diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md
index 2916ec1..46311d6 100644
--- a/anti-behavioral-analysis/debugger-evasion.md
+++ b/anti-behavioral-analysis/debugger-evasion.md
@@ -89,7 +89,7 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
[2] https://www.synack.com/2016/02/17/analyzing-the-anti-analysis-logic-of-an-adware-installer/
-[3] http://phishme.com/dridex-code-breaking-modify-the-malware-to-bypass-the-vm-bypass/
+[3] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
[4] https://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/
diff --git a/anti-behavioral-analysis/dynamic-analysis-evasion.md b/anti-behavioral-analysis/dynamic-analysis-evasion.md
index 20fa949..aeba38f 100644
--- a/anti-behavioral-analysis/dynamic-analysis-evasion.md
+++ b/anti-behavioral-analysis/dynamic-analysis-evasion.md
@@ -82,3 +82,4 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
[5] https://blogs.cisco.com/security/talos/rombertik
[6] https://www.joesecurity.org/blog/498839998833561473
+
diff --git a/anti-behavioral-analysis/memory-dump-evasion.md b/anti-behavioral-analysis/memory-dump-evasion.md
index d2b47ce..d5de7a9 100644
--- a/anti-behavioral-analysis/memory-dump-evasion.md
+++ b/anti-behavioral-analysis/memory-dump-evasion.md
@@ -47,7 +47,7 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor
|**SizeOfImage**|B0006.004|Set the SizeOfImage field of PEB.LoaderData to be huge.|
|**Tampering**|B0006.005|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
|**Hook memory mapping APIs**|B0006.010|Hooking prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
-|**Patch MmGetPhysicalMemoryRanges**|[B0006.011](#b0006011)|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
+|**Patch MmGetPhysicalMemoryRanges**|[B0006.011](#b0006011-snippet)|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
## Use in Malware
@@ -58,7 +58,7 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor
## Code Snippets
-### B0006.011
+### B0006.011 Snippet
Memory Dump::Code Encryption in Memory
SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md
index 02063ac..dcc7dc2 100644
--- a/anti-behavioral-analysis/sandbox-detection.md
+++ b/anti-behavioral-analysis/sandbox-detection.md
@@ -43,7 +43,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|**Check Files**|B0007.002|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.|
|**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
|**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.|
-|**Product Key/ID Testing**|[B0007.005](#b0007005)|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
+|**Product Key/ID Testing**|[B0007.005](#b0007005-snippet)|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
|**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.|
|**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.|
|**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.|
@@ -79,7 +79,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
## Code Snippets
-### B0007.005
+### B0007.005 Snippet
Sandbox Detection::Product Key/ID Testing
@@ -113,6 +113,18 @@ mov bl, 1
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)|CreateFile|
+|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)|GetModuleHandle|
+
+|Tool: CAPE|Mapping|APIs|
+|---|---|---|
+|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+
## References
[1] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
@@ -121,7 +133,7 @@ mov bl, 1
[3] https://github.com/LordNoteworthy/al-khaser
-[4] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
+[4] https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
[5] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md
index b8c4efa..ec1078d 100644
--- a/anti-behavioral-analysis/virtual-machine-detection.md
+++ b/anti-behavioral-analysis/virtual-machine-detection.md
@@ -55,7 +55,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|**Guest Process Testing**|B0009.010|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
|**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
|**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
-|**Instruction Testing**|[B0009.029](#b0009029)|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
+|**Instruction Testing**|[B0009.029](#b0009029-snippet)|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type.|
|**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
@@ -107,7 +107,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
## Code Snippets
-### B0009.029
+### B0009.029 Snippet
Virtual Machine Detection::Instruction Testing
SHA256: cfaf863181e49906df33f9104795678f2fb41a007a8fd066a84fd99f613d7ef3
diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md
index 377d10f..ed5df68 100644
--- a/anti-static-analysis/executable-code-obfuscation.md
+++ b/anti-static-analysis/executable-code-obfuscation.md
@@ -55,7 +55,7 @@ For encryption and encoding characteristics of malware samples, as well as malwa
|**Junk Code Insertion**|B0032.007|Insert dummy code between relevant opcodes. Can make signature writing more complex.|
|**Merged Code Sections**|B0032.015|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.|
|**Opaque Predicate**|B0032.019|An opaque predicate either always jumps (jumping over dead or junk code) or never jumps (executing essential code), but determining the execution path can be difficult.|
-|**Stack Strings**|B0032.017|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.|
+|**Stack Strings**|[B0032.017](#b0032017-snippet)|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.|
|**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).|
|**Symbol Obfuscation**|B0032.018|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.|
|**Thunk Code Insertion**|B0032.006|Variation on Jump Insertion. Used by some compilers for user-generated functions.|
@@ -78,23 +78,7 @@ For encryption and encoding characteristics of malware samples, as well as malwa
## Code Snippets
-### E1027.M02
-
- Obfuscated Files or Information::Encoding-Standard Algorithm
-SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
-
-
-
-### B0032.017
+### B0032.017 SNippet
Executable Code Obfuscation::Stack Strings
SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
diff --git a/command-and-control/c2-communication.md b/command-and-control/c2-communication.md
index 6e286b0..9675e91 100644
--- a/command-and-control/c2-communication.md
+++ b/command-and-control/c2-communication.md
@@ -45,7 +45,7 @@ As "server" and "client" are confusing terminology, we use the terms "controller
|**Execute Shell Command**|B0030.014|Execute/run the given command using a built-in program (e.g. cmd.exe, PowerShell, bash). This differs from Start Interactive Shell because the shell process is started only for the received command or set of commands and then exits. There is no loop looking for additional commands while the shell process is still running.|
|**File search**|B0030.015|Controller requests the implant to search for a given filename pattern, often a [glob](https://en.wikipedia.org/wiki/Glob_(programming)).|
|**Implant to Controller File Transfer**|B0030.004|File is transferred from implant to controller.|
-|**Receive Data**|[B0030.002](#b0030002)|Receive data or command from a controller.|
+|**Receive Data**|[B0030.002](#b0030002-snippet)|Receive data or command from a controller.|
|**Request Command**|B0030.008|Implant requests a command.|
|**Request Email Address List**|B0030.010|Request email address list.|
|**Request Email Template**|B0030.009|Request email template.|
@@ -94,7 +94,7 @@ As "server" and "client" are confusing terminology, we use the terms "controller
## Code Snippets
-### B0030.002
+### B0030.002 Snippet
C2 Communication::Receive Data
SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e0
diff --git a/command-and-control/ingress-tool-transfer.md b/command-and-control/ingress-tool-transfer.md
index 5b8e7c1..a63be9b 100644
--- a/command-and-control/ingress-tool-transfer.md
+++ b/command-and-control/ingress-tool-transfer.md
@@ -52,7 +52,11 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques
## References
-[1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
+[1] https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+
+[2] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/
+
+[3] https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
[2] https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
diff --git a/defense-evasion/modify-registry.md b/defense-evasion/modify-registry.md
index 2cd3b56..4885974 100644
--- a/defense-evasion/modify-registry.md
+++ b/defense-evasion/modify-registry.md
@@ -48,7 +48,7 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
## References
-[1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
+[1] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
[2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
diff --git a/defense-evasion/obfuscated-files-or-information.md b/defense-evasion/obfuscated-files-or-information.md
index 46c8051..2255dec 100644
--- a/defense-evasion/obfuscated-files-or-information.md
+++ b/defense-evasion/obfuscated-files-or-information.md
@@ -48,7 +48,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|---|---|---|
|**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.|
|**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information.|
-|**Encoding-Standard Algorithm**|E1027.m02|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information.|
+|**Encoding-Standard Algorithm**|[E1027.m02](#e1027m02-snippet)|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information.|
|**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted.|
|**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
|**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information.|
diff --git a/micro-behaviors/cryptography/decrypt-data.md b/micro-behaviors/cryptography/decrypt-data.md
index f8f544d..03ec176 100644
--- a/micro-behaviors/cryptography/decrypt-data.md
+++ b/micro-behaviors/cryptography/decrypt-data.md
@@ -59,7 +59,7 @@ Malware may decrypt data.
## Code Snippets
-### C0031
+### C0031 Snippet
Decrypt Data
SHA256: c86cbf5e78c9f05ecfc11e4f2c147781cef77842a457e19ba690477eb564c22b
diff --git a/micro-behaviors/cryptography/encrypt-data.md b/micro-behaviors/cryptography/encrypt-data.md
index 2db72eb..65bab9c 100644
--- a/micro-behaviors/cryptography/encrypt-data.md
+++ b/micro-behaviors/cryptography/encrypt-data.md
@@ -73,7 +73,7 @@ Malware may encrypt data.
## Code Snippets
-### C0031
+### C0027 Snippet
Encrypt Data
SHA256: c86cbf5e78c9f05ecfc11e4f2c147781cef77842a457e19ba690477eb564c22b
diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md
index d330c1a..f15160e 100644
--- a/xample-malware/dnschanger.md
+++ b/xample-malware/dnschanger.md
@@ -33,6 +33,13 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev
|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|DNSChanger sets file attributes. [[3]](#3)|
|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|DNSChanger accesses PE headers. [[3]](#3)|
+## ATT&CK Techniques
+
+|Name|Use|
+|---|---|
+|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[3]](#3) |
+|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[3]](#3) |
+
## Enhanced ATT&CK Techniques
|Name|Use|
diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md
index f82fade..be34dc0 100644
--- a/xample-malware/emotet.md
+++ b/xample-malware/emotet.md
@@ -41,6 +41,12 @@ Emotet is a banking trojan. [[1]](#1)
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [[1]](#1)|
|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Emotet writes clipboard data. [[6]](#6)|
+|Name|Use|
+|---|---|
+|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2) |
+|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2) |
+|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1) |
+|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6) |
## MBC Behaviors
diff --git a/xample-malware/samsam.md b/xample-malware/samsam.md
index 8db0c30..4fd11c8 100644
--- a/xample-malware/samsam.md
+++ b/xample-malware/samsam.md
@@ -73,7 +73,6 @@ BTC Wallet
Tor Onion Service
- jcmi5n4c3mvgtyt5.onion
-
## References
[1] https://www.cisa.gov/uscert/ncas/alerts/AA18-337A
diff --git a/xample-malware/trickbot.md b/xample-malware/trickbot.md
index 5f4c284..70262db 100644
--- a/xample-malware/trickbot.md
+++ b/xample-malware/trickbot.md
@@ -72,7 +72,6 @@ See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266
SHA256 Hashes
- a162bb9219a09b302b90bc6f908e117e3fb2c722560336d378fd76a8f22f78f8
-
MD5 Hashes
- 28661ea73413822c3b5b7de1bef0b246
- 218613f0f1d2780f08e754be9e6f8c64
@@ -80,7 +79,6 @@ MD5 Hashes
- 719578c91b4985d1f955f6adb688314f
- 132c4338cdc46a0a286abf574d68e2e0
- e8e7b0a8f274cad7bdaedd5a91b5164d
-
Yara Rules
- rule MALW_trickbot_bankBot : Trojan { meta: author = "Marc Salinas @Bondey_m" description = "Detects Trickbot Banking Trojan" strings: $str_trick_01 = "moduleconfig" $str_trick_02 = "Start" $str_trick_03 = "Control" $str_trick_04 = "FreeBuffer" $str_trick_05 = "Release" condition: all of ($str_trick_*) }
- rule MALW_systeminfo_trickbot_module : Trojan { meta: author = "Marc Salinas @Bondey_m" description = "Detects systeminfo module from Trickbot Trojan" strings: $str_systeminf_01 = "" $str_systeminf_02 = "" $str_systeminf_03 = "" $str_systeminf_04 = "GetSystemInfo.pdb" $str_systeminf_05 = "" $str_systeminf_06 = "" condition: all of ($str_ systeminf_*) }
diff --git a/xample-malware/up007.md b/xample-malware/up007.md
index 46f0e23..346ac8c 100644
--- a/xample-malware/up007.md
+++ b/xample-malware/up007.md
@@ -95,7 +95,6 @@ SHA256 Hashes
- 5b34b3365eb6a6c700b391172849a2668d66a167669018ae3b9555bc2d1e54ab
- ec05e37230e6534fa148b8e022f797ad0afe80f699fbd222a46672118663cf00
- b748b61ff6c3ea0c64f2359c44e022c629378aab6d7377e64c6ad0dcc5f78746
-
IP Addresses
- 59.188.12[.]123