Staging (#83)

* Adding script files * Scripting overhaul * Adding capa analysis from MITRE into corpus * Adding capa analysis from MITRE into corpus * Backtracing capa mappings to behavior pages * Other fixes * merge dev into staging * Fixing capa mappings * merge dev into staging * fix writes file typo * merge dev into staging * Fix method column + cape analysis * Updates to snippets and descriptions
2026-06-08 11:36:36 +00:00 · 2023-03-14 09:28:34 -04:00
parent 46d44c90c6
commit 9e30d80c19
17 changed files with 47 additions and 37 deletions
@@ -89,7 +89,7 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162

 <a name="2">[2]</a> https://www.synack.com/2016/02/17/analyzing-the-anti-analysis-logic-of-an-adware-installer/

-<a name="3">[3]</a> http://phishme.com/dridex-code-breaking-modify-the-malware-to-bypass-the-vm-bypass/
+<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

 <a name="4">[4]</a> https://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/

@@ -82,3 +82,4 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 <a name="5">[5]</a> https://blogs.cisco.com/security/talos/rombertik

 <a name="6">[6]</a> https://www.joesecurity.org/blog/498839998833561473
+
@@ -47,7 +47,7 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor
 |**SizeOfImage**|B0006.004|Set the SizeOfImage field of PEB.LoaderData to be huge.|
 |**Tampering**|B0006.005|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
 |**Hook memory mapping APIs**|B0006.010|Hooking prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
-|**Patch MmGetPhysicalMemoryRanges**|[B0006.011](#b0006011)|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
+|**Patch MmGetPhysicalMemoryRanges**|[B0006.011](#b0006011-snippet)|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|

 ## Use in Malware

@@ -58,7 +58,7 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor

 ## Code Snippets

-### B0006.011
+### B0006.011 Snippet
 <details>
 <summary> Memory Dump::Code Encryption in Memory </summary>
 SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
@@ -43,7 +43,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |**Check Files**|B0007.002|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.|
 |**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
 |**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.|
-|**Product Key/ID Testing**|[B0007.005](#b0007005)|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
+|**Product Key/ID Testing**|[B0007.005](#b0007005-snippet)|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
 |**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.|
 |**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.|
 |**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.|
@@ -79,7 +79,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t

 ## Code Snippets

-### B0007.005
+### B0007.005 Snippet
 <details>
 <summary> Sandbox Detection::Product Key/ID Testing </summary>
 <pre>
@@ -113,6 +113,18 @@ mov     bl, 1
 </pre>
 </details>

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)|CreateFile|
+|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)|GetModuleHandle|
+
+|Tool: CAPE|Mapping|APIs|
+|---|---|---|
+|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+
 ## References

 <a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 
@@ -121,7 +133,7 @@ mov     bl, 1

 <a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser

-<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
+<a name="4">[4]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/

 <a name="5">[5]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

@@ -55,7 +55,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |**Guest Process Testing**|B0009.010|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
 |**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
 |**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
-|**Instruction Testing**|[B0009.029](#b0009029)|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
+|**Instruction Testing**|[B0009.029](#b0009029-snippet)|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
 |**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type.|
 |**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
 |**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
@@ -107,7 +107,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t

 ## Code Snippets

-### B0009.029
+### B0009.029 Snippet
 <details>
 <summary> Virtual Machine Detection::Instruction Testing </summary>
 SHA256: cfaf863181e49906df33f9104795678f2fb41a007a8fd066a84fd99f613d7ef3
@@ -55,7 +55,7 @@ For encryption and encoding characteristics of malware samples, as well as malwa
 |**Junk Code Insertion**|B0032.007|Insert dummy code between relevant opcodes. Can make signature writing more complex.|
 |**Merged Code Sections**|B0032.015|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.|
 |**Opaque Predicate**|B0032.019|An opaque predicate either always jumps (jumping over dead or junk code) or never jumps (executing essential code), but determining the execution path can be difficult.|
-|**Stack Strings**|B0032.017|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.|
+|**Stack Strings**|[B0032.017](#b0032017-snippet)|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.|
 |**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).|
 |**Symbol Obfuscation**|B0032.018|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.|
 |**Thunk Code Insertion**|B0032.006|Variation on Jump Insertion. Used by some compilers for user-generated functions.|
@@ -78,23 +78,7 @@ For encryption and encoding characteristics of malware samples, as well as malwa

 ## Code Snippets

-### E1027.M02
-<details>
-<summary> Obfuscated Files or Information::Encoding-Standard Algorithm </summary>
-SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
-<pre>
-asm
-jle short_40182F
-mov dl, byte ptr [ebp+eax+var_7CA8]
-xor dl, cl
-mov byte ptr [ebp+eax+var_7CA8], dl
-inc eax
-cmp eax, edi
-jl short loc_40181A
-</pre>
-</details>
-
-### B0032.017
+### B0032.017 SNippet
 <details>
 <summary> Executable Code Obfuscation::Stack Strings </summary>
 SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
@@ -45,7 +45,7 @@ As "server" and "client" are confusing terminology, we use the terms "controller
 |**Execute Shell Command**|B0030.014|Execute/run the given command using a built-in program (e.g. cmd.exe, PowerShell, bash). This differs from Start Interactive Shell because the shell process is started only for the received command or set of commands and then exits. There is no loop looking for additional commands while the shell process is still running.|
 |**File search**|B0030.015|Controller requests the implant to search for a given filename pattern, often a [glob](https://en.wikipedia.org/wiki/Glob_(programming)).|
 |**Implant to Controller File Transfer**|B0030.004|File is transferred from implant to controller.|
-|**Receive Data**|[B0030.002](#b0030002)|Receive data or command from a controller.|
+|**Receive Data**|[B0030.002](#b0030002-snippet)|Receive data or command from a controller.|
 |**Request Command**|B0030.008|Implant requests a command.|
 |**Request Email Address List**|B0030.010|Request email address list.|
 |**Request Email Template**|B0030.009|Request email template.|
@@ -94,7 +94,7 @@ As "server" and "client" are confusing terminology, we use the terms "controller

 ## Code Snippets

-### B0030.002
+### B0030.002 Snippet
 <details>
 <summary> C2 Communication::Receive Data </summary>
 SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e0
@@ -52,7 +52,11 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques

 ## References

-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
+<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+
+<a name="2">[2]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/
+
+<a name="3">[3]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke

 <a name="2">[2]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/

@@ -48,7 +48,7 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112

 ## References

-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
+<a name="1">[1]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking

 <a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

@@ -48,7 +48,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |---|---|---|
 |**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.|
 |**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information.|
-|**Encoding-Standard Algorithm**|E1027.m02|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information.|
+|**Encoding-Standard Algorithm**|[E1027.m02](#e1027m02-snippet)|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information.|
 |**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted.|
 |**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
 |**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information.|
@@ -59,7 +59,7 @@ Malware may decrypt data.

 ## Code Snippets

-### C0031
+### C0031 Snippet
 <details>
 <summary> Decrypt Data </summary>
 SHA256: c86cbf5e78c9f05ecfc11e4f2c147781cef77842a457e19ba690477eb564c22b
@@ -73,7 +73,7 @@ Malware may encrypt data.

 ## Code Snippets

-### C0031
+### C0027 Snippet
 <details>
 <summary> Encrypt Data </summary>
 SHA256: c86cbf5e78c9f05ecfc11e4f2c147781cef77842a457e19ba690477eb564c22b
@@ -33,6 +33,13 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev
 |[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|DNSChanger sets file attributes. [[3]](#3)|
 |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|DNSChanger accesses PE headers. [[3]](#3)|

+## ATT&CK Techniques
+
+|Name|Use|
+|---|---|
+|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[3]](#3) |
+|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[3]](#3) |
+
 ## Enhanced ATT&CK Techniques

 |Name|Use|
@@ -41,6 +41,12 @@ Emotet is a banking trojan. [[1]](#1)
 |[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [[1]](#1)|
 |[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Emotet writes clipboard data. [[6]](#6)|

+|Name|Use|
+|---|---|
+|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2) |
+|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2) |
+|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1) |
+|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6) |

 ## MBC Behaviors

@@ -73,7 +73,6 @@ BTC Wallet
 Tor Onion Service
 - jcmi5n4c3mvgtyt5.onion

-
 ## References

 <a name="1">[1]</a> https://www.cisa.gov/uscert/ncas/alerts/AA18-337A
@@ -72,7 +72,6 @@ See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266

 SHA256 Hashes
 - a162bb9219a09b302b90bc6f908e117e3fb2c722560336d378fd76a8f22f78f8
-
 MD5 Hashes
 - 28661ea73413822c3b5b7de1bef0b246
 - 218613f0f1d2780f08e754be9e6f8c64
@@ -80,7 +79,6 @@ MD5 Hashes
 - 719578c91b4985d1f955f6adb688314f
 - 132c4338cdc46a0a286abf574d68e2e0
 - e8e7b0a8f274cad7bdaedd5a91b5164d
-
 Yara Rules
 - rule MALW_trickbot_bankBot : Trojan { meta: author = "Marc Salinas @Bondey_m" description = "Detects Trickbot Banking Trojan" strings: $str_trick_01 = "moduleconfig" $str_trick_02 = "Start" $str_trick_03 = "Control" $str_trick_04 = "FreeBuffer" $str_trick_05 = "Release" condition: all of ($str_trick_*) }
 - rule MALW_systeminfo_trickbot_module : Trojan { meta: author = "Marc Salinas @Bondey_m" description = "Detects systeminfo module from Trickbot Trojan" strings: $str_systeminf_01 = "" $str_systeminf_02 = "" $str_systeminf_03 = "" $str_systeminf_04 = "GetSystemInfo.pdb" $str_systeminf_05 = "" $str_systeminf_06 = "" condition: all of ($str_ systeminf_*) }
@@ -95,7 +95,6 @@ SHA256 Hashes
 - 5b34b3365eb6a6c700b391172849a2668d66a167669018ae3b9555bc2d1e54ab
 - ec05e37230e6534fa148b8e022f797ad0afe80f699fbd222a46672118663cf00
 - b748b61ff6c3ea0c64f2359c44e022c629378aab6d7377e64c6ad0dcc5f78746
-
 IP Addresses
 - 59.188.12[.]123