)| -|[Anti-Behavioral Analysis::Dynamic Analysis Evasion (B0003)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|Evades dynamic analysis. [[1]](#1)| -|[Anti-Behavioral Analysis::Emulator Evasion (B0005)](../anti-behavioral-analysis/emulator-evasion.md)|Evades emulator-based analysis. [[1]](#1)| -|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment. [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|The malware downloads and executes Claymore's Zcash miner from a remote server. [[1]](#1)| +|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|The malware executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)| +|[Impact::Resource Hijacking::Cryptojacking (B0018.002)](../impact/resource-hijacking.md)|The malware drops software that mines for cryptocurrency, depending on the system architecture. If the system has x86 architecture, the malware drops Cryptonight miner. If the system has x64 architecture, the malware drops Claymore's Zcash miner. [[1]](#1)| +|[Anti-Behavioral Analysis::Dynamic Analysis Evasion::Alternative ntdll.dll (B0003.001)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The malware loads ntdll.dll and user32.dll as data files and overwrites the first 8 bytes of those functions to avoid API hooking by security products. [[1]](#1)| +|[Anti-Behavioral Analysis::Emulator Evasion::Extra Loops/Time Locks (B0005.004)](../anti-behavioral-analysis/emulator-evasion.md)|The malware evades emulator-based analysis by using an infinite loop to check all open windows and compare each window's title bar to a list of strings. [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Check Windows - Title Bars (B0009.022)](../anti-behavioral-analysis/virtual-machine-detection.md)|WebCobra injects malicious code in to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in a VM. [[1]](#1)| +|[Discovery::Analysis Tool Discovery::Process Detection - PCAP Utilities (B0013.004)](../discovery/analysis-tool-discovery.md)|When infecting a x64 architecture system, the malware terminates if Wireshark is running on the system. [[1]](#1)| + ## Indicators of Compromise diff --git a/xample-malware/yispecter.md b/xample-malware/yispecter.md index 32cb888..84e9b05 100644 --- a/xample-malware/yispecter.md +++ b/xample-malware/yispecter.md @@ -2,7 +2,7 @@
| ID | -X0024 | +X0041 |
| Aliases | @@ -25,7 +25,7 @@ # YiSpecter -YiSpecter is Apple iOS malware that can download, install and launch arbitrary iOS apps, replace existing apps with those it downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmarks and opened pages, and upload device information to a C2 server. It uses tricks to hide its icons from iOS’s SpringBoard, which prevents the user from finding and deleting it. The components also use the same name and logos of system apps to trick iOS power users. [[1]](#1) +YiSpecter is an Apple iOS malware that can download, install and launch arbitrary iOS apps, replace existing apps with the downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmark and open pages, and upload device information to a C2 server. It uses tricks to hide its icons from iOS’s SpringBoard, which prevents the user from finding and deleting it. The components also use the same name and logos of system apps to trick iOS power users. [[1]](#1) ## ATT&CK Techniques @@ -35,20 +35,21 @@ See ATT&CK: [YiSpecter - Techniques Used](https://attack.mitre.org/software/S031 |Name|Use| |---|---| -|[Defense Evasion::Hide Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users [[1]](#1)| -|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Hijacks other installed applications' launch routines to use "ADPage" (an installed malicious app) to display advertisements [[1]](#1)| -|[Lateral Movement::Supply Chain Compromise::Exploit Private APIs (E1195.m02)](../lateral-movement/supply-chain-compromise.md)|Use of the private api allowed both Installation of malicious apps and uninstallation of legitimate apps without user notification [[1]](#1)| -|[Lateral Movement::Supply Chain Compromise::Abuse Enterprise Certificates (E1195.m01)](../lateral-movement/supply-chain-compromise.md)|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution [[1]](#1)| -|[Impact::Generate Traffic From Victim::Advertisement Replacement Fraud (E1643.m02)](../impact/generate-traffic-from-victim.md)|Displays brief advertisements whenever the user opens applications on their phone [[1]](#1)| +|[Defense Evasion::Hide Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|The malware hides icons from iOS's SpringBoard and use the same name and logos of system apps to trick iOS power users. [[1]](#1)| +|[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|The malware hijacks other installed applications' launch routines to use "ADPage" (an installed malicious app) to display advertisements. [[1]](#1)| +|[Lateral Movement::Supply Chain Compromise::Exploit Private APIs (E1195.m02)](../lateral-movement/supply-chain-compromise.md)|Within the malware, the private API allows installation of malicious apps and uninstallation of legitimate apps without user notification. [[1]](#1)| +|[Lateral Movement::Supply Chain Compromise::Abuse Enterprise Certificates (E1195.m01)](../lateral-movement/supply-chain-compromise.md)|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution. [[1]](#1)| +|[Impact::Generate Traffic from Victim::Advertisement Replacement Fraud (E1643.m02)](../impact/generate-traffic-from-victim.md)|The malware displays brief advertisements whenever the user opens applications on their phone. [[1]](#1)| ## MBC Behaviors |Name|Use| |---|---| -|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Can download and install arbitrary iOS apps [[1]](#1)| -|[Command and Control::C2 Communication::Send System Information (B0030.006)](../command-and-control/c2-communication.md)|Connects to the command and control server using HTTP to send device information [[1]](#1)| -|[Defense Evasion::Install Insecure or Malicious Configuration (B0047)](../defense-evasion/install-insecure-or-malicious-configuration.md)|Changes iOS Safari's default configuration [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|The malware can download and install arbitrary iOS apps. [[1]](#1)| +|[Command and Control::C2 Communication::Send System Information (B0030.006)](../command-and-control/c2-communication.md)|The malware connects to the C2 server using HTTP to send device information. [[1]](#1)| +|[Defense Evasion::Install Insecure or Malicious Configuration (B0047)](../defense-evasion/install-insecure-or-malicious-configuration.md)|The malware changes iOS Safari's default configuration. [[1]](#1)| + ## Indicators of Compromise