mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Staging (#151)
* Fixing links * Code samples (#149) * Update obfuscated-files-or-information.md Added code sample with some proposed formatting incl. annotations explaining broad behavior patterns * Update obfuscated-files-or-information.md Added brief clarification to note * Update obfuscated-files-or-information.md Made requested changes to format * Update system-information-discovery.md Added code snippet from PoisonIvy RAT * Update debugger-detection.md Added code with example of PEB access * Update system-information-discovery.md Added new method based on code snippet * Update registry.md Added snippet for registry key query * Update generate-pseudorandom-sequence.md Added example of Mersenne Twister algorithm * Update keylogging.md Add Dark Comet keylogging code sample * Update dns-communication.md Added code sample from darkcomet * Update socket-communication.md Added DarkComet code snippet * Update delete-file.md Provided DarkComet sample * Update file-and-directory-discovery.md Added DarkComet snippet * Update allocate-memory.md Added DarkComet sample * Update modulo.md Added Hupigon snippet * Update get-file-attributes.md Added Hupigon sample * Update application-window-discovery.md Added Hupigon snippet * Update create-process.md Added Hupigon snippet. * Update conditional-execution.md Added Hupigon snippet * Update create-thread.md Added Hupigon snippet * Update resume-thread.md Added Hupigon snippet * Update command-and-scripting-interpreter.md Added SmokeLoader sample * Update change-memory-protection.md Added SmokeLoader snippet * Update console.md Added snippet from SmokeLoader * Update dynamic-analysis-evasion.md Added Industroyer sample * Update interprocess-communication.md Added CobaltStrike sample * Update read-file.md Added Cobalt Strike snippet * Update writes-file.md Added cobalt strike snippet * Update noncryptographic-hash.md Added emotet snippet * Update clipboard-modification.md Added emotet snippet * Update check-mutex.md Added emotet sampler * Update check-mutex.md Fixed typo * Update create-mutex.md Added Emotet snippet * Update allocate-thread-local-storage.md Added emotet snippet * Update registry-run-keys-startup-folder.md Added emotet snippet * Update wininet.md Added EnvyScout snippet * Update http-communication.md Added EnvyScout snippet * Update enumerate-threads.md Added Envyscout snippet * Update set-thread-local-storage-value.md Added Envyscout sample * Update create-directory.md Added explosive snippet * Update delete-directory.md Added explosive code snippet (note: the malware is called "explosive") * Update set-file-attributes.md Added explosive sample * Update terminate-process.md Added explosive snippet * Update terminate-thread.md Added explosive sample * Update move-file.md Added Finfisher snippet * Update screen-capture.md Added ECCENTRICBANDWAGON snippet * Fix links (#150) * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * update mod date * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * Update code-discovery.md * Update taskbar-discovery.md * Update conditional-execution.md * Update memory-dump-evasion.md * Update execution-dependency.md * Update compromise-data-integrity.md * Update dns-communication.md * Update http-communication.md * Update interprocess-communication.md * Update socket-communication.md * Update wininet.md * Update generate-pseudorandom-sequence.md * Update modulo.md * Update noncryptographic-hash.md * Update create-directory.md * Update delete-directory.md * Update delete-file.md * Update get-file-attributes.md * Update move-file.md * Update read-file.md * Update terminate-thread.md * Update set-file-attributes.md * Update writes-file.md * Update allocate-memory.md * Update change-memory-protection.md * Update console.md * Update registry.md * Update allocate-thread-local-storage.md * Update check-mutex.md * Update terminate-process.md * Update create-mutex.md * Update create-process.md * Update set-thread-local-storage-value.md * Update resume-thread.md * Update enumerate-threads.md * Update create-thread.md * update for 3.1 release * update for 3.1 release * update for 3.1 release --------- Co-authored-by: ryan <ryanxu@wustl.edu> Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>
This commit is contained in:
Desiree Beck
@@ -1,4 +1,4 @@
|
||||
# <a name="mbc"></a>Malware Behavior Catalog v3.0 #
|
||||
# <a name="mbc"></a>Malware Behavior Catalog v3.1 #
|
||||
The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions, and read the [newsletters](./ynewsletters/README.md) for information on the most recent MBC updates and activity.
|
||||
|
||||
Open-source malware analysis tools map their output to MBC and ATT&CK:
|
||||
@@ -62,7 +62,7 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**.
|
||||
Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.
|
||||
|
||||
### STIX 2.1 Representation ###
|
||||
A STIX 2.1 representation for MBC v3.0 is available in the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository. It's based on a refined STIX 2.1 [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9) that includes new STIX domain objects for MBC objectives, behaviors, and methods.
|
||||
A STIX 2.1 representation for MBC v3.1 is available in the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository. It's based on a refined STIX 2.1 [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9) that includes new STIX domain objects for MBC objectives, behaviors, and methods.
|
||||
|
||||
### Navigator View ###
|
||||
This visual representation of the MBC Matrix is based on the ATT&CK Navigator. Two views are available:
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -129,21 +129,31 @@ Details on detecting debuggers can be found in the references.
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[antidebug_checkremotedebuggerpresent](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_checkremotedebuggerpresent.py)|Debugger Detection (B0001)|CheckRemoteDebuggerPresent, NtQueryInformationProcess|
|
||||
|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_nthookengine_libs.py)|Debugger Detection (B0001)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_nthookengine_libs.py)|Debugger Detection::API Hook Detection (B0001.001)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_setunhandledexceptionfilter.py)|Debugger Detection (B0001)|SetUnhandledExceptionFilter|
|
||||
|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_setunhandledexceptionfilter.py)|Debugger Detection::UnhandledExceptionFilter (B0001.030)|SetUnhandledExceptionFilter|
|
||||
|[antidebug_addvectoredexceptionhandler](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_addvectoredexceptionhandler.py)|Debugger Detection (B0001)|AddVectoredExceptionHandler|
|
||||
|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_outputdebugstring.py)|Debugger Detection (B0001)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
|
||||
|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_outputdebugstring.py)|Debugger Detection::OutputDebugString (B0001.016)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
|
||||
|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_gettickcount.py)|Debugger Detection (B0001)|GetTickCount|
|
||||
|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_gettickcount.py)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)|GetTickCount|
|
||||
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Detection (B0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Detection::Memory Breakpoints (B0001.009)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Debugger Detection (B0001)|NtSetInformationThread|
|
||||
|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Debugger Detection::NtSetInformationThread (B0001.014)|NtSetInformationThread|
|
||||
|[antidebug_debugactiveprocess](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_debugactiveprocess.py)|Debugger Detection (B0001)|DebugActiveProcess|
|
||||
|[antidebug_checkremotedebuggerpresent](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_checkremotedebuggerpresent.py)|Debugger Detection (B0001)|CheckRemoteDebuggerPresent, NtQueryInformationProcess|
|
||||
|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_nthookengine_libs.py)|Debugger Detection (B0001)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_nthookengine_libs.py)|Debugger Detection::API Hook Detection (B0001.001)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_setunhandledexceptionfilter.py)|Debugger Detection (B0001)|SetUnhandledExceptionFilter|
|
||||
|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_setunhandledexceptionfilter.py)|Debugger Detection::UnhandledExceptionFilter (B0001.030)|SetUnhandledExceptionFilter|
|
||||
|[antidebug_addvectoredexceptionhandler](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_addvectoredexceptionhandler.py)|Debugger Detection (B0001)|AddVectoredExceptionHandler|
|
||||
|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_outputdebugstring.py)|Debugger Detection (B0001)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
|
||||
|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_outputdebugstring.py)|Debugger Detection::OutputDebugString (B0001.016)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
|
||||
|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_gettickcount.py)|Debugger Detection (B0001)|GetTickCount|
|
||||
|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_gettickcount.py)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)|GetTickCount|
|
||||
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|Debugger Detection (B0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|Debugger Detection::Memory Breakpoints (B0001.009)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntsetinformationthread.py)|Debugger Detection (B0001)|NtSetInformationThread|
|
||||
|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntsetinformationthread.py)|Debugger Detection::NtSetInformationThread (B0001.014)|NtSetInformationThread|
|
||||
|[antidebug_debugactiveprocess](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_debugactiveprocess.py)|Debugger Detection (B0001)|DebugActiveProcess|
|
||||
|
||||
### B0001.019 Snippet
|
||||
<details>
|
||||
<summary> Anti-Behavioral Analysis::Debugger Detection::Process Environment Block </summary>
|
||||
SHA256: e33a713b96b45e2b2e0da350c0fdaaf865139607066aadff3b67b0ced82ca8bc
|
||||
Location: 0x1800270A2
|
||||
<pre>
|
||||
mov rax, qword ptr GS:[0x60] ; GS:[0x60] contains a pointer to the Windows Process Environment Block on 64-bit versions of Windows. This command is copying that pointer into the rax register.
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -91,11 +91,11 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Evasion (B0002)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Evasion::Guard Pages (B0002.008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntcreatethreadex.py)|Debugger Evasion (B0002)|NtCreateThreadEx|
|
||||
|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/debugs_self.py)|Debugger Evasion (B0002)|CreateProcessInternalW|
|
||||
|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/debugs_self.py)|Debugger Evasion::Self-Debugging (B0002.024)|CreateProcessInternalW|
|
||||
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|Debugger Evasion (B0002)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|Debugger Evasion::Guard Pages (B0002.008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntcreatethreadex.py)|Debugger Evasion (B0002)|NtCreateThreadEx|
|
||||
|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/debugs_self.py)|Debugger Evasion (B0002)|CreateProcessInternalW|
|
||||
|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/debugs_self.py)|Debugger Evasion::Self-Debugging (B0002.024)|CreateProcessInternalW|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -75,15 +75,26 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion (B0003)|--|
|
||||
|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion::Data Flood (B0003.002)|--|
|
||||
|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|--|
|
||||
|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_suspend.py)|Dynamic Analysis Evasion (B0003)|NtSuspendThread|
|
||||
|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_restart.py)|Dynamic Analysis Evasion (B0003)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
|
||||
|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_restart.py)|Dynamic Analysis Evasion::Restart (B0003.010)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
|
||||
|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_timeout.py)|Dynamic Analysis Evasion (B0003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
|
||||
|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_timeout.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
|
||||
|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Dynamic Analysis Evasion (B0003)|--|
|
||||
|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/api_spamming.py)|Dynamic Analysis Evasion (B0003)|--|
|
||||
|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/api_spamming.py)|Dynamic Analysis Evasion::Data Flood (B0003.002)|--|
|
||||
|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/api_spamming.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|--|
|
||||
|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_suspend.py)|Dynamic Analysis Evasion (B0003)|NtSuspendThread|
|
||||
|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_restart.py)|Dynamic Analysis Evasion (B0003)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
|
||||
|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_restart.py)|Dynamic Analysis Evasion::Restart (B0003.010)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
|
||||
|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_timelimit.py)|Dynamic Analysis Evasion (B0003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
|
||||
|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_timelimit.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
|
||||
|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_unhook.py)|Dynamic Analysis Evasion (B0003)|--|
|
||||
|
||||
### B0003.003 Snippet
|
||||
<details>
|
||||
<summary> Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution </summary>
|
||||
SHA256: 21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561
|
||||
Location: 0x40103B
|
||||
<pre>
|
||||
push 0x36ee80 ; sleep duration: 3600000 milliseconds (1 hour)
|
||||
call dword ptr [->KERNEL32.DLL::Sleep] ; Windows API call instructing thread to sleep for the time period specified above
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -57,12 +57,12 @@ Detects whether the malware instance is being executed inside an emulator. If so
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[antiemu_windefend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_windefend.py)|Emulator Detection (B0004)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Emulator Detection (B0004)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
|
||||
|[antiemu_wine_func](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_func.py)|Emulator Detection (B0004)|LdrGetProcedureAddress|
|
||||
|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Emulator Detection (B0004)|--|
|
||||
|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
|
||||
|[antiemu_windefend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_windefend.py)|Emulator Detection (B0004)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Emulator Detection (B0004)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
|
||||
|[antiemu_wine_func](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine_func.py)|Emulator Detection (B0004)|LdrGetProcedureAddress|
|
||||
|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|Emulator Detection (B0004)|--|
|
||||
|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.0</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>8 May 2023</b></td>
|
||||
<td><b>29 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -39,7 +39,7 @@ Memory dump evasion is an anti-forensic technique in which malware hinders retri
|
||||
|---|---|---|
|
||||
|**Code Encryption in Memory**|B0006.001|Encrypt the executing malware instance code in memory.|
|
||||
|**Erase the PE header**|B0006.002|Erase PE header from memory.|
|
||||
|**Feed Misinformation**|B0006.008|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](../credential-access/hooking.md).|
|
||||
|**Feed Misinformation**|B0006.008|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hijack Execution Flow](../defense-evasion/hijack-execution-flow.md).|
|
||||
|**Flow Opcode Obstruction**|B0006.009|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[6]](#6).|
|
||||
|**Guard Pages**|B0006.006|Encrypt blocks of code individually and decrypt temporarily only upon execution. This method is related to Unprotect technique U0102.|
|
||||
|**Hide virtual memory**|B0006.003|Hide arbitrary segments of virtual memory.|
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -71,30 +71,30 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sleep.py)|Sandbox Detection (B0007)|NtDelayExecution|
|
||||
|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sleep.py)|Sandbox Detection::Timing/Date Check (B0007.008)|NtDelayExecution|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Sandbox Detection (B0007)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Sandbox Detection::Human User Check (B0007.003)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_foregroundwindows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_foregroundwindows.py)|Sandbox Detection (B0007)|GetForegroundWindow, NtDelayExecution|
|
||||
|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_mutex.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_script_timer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_script_timer.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_sboxie_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[antisandbox_cuckoocrash](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoocrash.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_objects.py)|Sandbox Detection (B0007)|NtOpenDirectoryObject|
|
||||
|[antisandbox_sunbelt_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[antisandbox_cuckoo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/windows/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/windows/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoo_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_threattrack_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_threattrack_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sleep.py)|Sandbox Detection (B0007)|NtDelayExecution|
|
||||
|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sleep.py)|Sandbox Detection::Timing/Date Check (B0007.008)|NtDelayExecution|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Sandbox Detection (B0007)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Sandbox Detection::Human User Check (B0007.003)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_foregroundwindows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_forehwnd.py)|Sandbox Detection (B0007)|GetForegroundWindow, NtDelayExecution|
|
||||
|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_mutex.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_script_timer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_scripttimer.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_sboxie_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[antisandbox_cuckoocrash](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoocrash.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_joe_anubis_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_fortinet_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_fortinet_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sunbelt_files.py)|Sandbox Detection (B0007)|--|
|
||||
|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sunbelt_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|
||||
|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_objects.py)|Sandbox Detection (B0007)|NtOpenDirectoryObject|
|
||||
|[antisandbox_sunbelt_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sunbelt_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[antisandbox_cuckoo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoo.py)|Sandbox Detection (B0007)|--|
|
||||
|
||||
## Code Snippets
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -127,64 +127,64 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|Virtual Machine Detection (B0009)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
|
||||
|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|Virtual Machine Detection::Modern Specs Check - Drive size (B0009.015)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
|
||||
|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_mutex.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|Virtual Machine Detection (B0009)|NtQueryDirectoryObject, NtOpenDirectoryObject|
|
||||
|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|NtQueryDirectoryObject, NtOpenDirectoryObject|
|
||||
|[antivm_network_adapters](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_network_adapters.py)|Virtual Machine Detection (B0009)|GetAdaptersAddresses|
|
||||
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
|
||||
|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_provname.py)|Virtual Machine Detection (B0009)|WNetGetProviderNameW|
|
||||
|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_provname.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|WNetGetProviderNameW|
|
||||
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
|
||||
|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|Virtual Machine Detection (B0009)|NtOpenEvent, NtCreateEvent|
|
||||
|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
|
||||
|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
|
||||
|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Virtual Machine Detection (B0009)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Virtual Machine Detection::Human User Check (B0009.012)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Virtual Machine Detection (B0009)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|
||||
|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|
||||
|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
|
||||
|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
|
||||
|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
|
||||
|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_mutexes.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
|
||||
|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
|
||||
|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
|
||||
|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
|
||||
|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Virtual Machine Detection::Check Running Services (B0009.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
|
||||
|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk_setupapi.py)|Virtual Machine Detection (B0009)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
|
||||
|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_objects.py)|Virtual Machine Detection (B0009)|NtOpenDirectoryObject|
|
||||
|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_window.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_window.py)|Virtual Machine Detection::Check Windows (B0009.009)|--|
|
||||
|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk.py)|Virtual Machine Detection (B0009)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
|
||||
|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk.py)|Virtual Machine Detection::Modern Specs Check - Drive size (B0009.015)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
|
||||
|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_mutex.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_dirobjects.py)|Virtual Machine Detection (B0009)|NtQueryDirectoryObject, NtOpenDirectoryObject|
|
||||
|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_dirobjects.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|NtQueryDirectoryObject, NtOpenDirectoryObject|
|
||||
|[antivm_network_adapters](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_network_adapter.py)|Virtual Machine Detection (B0009)|GetAdaptersAddresses|
|
||||
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
|
||||
|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_provname.py)|Virtual Machine Detection (B0009)|WNetGetProviderNameW|
|
||||
|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_provname.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|WNetGetProviderNameW|
|
||||
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
|
||||
|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_events.py)|Virtual Machine Detection (B0009)|NtOpenEvent, NtCreateEvent|
|
||||
|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_devices.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
|
||||
|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_devices.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
|
||||
|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_files.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_files.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Virtual Machine Detection (B0009)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Virtual Machine Detection::Human User Check (B0009.012)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|Virtual Machine Detection (B0009)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|
||||
|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|
||||
|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
|
||||
|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
|
||||
|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_files.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
|
||||
|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_mutexes.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
|
||||
|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
|
||||
|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_files.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
|
||||
|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
|
||||
|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|Virtual Machine Detection::Check Running Services (B0009.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
|
||||
|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk_setupapi.py)|Virtual Machine Detection (B0009)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
|
||||
|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_objects.py)|Virtual Machine Detection (B0009)|NtOpenDirectoryObject|
|
||||
|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|
||||
|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_window.py)|Virtual Machine Detection (B0009)|--|
|
||||
|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_window.py)|Virtual Machine Detection::Check Windows (B0009.009)|--|
|
||||
|
||||
## Code Snippets
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -91,31 +91,30 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[packer_nspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_nspack.py)|Software Packing (F0001)|--|
|
||||
|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_vmprotect.py)|Software Packing (F0001)|--|
|
||||
|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_vmprotect.py)|Software Packing::VMProtect (F0001.010)|--|
|
||||
|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_confuser.py)|Software Packing (F0001)|--|
|
||||
|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_confuser.py)|Software Packing::Confuser (F0001.009)|--|
|
||||
|[packer_smartassembly](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_smartassembly.py)|Software Packing (F0001)|--|
|
||||
|[packer_mpress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_mpress.py)|Software Packing (F0001)|--|
|
||||
|[packer_enigma](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_enigma.py)|Software Packing (F0001)|--|
|
||||
|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Software Packing (F0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[packer_aspirecrypt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspirecrypt.py)|Software Packing (F0001)|--|
|
||||
|[packer_nate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_nate.py)|Software Packing (F0001)|--|
|
||||
|[packer_entropy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_entropy.py)|Software Packing (F0001)|--|
|
||||
|[packer_unknown_pe_section_name](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_unknown_pe_section_name.py)|Software Packing (F0001)|--|
|
||||
|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_upx.py)|Software Packing (F0001)|--|
|
||||
|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_upx.py)|Software Packing::UPX (F0001.008)|--|
|
||||
|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspack.py)|Software Packing (F0001)|--|
|
||||
|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspack.py)|Software Packing::ASPack (F0001.013)|--|
|
||||
|[packer_bedsprotector](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_bedsprotector.py)|Software Packing (F0001)|--|
|
||||
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing (F0001)|FindWindowA|
|
||||
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing::Themida (F0001.011)|FindWindowA|
|
||||
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing (F0001)|--|
|
||||
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing::Themida (F0001.011)|--|
|
||||
|[packer_spices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_spices.py)|Software Packing (F0001)|--|
|
||||
|[packer_yoda](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_yoda.py)|Software Packing (F0001)|--|
|
||||
|[packer_titan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_titan.py)|Software Packing (F0001)|--|
|
||||
|[packer_nspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_nspack.py)|Software Packing (F0001)|--|
|
||||
|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_vmprotect.py)|Software Packing (F0001)|--|
|
||||
|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_vmprotect.py)|Software Packing::VMProtect (F0001.010)|--|
|
||||
|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_confuser.py)|Software Packing (F0001)|--|
|
||||
|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_confuser.py)|Software Packing::Confuser (F0001.009)|--|
|
||||
|[packer_smartassembly](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_smartassembly.py)|Software Packing (F0001)|--|
|
||||
|[packer_mpress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_mpress.py)|Software Packing (F0001)|--|
|
||||
|[packer_enigma](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_enigma.py)|Software Packing (F0001)|--|
|
||||
|[packer_aspirecrypt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_aspirecrypt.py)|Software Packing (F0001)|--|
|
||||
|[packer_nate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_nate.py)|Software Packing (F0001)|--|
|
||||
|[packer_entropy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_entropy.py)|Software Packing (F0001)|--|
|
||||
|[packer_unknown_pe_section_name](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_anomaly.py)|Software Packing (F0001)|--|
|
||||
|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_upx.py)|Software Packing (F0001)|--|
|
||||
|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_upx.py)|Software Packing::UPX (F0001.008)|--|
|
||||
|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_aspack.py)|Software Packing (F0001)|--|
|
||||
|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_aspack.py)|Software Packing::ASPack (F0001.013)|--|
|
||||
|[packer_bedsprotector](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_bedsprotector.py)|Software Packing (F0001)|--|
|
||||
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_themida.py)|Software Packing (F0001)|FindWindowA|
|
||||
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_themida.py)|Software Packing::Themida (F0001.011)|FindWindowA|
|
||||
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_themida.py)|Software Packing (F0001)|--|
|
||||
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_themida.py)|Software Packing::Themida (F0001.011)|--|
|
||||
|[packer_spices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_spices.py)|Software Packing (F0001)|--|
|
||||
|[packer_yoda](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_yoda.py)|Software Packing (F0001)|--|
|
||||
|[packer_titan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_titan.py)|Software Packing (F0001)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>4.0</b></td>
|
||||
<td><b>4.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>18 December 2023</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -55,12 +55,12 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Archive Collected Data (E1560)|CryptEncrypt|
|
||||
|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt|
|
||||
|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|
||||
|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|
||||
|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|
||||
|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|
||||
|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data (E1560)|CryptEncrypt|
|
||||
|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt|
|
||||
|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|
||||
|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|
||||
|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|
||||
|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -47,8 +47,8 @@ Malware accesses files that contain sensitive data or credentials related to Bit
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_bitcoin.py)|Cryptocurrency (B0028)|--|
|
||||
|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_bitcoin.py)|Cryptocurrency::Bitcoin (B0028.001)|--|
|
||||
|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_bitcoin.py)|Cryptocurrency (B0028)|--|
|
||||
|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_bitcoin.py)|Cryptocurrency::Bitcoin (B0028.001)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -56,9 +56,9 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056),
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Input Capture (E1056)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Input Capture::Mouse Events (E1056.m01)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|Input Capture (E1056)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Input Capture (E1056)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Input Capture::Mouse Events (E1056.m01)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_scanbox.py)|Input Capture (E1056)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -66,9 +66,23 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Keylogging (F0002)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|
||||
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Keylogging::Application Hook (F0002.001)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|
||||
|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|Keylogging (F0002)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_keylog.py)|Keylogging (F0002)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|
||||
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_keylog.py)|Keylogging::Application Hook (F0002.001)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|
||||
|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_scanbox.py)|Keylogging (F0002)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|
||||
### F0002.002 Snippet
|
||||
<details>
|
||||
<summary> Collection::Keylogging::Polling </summary>
|
||||
SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
|
||||
|
||||
Location: 0x438af1
|
||||
<pre>
|
||||
push 0x11 ; provide argument for function call. In this case, 0x11 is the Windows keyboard code for indicating the 'CTRL' key
|
||||
call USER32.DLL::GetKeyState ; call function to get the state of the control key
|
||||
test ax, 0x8000 ; test to see what the previous function returned. In this case, we are seeing if the return value's high-order bit is a 1, which would mean the ctrl key is pressed
|
||||
setnz al ; if the previous condition is not met (the zero flag is 1), a 1 is stored in byte al
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>27 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -59,8 +59,30 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/poullight_files.py)|Screen Capture (E1113)|--|
|
||||
|[captures_screenshot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/captures_screenshot.py)|Screen Capture (E1113)|LdrGetProcedureAddress, NtCreateFile|
|
||||
|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_poullight.py)|Screen Capture (E1113)|--|
|
||||
|[captures_screenshot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_screenshot.py)|Screen Capture (E1113)|LdrGetProcedureAddress, NtCreateFile|
|
||||
|
||||
### E1113.m01 Snippet
|
||||
<details>
|
||||
<summary> Collection::Screen Capture::WinAPI </summary>
|
||||
SHA256: c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec
|
||||
Location: 0x4036de
|
||||
<pre>
|
||||
push 0xcc0020 ; Raster operation code to copy the source rectangle directly onto the destination rectangle
|
||||
push 0x0 ; y-coordinate of upper left corner of source rectangle
|
||||
push 0x0 ; x-coordinate of upper left corner of source rectangle
|
||||
push dword ptr [esi] ; handle to source device
|
||||
push eax ; height of source/destination rectangles
|
||||
mov eax, dword ptr [esi + 0xc]
|
||||
sub eax, param_2
|
||||
sub param_2, ebx
|
||||
push eax ; width of source/destination rectangles
|
||||
push param_1 ; y-coordinate of upper left corner of destination rectangle
|
||||
push param_2 ; x-coordinate of upper left corner of destination rectangle
|
||||
push dword ptr [ebp + local_28] ; handle to destingation device
|
||||
call dword ptr [->GDI32.DLL::BitBlt] ; Windows API function to transfer a rectangle of pixels from one device to another
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
<td><b>2.4</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -101,25 +101,25 @@ As "server" and "client" are confusing terminology, we use the terms "controller
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882_network.py)|C2 Communication (B0030)|ConnectEx, URLDownloadToFileW|
|
||||
|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|C2 Communication (B0030)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
|
||||
|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|C2 Communication::Check for Payload (B0030.005)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
|
||||
|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|C2 Communication (B0030)|--|
|
||||
|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|C2 Communication (B0030)|--|
|
||||
|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|C2 Communication (B0030)|HttpOpenRequestA, HttpSendRequestA|
|
||||
|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|C2 Communication (B0030)|InternetOpenA, InternetOpenUrlA|
|
||||
|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|C2 Communication (B0030)|--|
|
||||
|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|C2 Communication (B0030)|--|
|
||||
|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_athenahttp.py)|C2 Communication (B0030)|--|
|
||||
|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_tunneling_request.py)|C2 Communication (B0030)|DnsQuery_A, DnsQuery_W|
|
||||
|[network_questionable_host](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_questionable_host.py)|C2 Communication (B0030)|--|
|
||||
|[injection_network_traffic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_network_traffic.py)|C2 Communication (B0030)|HttpOpenRequestA, URLDownloadToFileW, HttpOpenRequestW, InternetConnectW, InternetConnectA, connect, InternetCrackUrlW, InternetCrackUrlA, WSASend|
|
||||
|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|C2 Communication (B0030)|listen, bind|
|
||||
|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_http.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile|
|
||||
|[network_country_distribution](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_country_distribution.py)|C2 Communication (B0030)|--|
|
||||
|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_url.py)|C2 Communication (B0030)|--|
|
||||
|[network_dyndns](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dyndns.py)|C2 Communication (B0030)|--|
|
||||
|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_network_activity.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
|
||||
|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|C2 Communication (B0030)|ConnectEx, URLDownloadToFileW|
|
||||
|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/internet_dropper.py)|C2 Communication (B0030)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
|
||||
|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/internet_dropper.py)|C2 Communication::Check for Payload (B0030.005)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
|
||||
|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_madness.py)|C2 Communication (B0030)|--|
|
||||
|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive.py)|C2 Communication (B0030)|--|
|
||||
|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_beacon.py)|C2 Communication (B0030)|HttpOpenRequestA, HttpSendRequestA|
|
||||
|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_nemty.py)|C2 Communication (B0030)|InternetOpenA, InternetOpenUrlA|
|
||||
|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive2.py)|C2 Communication (B0030)|--|
|
||||
|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_dirtjumper.py)|C2 Communication (B0030)|--|
|
||||
|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_athenahttp.py)|C2 Communication (B0030)|--|
|
||||
|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|C2 Communication (B0030)|DnsQuery_A, DnsQuery_W|
|
||||
|[network_questionable_host](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_questionable_host.py)|C2 Communication (B0030)|--|
|
||||
|[injection_network_traffic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_network.py)|C2 Communication (B0030)|HttpOpenRequestA, URLDownloadToFileW, HttpOpenRequestW, InternetConnectW, InternetConnectA, connect, InternetCrackUrlW, InternetCrackUrlA, WSASend|
|
||||
|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_bind.py)|C2 Communication (B0030)|listen, bind|
|
||||
|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_docfile_http.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile|
|
||||
|[network_country_distribution](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_cnc_generic.py)|C2 Communication (B0030)|--|
|
||||
|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/banker_zeus_url.py)|C2 Communication (B0030)|--|
|
||||
|[network_dyndns](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_dyndns.py)|C2 Communication (B0030)|--|
|
||||
|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
|
||||
|
||||
## Code Snippets
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -47,9 +47,9 @@ This behavior is related to Unprotect technique U0906.
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[whois_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/whois_create.py)|Domain Name Generation (B0031)|--|
|
||||
|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|Domain Name Generation (B0031)|--|
|
||||
|[network_dga_fraunhofer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga_fraunhofer.py)|Domain Name Generation (B0031)|--|
|
||||
|[whois_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/whois_create.py)|Domain Name Generation (B0031)|--|
|
||||
|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_dga.py)|Domain Name Generation (B0031)|--|
|
||||
|[network_dga_fraunhofer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_dga_fraunhofer.py)|Domain Name Generation (B0031)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -53,8 +53,8 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[suspicious_mpcmdrun_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_mpcmdrun_use.py)|Ingress Tool Transfer (E1105)|--|
|
||||
|[network_document_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_file.py)|Ingress Tool Transfer (E1105)|URLDownloadToFileW, HttpOpenRequestW, send, InternetCrackUrlW, InternetCrackUrlA, WSASend, URLDownloadToCacheFileW|
|
||||
|[suspicious_mpcmdrun_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/windows_utilities.py)|Ingress Tool Transfer (E1105)|--|
|
||||
|[network_document_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_payload_download.py)|Ingress Tool Transfer (E1105)|URLDownloadToFileW, HttpOpenRequestW, send, InternetCrackUrlW, InternetCrackUrlA, WSASend, URLDownloadToCacheFileW|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -43,12 +43,12 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_primary_patition.py)|Bootkit (F0013)|--|
|
||||
|[bootkit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bootkit.py)|Bootkit (F0013)|NtSetInformationFile, NtClose, DeviceIoControl, NtCreateFile, NtDuplicateObject, NtOpenFile, NtWriteFile, NtDeviceIoControlFile|
|
||||
|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/direct_hdd_access.py)|Bootkit (F0013)|--|
|
||||
|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enumerates_physical_drives.py)|Bootkit (F0013)|--|
|
||||
|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/physical_drive_access.py)|Bootkit (F0013)|--|
|
||||
|[suspicious_ioctl_scsipassthough](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_ioctl_scsipassthough.py)|Bootkit (F0013)|DeviceIoControl, NtDeviceIoControlFile|
|
||||
|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|--|
|
||||
|[bootkit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|NtSetInformationFile, NtClose, DeviceIoControl, NtCreateFile, NtDuplicateObject, NtOpenFile, NtWriteFile, NtDeviceIoControlFile|
|
||||
|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|--|
|
||||
|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|--|
|
||||
|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|--|
|
||||
|[suspicious_ioctl_scsipassthough](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|DeviceIoControl, NtDeviceIoControlFile|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -40,7 +40,7 @@ Malware may bypass Data Execution Prevention (DEP).
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[dep_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dep_bypass.py)|Bypass Data Execution Prevention (B0037)|VirtualProtectEx, NtProtectVirtualMemory|
|
||||
|[dep_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/dep_bypass.py)|Bypass Data Execution Prevention (B0037)|VirtualProtectEx, NtProtectVirtualMemory|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -70,41 +70,41 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[clickfraud_volume](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clickfraud_volume.py)|Disable or Evade Security Tools (F0004)|CoInternetSetFeatureEnabled|
|
||||
|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_1.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_2.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_suspend.py)|Disable or Evade Security Tools (F0004)|NtSuspendThread|
|
||||
|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_servicestop.py)|Disable or Evade Security Tools (F0004)|OpenServiceA, ControlService, OpenServiceW|
|
||||
|[disables_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_security.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antiav_whitespace](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_whitespace.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_windows_file_protection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_file_protection.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_winfirewall.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_crashdumps](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_crashdumps.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
|
||||
|[clickfraud_cookies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clickfraud_cookies.py)|Disable or Evade Security Tools (F0004)|InternetSetOptionA|
|
||||
|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wfp.py)|Disable or Evade Security Tools (F0004)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
|
||||
|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wfp.py)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
|
||||
|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
|
||||
|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Disable or Evade Security Tools::Unhook APIs (F0004.003)|--|
|
||||
|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_windows_defender](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows_defender_powershell.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
|
||||
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_notificationcenter.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[clickfraud_volume](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/clickfraud_volume.py)|Disable or Evade Security Tools (F0004)|CoInternetSetFeatureEnabled|
|
||||
|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_suspend.py)|Disable or Evade Security Tools (F0004)|NtSuspendThread|
|
||||
|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_servicestop.py)|Disable or Evade Security Tools (F0004)|OpenServiceA, ControlService, OpenServiceW|
|
||||
|[disables_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_security.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antiav_whitespace](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_whitespace.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_smartscreen.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_windows_file_protection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windows_file_protection.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_winfirewall.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_crashdumps](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_crashdumps.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
|
||||
|[clickfraud_cookies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/clickfraud_cookies.py)|Disable or Evade Security Tools (F0004)|InternetSetOptionA|
|
||||
|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wfp.py)|Disable or Evade Security Tools (F0004)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
|
||||
|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wfp.py)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
|
||||
|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
|
||||
|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_security.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_event_logging.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_unhook.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_unhook.py)|Disable or Evade Security Tools::Unhook APIs (F0004.003)|--|
|
||||
|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_seccenter.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wer.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_windows_defender](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_browserwarn.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
|
||||
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|Disable or Evade Security Tools (F0004)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
<td><b>2.4</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -59,13 +59,13 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spoofs_procname.py)|Hidden Files and Directories (F0005)|--|
|
||||
|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spoofs_procname.py)|Hidden Files and Directories::Location (F0005.002)|--|
|
||||
|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pe_compile_timestomping.py)|Hidden Files and Directories (F0005)|--|
|
||||
|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pe_compile_timestomping.py)|Hidden Files and Directories::Timestamp (F0005.004)|--|
|
||||
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Hidden Files and Directories (F0005)|--|
|
||||
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Hidden Files and Directories (F0005)|--|
|
||||
|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_file.py)|Hidden Files and Directories (F0005)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
|
||||
|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/spoofs_procname.py)|Hidden Files and Directories (F0005)|--|
|
||||
|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/spoofs_procname.py)|Hidden Files and Directories::Location (F0005.002)|--|
|
||||
|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/static_pe_anomaly.py)|Hidden Files and Directories (F0005)|--|
|
||||
|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/static_pe_anomaly.py)|Hidden Files and Directories::Timestamp (F0005.004)|--|
|
||||
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|Hidden Files and Directories (F0005)|--|
|
||||
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|Hidden Files and Directories (F0005)|--|
|
||||
|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_file.py)|Hidden Files and Directories (F0005)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -55,7 +55,7 @@ See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[stealth_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_window.py)|Hide Artifacts (E1564)|ShellExecuteExW, CreateProcessInternalW|
|
||||
|[stealth_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_window.py)|Hide Artifacts (E1564)|ShellExecuteExW, CreateProcessInternalW|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -76,12 +76,12 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|
||||
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[dll_load_uncommon_file_types](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dll_load_uncommon_file_types.py)|Hijack Execution Flow (F0015)|LdrLoadDll|
|
||||
|[malicious_dynamic_function_loading](https://github.com/CAPESandbox/community/tree/master/modules/signatures/malicious_dynamic_function_loading.py)|Hijack Execution Flow (F0015)|LdrGetProcedureAddress, LdrLoadDll|
|
||||
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_keylog.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|
||||
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_keylog.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, SetWindowsHookExW|
|
||||
|[dll_load_uncommon_file_types](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/dll_load_uncommon.py)|Hijack Execution Flow (F0015)|LdrLoadDll|
|
||||
|[malicious_dynamic_function_loading](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malicious_dynamic_function_loading.py)|Hijack Execution Flow (F0015)|LdrGetProcedureAddress, LdrLoadDll|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -51,13 +51,13 @@ See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mi
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Indicator Blocking (F0006)|--|
|
||||
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Indicator Blocking (F0006)|--|
|
||||
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Indicator Blocking (F0006)|--|
|
||||
|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Indicator Blocking (F0006)|--|
|
||||
|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Indicator Blocking (F0006)|NtCreateKey, NtSetValueKey|
|
||||
|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Indicator Blocking (F0006)|--|
|
||||
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Indicator Blocking (F0006)|--|
|
||||
|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_powershell_logging.py)|Indicator Blocking (F0006)|--|
|
||||
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|Indicator Blocking (F0006)|--|
|
||||
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|Indicator Blocking (F0006)|--|
|
||||
|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Indicator Blocking (F0006)|--|
|
||||
|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|Indicator Blocking (F0006)|NtCreateKey, NtSetValueKey|
|
||||
|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_etw.py)|Indicator Blocking (F0006)|--|
|
||||
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wer.py)|Indicator Blocking (F0006)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>3.1</b></td>
|
||||
<td><b>3.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -41,14 +41,14 @@ Malware may install malicious configuration settings or may modify existing conf
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Install Insecure or Malicious Configuration (B0047)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_hostfile.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bcdedit_command.py)|Install Insecure or Malicious Configuration (B0047)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_hostsfile.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|Install Insecure or Malicious Configuration (B0047)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -49,73 +49,73 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Modify Registry (E1112)|--|
|
||||
|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Modify Registry (E1112)|--|
|
||||
|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Modify Registry (E1112)|--|
|
||||
|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Modify Registry (E1112)|--|
|
||||
|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_networking_icon.py)|Modify Registry (E1112)|--|
|
||||
|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Modify Registry (E1112)|--|
|
||||
|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_power_options.py)|Modify Registry (E1112)|--|
|
||||
|[disables_cpl_disable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_cpl_disable.py)|Modify Registry (E1112)|--|
|
||||
|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Modify Registry (E1112)|--|
|
||||
|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_registry_script.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|
||||
|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/hides_recycle_bin_icon.py)|Modify Registry (E1112)|--|
|
||||
|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_restore_default_state.py)|Modify Registry (E1112)|--|
|
||||
|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_auto_app_termination.py)|Modify Registry (E1112)|--|
|
||||
|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_regkeys.py)|Modify Registry (E1112)|--|
|
||||
|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Modify Registry (E1112)|--|
|
||||
|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/prevents_safeboot.py)|Modify Registry (E1112)|--|
|
||||
|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Modify Registry (E1112)|--|
|
||||
|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_context_menus.py)|Modify Registry (E1112)|--|
|
||||
|[persistence_remotedesktop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_remotedesktop.py)|Modify Registry (E1112)|--|
|
||||
|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_bho.py)|Modify Registry (E1112)|--|
|
||||
|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|Modify Registry (E1112)|--|
|
||||
|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_notificationcenter.py)|Modify Registry (E1112)|--|
|
||||
|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_networking_icon.py)|Modify Registry (E1112)|--|
|
||||
|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_powershell_logging.py)|Modify Registry (E1112)|--|
|
||||
|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_power_options.py)|Modify Registry (E1112)|--|
|
||||
|[disables_cpl_disable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_cpl_display.py)|Modify Registry (E1112)|--|
|
||||
|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|Modify Registry (E1112)|--|
|
||||
|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_fileless.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|
||||
|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/hides_recyclebin_icon.py)|Modify Registry (E1112)|--|
|
||||
|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_restore_default_state.py)|Modify Registry (E1112)|--|
|
||||
|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app_autotermination.py)|Modify Registry (E1112)|--|
|
||||
|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_nemty.py)|Modify Registry (E1112)|--|
|
||||
|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_warzone.py)|Modify Registry (E1112)|--|
|
||||
|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/prevents_safeboot.py)|Modify Registry (E1112)|--|
|
||||
|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_smartscreen.py)|Modify Registry (E1112)|--|
|
||||
|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_context_menus.py)|Modify Registry (E1112)|--|
|
||||
|[reg_binary](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Modify Registry (E1112)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
|
||||
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Modify Registry (E1112)|--|
|
||||
|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_run_command.py)|Modify Registry (E1112)|--|
|
||||
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Modify Registry (E1112)|--|
|
||||
|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Modify Registry (E1112)|--|
|
||||
|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_backups.py)|Modify Registry (E1112)|--|
|
||||
|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_largekey.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|
||||
|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_username_startmenu.py)|Modify Registry (E1112)|--|
|
||||
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Modify Registry (E1112)|--|
|
||||
|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_startmenu_search.py)|Modify Registry (E1112)|--|
|
||||
|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Modify Registry (E1112)|--|
|
||||
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Modify Registry (E1112)|--|
|
||||
|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
|
||||
|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey|
|
||||
|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Modify Registry (E1112)|--|
|
||||
|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
|
||||
|[persistence_autorun_tasks](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun_tasks.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
|
||||
|[persistence_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_safeboot.py)|Modify Registry (E1112)|--|
|
||||
|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Modify Registry (E1112)|--|
|
||||
|[modify_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_certs.py)|Modify Registry (E1112)|--|
|
||||
|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Modify Registry (E1112)|--|
|
||||
|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_appv_virtualization.py)|Modify Registry (E1112)|--|
|
||||
|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Modify Registry (E1112)|--|
|
||||
|[modify_uac_prompt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_uac_prompt.py)|Modify Registry (E1112)|--|
|
||||
|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Modify Registry (E1112)|RegQueryValueExW, RegSetValueExW|
|
||||
|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rdptcp_key.py)|Modify Registry (E1112)|--|
|
||||
|[disables_system_restore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_system_restore.py)|Modify Registry (E1112)|--|
|
||||
|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_folder_options.py)|Modify Registry (E1112)|--|
|
||||
|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Modify Registry (E1112)|--|
|
||||
|[removes_security_maintenance_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_security_maintenance_icon.py)|Modify Registry (E1112)|--|
|
||||
|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Modify Registry (E1112)|--|
|
||||
|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Modify Registry (E1112)|--|
|
||||
|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Modify Registry (E1112)|--|
|
||||
|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_startmenu_defaults.py)|Modify Registry (E1112)|--|
|
||||
|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_uac.py)|Modify Registry (E1112)|--|
|
||||
|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Modify Registry (E1112)|--|
|
||||
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Modify Registry (E1112)|--|
|
||||
|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_perfkey.py)|Modify Registry (E1112)|--|
|
||||
|[modify_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_oem_information.py)|Modify Registry (E1112)|--|
|
||||
|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Modify Registry (E1112)|--|
|
||||
|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Modify Registry (E1112)|--|
|
||||
|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Modify Registry (E1112)|--|
|
||||
|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Modify Registry (E1112)|--|
|
||||
|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Modify Registry (E1112)|--|
|
||||
|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windowsupdate.py)|Modify Registry (E1112)|--|
|
||||
|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_pinned_programs.py)|Modify Registry (E1112)|--|
|
||||
|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_regkeys.py)|Modify Registry (E1112)|--|
|
||||
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Modify Registry (E1112)|--|
|
||||
|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Modify Registry (E1112)|--|
|
||||
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|Modify Registry (E1112)|--|
|
||||
|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_run_command.py)|Modify Registry (E1112)|--|
|
||||
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Modify Registry (E1112)|--|
|
||||
|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Modify Registry (E1112)|--|
|
||||
|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_backups.py)|Modify Registry (E1112)|--|
|
||||
|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_largekey.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|
||||
|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_username_startmenu.py)|Modify Registry (E1112)|--|
|
||||
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|Modify Registry (E1112)|--|
|
||||
|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|Modify Registry (E1112)|--|
|
||||
|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Modify Registry (E1112)|--|
|
||||
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Modify Registry (E1112)|--|
|
||||
|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
|
||||
|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey|
|
||||
|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Modify Registry (E1112)|--|
|
||||
|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
|
||||
|[persistence_autorun_tasks](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
|
||||
|[persistence_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|--|
|
||||
|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|Modify Registry (E1112)|--|
|
||||
|[modify_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_certs.py)|Modify Registry (E1112)|--|
|
||||
|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_proxy.py)|Modify Registry (E1112)|--|
|
||||
|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_appv_virtualization.py)|Modify Registry (E1112)|--|
|
||||
|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/virus_neshta.py)|Modify Registry (E1112)|--|
|
||||
|[modify_uac_prompt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_uac_notify.py)|Modify Registry (E1112)|--|
|
||||
|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Modify Registry (E1112)|RegQueryValueExW, RegSetValueExW|
|
||||
|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Modify Registry (E1112)|--|
|
||||
|[disables_system_restore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_sysrestore.py)|Modify Registry (E1112)|--|
|
||||
|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_folder_options.py)|Modify Registry (E1112)|--|
|
||||
|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_security.py)|Modify Registry (E1112)|--|
|
||||
|[removes_security_maintenance_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_sec_maintain_icon.py)|Modify Registry (E1112)|--|
|
||||
|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_etw.py)|Modify Registry (E1112)|--|
|
||||
|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_event_logging.py)|Modify Registry (E1112)|--|
|
||||
|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|Modify Registry (E1112)|--|
|
||||
|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_startmenu_defaults.py)|Modify Registry (E1112)|--|
|
||||
|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_uac.py)|Modify Registry (E1112)|--|
|
||||
|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_seccenter.py)|Modify Registry (E1112)|--|
|
||||
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wer.py)|Modify Registry (E1112)|--|
|
||||
|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|Modify Registry (E1112)|--|
|
||||
|[modify_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_oem.py)|Modify Registry (E1112)|--|
|
||||
|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|Modify Registry (E1112)|--|
|
||||
|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Modify Registry (E1112)|--|
|
||||
|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Modify Registry (E1112)|--|
|
||||
|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Modify Registry (E1112)|--|
|
||||
|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_browserwarn.py)|Modify Registry (E1112)|--|
|
||||
|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windowsupdate.py)|Modify Registry (E1112)|--|
|
||||
|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_pinned_programs.py)|Modify Registry (E1112)|--|
|
||||
|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_medusalocker.py)|Modify Registry (E1112)|--|
|
||||
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|Modify Registry (E1112)|--|
|
||||
|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|Modify Registry (E1112)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -79,7 +79,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|
||||
|[**Kraken**](../xample-malware/kraken.md)|2008|E1027.m02|Kraken encodes data using XOR. [[9]](#9)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|E1027.m02|Locky Bart encodes data using XOR. [[9]](#9)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|E1027.m02|Mebromi encodes data using XOR. [[9]](#9)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|E1027.m02|Redhip encodes data using XOR. [[9]](#9)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|E1027.m02|Redhip encodes data using XOR. [[9]](#9)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1027.m02|Rombertik encodes data using XOR. [[9]](#9)|
|
||||
|[**SamSam**](../xample-malware/samsam.md)|2015|E1027.m07|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [[10]](#10)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|E1027.m02|Shamoon encodes data using XOR. [[9]](#9)|
|
||||
@@ -120,9 +120,38 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|
||||
|---|---|---|
|
||||
|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Obfuscated Files or Information (E1027)|RtlDecompressBuffer|
|
||||
|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Obfuscated Files or Information (E1027)|CryptDecrypt|
|
||||
|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Obfuscated Files or Information (E1027)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_obfuscation.py)|Obfuscated Files or Information (E1027)|--|
|
||||
|[dotnet_code_compile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dotnet_code_compile.py)|Obfuscated Files or Information (E1027)|NtWriteFile, CreateProcessInternalA, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Obfuscated Files or Information (E1027)|--|
|
||||
|[dotnet_code_compile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/compile_dotnet_code.py)|Obfuscated Files or Information (E1027)|NtWriteFile, CreateProcessInternalA, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|
||||
### E1027.m02 Snippet
|
||||
<details>
|
||||
<summary> Obfuscated Files or Information::Encoding-Standard Algorithm </summary>
|
||||
SHA256: 5fb7f3fac0a9b9ab243ee642a0775500c524166ef075035c9510ccbab76ad633
|
||||
Location: 0x10001060
|
||||
<pre>
|
||||
mov eax, dword ptr [esi + 0x38]
|
||||
xor dword ptr [esi + 0xd0], eax
|
||||
mov eax, dword ptr [esi + 0xf0]
|
||||
add eax, 0xfff5b6c8
|
||||
add eax, ecx
|
||||
mov ecx, dword ptr [esi + 0x8c]
|
||||
add dword ptr [esi + 0xc0], eax
|
||||
mov eax, dword ptr [esi + 0x54]
|
||||
xor dword ptr [ecx + edx*0x1], eax ; perform encryption operation
|
||||
add edx, 0x4 ; adjust edx to next location to encrypt
|
||||
mov eax, dword ptr [esi + 0x90]
|
||||
add dword ptr [esi + 0x54], eax
|
||||
mov ecx, dword ptr [esi + 0xe8]
|
||||
mov eax, ecx
|
||||
xor eax, 0xa4937
|
||||
add dword ptr [esi + 0x68], eax
|
||||
mov eax, dword ptr [esi + 0xa4]
|
||||
xor eax, 0x4
|
||||
sub dword ptr [esi + 0x60], eax
|
||||
cmp edx, 0x36c8 ; perform comparison to check if all data encrypted
|
||||
jl lab_10001060 ; jump to first line of sample
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>29 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -48,7 +48,7 @@ Polymorphic code, a file with the same functionality but different execution, is
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[polymorphic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/polymorphic.py)|Polymorphic Code (B0029)|--|
|
||||
|[polymorphic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/polymorphic.py)|Polymorphic Code (B0029)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -67,7 +67,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1055.m02|Stuxnet uses Mrxcls.sys driver for persistence. It is registered as a boot start service by creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys". [[9]](#9)|
|
||||
|[**Netwalker**](../xample-malware/netwalker.md)|2020|E1055.001|Netwalker uses reflective DLL loading to inject from memory. [[10]](#10)|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|The malware can attach user process memory. [[13]](#13)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|E1055.003|The malware can inject threads. [[13]](#13)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|E1055.003|The malware can inject threads. [[13]](#13)|
|
||||
|[**Conti**](../xample-malware/conti.md)|2019|E1055.012|Conti creates a process in a suspended state and unmaps or removes the PE image layout from a given process space.|
|
||||
|
||||
## Detection
|
||||
@@ -83,28 +83,27 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[volatility_handles_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_handles_1.py)|Process Injection (E1055)|--|
|
||||
|[volatility_ldrmodules_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_ldrmodules_1.py)|Process Injection (E1055)|--|
|
||||
|[volatility_ldrmodules_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_ldrmodules_2.py)|Process Injection (E1055)|--|
|
||||
|[volatility_malfind_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_malfind_1.py)|Process Injection (E1055)|--|
|
||||
|[volatility_malfind_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_malfind_2.py)|Process Injection (E1055)|--|
|
||||
|[volatility_modscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_modscan_1.py)|Process Injection (E1055)|--|
|
||||
|[injection_explorer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_explorer.py)|Process Injection (E1055)|NtReadVirtualMemory, NtWow64ReadVirtualMemory64, NtOpenProcess, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, SetWindowLongW, FindWindowA, FindWindowW, FindWindowExW, ReadProcessMemory, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW|
|
||||
|[injection_themeinitapihook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_themeinitapihook.py)|Process Injection (E1055)|ThemeInitApiHook|
|
||||
|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/explorer_http.py)|Process Injection (E1055)|WinHttpConnect, WinHttpOpenRequest|
|
||||
|[injection_createremotethread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_createremotethread.py)|Process Injection (E1055)|--|
|
||||
|[volatility_handles_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
|
||||
|[volatility_ldrmodules_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
|
||||
|[volatility_ldrmodules_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
|
||||
|[volatility_malfind_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
|
||||
|[volatility_malfind_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
|
||||
|[volatility_modscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
|
||||
|[injection_explorer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_explorer.py)|Process Injection (E1055)|NtReadVirtualMemory, NtWow64ReadVirtualMemory64, NtOpenProcess, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, SetWindowLongW, FindWindowA, FindWindowW, FindWindowExW, ReadProcessMemory, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW|
|
||||
|[injection_themeinitapihook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_themeinitapihook.py)|Process Injection (E1055)|ThemeInitApiHook|
|
||||
|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_explorer.py)|Process Injection (E1055)|WinHttpConnect, WinHttpOpenRequest|
|
||||
|[injection_createremotethread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_createremotethread.py)|Process Injection (E1055)|--|
|
||||
|[doppelganging](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|
||||
|[injection_inter_process](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|
||||
|[injection_create_remote_thread](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|
||||
|[injection_process_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|
||||
|[injection_set_window_long](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_set_window_long.py)|Process Injection (E1055)|NtMapViewOfSection, SetWindowLongW, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, FindWindowA, PostMessageA, FindWindowW, FindWindowExW, PostMessageW, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW|
|
||||
|[transacted_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|NtRollbackTransaction, NtMapViewOfSection, RtlSetCurrentTransaction|
|
||||
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Process Injection (E1055)|--|
|
||||
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--|
|
||||
|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Process Injection (E1055)|--|
|
||||
|[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_shim_database.py)|Process Injection::Injection using Shims (E1055.m03)|--|
|
||||
|[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_runpe.py)|Process Injection (E1055)|--|
|
||||
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--|
|
||||
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--|
|
||||
|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_silent_process_exit.py)|Process Injection (E1055)|--|
|
||||
|[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_shim.py)|Process Injection::Injection using Shims (E1055.m03)|--|
|
||||
|[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_runpe.py)|Process Injection (E1055)|--|
|
||||
|
||||
## References
|
||||
<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>3.1</b></td>
|
||||
<td><b>3.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -61,11 +61,11 @@ Rootkits can also be detected via memory dump analysis or virtual machine intros
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[spicyhotpot_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spicyhotpot_behavior.py)|Rootkit (E1014)|--|
|
||||
|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_primary_patition.py)|Rootkit (E1014)|--|
|
||||
|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/direct_hdd_access.py)|Rootkit (E1014)|--|
|
||||
|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enumerates_physical_drives.py)|Rootkit (E1014)|--|
|
||||
|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/physical_drive_access.py)|Rootkit (E1014)|--|
|
||||
|[spicyhotpot_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rootkit_spicyhotpot.py)|Rootkit (E1014)|--|
|
||||
|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Rootkit (E1014)|--|
|
||||
|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Rootkit (E1014)|--|
|
||||
|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Rootkit (E1014)|--|
|
||||
|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Rootkit (E1014)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
<td><b>Indicator Removal on Host: Uninstall Malicious Application (<a href="https://attack.mitre.org/techniques/T1630/001/">T1630.001</a>), Indicator Removal on Host: File Deletion (<a href="https://attack.mitre.org/techniques/T1070/004/">T1070.004</a>)</b></td>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -20,7 +20,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>28 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -57,9 +57,9 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_task_delete.py)|Self Deletion (F0007)|DeleteFileW|
|
||||
|[deletes_executed_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_executed_files.py)|Self Deletion (F0007)|--|
|
||||
|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Self Deletion (F0007)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
|
||||
|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trickbot_files.py)|Self Deletion (F0007)|DeleteFileW|
|
||||
|[deletes_executed_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_executed.py)|Self Deletion (F0007)|--|
|
||||
|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_self.py)|Self Deletion (F0007)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -66,14 +66,14 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_devices.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery::Process detection (B0013.001)|--|
|
||||
|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery::Known Window (B0013.009)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Analysis Tool Discovery::Known File Location (B0013.008)|--|
|
||||
|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_devices.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_windows.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_windows.py)|Analysis Tool Discovery::Process detection (B0013.001)|--|
|
||||
|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_windows.py)|Analysis Tool Discovery::Known Window (B0013.009)|--|
|
||||
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectfile.py)|Analysis Tool Discovery (B0013)|--|
|
||||
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectfile.py)|Analysis Tool Discovery::Known File Location (B0013.008)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -55,7 +55,22 @@ Malware may attempt to gain information about the operating system and applicati
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[browser_needed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_needed.py)|Application Window Discovery (E1010)|FindWindowW, FindWindowExA, FindWindowExW, FindWindowA|
|
||||
|[browser_needed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_needed.py)|Application Window Discovery (E1010)|FindWindowW, FindWindowExA, FindWindowExW, FindWindowA|
|
||||
|
||||
### E1010 Snippet
|
||||
<details>
|
||||
<summary> Discovery::Application Window Discovery </summary>
|
||||
SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
|
||||
Location: 0x455A5D
|
||||
<pre>
|
||||
push 0x100 ; Maximum number of characters to get from window title, including trailing string terminator (in this case, 256).
|
||||
lea param_1, [esp + 0x4]
|
||||
push param_1 ; Buffer for receiving text from window
|
||||
mov param_1, dword ptr [ebx + 0x30]
|
||||
push param_1 ; Handle to window containing text
|
||||
call USER32.DLL::GetWindowTextA ; Function call to fetch specified window title
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>29 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -49,7 +49,7 @@ Malware may inspect code or enumerate aspects.
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|B0046.001|Gamut enumerates PE sections. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0046.001|Hupigon enumerates PE sections. [[1]](#1)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|B0046.001|Locky Bart enumerates PE sections. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|B0046.002|Redhip inspects section memory permissions. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|B0046.002|Redhip inspects section memory permissions. [[1]](#1)|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0046.001|Stuxnet enumerates PE sections. [[1]](#1)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0046.002|TrickBot inspects section memory permissions. [[1]](#1)|
|
||||
|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0046.001|Ursnif enumerates PE sections. [[1]](#1)|
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -58,7 +58,7 @@ Malware may enumerate files and directories or may search for specific files or
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR checks if a file exists. [[6]](#6)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|The malware gets a file size. [[6]](#6)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi gets a file size. [[6]](#6)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets a file size. [[6]](#6)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip gets a file size. [[6]](#6)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware gets the file version info. [[6]](#6)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets a common file path. [[6]](#6)|
|
||||
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[7]](#7)|
|
||||
@@ -79,24 +79,39 @@ Malware may enumerate files and directories or may search for specific files or
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|File and Directory Discovery (E1083)|NtQueryDirectoryObject, NtOpenDirectoryObject|
|
||||
|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|File and Directory Discovery (E1083)|NtOpenEvent, NtCreateEvent|
|
||||
|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|File and Directory Discovery::Log File (E1083.m01)|NtOpenEvent, NtCreateEvent|
|
||||
|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
|
||||
|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectfile.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
|
||||
|[driver_filtermanager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_filtermanager.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoo_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_threattrack_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_dirobjects.py)|File and Directory Discovery (E1083)|NtQueryDirectoryObject, NtOpenDirectoryObject|
|
||||
|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_events.py)|File and Directory Discovery (E1083)|NtOpenEvent, NtCreateEvent|
|
||||
|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_events.py)|File and Directory Discovery::Log File (E1083.m01)|NtOpenEvent, NtCreateEvent|
|
||||
|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_devices.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_devices.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
|
||||
|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectfile.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
|
||||
|[driver_filtermanager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/driver_filtermanager.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_joe_anubis_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_fortinet_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sunbelt_files.py)|File and Directory Discovery (E1083)|--|
|
||||
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectfile.py)|File and Directory Discovery (E1083)|--|
|
||||
|
||||
### E1083 Snippet
|
||||
<details>
|
||||
<summary> Discovery::File and Directory Discovery </summary>
|
||||
SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
|
||||
Location: 0x409A62
|
||||
<pre>
|
||||
push eax ; argument to function containing file path to search
|
||||
call KERNEL32.DLL::GetFileAttributesA ; Function to retrieve file attributes for file path indicated by eax
|
||||
cmp eax, -0x1 ; Test if function returned an error
|
||||
jz lab_00409a71 ; If the function failed (the file's attributes were not retrieved and the return value is -1), jump to the specified address to continue execution
|
||||
test al, 0x10 ; Test the lower 8 bits of the return value to check if the file is a directory
|
||||
jnz lab_00409a75 ; If the returned result is not a directory, jump to the specified address to continue execution
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
@@ -112,4 +127,4 @@ Malware may enumerate files and directories or may search for specific files or
|
||||
|
||||
<a name="6">[6]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
<a name="7">[7]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
|
||||
<a name="7">[7]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -37,6 +37,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Generate Windows Exception**|E1082.m01|Malware may trigger an exception as a way of gathering system details.|
|
||||
|**Enumerate Environment Variables**|E1082.m02|Malware may query environmental variables as a way of gathering system details.|
|
||||
|
||||
## Use in Malware
|
||||
|
||||
@@ -46,7 +47,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Malware learns about the system so it can drop compatible miner software. [[8]](#8)|
|
||||
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Malware uses Window's command prompt commands to gather system info, task list, installed drivers, and installed programs. [[1]](#1)|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Malware uses Systeminfo to gather OS version, system configuration, BIOS, the motherboard, and processor. [[2]](#2)|
|
||||
|[**DarkComet**](../xample-malware/darkcomet.md)|2008|--|Malware can collect information about the computer, resources, and operating system version. [[3]](#3)|
|
||||
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|Malware can collect information about the computer, resources, and operating system version. [[3]](#3)|
|
||||
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Emotet collects information related to OS, processes, and sometimes mail client information and sends it to C2. [[4]](#4)|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Malware gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the network to spread itself. [[5]](#5)|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet checks OS version. [[5]](#5)|
|
||||
@@ -57,7 +58,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon queries environment variables. [[9]](#9)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter gets disk information. [[9]](#9)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi checks OS version. [[9]](#9)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip checks the OS version. [[9]](#9)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip checks the OS version. [[9]](#9)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik gets the disk size. [[9]](#9)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)|
|
||||
@@ -74,32 +75,44 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|System Information Discovery (E1082)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
|
||||
|[recon_systeminfo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_systeminfo.py)|System Information Discovery (E1082)|--|
|
||||
|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|System Information Discovery (E1082)|HttpOpenRequestA, HttpSendRequestA|
|
||||
|[uses_adfind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_adfind.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|System Information Discovery (E1082)|--|
|
||||
|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|System Information Discovery (E1082)|--|
|
||||
|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|System Information Discovery (E1082)|--|
|
||||
|[uses_windows_utilities_nltest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_nltest.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|
||||
|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|System Information Discovery (E1082)|--|
|
||||
|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_account_discovery_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_currently_loggedin_user_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_pwsh.py)|System Information Discovery (E1082)|--|
|
||||
|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_pwsh.py)|System Information Discovery (E1082)|--|
|
||||
|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_user_discovery_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
|
||||
|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk_setupapi.py)|System Information Discovery (E1082)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
|
||||
|[antisandbox_check_userdomain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_check_userdomain.py)|System Information Discovery (E1082)|rtcEnvironBstr|
|
||||
|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|System Information Discovery (E1082)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_fingerprint.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk.py)|System Information Discovery (E1082)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
|
||||
|[recon_systeminfo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_systeminfo.py)|System Information Discovery (E1082)|--|
|
||||
|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_beacon.py)|System Information Discovery (E1082)|HttpOpenRequestA, HttpSendRequestA|
|
||||
|[uses_adfind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_adfind.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|System Information Discovery (E1082)|--|
|
||||
|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|System Information Discovery (E1082)|--|
|
||||
|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|System Information Discovery (E1082)|--|
|
||||
|[uses_windows_utilities_nltest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/windows_utilities.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|
||||
|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|System Information Discovery (E1082)|--|
|
||||
|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
|
||||
|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
|
||||
|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk_setupapi.py)|System Information Discovery (E1082)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
|
||||
|[antisandbox_check_userdomain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_check_userdomain.py)|System Information Discovery (E1082)|rtcEnvironBstr|
|
||||
|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_scanbox.py)|System Information Discovery (E1082)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_fingerprint.py)|System Information Discovery (E1082)|--|
|
||||
|
||||
### E1082.m02 Snippet
|
||||
<details>
|
||||
<summary> System Information Discovery </summary>
|
||||
SHA256: e4b36a1d4e70d988efa2ec27e5a639be5eb0880474f746851c13e56f007a8377
|
||||
Location: 0x004017e9
|
||||
<pre>
|
||||
push eax ; push register to store return value onto the stack
|
||||
push u_ALLUSERSPROFILE_0041a9a4 ; push argument to function (name of the sought environment variable - in this case, ALLUSERSPROFILE)
|
||||
call dword ptr [->KERNEL32.DLL::GetEnvironmentVariableW] ; call function to get environment variable value
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>29 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -32,7 +32,7 @@
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip finds taskbars. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip finds taskbars. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -50,7 +50,7 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut accepts command line arguments. [[9]](#9)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon accepts command line arguments. [[9]](#9)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi accepts command line arguments. [[9]](#9)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip accepts command line arguments. [[9]](#9)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip accepts command line arguments. [[9]](#9)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware accepts command line arguments. [[9]](#9)|
|
||||
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs a script to inject a JavaScript script and modify web traffic. [[10]](#10)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot accepts command line arguments. [[9]](#9)|
|
||||
@@ -65,53 +65,63 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
|
||||
|[js_suspicious_redirect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/js_suspicious_redirect.py)|Command and Scripting Interpreter (E1059)|CDocument_write, JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[odbcconf_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/odbcconf_bypass.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[regsvr32_squiblydoo_dll_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/regsvr32_squiblydoo_dll_load.py)|Command and Scripting Interpreter (E1059)|LdrLoadDll|
|
||||
|[squiblydoo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/squiblydoo_bypass.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[squiblytwo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/squiblytwo_bypass.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[exe_dropper_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exe_dropper_js.py)|Command and Scripting Interpreter (E1059)|JsEval|
|
||||
|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_registry_script.py)|Command and Scripting Interpreter (E1059)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|
||||
|[ie_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ie_martian_children.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[office_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_martian_children.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[js_phish](https://github.com/CAPESandbox/community/tree/master/modules/signatures/js_phish.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_winfirewall.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[script_tool_executed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_tool_executed.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_obfuscation.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_switches](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_switches.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_terminate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_terminate.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_forfiles_wildcard](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_forfiles_wildcard.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_http_link.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_long_string](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_long_string.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_reversed_http_link.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[long_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/long_commandline.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_renamed_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_renamed_commandline.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[wmi_script_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_script_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[disables_mappeddrives_autodisconnect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_mappeddrives_autodisconnect.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_account_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_currently_loggedin_user_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_pwsh.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_pwsh.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_user_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_network_connection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_network_connection.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, InternetReadFile|
|
||||
|[powershell_scriptblock_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_scriptblock_logging.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_command_suspicious](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_command_suspicious.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_renamed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_renamed.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_reversed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_reversed.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_variable_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_variable_obfuscation.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[office_com_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_com_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[office_vb_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_vb_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[office_wmi_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_wmi_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[document_script_exe_drop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/document_script_exe_drop.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
|
||||
|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows_defender_powershell.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[office_suspicious_processes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_suspicious_processes.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_created_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_network_activity.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
|
||||
|[suspicious_js_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_js_script.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText|
|
||||
|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
|
||||
|[js_suspicious_redirect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/js_suspicious_redirect.py)|Command and Scripting Interpreter (E1059)|CDocument_write, JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[odbcconf_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_applocker.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[regsvr32_squiblydoo_dll_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_applocker.py)|Command and Scripting Interpreter (E1059)|LdrLoadDll|
|
||||
|[squiblydoo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_applocker.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[squiblytwo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_applocker.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[exe_dropper_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/dropper_js.py)|Command and Scripting Interpreter (E1059)|JsEval|
|
||||
|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_fileless.py)|Command and Scripting Interpreter (E1059)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|
||||
|[ie_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/martians_ie.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bcdedit_command.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[office_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/martians_office.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[js_phish](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/js_phish.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_winfirewall.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[script_tool_executed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/windows_utilities.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_switches](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_terminate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_forfiles_wildcard](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_long_string](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[long_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_renamed_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[wmi_script_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wmi.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[disables_mappeddrives_autodisconnect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_drives_autodisconnect.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_network_connection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, InternetReadFile|
|
||||
|[powershell_scriptblock_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_command_suspicious](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_renamed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_reversed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[powershell_variable_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[office_com_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[office_vb_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[office_wmi_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
|
||||
|[document_script_exe_drop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/document_exedrop.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
|
||||
|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Command and Scripting Interpreter (E1059)|--|
|
||||
|[office_suspicious_processes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_suspicious_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
|
||||
|[suspicious_js_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText|
|
||||
|
||||
### E1059 Snippet
|
||||
<details>
|
||||
<summary> Execution::Command and Scripting Interpreter </summary>
|
||||
SHA256: 905b9db8cf5a3001318b28ee5dc674f8f65ca1e4306aab9e331b3bba24e7b8a8
|
||||
Location: 0x41B7A6
|
||||
<pre>
|
||||
call dword ptr [->KERNEL32.DLL::GetCommandLineW]
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>3.0</b></td>
|
||||
<td><b>3.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>19 September 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -70,6 +70,31 @@ Some aspects of this Conditional Execution behavior are related to the [Executio
|
||||
|---|---|---|
|
||||
|[run as service](https://github.com/mandiant/capa-rules/blob/master/host-interaction/service/run-as-service.yml)|Conditional Execution::Runs as Service (B0025.007)|RegisterServiceCtrlHandler, RegisterServiceCtrlHandlerEx, StartServiceCtrlDispatcher, System.ServiceProcess.ServiceBase::Run|
|
||||
|
||||
### B0025.007 Snippet
|
||||
<details>
|
||||
<summary> Execution::Conditional Execution::Runs as Service </summary>
|
||||
SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
|
||||
Location: 0x4596BC
|
||||
<pre>
|
||||
push 0x0 ; Optional password to account running the service. Not needed for services running as LocalService
|
||||
push 0x0 ; Name of account under which to run the service. If null, use the LocalService account
|
||||
push 0x0 ; Optional list of dependencies required for the service to run
|
||||
push 0x0 ; Optional variable for tag depending on value of next parameter. If null, accept the value provided by that parameter.
|
||||
push 0x0 ; Optional load order group for the service. This service does not belong to a group
|
||||
mov param_1, dword ptr [ebp + local_8]
|
||||
call FUN_00404dfc ; Get path of binary for service to run and any arguments
|
||||
push param_1 ; Push to stack
|
||||
push 0x0 ; What to do if there is an error -- in this case, ignore it
|
||||
push 0x2 ; How to start service -- in this case, during system startup
|
||||
push 0x110 ; Service type -- in this case, service is its own process and is capable of interacting with desktop
|
||||
push 0xf01ff ; Desired access rights for service -- in this case, all rights
|
||||
push edi ; Display name for service
|
||||
push esi ; Name of service to install
|
||||
push ebx ; Handle to service control manager database
|
||||
call ADVAPI32.DLL::CreateServiceA ; Create service
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>12 June 2023</b></td>
|
||||
<td><b>29 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,8 +34,8 @@ Software may require certain run-time or library dependencies consistent with no
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Adwind jRAT**](../xample-malware/adwindjrat.md)|2019|--|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)|
|
||||
|[**Adwind jRAT**](../xample-malware/adwind-jrat.md)|2019|--|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)|
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/
|
||||
<a name="1">[1]</a> https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>3.1</b></td>
|
||||
<td><b>3.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -57,31 +57,31 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[office_cve2017_11882](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882.py)|Exploitation for Client Execution (E1203)|CreateProcessInternalW|
|
||||
|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882_network.py)|Exploitation for Client Execution (E1203)|ConnectEx, URLDownloadToFileW|
|
||||
|[office_flash_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_flash_load.py)|Exploitation for Client Execution (E1203)|CoGetClassObject, CoCreateInstance|
|
||||
|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Exploitation for Client Execution (E1203)|NtWriteFile|
|
||||
|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
|
||||
|[exploit_getbasekerneladdress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_getbasekerneladdress.py)|Exploitation for Client Execution (E1203)|EnumDeviceDrivers, LdrGetProcedureAddress, LdrLoadDll, K32EnumDeviceDrivers|
|
||||
|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016_7200.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory|
|
||||
|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_file_created.py)|Exploitation for Client Execution (E1203)|NtCreateFile|
|
||||
|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_process_create.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
|
||||
|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_curl.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
|
||||
|[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll|
|
||||
|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2015_2419_js.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_psexec.py)|Exploitation for Client Execution (E1203)|--|
|
||||
|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_psexec.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
|
||||
|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_tools.py)|Exploitation for Client Execution (E1203)|--|
|
||||
|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_tools.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
|
||||
|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_rdp_clip.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
|
||||
|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_remote_desktop_session.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
|
||||
|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016-0189.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_heapspray.py)|Exploitation for Client Execution (E1203)|NtAllocateVirtualMemory|
|
||||
|[rtf_aslr_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_aslr_bypass.py)|Exploitation for Client Execution (E1203)|--|
|
||||
|[rtf_exploit_static](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_exploit_static.py)|Exploitation for Client Execution (E1203)|--|
|
||||
|[office_cve2017_11882](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Exploitation for Client Execution (E1203)|CreateProcessInternalW|
|
||||
|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Exploitation for Client Execution (E1203)|ConnectEx, URLDownloadToFileW|
|
||||
|[office_flash_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Exploitation for Client Execution (E1203)|CoGetClassObject, CoCreateInstance|
|
||||
|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Exploitation for Client Execution (E1203)|NtWriteFile|
|
||||
|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_remotedesktop.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
|
||||
|[exploit_getbasekerneladdress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_getbasekerneladdress.py)|Exploitation for Client Execution (E1203)|EnumDeviceDrivers, LdrGetProcedureAddress, LdrLoadDll, K32EnumDeviceDrivers|
|
||||
|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2016_7200.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory|
|
||||
|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateFile|
|
||||
|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
|
||||
|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
|
||||
|[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll|
|
||||
|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2015_2419.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sysinternals.py)|Exploitation for Client Execution (E1203)|--|
|
||||
|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sysinternals.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
|
||||
|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sysinternals.py)|Exploitation for Client Execution (E1203)|--|
|
||||
|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sysinternals.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
|
||||
|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
|
||||
|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
|
||||
|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2016-0189.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_heapspray.py)|Exploitation for Client Execution (E1203)|NtAllocateVirtualMemory|
|
||||
|[rtf_aslr_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_rtf.py)|Exploitation for Client Execution (E1203)|--|
|
||||
|[rtf_exploit_static](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_rtf.py)|Exploitation for Client Execution (E1203)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -58,7 +58,7 @@ Droppers may be described as “single stage” or “two stage.” While the fo
|
||||
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs an open-source program called mitmproxy. [[16]](#16)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware contains an embedded PE file. [[19]](#19)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut contains an embedded PE file. [[19]](#19)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip contains an embedded PE file. [[19]](#19)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip contains an embedded PE file. [[19]](#19)|
|
||||
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[20]](#20)|
|
||||
|
||||
## Detection
|
||||
@@ -70,9 +70,9 @@ Droppers may be described as “single stage” or “two stage.” While the fo
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[bitcoin_opencl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bitcoin_opencl.py)|Install Additional Program (B0023)|--|
|
||||
|[dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dropper.py)|Install Additional Program (B0023)|--|
|
||||
|[sniffer_winpcap](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sniffer_winpcap.py)|Install Additional Program (B0023)|--|
|
||||
|[bitcoin_opencl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bitcoin_opencl.py)|Install Additional Program (B0023)|--|
|
||||
|[dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/dropper.py)|Install Additional Program (B0023)|--|
|
||||
|[sniffer_winpcap](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sniffer_winpcap.py)|Install Additional Program (B0023)|--|
|
||||
|
||||
## References
|
||||
<a name="1">"Cyclops Blink: Malware Analysis Report, Version 1.0," National Cyber Security Centre/GCHQ, 23 Feb. 2022. [Online]. Available: https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf.
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>3.1</b></td>
|
||||
<td><b>3.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>12 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -54,7 +54,45 @@ After E1510 was defined, T1510 was replaced by T1641.001, and Clipboard Data (<a
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[set_clipboard_data](https://github.com/CAPESandbox/community/tree/master/modules/signatures/set_clipboard_data.py)|Clipboard Modification (E1510)|SetClipboardData|
|
||||
|[set_clipboard_data](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/set_clipboard_data.py)|Clipboard Modification (E1510)|SetClipboardData|
|
||||
|
||||
### E1510 Snippet
|
||||
<details>
|
||||
<summary> Impact::Clipboard Modification </summary>
|
||||
SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
|
||||
Location: 0x402C0F
|
||||
<pre>
|
||||
push 0x0 ; associate clipboard with current task
|
||||
call dword ptr [->USER32.DLL::OpenClipboard] ; call function to open clipboard
|
||||
test eax, eax ; test if the clipboard open returned 0
|
||||
jz LAB_00402c70 ; if the clipboard open operation returned 0 (failed), jump to another instruction and execute from that point
|
||||
call dword ptr [->USER32.DLL::EmptyClipboard] ; call function to empty the clipboard
|
||||
lea eax, [esi * 0x2 + 0x2]
|
||||
push eax ; Number of bytes of heap memory to allocate
|
||||
push 0x2042 ; Memory allocation attributes. Notably, 0x2000 is deprecated and only intended for use with 16-bit Windows and will be ignored, so the actual argument is 0x0042, which allocates moveable memory and initializes the contents to zero
|
||||
call dword ptr [->KERNEL32.DLL::GlobalAlloc] ; Allocates heap memory
|
||||
mov esi, eax ; store pointer to allocated memory in esi
|
||||
test esi, esi ; test to see if NULL (0) returned, indicating an error with allocation
|
||||
jz LAB_00402c6a ; if error occurred, jump to memory address and begin execution there
|
||||
push esi ; pass newly-allocated memory to lock function
|
||||
call dword ptr [->KERNEL32.DLL::GlobalLock] ; lock the allocated heap memory
|
||||
test eax, eax ; test to see if lock returned NULL (0), indicating an error occurred
|
||||
jz LAB_00402c6a ; if an error occurred, jump to memory address and begin execution there
|
||||
push dword ptr [esp + local_26c] ; number of characters that can be stored in the provided buffer
|
||||
push eax ; buffer that will hold converted string
|
||||
push -0x1 ; size of the string to process. -1 indicates that the input ends with a null-terminating character, so to process up through that point
|
||||
push edi ; pointer to string to convert
|
||||
push 0x0 ; conversion type flags (must be 0 for UTF-8)
|
||||
push 0xfde9 ; code to use for conversion. In this case, 65001 indicates UTF-8
|
||||
call dword ptr [->KERNEL32.DLL::MultiByteToWideChar] ; call function to map string from UTF-8 to UTF-16
|
||||
push esi ; pointer to heap memory to unlock
|
||||
call dword ptr [->KERNEL32.DLL::GlobalUnlock] ; call function to unlock heap memory
|
||||
push esi ; handle to heap memory that will be written to clipboard
|
||||
push 0xd ; type of data to write (0xd indicates unicode)
|
||||
call dword ptr [->USER32.DLL::SetClipboardData] ; call function to write data to clipboard
|
||||
call dword ptr [->USER32.DLL::CloseClipboard] ; close the clipboard
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>29 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -46,4 +46,4 @@ The related **Data Manipulation: Stored Data Manipulation ([T1565.001](https://a
|
||||
|
||||
<a name="1">[1]</a> "TRISIS Malware: Analysis of Safety System Targeted Malware, version 1.20171213," Dragos, 13 Dec. 2017. [Online]. Available: https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf.
|
||||
|
||||
<a name="2">[2]</a> https://content.fireeye.com/apt/rpt-apt38
|
||||
<a name="2">[2]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -62,10 +62,10 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clears_logs.py)|Data Destruction (E1485)|--|
|
||||
|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_recyclebin.py)|Data Destruction (E1485)|--|
|
||||
|[uses_windows_utilities_cipher](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_cipher.py)|Data Destruction (E1485)|--|
|
||||
|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Data Destruction (E1485)|NtDeleteFile, DeleteFileW, DeleteFileA|
|
||||
|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/clears_logs.py)|Data Destruction (E1485)|--|
|
||||
|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_recyclebin.py)|Data Destruction (E1485)|--|
|
||||
|[uses_windows_utilities_cipher](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/windows_utilities.py)|Data Destruction (E1485)|--|
|
||||
|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/anomalous_deletefile.py)|Data Destruction (E1485)|NtDeleteFile, DeleteFileW, DeleteFileA|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -57,15 +57,15 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Data Encrypted for Impact (E1486)|CryptEncrypt|
|
||||
|[ransomware_dmalocker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_dmalocker.py)|Data Encrypted for Impact (E1486)|RegSetValueExA|
|
||||
|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_revil_regkey.py)|Data Encrypted for Impact (E1486)|--|
|
||||
|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_radamant.py)|Data Encrypted for Impact (E1486)|--|
|
||||
|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_extensions.py)|Data Encrypted for Impact (E1486)|--|
|
||||
|[sodinokibi_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sodinokibi_behavior.py)|Data Encrypted for Impact (E1486)|bind, RegSetValueExW, WinHttpOpen, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_message.py)|Data Encrypted for Impact (E1486)|NtWriteFile|
|
||||
|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Data Encrypted for Impact (E1486)|--|
|
||||
|[ransomware_file_modifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_file_modifications.py)|Data Encrypted for Impact (E1486)|NtWriteFile, MoveFileWithProgressW, NtCreateFile, MoveFileWithProgressTransactedW|
|
||||
|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_crypto.py)|Data Encrypted for Impact (E1486)|CryptEncrypt|
|
||||
|[ransomware_dmalocker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_dmalocker.py)|Data Encrypted for Impact (E1486)|RegSetValueExA|
|
||||
|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_revil_regkey.py)|Data Encrypted for Impact (E1486)|--|
|
||||
|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_radamant.py)|Data Encrypted for Impact (E1486)|--|
|
||||
|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_fileextensions.py)|Data Encrypted for Impact (E1486)|--|
|
||||
|[sodinokibi_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_sodinokibi.py)|Data Encrypted for Impact (E1486)|bind, RegSetValueExW, WinHttpOpen, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_message.py)|Data Encrypted for Impact (E1486)|NtWriteFile|
|
||||
|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_files.py)|Data Encrypted for Impact (E1486)|--|
|
||||
|[ransomware_file_modifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_filemodifications.py)|Data Encrypted for Impact (E1486)|NtWriteFile, MoveFileWithProgressW, NtCreateFile, MoveFileWithProgressTransactedW|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -49,10 +49,10 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016_7200.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_cnc_http.py)|Denial of Service (B0033)|--|
|
||||
|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2015_2419_js.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016-0189.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2016_7200.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_cnc_http.py)|Denial of Service (B0033)|--|
|
||||
|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2015_2419.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2016-0189.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
+5
-5
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>3.1</b></td>
|
||||
<td><b>3.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -49,9 +49,9 @@ This description refines the ATT&CK **Disk Wipe: Disk Content Wipe ([T1561.001](
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[deletes_shadow_copies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_shadow_copies.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[deletes_system_state_backup](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_system_state_backup.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wiper_zeroedbytes.py)|Disk Wipe (F0014)|NtWriteFile|
|
||||
|[deletes_shadow_copies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_shadowcopies.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[deletes_system_state_backup](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_system_backup.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wiper.py)|Disk Wipe (F0014)|NtWriteFile|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
+42
-42
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -61,48 +61,48 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Remote Access (B0022)|--|
|
||||
|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_spynet.py)|Remote Access (B0022)|--|
|
||||
|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/parallax_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[rat_pcclient](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_pcclient.py)|Remote Access (B0022)|--|
|
||||
|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_fynloski_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_beebus_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_files.py)|Remote Access (B0022)|--|
|
||||
|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_files.py)|Remote Access (B0022)|--|
|
||||
|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Remote Access (B0022)|--|
|
||||
|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_remotedesktop.py)|Remote Access (B0022)|--|
|
||||
|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_spynet.py)|Remote Access (B0022)|--|
|
||||
|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_parallax_mutex.py)|Remote Access (B0022)|--|
|
||||
|[rat_pcclient](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_pcclient.py)|Remote Access (B0022)|--|
|
||||
|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_fynloski_mutex.py)|Remote Access (B0022)|--|
|
||||
|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_beebus_mutex.py)|Remote Access (B0022)|--|
|
||||
|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xpert.py)|Remote Access (B0022)|--|
|
||||
|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xpert.py)|Remote Access (B0022)|--|
|
||||
|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_warzone.py)|Remote Access (B0022)|--|
|
||||
|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_warzone.py)|Remote Access (B0022)|--|
|
||||
|[evil_grab](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Remote Access (B0022)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
|
||||
|[PlugX](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Remote Access (B0022)|memcpy, RtlDecompressBuffer|
|
||||
|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ratsnif_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[netwire_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/netwire_behavior.py)|Remote Access (B0022)|RegSetValueExA|
|
||||
|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Remote Access (B0022)|--|
|
||||
|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_xtreme_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[blackrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_apis.py)|Remote Access (B0022)|CryptHashData, RtlDecompressBuffer, CreateProcessInternalW|
|
||||
|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_network_activity.py)|Remote Access (B0022)|send|
|
||||
|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Remote Access (B0022)|RegQueryValueExW, RegSetValueExW|
|
||||
|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_rdp_clip.py)|Remote Access (B0022)|--|
|
||||
|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_remote_desktop_session.py)|Remote Access (B0022)|--|
|
||||
|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_plugx_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_files.py)|Remote Access (B0022)|--|
|
||||
|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Remote Access (B0022)|send|
|
||||
|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/venomrat_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[trochilusrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trochilusrat_apis.py)|Remote Access (B0022)|OutputDebugStringW, NtCreateUserProcess, RegSetValueExW, CreateProcessInternalW|
|
||||
|[dcrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_behavior.py)|Remote Access (B0022)|GetAddrInfo, GetAddrInfoW, CryptHashData|
|
||||
|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_files.py)|Remote Access (B0022)|--|
|
||||
|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[karagany_system_event_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_system_event_objects.py)|Remote Access (B0022)|NtCreateEventEx, NtCreateEvent|
|
||||
|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_files.py)|Remote Access (B0022)|--|
|
||||
|[orcusrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/orcusrat_behavior.py)|Remote Access (B0022)|RegOpenKeyExW|
|
||||
|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Remote Access (B0022)|--|
|
||||
|[rat_luminosity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_luminosity.py)|Remote Access (B0022)|CryptHashData, NtCreateMutant, NtCreateFile|
|
||||
|[rat_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_nanocore.py)|Remote Access (B0022)|CryptHashData|
|
||||
|[static_rat_config](https://github.com/CAPESandbox/community/tree/master/modules/signatures/static_rat_config.py)|Remote Access (B0022)|--|
|
||||
|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_files.py)|Remote Access (B0022)|--|
|
||||
|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_mutexes.py)|Remote Access (B0022)|--|
|
||||
|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Remote Access (B0022)|--|
|
||||
|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_ratsnif_mutex.py)|Remote Access (B0022)|--|
|
||||
|[netwire_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_netwire.py)|Remote Access (B0022)|RegSetValueExA|
|
||||
|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_njrat_regkeys.py)|Remote Access (B0022)|--|
|
||||
|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xtreme_mutex.py)|Remote Access (B0022)|--|
|
||||
|[blackrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Remote Access (B0022)|CryptHashData, RtlDecompressBuffer, CreateProcessInternalW|
|
||||
|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Remote Access (B0022)|--|
|
||||
|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Remote Access (B0022)|send|
|
||||
|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Remote Access (B0022)|RegQueryValueExW, RegSetValueExW|
|
||||
|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Remote Access (B0022)|--|
|
||||
|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Remote Access (B0022)|--|
|
||||
|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_plugx_mutex.py)|Remote Access (B0022)|--|
|
||||
|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_oblique.py)|Remote Access (B0022)|--|
|
||||
|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_oblique.py)|Remote Access (B0022)|--|
|
||||
|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_oblique.py)|Remote Access (B0022)|send|
|
||||
|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_venom.py)|Remote Access (B0022)|--|
|
||||
|[trochilusrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_trochilus.py)|Remote Access (B0022)|OutputDebugStringW, NtCreateUserProcess, RegSetValueExW, CreateProcessInternalW|
|
||||
|[dcrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_dcrat.py)|Remote Access (B0022)|GetAddrInfo, GetAddrInfoW, CryptHashData|
|
||||
|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_dcrat.py)|Remote Access (B0022)|--|
|
||||
|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_dcrat.py)|Remote Access (B0022)|--|
|
||||
|[karagany_system_event_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_karagany.py)|Remote Access (B0022)|NtCreateEventEx, NtCreateEvent|
|
||||
|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_karagany.py)|Remote Access (B0022)|--|
|
||||
|[orcusrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_orcus.py)|Remote Access (B0022)|RegOpenKeyExW|
|
||||
|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|Remote Access (B0022)|--|
|
||||
|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|Remote Access (B0022)|--|
|
||||
|[rat_luminosity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_luminosity.py)|Remote Access (B0022)|CryptHashData, NtCreateMutant, NtCreateFile|
|
||||
|[rat_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_nanocore.py)|Remote Access (B0022)|CryptHashData|
|
||||
|[static_rat_config](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/static_rat_config.py)|Remote Access (B0022)|--|
|
||||
|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|Remote Access (B0022)|--|
|
||||
|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|Remote Access (B0022)|--|
|
||||
|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|Remote Access (B0022)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -25,7 +25,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -56,9 +56,9 @@ The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[cryptopool_domains](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptopool_domains.py)|Resource Hijacking (B0018)|GetAddrInfoW|
|
||||
|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomining_stratum_command.py)|Resource Hijacking (B0018)|--|
|
||||
|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomining_stratum_command.py)|Resource Hijacking::Cryptojacking (B0018.002)|--|
|
||||
|[cryptopool_domains](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cryptopools.py)|Resource Hijacking (B0018)|GetAddrInfoW|
|
||||
|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cryptomining.py)|Resource Hijacking (B0018)|--|
|
||||
|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cryptomining.py)|Resource Hijacking::Cryptojacking (B0018.002)|--|
|
||||
|
||||
## References
|
||||
<a name="1">[1]</a> B. G. a. M. Ahuje,"CrowdStrike Discovers First-Ever Dero Cryptojacking Campaign Targeting Kubernetes," CrowdStrike, blog, 15 Mar. 2023. [Online]. Available: https://www.crowdstrike.com/blog/crowdstrike-discovers-first-ever-dero-cryptojacking-campaign-targeting-kubernetes/.
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>29 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -44,8 +44,8 @@ The DNS Communication micro-behavior focuses on DNS communication.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0011.001|Hupigon resolves DNS. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0011.001|Shamoon resolves DNS. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0011.001|Hupigon resolves DNS. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0011.001|Shamoon resolves DNS. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -65,6 +65,17 @@ The DNS Communication micro-behavior focuses on DNS communication.
|
||||
|[network_dns_doh_tls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_doh_tls.py)|DNS Communication (C0011)|--|
|
||||
|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|DNS Communication (C0011)|--|
|
||||
|
||||
### C0011.001 Snippet
|
||||
<details>
|
||||
<summary> Communication::DNS Communication::Resolve </summary>
|
||||
SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
|
||||
Location: 0x472CD3
|
||||
<pre>
|
||||
push ebx ; hostname to perform DNS lookup for
|
||||
call WSOCK32.DLL::gethostbyname ; Windows function which will retrieve an object representing the specified host
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -59,11 +59,11 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0002.010|The malware initializes IWebBrowser2. [[1]](#1)|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0002.011|The malware extracts the HTTP body. [[1]](#1)|
|
||||
|[**Emotet**](../xample-malware/emotet.md)|2018|C0002.012|The malware creates a HTTP request. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|C0002.009|Kovter connects to a HTTP server. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|C0002.012|Kovter creates a HTTP request. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0002.010|The malware initializes IWebBrowser2. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0002.011|The malware extracts the HTTP body. [[1]](#1)|
|
||||
|[**Emotet**](../../xample-malware/emotet.md)|2018|C0002.012|The malware creates a HTTP request. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|C0002.009|Kovter connects to a HTTP server. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|C0002.012|Kovter creates a HTTP request. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -120,6 +120,21 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|
||||
|[downloads_from_filehosting](https://github.com/CAPESandbox/community/tree/master/modules/signatures/downloads_from_filehosting.py)|HTTP Communication (C0002)|WinHttpOpenRequest, InternetOpenUrlA|
|
||||
|[purplewave_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_network_activity.py)|HTTP Communication (C0002)|InternetOpenW, HttpOpenRequestW, HttpSendRequestW, HttpAddRequestHeadersA|
|
||||
|
||||
### C0002.017 Snippet
|
||||
<details>
|
||||
<summary> Communication::HTTP Communication::Get Response </summary>
|
||||
SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641
|
||||
Location: 0x180001380
|
||||
<pre>
|
||||
mov param_2, ebx
|
||||
lea r9, [rsp + 0x44] ; where to store the number of bytes read
|
||||
add param_2, r14 ; pointer to buffer to receive HTTP data
|
||||
mov param_3, 0x400 ; number of bytes to read (1024)
|
||||
mov param_1, rsi ; handle to previously opened HTTP request
|
||||
call qword ptr [->WININET::InternetReadFile] ; Windows API for reading data from HTTP or FTP connections
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -43,9 +43,9 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0003.001|Hupigon creates two anonymous pipes. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0003.004|Hupigon writes pipes. [[1]](#1)|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|C0003.004|Poison Ivy writes pipes. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0003.001|Hupigon creates two anonymous pipes. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0003.004|Hupigon writes pipes. [[1]](#1)|
|
||||
|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|C0003.004|Poison Ivy writes pipes. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -64,6 +64,24 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
|
||||
|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication (C0003)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
|
||||
|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
|
||||
|
||||
### C0003.002 Snippet
|
||||
<details>
|
||||
<summary> Communication::Interprocess Communication::Connect Pipe </summary>
|
||||
SHA256: e5897829835f3e9fbab71674ca06f48ff127ec014d1629817f0566203c93b732
|
||||
Location: 0x40167C
|
||||
<pre>
|
||||
call qword ptr [->KERNEL32.DLL::CreateNamedPipeA] ; stores return value in rax
|
||||
mov r12, rax ; r12 now contains a handle to the named pipe
|
||||
lea rax, [rax + -0x1]
|
||||
cmp rax, -0x3
|
||||
ja LAB_004016dc
|
||||
xor param_2, param_2 ; set value to zeroes. param_2 is edx, which is sometimes used to hold the second argument to a function
|
||||
mov param_1, r12 ; param_1 is rcx, which is sometimes used to hold the first argument to a function. r12 contains the return value from KERNEL32.DLL::CreateNamedPipeA (see earlier mov instruction)
|
||||
lea rdi, [rsp + 0x4c]
|
||||
call qword ptr [->KERNEL32.DLL::ConnectNamedPipe] ; takes param_1 and param_2 as arguments. Return value stored in rax.
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>3.1</b></td>
|
||||
<td><b>3.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -59,9 +59,9 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**SYNful Knock**](../../xample-malware/synful-knock.md)|2015|C0001.014|SYNful Knock initiates communication with the C2 server via a uniquely crafted TCP SYN packet sent to port 80 of the "implanted" router. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0001.010|Hupigon creates a UDP socket. [[2]](#2)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0001.011|Rombertik creates a TCP socket. [[2]](#2)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0001.009|Shamoon initializes a Winsock library. [[2]](#2)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0001.010|Hupigon creates a UDP socket. [[2]](#2)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0001.011|Rombertik creates a TCP socket. [[2]](#2)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0001.009|Shamoon initializes a Winsock library. [[2]](#2)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -90,6 +90,18 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|
||||
|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Socket Communication (C0001)|send|
|
||||
|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|Socket Communication (C0001)|listen, bind|
|
||||
|
||||
### C0001.009 Snippet
|
||||
<details>
|
||||
<summary> Communication::Socket Communication::Initialize Winsock Library </summary>
|
||||
SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
|
||||
Location: 0x472C92
|
||||
<pre>
|
||||
push eax ; pointer to WSADATA structure that the call to start Winsock will populate with the Windows socket data
|
||||
push 0x101 ; highest version of Winsock permitted for use in this application -- in this case, version 1.1 (major version in lowest-order byte, minor version in highest-order byte)
|
||||
call WSOCK.DLL::WSAStartup ; Initiate the Winsock DLL
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://www.mandiant.com/resources/synful-knock-acis
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -48,6 +48,45 @@ The methods below are those of most interest in malware analysis. Details can be
|
||||
|---|---|---|
|
||||
|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|WinINet (C0005)|InternetOpenA, InternetOpenUrlA|
|
||||
|
||||
### C0005.001 Snippet
|
||||
<details>
|
||||
<summary> Communication::WinINet::InternetConnect </summary>
|
||||
SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641
|
||||
Location: 0x1800010b2
|
||||
<pre>
|
||||
call qword ptr [->WININET.DLL::InternetOpenA] ; Open a connection to the Internet and return the handle into rax
|
||||
mov rbp, rax ; store the handle in rbp
|
||||
test rax, rax
|
||||
jz LAB_1800013de
|
||||
mov param_1, 0x17
|
||||
call thunk_FUN_180004114
|
||||
mov r10, rax
|
||||
mov rdi, rax
|
||||
xor eax, eax
|
||||
mov param_1, 0x17
|
||||
stosb.rep rdi
|
||||
mov rdi, r10
|
||||
mov param_2, rbx
|
||||
nop dword ptr [rax]
|
||||
nop word ptr [rax + rax*0x1]
|
||||
movzx param_1, byte ptr [param_2 + rsi*offset DAT_18001ea00] ; first instruction in loop
|
||||
add param_2, 0x3 ; increase loop variable
|
||||
mov byte ptr [rdi], param_1
|
||||
lea rdi, [rdi + 0x1]
|
||||
cmp param_2, 0x42 ; test for loop end
|
||||
jl LAB_1800010f0 ; jump to beginning of loop
|
||||
movzx param_3, word ptr [DAT_18001ea44] ; TCP/IP port to connect to. DAT_18001ea44 contains 443, so this connection will occur on the default HTTPS port
|
||||
xor r9d, r9d ; name of user (if FTP connection), or NULL
|
||||
mov qword ptr [rsp + local_390], rbx ; pointer to application context for the returned handle to the internet connection
|
||||
mov param_2, r10 ; pointer to host name for internet server
|
||||
mov dword ptr [rsp + local_398], ebx ; pointer to flags specific for service used
|
||||
mov param_1, rbp ; handle to the internet connection established earlier
|
||||
mov dword ptr [rsp + local_3a0], 0x3 ; service type to access (0x3 indicates use of HTTP)
|
||||
mov qword ptr [rsp + local_3a8], rbx ; password for FTP (if needed)
|
||||
call qword ptr [->WININET.DLL::InternetConnectA] ; Windows API function to initiate an HTTP connection
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions
|
||||
|
||||
@@ -18,7 +18,7 @@ Micro-behaviors that enable malware to use crypto.
|
||||
|
||||
* **Crypto Algorithm** [C0068](../cryptography/crypto-algorithm.md)
|
||||
* **Crypto Constant** [C0069](../cryptography/crypto-constant.md)
|
||||
* **Crypto Library** [C0059](../cryptography/crypto-lib.md)
|
||||
* **Crypto Library** [C0059](../cryptography/crypto-library.md)
|
||||
* **Encrypt Data** [C0027](../cryptography/encrypt-data.md)
|
||||
* **Decrypt Data** [C0031](../cryptography/decrypt-data.md)
|
||||
* **Generate Pseudo-random Sequence** [C0021](../cryptography/generate-pseudorandom-sequence.md)
|
||||
|
||||
@@ -30,4 +30,4 @@
|
||||
|
||||
A known crypto algorithm is implemented in the code and it is unknown whether it is from a public crypto library.
|
||||
|
||||
When the library is known, **Crypto Library ([C0059](../cryptography/crypto-lib.md))** micro-behavior should be used.
|
||||
When the library is known, **Crypto Library ([C0059](../cryptography/crypto-library.md))** micro-behavior should be used.
|
||||
|
||||
@@ -45,13 +45,13 @@ Malware may use a cryptographic hash.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy hashes data via WinCrypt. [[1]](#1)|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0029.001|BlackEnergy hashes data with MD5. [[1]](#1)|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0029.002|BlackEnergy hashes data using SHA1. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter hashes data via WinCrypt. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip hashes data via WinCrypt. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0029.002|Redhip hashes data using SHA1. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|C0029.002|UP007 hashes data using SHA1. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy hashes data via WinCrypt. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0029.001|BlackEnergy hashes data with MD5. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0029.002|BlackEnergy hashes data using SHA1. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter hashes data via WinCrypt. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip hashes data via WinCrypt. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|C0029.002|Redhip hashes data using SHA1. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|C0029.002|UP007 hashes data using SHA1. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -53,8 +53,8 @@ Malware may decrypt data.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -54,20 +54,20 @@ Malware may encrypt data.
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**TrickBot**](../../xample-malware/trickbot.md)|2016|C0027.001|The malware uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files. [[1]](#1)|
|
||||
|[**Emotet**](../xample-malware/emotet.md)|2018|C0027.009|Emotet encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**Emotet**](../../xample-malware/emotet.md)|2018|C0027.009|Emotet encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**Emotet**](../../xample-malware/emotet.md)|2018|C0027.011|Emotet uses RSA to encrypt network traffic to its C2. [[2]](#2)|
|
||||
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|C0027.001|GravityRat v3 supports file AES file encryption. [[3]](#3)|
|
||||
|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|C0027.003|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key. [[4]](#4)|
|
||||
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|C0027.009|CHOPSTICK encrypts the configuration block using RC4 encryption. [[5]](#5)|
|
||||
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|C0027.009|The malware decrypts inner configurations stored in the binary. The malware also encrypts the value of each JSON key with RC4 and encodes the value with Base64. [[6]](#6) [[7]](#7)|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0027.009|BlackEnergy encrypts data using RC4 via WinAPI. [[8]](#8)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0027.009|Dark Comet encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0027.009|DNSChanger encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0027.004|Hupigon encrypts data using DES. [[8]](#8)|
|
||||
|[**Kraken**](../xample-malware/kraken.md)|2008|C0027.009|Kraken encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0027.009|Locky Bart encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip encrypts data using DPAPI. [[8]](#8)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0027.009|Rombertik encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**CHOPSTICK**](../../xample-malware/chopstick.md)|2015|C0027.009|CHOPSTICK encrypts the configuration block using RC4 encryption. [[5]](#5)|
|
||||
|[**Matanbuchus**](../../xample-malware/matanbuchus.md)|2021|C0027.009|The malware decrypts inner configurations stored in the binary. The malware also encrypts the value of each JSON key with RC4 and encodes the value with Base64. [[6]](#6) [[7]](#7)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0027.009|BlackEnergy encrypts data using RC4 via WinAPI. [[8]](#8)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0027.009|Dark Comet encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|C0027.009|DNSChanger encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0027.004|Hupigon encrypts data using DES. [[8]](#8)|
|
||||
|[**Kraken**](../../xample-malware/kraken.md)|2008|C0027.009|Kraken encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0027.009|Locky Bart encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip encrypts data using DPAPI. [[8]](#8)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0027.009|Rombertik encrypts data using RC4 PRGA. [[8]](#8)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -41,10 +41,10 @@ Malware may import, generate, or otherwise use an encryption key.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates new key via CryptAcquireContext. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates a new key via CryptAcquireContext. [[1]](#1)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a new key via CryptAcquireContext. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0028.002|Rombertik encrypts data using RC4 KSA. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates new key via CryptAcquireContext. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter creates a new key via CryptAcquireContext. [[1]](#1)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a new key via CryptAcquireContext. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0028.002|Rombertik encrypts data using RC4 KSA. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.0</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -43,8 +43,8 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0021.003|BlackEnergy generates random numbers via WinAPI. [[1]](#1)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0021.003|BlackEnergy generates random numbers via WinAPI. [[1]](#1)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -55,6 +55,43 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p
|
||||
|[generate random numbers via RtlGenRandom](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml)|Generate Pseudo-random Sequence::Use API (C0021.003)|SystemFunction036|
|
||||
|[generate random numbers using a Mersenne Twister](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml)|Generate Pseudo-random Sequence (C0021)|--|
|
||||
|
||||
### C0021 Snippet
|
||||
<details>
|
||||
<summary> Cryptography::Generate Pseudo-random Sequence </summary>
|
||||
SHA256: 192cdcbdec8bdebb7cae89037d6004b4aff2b8264c35a3875fa2d6db104437ca
|
||||
Location: 0x40B120
|
||||
<pre>
|
||||
mov eax, [DAT_00423174] ; set up the array of values used for the twister
|
||||
mov ecx, dword ptr [eax*0x4 + DAT_004227b0]
|
||||
mov dword ptr [EBP + local_8], ecx
|
||||
mov edx, dword ptr [DAT_00423174]
|
||||
add edx, 0x1
|
||||
mov dword ptr [DAT_OO423174], edx
|
||||
mov eax, dword ptr [ebp + local_8] ; set up by taking x (value in series to start the transform, stored at the memory address [ebp + local_8] in this case
|
||||
shr eax, 0xb ; shift x right by 11
|
||||
xor eax, dword ptr [ebp + local_8] ; xor the result of the previous operation with the old value of x. The eax register now contains intermediate value y
|
||||
mov dword ptr [ebp + local_8], eax ; store the value of y
|
||||
mov ecx, dword ptr [ebp + local_8] ; ecx now contains y
|
||||
shl ecx, 0x7 ; shift y left by 7
|
||||
and ecx, 0x9d2c5680 ; perform a bitwise and against a known constant bitmask (this value is specified in the transform equation)
|
||||
xor ecx, dword ptr [ebp + local_8] ; xor the output of the previous two instructions with the old value of y to produce y1 (still an intermediate value)
|
||||
mov dword ptr [ebp + local_8], ecx ; store y1
|
||||
mov edx, dword ptr [ebp + local_8] ; load y1 into edx to start the third part of the transform
|
||||
shl edx, 0xf ; shift y1 left by 15
|
||||
and edx, 0xefc60000 ; take y1 and perform a bitwise and operation with another constant
|
||||
xor edx, dword ptr [ebp + local_8] ; xor the output from the previous two instructions with the value of y1 stored earlier
|
||||
mov dword ptr [ebp + local_8], edx ; save this new intermediate y-value (y2)
|
||||
mov eax, dword ptr [ebp + local_8] ; load y2 into eax to start the final portion of the transform and produce the output
|
||||
shr eax, 0x12 ; shift y2 right by 18
|
||||
xor eax, dword ptr [ebp + local_8] ; xor the output from the previous instruction with the value of y2 stored earlier
|
||||
mov dword ptr [ebp + local_8], eax ; store the z-value (final output)
|
||||
mov eax, dword ptr [ebp + local_8] ; load the z-value into eax to return it
|
||||
mov esp, ebp ; move the stack pointer to the frame pointer
|
||||
pop ebp ; pop the current frame off the stack
|
||||
ret ; return from the function
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -34,7 +34,7 @@ Malware may check a string for some characteristics, such as being ASCII content
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart references Base64 strings. [[1]](#1)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart references Base64 strings. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -43,10 +43,10 @@ Malware may derive a checksum from some block of data. The checksum is often use
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0032.001|Dark Comet hashes data with CRC32. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|C0032.001|Gamut hashes data with CRC32. [[1]](#1)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0032.001|Locky Bart hashes data with CRC32. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|C0032.001|UP007 hashes data with CRC32. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0032.001|Dark Comet hashes data with CRC32. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|C0032.001|Gamut hashes data with CRC32. [[1]](#1)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0032.001|Locky Bart hashes data with CRC32. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|C0032.001|UP007 hashes data with CRC32. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -34,8 +34,8 @@ Malware may utilize a compression library.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|DarkComet linked against ZLIB. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|DarkComet linked against ZLIB. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -42,7 +42,7 @@ Malware may decompress data.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Bagle**](../xample-malware/bagle.md)|2004|C0025.003|Bagle decompresses data using aPLib. [[1]](#1)|
|
||||
|[**Bagle**](../../xample-malware/bagle.md)|2004|C0025.003|Bagle decompresses data using aPLib. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -41,20 +41,20 @@ Malware may encode data.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|C0026.002|CryptoLocker encodes data using XOR. [[1]](#1)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0026.002|Dark Comet encodes data using XOR. [[1]](#1)|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0026.002|DNSChanger encodes data using XOR. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|C0026.002|Gamut encodes data using XOR. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0026.002|Hupigon encodes data using XOR. [[1]](#1)|
|
||||
|[**Kraken**](../xample-malware/kraken.md)|2008|C0026.002|Kraken encodes data using XOR. [[1]](#1)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0026.002|Locky Bart encodes data using XOR. [[1]](#1)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|C0026.002|Mebromi encodes data using XOR. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0026.002|Redhip encodes data using XOR. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0026.002|Rombertik encodes data using XOR. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0026.002|Shamoon encodes data using XOR. [[1]](#1)|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0026.002|Stuxnet encodes data using XOR. [[1]](#1)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0026.002|TrickBot encodes data using XOR. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|C0026.002|The malware encodes data using XOR. [[1]](#1)|
|
||||
|[**CryptoLocker**](../../xample-malware/cryptolocker.md)|2013|C0026.002|CryptoLocker encodes data using XOR. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0026.002|Dark Comet encodes data using XOR. [[1]](#1)|
|
||||
|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|C0026.002|DNSChanger encodes data using XOR. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|C0026.002|Gamut encodes data using XOR. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0026.002|Hupigon encodes data using XOR. [[1]](#1)|
|
||||
|[**Kraken**](../../xample-malware/kraken.md)|2008|C0026.002|Kraken encodes data using XOR. [[1]](#1)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0026.002|Locky Bart encodes data using XOR. [[1]](#1)|
|
||||
|[**Mebromi**](../../xample-malware/mebromi.md)|2011|C0026.002|Mebromi encodes data using XOR. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|C0026.002|Redhip encodes data using XOR. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0026.002|Rombertik encodes data using XOR. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0026.002|Shamoon encodes data using XOR. [[1]](#1)|
|
||||
|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|C0026.002|Stuxnet encodes data using XOR. [[1]](#1)|
|
||||
|[**TrickBot**](../../xample-malware/trickbot.md)|2016|C0026.002|TrickBot encodes data using XOR. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|C0026.002|The malware encodes data using XOR. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.0</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -35,3 +35,13 @@ Malware calculates a modulo value.
|
||||
|Tool: capa|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[calculate modulo 256 via x86 assembly](https://github.com/mandiant/capa-rules/blob/master/lib/calculate-modulo-256-via-x86-assembly.yml)|Modulo (C0058)|--|
|
||||
|
||||
### C0058 Snippet
|
||||
<details>
|
||||
<summary> Data::Modulo </summary>
|
||||
SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
|
||||
Location: 0x403135
|
||||
<pre>
|
||||
and param_3, 0xff ; Taking the bitwise AND of any number x with a number equivalent to (2^n - 1) where n is a whole number is congruent to taking x % 2^n. In this case, x = param_3 and 0xff = 255 which satisfies (2^n - 1) for n = 8.
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.0</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -48,3 +48,27 @@ Malware may use a non-cryptographic hash.
|
||||
|[hash data using murmur3](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml)|Non-Cryptographic Hash::MurmurHash (C0030.001)|--|
|
||||
|[hash data using fnv](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/fnv/hash-data-using-fnv.yml)|Non-Cryptographic Hash::FNV (C0030.005)|_allmul|
|
||||
|[hash data using djb2](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/djb2/hash-data-using-djb2.yml)|Non-Cryptographic Hash::djb2 (C0030.006)|--|
|
||||
|
||||
|
||||
### C0030.005 Snippet
|
||||
<details>
|
||||
<summary> Data::Non-Cryptographic Hash::FNV </summary>
|
||||
SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
|
||||
Location: 0x403454
|
||||
<pre>
|
||||
mov esi, dword ptr [ebp + param_2] ; set number of bytes to hash
|
||||
mov edx, 0x811c9dc5 ; store FNV offset constant. The constants used in this snippet are the constants used for a 32-bit/4 byte message.
|
||||
push edi ; save the value of edi on the stack
|
||||
mov edi, dword ptr [ebp + param_1] ; first byte to hash
|
||||
mov ecx, 0x0 ; initialize counter
|
||||
sub esi, edi ; obtain the offset between first and last bytes to hash
|
||||
jz LAB_00403481 ; if the first and last bytes of the hash are the same, execute elsewhere and don't perform the hashing operation.
|
||||
nop dword ptr [eax]
|
||||
movzx eax, byte ptr [ecx + edi*0x1] ; move the byte to hash into the accumulator
|
||||
inc ecx ; increment the counter
|
||||
xor eax, edx ; xor the new value in the accumulator with the rest of the hash (for first xor, this will be the offset constant set earlier) and store the result in the accumulator. The xor occurring before the multiplication indicates that this is the FNV-1a variant of the algorithm
|
||||
imul edx, eax, 0x1000193 ; multiply the accumulator by the prime constant and store in edx for xor operation in next iteration
|
||||
cmp ecx, esi ; check if counter has reached offset (hashed last byte)
|
||||
jc LAB_00403470 ; if the counter has not yet reached the offset, jump back to the movzx instruction above
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
@@ -34,12 +34,12 @@ Malware copies a file.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR copies files. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon copies files. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter copies files. [[1]](#1)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi copies files. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip copies files. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)|
|
||||
|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR copies files. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon copies files. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter copies files. [[1]](#1)|
|
||||
|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi copies files. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip copies files. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,13 +34,13 @@ Malware creates a directory.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut creates directories. [[1]](#1)|
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR creates directories. [[1]](#1)|
|
||||
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT creates directories. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates directories. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates directories. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates directories. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 creates directories. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut creates directories. [[1]](#1)|
|
||||
|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR creates directories. [[1]](#1)|
|
||||
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT creates directories. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon creates directories. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter creates directories. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip creates directories. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 creates directories. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -52,6 +52,18 @@ Malware creates a directory.
|
||||
|---|---|---|
|
||||
|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create Directory (C0046)|--|
|
||||
|
||||
### C0046 Snippet
|
||||
<details>
|
||||
<summary> File System::Create Directory </summary>
|
||||
SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
|
||||
Location: 0x1400036d4
|
||||
<pre>
|
||||
xor param_2, param_2 ; use default security attributes (param_2 is NULL)
|
||||
mov param_1, rbp ; use contents of rbp as directory name
|
||||
call qword ptr [->KERNEL32.DLL::CreateDirectoryA] ; call Windows API to create directory
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,9 +34,9 @@ Malware deletes a directory.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut deletes directories. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut deletes directories. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -44,6 +44,17 @@ Malware deletes a directory.
|
||||
|---|---|---|
|
||||
|[delete directory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/delete/delete-directory.yml)|Delete Directory (C0048)|RemoveDirectory, RemoveDirectoryTransacted, _rmdir, _wrmdir, System.IO.DirectoryInfo::Delete, System.IO.Directory::Delete|
|
||||
|
||||
### C0048 Snippet
|
||||
<details>
|
||||
<summary> File System::Delete Directory </summary>
|
||||
SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
|
||||
Location: 0x140002204
|
||||
<pre>
|
||||
mov param_1, rdi ; store name of directory to remove
|
||||
call qword ptr [->KERNEL32.DLL::RemoveDirectoryA] ; call Windows API function to remove directory
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,19 +34,19 @@ Malware deletes a file.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet deletes files. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut deletes files. [[1]](#1)|
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR deletes files. [[1]](#1)|
|
||||
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT deletes files. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon deletes files. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter deletes files. [[1]](#1)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi deletes files. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip deletes files. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik deletes files. [[1]](#1)|
|
||||
|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam deletes files. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon deletes files. [[1]](#1)|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet deletes files. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut deletes files. [[1]](#1)|
|
||||
|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR deletes files. [[1]](#1)|
|
||||
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT deletes files. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon deletes files. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter deletes files. [[1]](#1)|
|
||||
|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi deletes files. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip deletes files. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik deletes files. [[1]](#1)|
|
||||
|[**SamSam**](../../xample-malware/samsam.md)|2015|--|SamSam deletes files. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon deletes files. [[1]](#1)|
|
||||
|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -63,6 +63,20 @@ Malware deletes a file.
|
||||
|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA|
|
||||
|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
|
||||
|
||||
### C0047 Snippet
|
||||
<details>
|
||||
<summary> File System::Delete File </summary>
|
||||
SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
|
||||
Location: 0x409BB1
|
||||
<pre>
|
||||
call FUN_00404E80 ; generate file name to delete and store in eax
|
||||
push eax ; use the name generated by the previous function as an argument to the next function call
|
||||
call KERNEL32.DLL::DeleteFileA ; delete the file
|
||||
cmp eax, 0x1 ; if the file was successfully deleted, the previous function call will return a 1 into eax
|
||||
sbb eax, eax ; isolate the carry flag from the previous comparison. This will only be 1 if the previous command failed, otherwise it will be 0.
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,12 +34,12 @@ Malware gets file attributes.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet gets file attributes. [[1]](#1)|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger gets file attributes. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut gets file attributes. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon gets file attributes. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets file attributes. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 gets file attributes. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet gets file attributes. [[1]](#1)|
|
||||
|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger gets file attributes. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut gets file attributes. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon gets file attributes. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip gets file attributes. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 gets file attributes. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -47,6 +47,25 @@ Malware gets file attributes.
|
||||
|---|---|---|
|
||||
|[get file attributes](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/get-file-attributes.yml)|Get File Attributes (C0049)|kernel32.GetFileAttributes, ZwQueryDirectoryFile, ZwQueryInformationFile, NtQueryDirectoryFile, NtQueryInformationFile, System.IO.File::GetAttributes, System.IO.File::GetCreationTime, System.IO.File::GetCreationTimeUtc, System.IO.File::GetLastAccessTime, System.IO.File::GetLastAccessTimeUtc, System.IO.File::GetLastWriteTime, System.IO.File::GetLastWriteTimeUtc|
|
||||
|
||||
### C0049 Snippet
|
||||
<details>
|
||||
<summary> File System::Get File Attributes </summary>
|
||||
SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
|
||||
Location: 0x4094B0
|
||||
<pre>
|
||||
push ebx ; Name of file to get attributes for
|
||||
mov ebx, param_1
|
||||
mov param_1, ebx
|
||||
call FUN_00404DFC
|
||||
push param_1 ; Return value for function call
|
||||
call KERNEL32.DLL::GetFileAttributesA ; Call Windows API for file deletion
|
||||
cmp param_1, -0x1 ; Test if the return value indicates an error
|
||||
jz LAB_004094C9 ; If the function returned an error, go to this address to continue execution
|
||||
test param_1, 0x10 ; Test to see if the file queried is a directory
|
||||
jnz LAB_004094CD ; If the file is not a directory, continue execution from this address
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,12 +34,12 @@ Malware moves a file.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut moves files. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon moves files. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter moves files. [[1]](#1)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi moves files. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon moves files. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 moves files. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut moves files. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon moves files. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter moves files. [[1]](#1)|
|
||||
|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi moves files. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon moves files. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 moves files. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -51,6 +51,20 @@ Malware moves a file.
|
||||
|---|---|---|
|
||||
|[move_file_on_reboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/move_file_on_reboot.py)|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW|
|
||||
|
||||
### C0063 Snippet
|
||||
<details>
|
||||
<summary> File System::Move File </summary>
|
||||
SHA256: bb8c0e477512adab1db26eb77fe10dadbc5dcbf8e94569061c7199ca4626a420
|
||||
Location: 0x41a61d
|
||||
<pre>
|
||||
push 0x4 ; option to delay move until the next reboot
|
||||
push edi ; new name for the moved file
|
||||
lea eax, [ebp + 0xffffefc4]
|
||||
push eax ; name of the file to be moved
|
||||
call dword ptr [->KERNEL32.DLL::MoveFileExW] ; Windows API function to move the file from one name to another
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,20 +34,20 @@ Malware reads a file.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet reads files on Windows. [[1]](#1)|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger reads files on Windows. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut reads files on Windows. [[1]](#1)|
|
||||
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT reads files on Windows. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon reads files on Windows. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter reads files on Windows. [[1]](#1)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart reads files on Windows. [[1]](#1)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi reads files on Windows. [[1]](#1)|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy reads files on Windows. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip reads files on Windows. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik reads files on Windows. [[1]](#1)|
|
||||
|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam reads files on Windows. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon reads files on Windows. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 reads files on Windows. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet reads files on Windows. [[1]](#1)|
|
||||
|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger reads files on Windows. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut reads files on Windows. [[1]](#1)|
|
||||
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT reads files on Windows. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon reads files on Windows. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter reads files on Windows. [[1]](#1)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart reads files on Windows. [[1]](#1)|
|
||||
|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi reads files on Windows. [[1]](#1)|
|
||||
|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|--|Poison Ivy reads files on Windows. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip reads files on Windows. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik reads files on Windows. [[1]](#1)|
|
||||
|[**SamSam**](../../xample-malware/samsam.md)|2015|--|SamSam reads files on Windows. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon reads files on Windows. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 reads files on Windows. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -67,6 +67,21 @@ Malware reads a file.
|
||||
|[infostealer_browser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_browser.py)|Read File (C0051)|NtReadFile, CopyFileA, CopyFileExW, CopyFileW|
|
||||
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Read File (C0051)|--|
|
||||
|
||||
### C0051 Snippet
|
||||
<details>
|
||||
<summary> File System::Read File </summary>
|
||||
SHA256: e5897829835f3e9fbab71674ca06f48ff127ec014d1629817f0566203c93b732
|
||||
Location: 0x401762
|
||||
<pre>
|
||||
mov r9, rdi ; variable that will hold number of bytes actually read from file
|
||||
mov r8d, ebx ; number of bytes to read
|
||||
mov param_2, rsi ; pointer to buffer that will hold content read from file
|
||||
mov param_1, r12 ; handle to the device/file to read from
|
||||
mov qword ptr [rsp + local_58], 0x0 ; optional pointer to OVERLAPPED structure (in this case, it is NULL)
|
||||
call qword ptr [->KERNEL32.DLL::ReadFile] ; API call to read file specified in param_1
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,12 +34,12 @@ Malware sets file attributes.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger sets file attributes. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut sets file attributes. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon sets file attributes. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter sets file attributes. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip sets file attributes. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 sets file attributes. [[1]](#1)|
|
||||
|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger sets file attributes. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut sets file attributes. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon sets file attributes. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter sets file attributes. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip sets file attributes. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 sets file attributes. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -48,6 +48,18 @@ Malware sets file attributes.
|
||||
|[change file permission on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/change-file-permission-on-linux.yml)|Set File Attributes (C0050)|chown, fchown, lchown, fchownat|
|
||||
|[set file attributes](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/set-file-attributes.yml)|Set File Attributes (C0050)|kernel32.SetFileAttributes, ZwSetInformationFile, NtSetInformationFile, System.IO.File::SetAttributes, System.IO.File::SetCreationTime, System.IO.File::SetCreationTimeUtc, System.IO.File::SetLastAccessTime, System.IO.File::SetLastAccessTimeUtc, System.IO.File::SetLastWriteTime, System.IO.File::SetLastWriteTimeUtc|
|
||||
|
||||
### C0050 Snippet
|
||||
<details>
|
||||
<summary> File System::Set File Attributes </summary>
|
||||
SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
|
||||
Location: 0x140006a6d
|
||||
<pre>
|
||||
mov edx, 0x2 ; pass the value indicating for the 'hidden' attribute to be set on the file
|
||||
lea rcx, [rsp + 0x40] ; name of the file for which attributes should be changed
|
||||
call qword ptr [->KERNEL32.DLL::SetFileAttributesA] ; call Windows API for changing file attributes
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,18 +34,18 @@ Malware writes to a file.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker writes Fileon Windows. [[1]](#1)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet writes Fileon Windows. [[1]](#1)|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger writes Fileon Windows. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut writes files on Windows. [[1]](#1)|
|
||||
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT writes files on Windows. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon writes files on Windows. [[1]](#1)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart writes files on Windows. [[1]](#1)|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy writes files on Windows. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip writes files on Windows. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik writes files on Windows. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon writes files on Windows. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 writes files on Windows. [[1]](#1)|
|
||||
|[**CryptoLocker**](../../xample-malware/cryptolocker.md)|2013|--|CryptoLocker writes Fileon Windows. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet writes Fileon Windows. [[1]](#1)|
|
||||
|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger writes Fileon Windows. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut writes files on Windows. [[1]](#1)|
|
||||
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT writes files on Windows. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon writes files on Windows. [[1]](#1)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart writes files on Windows. [[1]](#1)|
|
||||
|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|--|Poison Ivy writes files on Windows. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip writes files on Windows. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik writes files on Windows. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon writes files on Windows. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 writes files on Windows. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -67,6 +67,21 @@ Malware writes to a file.
|
||||
|[echelon_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/echelon_files.py)|Writes File (C0052)|--|
|
||||
|[upatre_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/upatre_files.py)|Writes File (C0052)|--|
|
||||
|
||||
### C0052 Snippet
|
||||
<details>
|
||||
<summary> File System::Writes File </summary>
|
||||
SHA256: e5897829835f3e9fbab71674ca06f48ff127ec014d1629817f0566203c93b732
|
||||
Location: 0x4016A7
|
||||
<pre>
|
||||
mov r9, rdi ; variable that will hold number of bytes actually written
|
||||
mov r8d, ebx ; number of bytes to write
|
||||
mov param_2, rsi ; pointer to buffer containing data that will be written to the file
|
||||
mov param_1, r12 ; handle to the device/file to write to
|
||||
mov qword ptr [rsp + local_58], 0x0 ; optional pointer to OVERLAPPED structure (in this case, it is NULL)
|
||||
call qword ptr [->KERNEL32.DLL::WriteFile] ; API call to write to file specified in param_1
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2023</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,15 +34,15 @@ Malware allocates memory, often to unpack itself.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker allocates RWX memory. [[1]](#1)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet allocates RWX memory. [[1]](#1)|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger allocates RWX memory. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon allocates RWX memory. [[1]](#1)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi allocates RWX memory. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip spawns threads to RWX shellcode. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik allocates RWX memory. [[1]](#1)|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet allocates RWX memory. [[1]](#1)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot allocates RWX memory. [[1]](#1)|
|
||||
|[**CryptoLocker**](../../xample-malware/cryptolocker.md)|2013|--|CryptoLocker allocates RWX memory. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet allocates RWX memory. [[1]](#1)|
|
||||
|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger allocates RWX memory. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon allocates RWX memory. [[1]](#1)|
|
||||
|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi allocates RWX memory. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip spawns threads to RWX shellcode. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik allocates RWX memory. [[1]](#1)|
|
||||
|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet allocates RWX memory. [[1]](#1)|
|
||||
|[**TrickBot**](../../xample-malware/trickbot.md)|2016|--|TrickBot allocates RWX memory. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -57,6 +57,20 @@ Malware allocates memory, often to unpack itself.
|
||||
|---|---|---|
|
||||
|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|
||||
### C0007 Snippet
|
||||
<details>
|
||||
<summary> Memory::Allocate Memory </summary>
|
||||
SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
|
||||
Location: 0x422BDC
|
||||
<pre>
|
||||
push 0x40 ; Memory protections to apply to pages in allocated memory region (in this case, PAGE_EXECUTE_READWRITE, which allows execute, read-only, or read/write access to the allocated memory)
|
||||
push 0x1000 ; The type of allocation to perform (in this case, MEM_COMMIT which allocates empty virtual memory to begin with and only allocates physical pages when needed).
|
||||
push 0x1000 ; Size of region to allocate in bytes
|
||||
push 0x0 ; Starting address for region where memory should be allocated (not provided in this example)
|
||||
call KERNEL32.DLL::VirtualAlloc ; call function to allocate virtual memory
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -50,6 +50,23 @@ Malware may change memory protection. For example, read-write memory may be chan
|
||||
|---|---|---|
|
||||
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Change Memory Protection (C0008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|
||||
|
||||
### C0008 Snippet
|
||||
<details>
|
||||
<summary> Memory::Change Memory Protection </summary>
|
||||
SHA256: 905b9db8cf5a3001318b28ee5dc674f8f65ca1e4306aab9e331b3bba24e7b8a8
|
||||
Location: 0x41AB74
|
||||
<pre>
|
||||
push ecx ; pointer to return value
|
||||
push 0x40 ; new memory protection option to apply -- in this case, read, write, and execute permissions will be applied to the pages
|
||||
mov [DAT_01f56ff0], eax
|
||||
mov eax, [DAT_00492fc4]
|
||||
push edx ; size of region to change access protection attributes (in bytes)
|
||||
push eax ; Address of first page in region where access protection attributes are to be changed
|
||||
; instructions from 0x41ab83 to 0x41abb4 omitted
|
||||
call dword ptr [->KERNEL32.DLL::VirtualProtect] ; call function to change memory protection attributes
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
|
||||
|
||||
@@ -28,4 +28,4 @@
|
||||
|
||||
# Stack Pivot
|
||||
|
||||
Stack pivoting involves pointing the stack pointer to an attacker-owned buffer, such as the heap, and facilitates exploits such as ROP-based exploits (see [Bypass DEP](../defense-evasion/bypass-data-execution-prevention.md) behavior).
|
||||
Stack pivoting involves pointing the stack pointer to an attacker-owned buffer, such as the heap, and facilitates exploits such as ROP-based exploits (see [Bypass DEP](../../defense-evasion/bypass-data-execution-prevention.md) behavior).
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -40,3 +40,21 @@ Malware modifies the console.
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Console (C0033)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|
||||
|
||||
### C0033 Snippet
|
||||
<details>
|
||||
<summary> Operating System::Console </summary>
|
||||
SHA256: 905b9db8cf5a3001318b28ee5dc674f8f65ca1e4306aab9e331b3bba24e7b8a8
|
||||
Location: 0x41B4CD
|
||||
<pre>
|
||||
lea eax, [esp + 0x50] ; load an address into eax
|
||||
push eax ; where to store number of characters read
|
||||
push ecx ; coordinates of console cell on screen where reading text should begin
|
||||
push ecx ; number of screen buffer character cells to read
|
||||
lea edx, [esp + 0x2cc] ; load address into edx
|
||||
push edx ; address of buffer into which characters should be read
|
||||
push ecx ; handle to the console read buffer
|
||||
mov dword ptr [esp + 0x68], ecx
|
||||
call KERNEL32.DLL::ReadConsoleOutputCharacterA ; call function to read characters from the console
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
@@ -40,8 +40,8 @@ Malware modifies environment variables.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|C0034.001|Kovter sets environment variables. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|C0034.001|UP007 sets environment variables. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|C0034.001|Kovter sets environment variables. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|C0034.001|UP007 sets environment variables. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -46,40 +46,40 @@ Malware modifies the registry.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0036.005|BlackEnergy queries or enumerates a registry key. [[1]](#1)|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0036.006|BlackEnergy queries or enumerates a registry value. [[1]](#1)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.001|Dark Comet sets registry values. [[1]](#1)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.002|Dark Comet deletes registry keys. [[1]](#1)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.005|Dark Comet queries or enumerates registry keys. [[1]](#1)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.006|Dark Comet queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.007|Dark Comet deletes registry values. [[1]](#1)|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0036.001|DNSChanger sets registry keys. [[1]](#1)|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0036.006|DNSChanger queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.001|Gamut sets registry values. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.002|Gamut deletes registry keys. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.005|Gamut queries or enumerates registry keys. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.006|Gamut queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.007|Gamut deletes registry values. [[1]](#1)|
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|C0036.006|GoBotKR queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.001|Hupigon sets registry values. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.002|Hupigon deletes registry keys. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.005|Hupigon queries or enumerates registry keys. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.006|Hupigon queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.007|Hupigon deletes registry values. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|C0036.004|Kovter creates or opens registry keys. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|C0036.006|Kovter queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0036.001|Locky Bart sets registry values. [[1]](#1)|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|C0036.006|Poison Ivy queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.001|Redhip set registry values. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.002|Redhip deletes registry keys. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.006|Redhip queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.001|Rombertik sets registry values. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.002|Rombertik deletes registry keys. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.006|Rombertik queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0036.006|Shamoon queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0036.007|Shamoon deletes registry values. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|C0036.001|UP007 sets registry values. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|C0036.006|UP007 queries or enumerates registry values. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0036.005|BlackEnergy queries or enumerates a registry key. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0036.006|BlackEnergy queries or enumerates a registry value. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.001|Dark Comet sets registry values. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.002|Dark Comet deletes registry keys. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.005|Dark Comet queries or enumerates registry keys. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.006|Dark Comet queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.007|Dark Comet deletes registry values. [[1]](#1)|
|
||||
|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|C0036.001|DNSChanger sets registry keys. [[1]](#1)|
|
||||
|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|C0036.006|DNSChanger queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.001|Gamut sets registry values. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.002|Gamut deletes registry keys. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.005|Gamut queries or enumerates registry keys. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.006|Gamut queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.007|Gamut deletes registry values. [[1]](#1)|
|
||||
|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|C0036.006|GoBotKR queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.001|Hupigon sets registry values. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.002|Hupigon deletes registry keys. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.005|Hupigon queries or enumerates registry keys. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.006|Hupigon queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.007|Hupigon deletes registry values. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|C0036.004|Kovter creates or opens registry keys. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|C0036.006|Kovter queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0036.001|Locky Bart sets registry values. [[1]](#1)|
|
||||
|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|C0036.006|Poison Ivy queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|C0036.001|Redhip set registry values. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|C0036.002|Redhip deletes registry keys. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|C0036.006|Redhip queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0036.001|Rombertik sets registry values. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0036.002|Rombertik deletes registry keys. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0036.006|Rombertik queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0036.006|Shamoon queries or enumerates registry values. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0036.007|Shamoon deletes registry values. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|C0036.001|UP007 sets registry values. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|C0036.006|UP007 queries or enumerates registry values. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -220,6 +220,21 @@ Malware modifies the registry.
|
||||
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Registry::Set Registry Value (C0036.001)|--|
|
||||
|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Registry (C0036)|--|
|
||||
|
||||
### C0036.005 Snippet
|
||||
<details>
|
||||
<summary> Registry::Query Registry Key </summary>
|
||||
SHA256: 1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53
|
||||
Location: 0x408723
|
||||
<pre>
|
||||
push eax ; phkResult: stores pointer to handle containing open registry key
|
||||
push 0x1 ; samDesired: Desired access rights for opened key. 0x1 is KEY_QUERY_VALUE, which is required to query the value of the sought registry key
|
||||
push 0x0 ; ulOptions: Optional key set to 0, so no options passed to registry key
|
||||
push ecx ; lpSubKey: Optional parameter indicating a subkey to read from
|
||||
push edx ; handle to open registry key or name of registry key to open
|
||||
call dword ptr [->ADVAPI32.DLL::RegOpenKeyExA] ; Windows API call which opens registry key for the query
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.0</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>13 September 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,8 +34,8 @@ Malware allocates thread local storage.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter allocates thread local storage. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon allocates thread local storage. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter allocates thread local storage. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon allocates thread local storage. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -43,6 +43,16 @@ Malware allocates thread local storage.
|
||||
|---|---|---|
|
||||
|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc|
|
||||
|
||||
### C0040 Snippet
|
||||
<details>
|
||||
<summary> Process::Allocate Thread Local Storage </summary>
|
||||
SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
|
||||
Location: 0x4142CB
|
||||
<pre>
|
||||
call dword ptr [->KERNEL32.DLL::TlsAlloc] ; call Windows API function to allocate thread local storage
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,8 +34,8 @@ Malware checks a mutex.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists. [[1]](#1)|
|
||||
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware checks if multiple instances of the same mutex is running. If multiple instances are running, the malware exits. [[2]](#2) [[3]](#3)|
|
||||
|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|--|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists. [[1]](#1)|
|
||||
|[**Matanbuchus**](../../xample-malware/matanbuchus.md)|2021|--|Malware checks if multiple instances of the same mutex is running. If multiple instances are running, the malware exits. [[2]](#2) [[3]](#3)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -51,6 +51,21 @@ Malware checks a mutex.
|
||||
|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_mutexes.py)|Check Mutex (C0043)|--|
|
||||
|[purplewave_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_mutexes.py)|Check Mutex (C0043)|--|
|
||||
|
||||
### C0043 Snippet
|
||||
<details>
|
||||
<summary> Process::Check Mutex </summary>
|
||||
SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
|
||||
Location: 0x40294C
|
||||
<pre>
|
||||
push eax ; name of mutex to be opened
|
||||
push 0x0 ; whether to allow processes created by the process which owns the mutex to inherit it (false)
|
||||
push 0x1f0001 ; mutex access rights (MUTEX_ALL_ACCESS)
|
||||
call dword ptr [->KERNEL32.DLL::OpenMutexW] ; call function to open mutex
|
||||
test eax, eax ; test to see if previous function call returned 0
|
||||
jz LAB_00402976 ; if it returned zero (error), jump to new memory location and execute from that point
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,12 +34,12 @@ Malware creates a mutex.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy has a default process mutex, but can be altered at build time. [[1]](#1)|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[2]](#2)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates a mutex. [[3]](#3)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates a mutex. [[3]](#3)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates a mutex. [[3]](#3)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik creates a mutex. [[3]](#3)|
|
||||
|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|--|Poison Ivy has a default process mutex, but can be altered at build time. [[1]](#1)|
|
||||
|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[2]](#2)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon creates a mutex. [[3]](#3)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter creates a mutex. [[3]](#3)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip creates a mutex. [[3]](#3)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik creates a mutex. [[3]](#3)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -102,6 +102,19 @@ Malware creates a mutex.
|
||||
|[medusalocker_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_mutexes.py)|Create Mutex (C0042)|--|
|
||||
|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_mutexes.py)|Create Mutex (C0042)|--|
|
||||
|
||||
### C0042 Snippet
|
||||
<details>
|
||||
<summary> Process::Create Mutex </summary>
|
||||
SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
|
||||
Location: 0x402A1E
|
||||
<pre>
|
||||
push eax ; name of mutex
|
||||
push 0x0 ; if the thread that creates the mutex owns it (false, in this case)
|
||||
push 0x0 ; optional security descriptor set to NULL, so default security descriptor will be used
|
||||
call dword ptr [->KERNEL32.DLL::CreateMutexW] ; call function to create mutex
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -42,20 +42,20 @@ Malware creates a process.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0017.002|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates a process on Windows. [[2]](#2)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a process on Windows. [[2]](#2)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut creates a process on Windows. [[2]](#2)|
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a process on Windows. [[2]](#2)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates a process on Windows. [[2]](#2)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates a process on Windows. [[2]](#2)|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi creates a process on Windows. [[2]](#2)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates a process on Windows. [[2]](#2)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|C0017.003|Redhip creates a suspended process. [[2]](#2)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon creates a process on Windows. [[2]](#2)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot creates a process on Windows. [[2]](#2)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0017.003|TrickBot creates a suspended process. [[2]](#2)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|The malware creates a process on Windows. [[2]](#2)|
|
||||
|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|C0017.002|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates a process on Windows. [[2]](#2)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a process on Windows. [[2]](#2)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut creates a process on Windows. [[2]](#2)|
|
||||
|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a process on Windows. [[2]](#2)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon creates a process on Windows. [[2]](#2)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter creates a process on Windows. [[2]](#2)|
|
||||
|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi creates a process on Windows. [[2]](#2)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip creates a process on Windows. [[2]](#2)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|C0017.003|Redhip creates a suspended process. [[2]](#2)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon creates a process on Windows. [[2]](#2)|
|
||||
|[**TrickBot**](../../xample-malware/trickbot.md)|2016|--|TrickBot creates a process on Windows. [[2]](#2)|
|
||||
|[**TrickBot**](../../xample-malware/trickbot.md)|2016|C0017.003|TrickBot creates a suspended process. [[2]](#2)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|--|The malware creates a process on Windows. [[2]](#2)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -75,6 +75,30 @@ Malware creates a process.
|
||||
|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_create_process.py)|Create Process::Create Process via WMI (C0017.002)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_created_process.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW|
|
||||
|
||||
### C0049 Snippet
|
||||
<details>
|
||||
<summary> Process::Create Process </summary>
|
||||
SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
|
||||
Location: 0x458C26
|
||||
<pre>
|
||||
lea param_1, [ebp + 0xfffffeb0]
|
||||
push param_1 ; pointer to PROCESS_INFORMATION struct to hold information about the new process
|
||||
lea param_1, [ebp + 0xfffffec0]
|
||||
push param_1 ; pointer to STARTUPINFO struct
|
||||
push 0x0 ; path to directory for new process -- if null, use same directory as calling process
|
||||
push 0x0 ; environment block for new process -- if null, use the calling process's environment block
|
||||
push 0x4 ; process creation flags (CREATE_SUSPENDED in this case)
|
||||
push 0x0 ; if heritable handles in the calling process should be inherited by the new process. If false, inheritance will not occur.
|
||||
push 0x0 ; security attributes for new process. If null, child processes cannot inherit thread running new process
|
||||
push 0x0 ; security attributes for new process. If null, child processes cannot inherit handle for new process
|
||||
mov param_1, dword ptr [ebp + local_8]
|
||||
call FUN_00404dfc
|
||||
push param_1 ; command line for new process to execute
|
||||
push 0x0 ; application name to be executed. If null, use command line provided in another argument
|
||||
call KERNEL32.DLL::CreateProcessA ; Call Windows API function to create new process
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,12 +34,12 @@ Malware creates a thread.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a thread. [[1]](#1)|
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a thread. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates a thread. [[1]](#1)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a thread. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik creates a thread. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon creates a thread. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a thread. [[1]](#1)|
|
||||
|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a thread. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon creates a thread. [[1]](#1)|
|
||||
|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a thread. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik creates a thread. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon creates a thread. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -54,6 +54,26 @@ Malware creates a thread.
|
||||
|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntcreatethreadex.py)|Create Thread (C0038)|NtCreateThreadEx|
|
||||
|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Create Thread (C0038)|NtSetInformationThread|
|
||||
|
||||
### C0038 Snippet
|
||||
<details>
|
||||
<summary> Process::Create Thread </summary>
|
||||
SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
|
||||
Location: 0x404915
|
||||
<pre>
|
||||
mov param_2, dword ptr [ebp + param_4]
|
||||
push param_2 ; Pointer to location where thread handler will be returned
|
||||
mov param_2, dword ptr [ebp + param_5]
|
||||
push param_2 ; Flags controlling thread creation
|
||||
push param_1 ; Pointer to variable to be passed to thread
|
||||
mov param_1, FUN_004048b8
|
||||
push param_1 ; Pointer to function where thread will begin execution
|
||||
push esi ; Size of stack for new thread
|
||||
push ebx ; Pointer to security attributes for thread. If null, the handle to the thread cannot be inherited
|
||||
call KERNEL32.DLL::CreateThread ; Call to thread creation API
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.0</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>13 September 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -35,3 +35,18 @@ Malware enumerates threads.
|
||||
|Tool: capa|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[enumerate threads](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/list/enumerate-threads.yml)|Enumerate Threads (C0064)|kernel32.Thread32First, kernel32.Thread32Next, kernel32.CreateToolhelp32Snapshot|
|
||||
|
||||
### C0064 Snippet
|
||||
<details>
|
||||
<summary> Process::Enumerate Threads </summary>
|
||||
SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641
|
||||
Location: 0x180003675
|
||||
<pre>
|
||||
lea rdx, [rsp + 0x48] ; pointer to THREAD32ENTRY struct
|
||||
mov rcx, r15 ; handle to snapshot of system processes
|
||||
call qword ptr [->KERNEL32.DLL::Thread32First] ; Windows API call to retrieve information about the first thread in a snapshot
|
||||
lea rdx, [rsp + 0x48]
|
||||
mov rcx, r15
|
||||
call qword ptr [->KERNEL32.DLL::Thread32Next] ; takes the same arguments as Thread32First and gets the next thread from the snapshot
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>6 February 2024</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,8 +34,8 @@ Malware resumes a thread.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker resumes thread. [[1]](#1)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet resumes a thread. [[1]](#1)|
|
||||
|[**CryptoLocker**](../../xample-malware/cryptolocker.md)|2013|--|CryptoLocker resumes thread. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet resumes a thread. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -43,6 +43,21 @@ Malware resumes a thread.
|
||||
|---|---|---|
|
||||
|[resume thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/resume/resume-thread.yml)|Resume Thread (C0054)|kernel32.ResumeThread, ntdll.NtResumeThread, ntdll.ZwResumeThread, System.Threading.Thread::Resume|
|
||||
|
||||
### C0054 Snippet
|
||||
<details>
|
||||
<summary> Process::Resume Thread </summary>
|
||||
SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
|
||||
Location: 0x41B345
|
||||
<pre>
|
||||
push esi ; Where to store return value
|
||||
mov ebx, param_1
|
||||
mov param_1, dword ptr [ebx + 0x4]
|
||||
push param_1 ; Handle to thread to resume
|
||||
call KERNEL32.DLL::ResumeThread ; API call to resume thread
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.0</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>13 September 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,12 +34,12 @@ Malware allocates thread local storage.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet sets thread local storage values. [[1]](#1)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut sets thread local storage values. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon sets thread local storage values. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter sets thread local storage values. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip sets thread local storage values. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik sets thread local storage values. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet sets thread local storage values. [[1]](#1)|
|
||||
|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut sets thread local storage values. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon sets thread local storage values. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter sets thread local storage values. [[1]](#1)|
|
||||
|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip sets thread local storage values. [[1]](#1)|
|
||||
|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik sets thread local storage values. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -47,6 +47,18 @@ Malware allocates thread local storage.
|
||||
|---|---|---|
|
||||
|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue|
|
||||
|
||||
### C0041 Snippet
|
||||
<details>
|
||||
<summary> Process::Set Thread Local Storage Value </summary>
|
||||
SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641
|
||||
Location: 0x180005B08
|
||||
<pre>
|
||||
mov param_2, rbx ; Value to be stored in TLS index
|
||||
mov param_1, edi ; TLS index
|
||||
call qword ptr [->KERNEL32.DLL::TlsSetValue] ; Call Windows API function to store value in thread's thread local storage (TLS) at the specified index
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -34,10 +34,10 @@ This behavior is related to Unprotect technique U0101.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet suspends threads. [[1]](#1)|
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR suspends threads. [[1]](#1)|
|
||||
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT suspends threads. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon suspends threads. [[1]](#1)|
|
||||
|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet suspends threads. [[1]](#1)|
|
||||
|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR suspends threads. [[1]](#1)|
|
||||
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT suspends threads. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon suspends threads. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -34,15 +34,15 @@ Malware terminates a process.
|
||||
|
||||
|Name|Date|Method|Description|
|
||||
|---|---|---|---|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy terminates a process via fastfail. [[1]](#1)|
|
||||
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR terminates processes. [[1]](#1)|
|
||||
|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT terminates processes. [[1]](#1)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon terminates processes. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter terminates processes. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon terminates processes. [[1]](#1)|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet terminates processes. [[1]](#1)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot terminates processes. [[1]](#1)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 terminates processes. [[1]](#1)|
|
||||
|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy terminates a process via fastfail. [[1]](#1)|
|
||||
|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR terminates processes. [[1]](#1)|
|
||||
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT terminates processes. [[1]](#1)|
|
||||
|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon terminates processes. [[1]](#1)|
|
||||
|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter terminates processes. [[1]](#1)|
|
||||
|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon terminates processes. [[1]](#1)|
|
||||
|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet terminates processes. [[1]](#1)|
|
||||
|[**TrickBot**](../../xample-malware/trickbot.md)|2016|--|TrickBot terminates processes. [[1]](#1)|
|
||||
|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 terminates processes. [[1]](#1)|
|
||||
|
||||
## Detection
|
||||
|
||||
@@ -56,6 +56,17 @@ Malware terminates a process.
|
||||
|---|---|---|
|
||||
|[terminates_remote_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/terminates_remote_process.py)|Terminate Process (C0018)|NtTerminateProcess|
|
||||
|
||||
### C0018 Snippet
|
||||
<details>
|
||||
<summary> Process::Terminate Process </summary>
|
||||
SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
|
||||
Location: 0x1400083c7
|
||||
<pre>
|
||||
mov ecx, eax ; use the value stored in eax as the exit status for the exited process
|
||||
call qword ptr [->MSVCRT.DLL::exit] ; call the Windows API function to terminate the process
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.0</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>13 September 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -35,3 +35,15 @@ Malware terminates a thread.
|
||||
|Tool: capa|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[terminate thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/terminate/terminate-thread.yml)|Terminate Thread (C0039)|kernel32.TerminateThread, PsTerminateSystemThread, System.Threading.Thread.Abort|
|
||||
|
||||
### C0039 Snippet
|
||||
<details>
|
||||
<summary> Process::Terminate Thread </summary>
|
||||
SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
|
||||
Location: 0x14000395B
|
||||
<pre>
|
||||
mov param_1, qword ptr [DAT_14000ca58] ; thread to terminate
|
||||
xor param_2, param_2 ; set the thread's exit status to 0
|
||||
call qword ptr [->KERNEL32.DLL::TerminateThread] ; call the Windows API function to terminate the thread
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -49,9 +49,9 @@ See ATT&CK: **Boot or Logon Autostart Execution: Kernel Modules and Extensions (
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_devicetree_1.py)|Kernel Modules and Extensions (F0010)|--|
|
||||
|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_devicetree_1.py)|Kernel Modules and Extensions::Device Driver (F0010.001)|--|
|
||||
|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_load.py)|Kernel Modules and Extensions (F0010)|NtLoadDriver|
|
||||
|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Kernel Modules and Extensions (F0010)|--|
|
||||
|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Kernel Modules and Extensions::Device Driver (F0010.001)|--|
|
||||
|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/driver_load.py)|Kernel Modules and Extensions (F0010)|NtLoadDriver|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.1</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -46,12 +46,12 @@ See ATT&CK: **Create or Modify System Process::Windows Service ([T1543.003](http
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_1.py)|Modify Existing Service (F0011)|--|
|
||||
|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_2.py)|Modify Existing Service (F0011)|--|
|
||||
|[volatility_svcscan_3](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_3.py)|Modify Existing Service (F0011)|--|
|
||||
|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_servicestop.py)|Modify Existing Service (F0011)|OpenServiceA, ControlService, OpenServiceW|
|
||||
|[persistence_service](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_service.py)|Modify Existing Service (F0011)|--|
|
||||
|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Modify Existing Service (F0011)|--|
|
||||
|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Modify Existing Service (F0011)|--|
|
||||
|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Modify Existing Service (F0011)|--|
|
||||
|[volatility_svcscan_3](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Modify Existing Service (F0011)|--|
|
||||
|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_servicestop.py)|Modify Existing Service (F0011)|OpenServiceA, ControlService, OpenServiceW|
|
||||
|[persistence_service](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_service.py)|Modify Existing Service (F0011)|--|
|
||||
|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_seccenter.py)|Modify Existing Service (F0011)|--|
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Version</b></td>
|
||||
<td><b>2.2</b></td>
|
||||
<td><b>2.3</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Created</b></td>
|
||||
@@ -21,7 +21,7 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Last Modified</b></td>
|
||||
<td><b>5 December 2023</b></td>
|
||||
<td><b>30 April 2024</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -48,11 +48,11 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol
|
||||
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware adds registry entries to ensure automatic execution at system startup. [[9]](#9)|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder, allowing it to persist via a Run registry key. [[10]](#10) [[17]](#17)|
|
||||
|[**Conficker**](../xample-malware/conficker.md)|2008|--|To start itself at system boot, the virus saves a copy of its DLL form to a random filename in the Windows system folder, then adds registry keys to have svchost.exe invoke that DLL as an invisible network service. [[11]](#11)|
|
||||
|[**DarkComet**](../xample-malware/darkcomet.md)|2008|--|DarkComet adds several registry entries to enable automatic execution at startup. [[12]](#12)|
|
||||
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet adds several registry entries to enable automatic execution at startup. [[12]](#12)|
|
||||
|[**Emotet**](../xample-malware/emotet.md)|2018|--|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [[13]](#13)|
|
||||
|[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle adds registry keys to enable its automatic execution at every system startup. [[14]](#14)|
|
||||
|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Malware adds registry keys to enable startup after reboot. [[15]](#15)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip persists via a Run registry key. [[17]](#17)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip persists via a Run registry key. [[17]](#17)|
|
||||
|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry creates two registry run keys to ensure persistence. [[18]](#18)|
|
||||
|[**CryptoWall**](../xample-malware/cryptowall.md)|A copy of Crytowall is placed in the startup folder and a directory at the root of the system drive. Also adds multiple "autostart" registry keys. [[19]](#19)|
|
||||
|
||||
@@ -64,9 +64,40 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol
|
||||
|
||||
|Tool: CAPE|Mapping|APIs|
|
||||
|---|---|---|
|
||||
|[persistence_bootexecute](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_bootexecute.py)|Registry Run Keys / Startup Folder (F0012)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|
||||
|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Registry Run Keys / Startup Folder (F0012)|--|
|
||||
|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun.py)|Registry Run Keys / Startup Folder (F0012)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
|
||||
|[persistence_bootexecute](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_bootexecute.py)|Registry Run Keys / Startup Folder (F0012)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|
||||
|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Registry Run Keys / Startup Folder (F0012)|--|
|
||||
|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Registry Run Keys / Startup Folder (F0012)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
|
||||
|
||||
### F0012 Snippet
|
||||
<details>
|
||||
<summary> Persistence::Registry Run Keys/Startup Folder </summary>
|
||||
SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
|
||||
Location: 0x402994
|
||||
<pre>
|
||||
push eax ; where to store handle to created/opened registry key
|
||||
push u_SOFTWARE\Microsoft\Windows\Curre_00429bb8 ; subkey to create -- in this case SOFTWARE\Microsoft\Windows\Current\Version\Run
|
||||
push 0x80000001 ; predefined registry key HKEY_CURRENT_USER
|
||||
call dword ptr [->ADVAPI32.DLL::RegCreateKeyW] ; call to Windows API function to create the registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current\Version\Run
|
||||
lea ecx, [esp + 0x70]
|
||||
lea edx, [ecx + 0x2]
|
||||
nop dword ptr [eax]
|
||||
mov ax, word ptr [ecx]
|
||||
add ecx, 0x2
|
||||
test ax, ax
|
||||
jnz lab_004029b0
|
||||
sub ecx, edx
|
||||
sar ecx, 1
|
||||
lea eax, [ecx * 0x2 + 0x2]
|
||||
push eax ; size of data to write to registry key
|
||||
lea eax, [esp + 0x74]
|
||||
push eax ; data to write to registry key
|
||||
push 0x1 ; indicates that the type of value to be written to registry key is a string
|
||||
push 0x0 ; reserved parameter, must be NULL
|
||||
push u_WinHoster_00429c14 ; name of the value to add to the key -- in this case, WinHoster
|
||||
push dword ptr [esp + local_264] ; handle to open registry key
|
||||
call dword ptr [->ADVAPI32.DLL::RegSetValueExW] ; API call to set registry value
|
||||
</pre>
|
||||
</details>
|
||||
|
||||
## References
|
||||
|
||||
|
||||
@@ -37,4 +37,4 @@ DYEPACK is a malware suite that manipulates local information regarding SWIFT tr
|
||||
|
||||
## References
|
||||
|
||||
<a name="1">[1]</a> https://content.fireeye.com/apt/rpt-apt38
|
||||
<a name="1">[1]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf
|
||||
|
||||
+7
-6
@@ -10,7 +10,7 @@
|
||||
|
||||
## <a name="next"></a>What's New? ##
|
||||
|
||||
* **MBC v3.0** - The latest MBC release includes behavior detection information, expanded descriptions, and new properties, such as version and created and modified dates.
|
||||
* **MBC v3.1** - The MBC 3.1 release includes additional code snippets, expanded descriptions, and updated links.
|
||||
|
||||
* **STIX 2.1 Representation** - MBC content is available in an updated STIX format based on the new [STIX 2.1 Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9).
|
||||
|
||||
@@ -18,7 +18,7 @@
|
||||
|
||||
* **CACAO Playbook Example** - An example [CACAO](https://github.com/oasis-tcs/cacao/tree/master/Examples/CACAO-2.0) playbook for [Locky Bart](../xample-malware/locky-bart.md) references MBC behaviors.
|
||||
|
||||
* **MBC Website** - We're developing a website to replace the current markdown content.
|
||||
|
||||
|
||||
* **MBC Mailing List** - To join the MBC mailing list, please send a request to mbc@mitre.org.
|
||||
|
||||
@@ -32,7 +32,7 @@
|
||||
* **Malware analysis support**: MBC's set of identified, organized behaviors helps an analyst know what to look for, informing the malware analysis process.
|
||||
|
||||
### What are objectives? ###
|
||||
**Objectives** correspond to the intentions behind malware behaviors. For example, malware may use [Hooking](../credential-access/hooking.md) (behavior) to load and execute code within the context of another process either to hide its execution (defense evasion objective), to gain elevated privileges (privilege escalation objective), or to access the process's memory (credential access objective).
|
||||
**Objectives** correspond to the intentions behind malware behaviors. For example, malware may use [Hijack Execution Flow](../defense-evasion/hijack-execution-flow.md) (behavior) to load and execute code within the context of another process either to hide its execution (defense evasion objective), to gain elevated privileges (privilege escalation objective), or to access the process's memory (credential access objective).
|
||||
|
||||
### How were behaviors identified? ###
|
||||
As discussed [below](#maec), many MBC behaviors stemmed from MAEC and EMA. Mapping [capa rules](https://github.com/fireeye/capa-rules) to MBC was another avenue for defining behaviors (especially MBC's micro-behaviors). We also identified MBC behaviors by studying publicly available analysis reports and output of automated analysis engines (some of which map behavior indicators to ATT&CK). Such resources enabled identification of MBC-enhanced ATT&CK techniques, as well as the definition of new behaviors for results that could not be mapped to ATT&CK.
|
||||
@@ -68,6 +68,7 @@ There was no version control when MBC v1.0 was released at the end of January 20
|
||||
* MBC v2.2 was released in February 2022 and includes additional micro-behaviors and behavior methods. Added code snippets to certain methods.
|
||||
* MBC v2.3 was released in September 2022 and aligns with ATT&CK v11 and includes an updated malware corpus.
|
||||
* MBC v3.0 was released in September 2023 and includes behavior detection information, expanded descriptions, and new properties.
|
||||
* MBC v3.1 was released in May 2024 and includes expanded descriptions and additional code snippets.
|
||||
|
||||
## <a name="use"></a>Using MBC ##
|
||||
|
||||
@@ -120,7 +121,7 @@ Although one-to-one mappings are best practice, there may be some instances when
|
||||
Behaviors identified by automated tools are often intentionally broad to give an overview of the malware sample's behavior. Broad behaviors will often map to multiple MBC behaviors. For example, if a tool reports that Armadillo was used on a malware sample, both [Executable Code Obfuscation](../anti-static-analysis/executable-code-obfuscation.md) and [Software Packing](../anti-static-analysis/software-packing.md) behaviors apply.
|
||||
|
||||
### How are MBC behaviors, possibly at different levels of abstraction, associated? ###
|
||||
MBC does not define relationships between behaviors, so association of behaviors must be done at the reporting level. The [GoBotKR](../xample-malware/gobotkr.md) example [above](./gobotkr) illustrates how two behaviors can be associated by the human-readable text: "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2).
|
||||
MBC does not define relationships between behaviors, so association of behaviors must be done at the reporting level. The [GoBotKR](../xample-malware/gobotkr.md) example above illustrates how two behaviors can be associated by the human-readable text: "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2).
|
||||
|
||||
### Can variant names captured by an anti-virus tool be captured in MBC? ###
|
||||
No. MBC captures behaviors and characteristics directly associated with malware code. Variant names are outside MBC's scope. A variant name may lead to published reports, in which case, one could use the report to map the sample to its associated behaviors.
|
||||
@@ -180,7 +181,7 @@ Cuckoo Sandbox 2.0.7 includes mappings between its signatures and ATT&CK. The MB
|
||||
## <a name="other"></a>MBC and Other Community Efforts ##
|
||||
|
||||
### <a name="maec"></a>What is the relationship between MAEC, EMA, and MBC? ###
|
||||
In short, the [Malware Attribute Enumeration and Characterization (MAEC)](http://maecproject.github.io/) led to the [Encyclopedia of Malware Attributes (EMA)](https://collaborate.mitre.org/ema/index.php/ema:Main_Page), and EMA led to the Malware Behavior Catalog.
|
||||
In short, the [Malware Attribute Enumeration and Characterization (MAEC)](http://maecproject.github.io/) led to the Encyclopedia of Malware Attributes (EMA), and EMA led to the Malware Behavior Catalog.
|
||||
|
||||
MAEC is a community-developed structured language for encoding and sharing high-fidelity information about malware based upon attributes such as behaviors, artifacts, and relationships between malware samples. The vocabularies associated with MAEC define malware capabilities and behaviors, which are further defined and specified in EMA, along with "behavior instances" that capture specific malware instances/families exhibiting behaviors.
|
||||
|
||||
@@ -231,7 +232,7 @@ We can't predict what will happen in the long run, but currently there are no pl
|
||||
### Why aren't ATT&CK [Initial Access](https://attack.mitre.org/tactics/TA0001/) techniques included in MBC? ###
|
||||
Initial Access - the way malware gains an initial foothold within a system - is not typically determined by analyzing the malware's code. For example, in ATT&CK's [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/) sub-technique, the attachment may be a malicious executable file, but the *code* of the attached file's isn't related to its email delivery. This is not to say an analyst can't surmise initial access by studying a malware instance, but determining initial access requires evidence beyond the malware's code.
|
||||
|
||||
Some malware self-replicates or distributes other malware, but in keeping with MBC's *malware, code-oriented perspective*, such behaviors would be associated with the [LATERAL MOVEMENT](../lateral-movement), [EXECUTION](../execution), and/or [IMPACT](../impact) objectives in MBC. For example, if malware sends spearphishing email, its behavior would be captured by the [Send Email](../executionsend-email.md) behavior, which is associated with execution and lateral movement.
|
||||
Some malware self-replicates or distributes other malware, but in keeping with MBC's *malware, code-oriented perspective*, such behaviors would be associated with the [LATERAL MOVEMENT](../lateral-movement), [EXECUTION](../execution), and/or [IMPACT](../impact) objectives in MBC. For example, if malware sends spearphishing email, its behavior would be captured by the [Send Email](../execution/send-email.md) behavior, which is associated with execution and lateral movement.
|
||||
|
||||
### Why aren't [PRE-ATT&CK](https://attack.mitre.org/techniques/pre/) techniques used by malware authors included in MBC? ###
|
||||
**For example, why doesn't the [Obfuscate or Encrypt Code](https://attack.mitre.org/techniques/T1319/) technique under the [Adversary OPSEC](https://attack.mitre.org/tactics/TA0021/) tactic apply to malware showing signs of anti-analysis techniques?**
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user