From f7d92d59fa9d10fb71c403fdf264ea3502940c80 Mon Sep 17 00:00:00 2001 From: Ryan Xu Date: Wed, 20 Sep 2023 15:57:32 -0400 Subject: [PATCH] Staging (#124) - Updating capa detection in behaviors - Newsletter - Conti malware - pafish faq --- README.md | 7 +- anti-behavioral-analysis/README.md | 2 +- anti-behavioral-analysis/capture-evasion.md | 2 +- .../debugger-detection.md | 27 +- anti-behavioral-analysis/debugger-evasion.md | 8 +- .../dynamic-analysis-evasion.md | 8 +- .../emulator-detection.md | 18 +- anti-behavioral-analysis/emulator-evasion.md | 2 +- .../memory-dump-evasion.md | 2 +- anti-behavioral-analysis/sandbox-detection.md | 2 +- .../virtual-machine-detection.md | 35 +- anti-static-analysis/README.md | 4 +- .../call-graph-generation-evasion.md | 4 +- .../data-flow-analysis-evasion.md | 2 +- anti-static-analysis/disassembler-evasion.md | 8 +- .../executable-code-obfuscation.md | 19 +- .../executable-code-optimization.md | 2 +- .../executable-code-virtualization.md | 2 +- anti-static-analysis/software-packing.md | 27 +- capa.md | 795 +++++++++--------- collection/README.md | 2 +- collection/cryptocurrency.md | 2 +- collection/input-capture.md | 7 +- collection/keylogging.md | 8 +- collection/screen-capture.md | 8 +- command-and-control/README.md | 2 +- command-and-control/c2-communication.md | 9 +- command-and-control/domain-name-generation.md | 2 +- command-and-control/ingress-tool-transfer.md | 2 +- credential-access/README.md | 2 +- defense-evasion/README.md | 2 +- .../alternative-installation-location.md | 2 +- defense-evasion/bootkit.md | 2 +- .../bypass-data-execution-prevention.md | 2 +- defense-evasion/covert-location.md | 2 +- .../disable-or-evade-security-tools.md | 12 +- .../hidden-files-and-directories.md | 2 +- defense-evasion/hide-artifacts.md | 2 +- defense-evasion/hijack-execution-flow.md | 9 +- defense-evasion/indicator-blocking.md | 2 +- ...all-insecure-or-malicious-configuration.md | 2 +- defense-evasion/modify-registry.md | 4 +- .../obfuscated-files-or-information.md | 33 +- defense-evasion/polymorphic-code.md | 2 +- defense-evasion/process-injection.md | 13 +- defense-evasion/rootkit.md | 2 +- defense-evasion/self-deletion.md | 8 +- discovery/README.md | 2 +- discovery/analysis-tool-discovery.md | 9 +- discovery/application-window-discovery.md | 8 +- discovery/code-discovery.md | 9 +- discovery/file-and-directory-discovery.md | 15 +- discovery/self-discovery.md | 2 +- discovery/smtp-connection-discovery.md | 2 +- discovery/system-information-discovery.md | 11 +- discovery/taskbar-discovery.md | 8 +- execution/README.md | 2 +- .../command-and-scripting-interpreter.md | 8 +- execution/conditional-execution.md | 7 +- execution/execution-dependency.md | 2 +- .../exploitation-for-client-execution.md | 2 +- execution/install-additional-program.md | 8 +- execution/prevent-concurrent-execution.md | 2 +- execution/remote-commands.md | 2 +- execution/send-email.md | 2 +- execution/send-poisoned-text-message.md | 2 +- execution/system-services.md | 2 +- execution/user-execution.md | 2 +- exfiltration/README.md | 2 +- exfiltration/archive-collected-data.md | 2 +- exfiltration/automated-exfiltration.md | 2 +- impact/README.md | 2 +- impact/clipboard-modification.md | 7 +- impact/compromise-data-integrity.md | 2 +- impact/data-destruction.md | 7 +- impact/data-encrypted-for-impact.md | 4 +- impact/denial-of-service.md | 2 +- impact/destroy-hardware.md | 2 +- impact/disk-wipe.md | 8 +- impact/exploit-kit.md | 2 +- impact/generate-traffic-from-victim.md | 2 +- impact/manipulate-network-traffic.md | 2 +- impact/modify-hardware.md | 9 +- impact/remote-access.md | 8 +- impact/resource-hijacking.md | 2 +- impact/spamming.md | 2 +- lateral-movement/README.md | 2 +- lateral-movement/supply-chain-compromise.md | 2 +- micro-behaviors/communication/README.md | 2 +- .../communication/dns-communication.md | 9 +- .../communication/ftp-communication.md | 9 +- .../communication/http-communication.md | 30 +- .../communication/icmp-communication.md | 8 +- .../interprocess-communication.md | 14 +- .../communication/smtp-communication.md | 2 +- .../communication/socket-communication.md | 21 +- micro-behaviors/communication/wininet.md | 2 +- micro-behaviors/cryptography/README.md | 2 +- .../cryptography/crypto-algorithm.md | 2 +- .../cryptography/crypto-constant.md | 2 +- micro-behaviors/cryptography/crypto-lib.md | 12 +- .../cryptography/cryptographic-hash.md | 14 +- micro-behaviors/cryptography/decrypt-data.md | 9 +- micro-behaviors/cryptography/encrypt-data.md | 28 +- .../cryptography/encryption-key.md | 10 +- .../generate-pseudorandom-sequence.md | 11 +- .../hashed-message-authentication-code.md | 10 +- micro-behaviors/data/README.md | 2 +- micro-behaviors/data/check-string.md | 8 +- micro-behaviors/data/checksum.md | 11 +- micro-behaviors/data/compress-data.md | 12 +- micro-behaviors/data/compression-library.md | 9 +- micro-behaviors/data/decode-data.md | 2 +- micro-behaviors/data/decompress-data.md | 12 +- micro-behaviors/data/encode-data.md | 12 +- micro-behaviors/data/modulo.md | 10 +- micro-behaviors/data/noncryptographic-hash.md | 12 +- micro-behaviors/data/use-constant.md | 2 +- micro-behaviors/file-system/README.md | 2 +- .../file-system/alter-file-extension.md | 2 +- micro-behaviors/file-system/copy-file.md | 8 +- .../file-system/create-directory.md | 9 +- micro-behaviors/file-system/create-file.md | 8 +- .../file-system/delete-directory.md | 8 +- micro-behaviors/file-system/delete-file.md | 8 +- .../file-system/get-file-attributes.md | 8 +- micro-behaviors/file-system/move-file.md | 8 +- micro-behaviors/file-system/read-file.md | 11 +- .../file-system/read-virtual-disk.md | 10 +- .../file-system/set-file-attributes.md | 9 +- micro-behaviors/file-system/writes-file.md | 10 +- micro-behaviors/hardware/README.md | 2 +- micro-behaviors/hardware/install-driver.md | 11 +- micro-behaviors/hardware/load-driver.md | 10 +- micro-behaviors/hardware/simulate-hardware.md | 10 +- micro-behaviors/memory/README.md | 2 +- micro-behaviors/memory/allocate-memory.md | 11 +- .../memory/change-memory-protection.md | 2 +- micro-behaviors/memory/free-memory.md | 10 +- micro-behaviors/memory/heap-spray.md | 2 +- micro-behaviors/memory/overflow-buffer.md | 2 +- micro-behaviors/memory/stack-pivot.md | 2 +- micro-behaviors/operating-system/README.md | 2 +- micro-behaviors/operating-system/console.md | 9 +- .../operating-system/environment-variable.md | 9 +- micro-behaviors/operating-system/registry.md | 18 +- micro-behaviors/operating-system/wallpaper.md | 10 +- micro-behaviors/process/README.md | 7 +- .../process/allocate-thread-local-storage.md | 8 +- micro-behaviors/process/check-mutex.md | 9 +- micro-behaviors/process/create-mutex.md | 8 +- micro-behaviors/process/create-process.md | 11 +- micro-behaviors/process/create-thread.md | 9 +- micro-behaviors/process/enumerate-threads.md | 10 +- micro-behaviors/process/open-process.md | 10 +- micro-behaviors/process/open-thread.md | 10 +- micro-behaviors/process/resume-thread.md | 8 +- micro-behaviors/process/set-thread-context.md | 31 + .../process/set-thread-local-storage-value.md | 8 +- micro-behaviors/process/suspend-thread.md | 8 +- micro-behaviors/process/synchronization.md | 2 +- micro-behaviors/process/terminate-process.md | 10 +- micro-behaviors/process/terminate-thread.md | 10 +- micro-behaviors/process/unmap-section-view.md | 31 + .../process/write-process-memory.md | 31 + persistence/README.md | 2 +- persistence/component-firmware.md | 2 +- persistence/kernel-modules-and-extensions.md | 2 +- persistence/malicious-network-driver.md | 2 +- persistence/modify-existing-service.md | 2 +- .../registry-run-keys-startup-folder.md | 7 +- persistence/shutdown-event.md | 2 +- privilege-escalation/README.md | 2 +- privilege-escalation/install-certificate.md | 2 +- .../AttackFlow/Conti_Process_Hollowing.afb | 1 + .../AttackFlow/Conti_Process_Hollowing.json | 172 ++++ .../AttackFlow/Conti_Process_Hollowing.png | Bin 0 -> 106467 bytes xample-malware/README.md | 1 + xample-malware/conti.md | 58 ++ xample-malware/wannacry.md | 2 +- yfaq/README.md | 5 +- yfaq/pafish.md | 35 + ynewsletters/09152023.md | 17 + ynewsletters/README.md | 2 + 184 files changed, 1732 insertions(+), 606 deletions(-) create mode 100644 micro-behaviors/process/set-thread-context.md create mode 100644 micro-behaviors/process/unmap-section-view.md create mode 100644 micro-behaviors/process/write-process-memory.md create mode 100644 xample-malware/AttackFlow/Conti_Process_Hollowing.afb create mode 100644 xample-malware/AttackFlow/Conti_Process_Hollowing.json create mode 100644 xample-malware/AttackFlow/Conti_Process_Hollowing.png create mode 100644 xample-malware/conti.md create mode 100644 yfaq/pafish.md create mode 100644 ynewsletters/09152023.md diff --git a/README.md b/README.md index b43180c..e2237f9 100644 --- a/README.md +++ b/README.md @@ -29,11 +29,11 @@ Methods are associated with behaviors and serve different roles, depending on th Note that a method cannot be used without a behavior. -### Micro-behaviors ### +### Micro-objectives / Micro-behaviors ### Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created, or a string may be checked for some condition. Because such behaviors are often noted in malware analysis, they are captured in MBC. See [Micro-behaviors](./micro-behaviors/README.md) for details. ### Identifiers ### -As shown below, the letter of an identifier relays information about a behavior. Note that letters used in MBC v2 are changed from MBC v1. +As shown below, the letter of an identifier relays information about a behavior. Note that letters used in MBC v2 and v3 are changed from MBC v1. |**Letter**|**Example**|**Description**| |---|---|---| @@ -73,9 +73,6 @@ This visual representation of the MBC Matrix is based on the ATT&CK Navigator. T ### Malware Corpus ### The MBC contains a [malware corpus](./xample-malware/README.md) where each malware entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports. Note that some malware types are also present in the ATT&CK software page. We refer readers to the corresponding ATT&CK page for a list of identified ATT&CK techniques. However, we will list any newly identified ATT&CK techniques in the MBC malware page. -## Micro-behavior Objectives ## -[Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development. - ## Malware Objective Descriptions ## Malware objectives are defined in the table below. Follow the links to view associated behaviors. diff --git a/anti-behavioral-analysis/README.md b/anti-behavioral-analysis/README.md index 6a4a28a..c54afb2 100644 --- a/anti-behavioral-analysis/README.md +++ b/anti-behavioral-analysis/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +12 June 2023 diff --git a/anti-behavioral-analysis/capture-evasion.md b/anti-behavioral-analysis/capture-evasion.md index 2fe3bab..f2c394a 100644 --- a/anti-behavioral-analysis/capture-evasion.md +++ b/anti-behavioral-analysis/capture-evasion.md @@ -25,7 +25,7 @@ Last Modified -28 October 2022 +1 March 2023 diff --git a/anti-behavioral-analysis/debugger-detection.md b/anti-behavioral-analysis/debugger-detection.md index 770249c..e832bf0 100644 --- a/anti-behavioral-analysis/debugger-detection.md +++ b/anti-behavioral-analysis/debugger-detection.md @@ -25,7 +25,7 @@ Last Modified -2 May 2023 +13 September 2023 @@ -36,10 +36,10 @@ Malware detects whether it's being executed inside a debugger by checking for ar While many methods are listed in the table below, among the most commonly used are: - Using APIs such as IsDebuggerPresent, CheckRemoteDebuggerPresent, and OutputDebugString -- Reading the BeingDebugged bit ( is it a 1 or 0) in the Process Environment Block (PEB) +- Reading the BeingDebugged bit (is it a 1 or 0) in the Process Environment Block (PEB) - Checking whether a software breakpoint instruction is used (INT3; 0xCC opcode) -Details on detecting debuggers are given in the references. +Details on detecting debuggers can be found in the references. ## Methods @@ -106,6 +106,27 @@ Details on detecting debuggers are given in the references. |[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.034|The malware executes anti-debugging instructions. [[15]](#15)| |[**UP007**](../xample-malware/up007.md)|2016|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[check for trap flag exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml)|Debugger Detection (B0001)| | +|[check for software breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml)|Debugger Detection::Software Breakpoints (B0001.025)| | +|[check process job object](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml)|Debugger Detection (B0001)|kernel32.QueryInformationJobObject, kernel32.OpenProcess| +|[check for PEB BeingDebugged flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml)|Debugger Detection::Process Environment Block BeingDebugged (B0001.035)| | +|[check for time delay via GetTickCount](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)| | +|[check for protected handle exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml)|Debugger Detection::SetHandleInformation (B0001.024)|SetHandleInformation, CloseHandle| +|[check for OutputDebugString error](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml)|Debugger Detection::OutputDebugString (B0001.016)|kernel32.SetLastError, kernel32.GetLastError, kernel32.OutputDebugString| +|[check for unexpected memory writes](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml)|Debugger Detection::Memory Write Watching (B0001.010)|kernel32.GetWriteWatch| +|[check for kernel debugger via shared user data structure](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml)|Debugger Detection (B0001)| | +|[check for time delay via QueryPerformanceCounter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml)|Debugger Detection::Timing/Delay Check QueryPerformanceCounter (B0001.033)| | +|[check for hardware breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml)|Debugger Detection::Hardware Breakpoints (B0001.005)|kernel32.GetThreadContext| +|[check ProcessDebugPort](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml)|Debugger Detection::NtQueryInformationProcess (B0001.012)|NtQueryInformationProcess| +|[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::CheckRemoteDebuggerPresent (B0001.002)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent| +|[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::WudfIsAnyDebuggerPresent (B0001.031)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent| +|[check for PEB NtGlobalFlag flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml)|Debugger Detection::Process Environment Block NtGlobalFlag (B0001.036)| | +|[execute anti-debugging instructions](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml)|Debugger Detection::Anti-debugging Instructions (B0001.034)| | +|[PEB access](https://github.com/mandiant/capa-rules/blob/master/lib/peb-access.yml)|Debugger Detection::Process Environment Block (B0001.019)| | ## References diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md index d3eefa5..2a41e65 100644 --- a/anti-behavioral-analysis/debugger-evasion.md +++ b/anti-behavioral-analysis/debugger-evasion.md @@ -25,7 +25,7 @@ Last Modified -4 May 2023 +13 September 2023 @@ -82,6 +82,12 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162 |[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[3]](#3)| |[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of a debugger. [[4]](#4)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[hide thread from debugger](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml)|Debugger Evasion (B0002)|NtSetInformationThread, ZwSetInformationThread, GetCurrentThread| +|[switch active desktop](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/switch-active-desktop.yml)|Debugger Evasion (B0002)|user32.CreateDesktop, user32.SwitchDesktop| ## References diff --git a/anti-behavioral-analysis/dynamic-analysis-evasion.md b/anti-behavioral-analysis/dynamic-analysis-evasion.md index 3a1e302..2107ccf 100644 --- a/anti-behavioral-analysis/dynamic-analysis-evasion.md +++ b/anti-behavioral-analysis/dynamic-analysis-evasion.md @@ -25,7 +25,7 @@ Last Modified -02 May 2023 +13 September 2023 @@ -60,7 +60,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |**Illusion**|B0003.009|Creates an illusion; makes the analyst think something happened when it didn't.| |**Restart**|B0003.010|Restarts or shuts down system to bypass sandboxing.| - ## Use in Malware |Name|Date|Method|Description| @@ -73,6 +72,11 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |[**Rombertik**](../xample-malware/rombertik.md)|2015|B0003.011|The malware computes a 32-bit hash of a resource in memory, and compares it to the PE Compile Timestamp of the unpacked sample. If the resource or compile time has been altered, the malware acts destructively. [[5]](#5)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|B0003.012|The malware uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering). [[6]](#6)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[delay execution](https://github.com/mandiant/capa-rules/blob/master/lib/delay-execution.yml)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|kernel32.Sleep, kernel32.SleepEx, kernel32.WaitForSingleObject, kernel32.SignalObjectAndWait, kernel32.WaitForSingleObjectEx, kernel32.WaitForMultipleObjects, kernel32.WaitForMultipleObjectsEx, kernel32.RegisterWaitForSingleObject, WaitOnAddress, user32.MsgWaitForMultipleObjects, user32.MsgWaitForMultipleObjectsEx, NtDelayExecution, KeWaitForSingleObject, KeDelayExecutionThread, sleep, usleep| ## References diff --git a/anti-behavioral-analysis/emulator-detection.md b/anti-behavioral-analysis/emulator-detection.md index b0717f1..b4fcbfa 100644 --- a/anti-behavioral-analysis/emulator-detection.md +++ b/anti-behavioral-analysis/emulator-detection.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +19 September 2023 @@ -43,21 +43,21 @@ Detects whether the malware instance is being executed inside an emulator. If so |**Check for WINE Version**|B0004.002|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.| |**Failed Network Connections**|B0004.004|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.| -## Detection - -|Tool: capa|Mapping|APIs| -|---|---|---| -|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress| - - ## Use in Malware |Name|Date|Method|Description| |---|---|---|---| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[2]](#2)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0004)|GetModuleHandle, GetProcAddress| + + ## References -[1] https://search.unprotect.it/map/sandbox-evasion/ +[1] https://search.unprotect.it/category/sandbox-evasion/ [2] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/anti-behavioral-analysis/emulator-evasion.md b/anti-behavioral-analysis/emulator-evasion.md index 8a793e0..f004599 100644 --- a/anti-behavioral-analysis/emulator-evasion.md +++ b/anti-behavioral-analysis/emulator-evasion.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +4 March 2023 diff --git a/anti-behavioral-analysis/memory-dump-evasion.md b/anti-behavioral-analysis/memory-dump-evasion.md index 4564f78..6c2e688 100644 --- a/anti-behavioral-analysis/memory-dump-evasion.md +++ b/anti-behavioral-analysis/memory-dump-evasion.md @@ -25,7 +25,7 @@ Last Modified -02 May 2023 +8 May 2023 diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md index 05a1a6b..1844d08 100644 --- a/anti-behavioral-analysis/sandbox-detection.md +++ b/anti-behavioral-analysis/sandbox-detection.md @@ -25,7 +25,7 @@ Last Modified -19 May 2023 +17 August 2023 diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md index 92dd356..0907df0 100644 --- a/anti-behavioral-analysis/virtual-machine-detection.md +++ b/anti-behavioral-analysis/virtual-machine-detection.md @@ -25,7 +25,7 @@ Last Modified -4 May 2023 +13 September 2023 @@ -33,10 +33,12 @@ # Virtual Machine Detection Malware checks whether it is being executed inside a virtual environment. In performing reconnaissance of its environment, the malware will check on a variety of user or system based artifacts. Examples include: - • monitoring for user action as reflected by scrolling - • verifying system characteristics through Windows Management Interface (WMI) queries, e.g., for MAC address - • observing whether tool artifacts represented by strings or processes exist, e.g., VirtualBox.exe or joeboxserver.exe - • and checking specific registry keys or values [[1]](#1) + +- monitoring for user action as reflected by scrolling +- verifying system characteristics through Windows Management Interface (WMI) queries, e.g., for MAC address +- observing whether tool artifacts represented by strings or processes exist, e.g., VirtualBox.exe or joeboxserver.exe +- checking specific registry keys or values [[1]](#1) + Upon detection of the virtual machine, conditional execution will change the malware’s behavior. For example, execution may terminate, or activity may appear benign, e.g., connecting to a benign domain. The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** ATT&CK techniques were defined subsequent to this MBC behavior. @@ -61,7 +63,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.| |**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.| |**Instruction Testing**|[B0009.029](#b0009029-snippet)|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| -|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type. This method is related to Unprotect technqiue U1324.| +|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type. This method is related to Unprotect technique U1324.| |**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) This method is related to Unprotect technique U1323.| |**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| |**Instruction Testing - SGDT/SLDT (no pill)**|B0009.031|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero. This method is related to Unprotect technique U1327.| @@ -107,8 +109,23 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |Tool: capa|Mapping|APIs| |---|---|---| -|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress| - +|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Virtual Machine Detection (B0009)|GetModuleHandle| +|[check for Windows sandbox via genuine state](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml)|Virtual Machine Detection (B0009)|SLIsGenuineLocal, UuidFromString| +|[reference anti-VM strings targeting Parallels](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml)|Virtual Machine Detection (B0009)| | +|[check for unmoving mouse cursor](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml)|Virtual Machine Detection::Human User Check (B0009.012)| | +|[reference anti-VM strings targeting VirtualPC](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml)|Virtual Machine Detection (B0009)| | +|[reference anti-VM strings targeting VMWare](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml)|Virtual Machine Detection (B0009)| | +|[check for foreground window switch](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml)|Virtual Machine Detection::Human User Check (B0009.012)|Sleep| +|[detect VM via disk hardware WMI queries](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml)|Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)| | +|[reference anti-VM strings targeting Qemu](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml)|Virtual Machine Detection (B0009)| | +|[reference anti-VM strings targeting Xen](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml)|Virtual Machine Detection (B0009)| | +|[check for sandbox username or hostname](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml)|Virtual Machine Detection (B0009)| | +|[check for Windows sandbox via process name](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml)|Virtual Machine Detection (B0009)| | +|[check for Windows sandbox via dns suffix](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml)|Virtual Machine Detection (B0009)|GetAdaptersAddresses| +|[check for Windows sandbox via device](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml)|Virtual Machine Detection (B0009)| | +|[reference anti-VM strings targeting VirtualBox](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml)|Virtual Machine Detection (B0009)| | +|[check for Windows sandbox via registry](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml)|Virtual Machine Detection (B0009)|RegOpenKeyEx, RegEnumValue| +|[reference anti-VM strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml)|Virtual Machine Detection (B0009)| | ## Code Snippets @@ -155,7 +172,7 @@ jmp short loc_401CBB [1] Check Point Research,"CP: Evasion Techniques," evasions.checkpoint.com, [Online]. Available: https://evasions.checkpoint.com. -[2] https://search.unprotect.it/map/sandbox-evasion/ +[2] https://search.unprotect.it/category/sandbox-evasion/ [3] https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html diff --git a/anti-static-analysis/README.md b/anti-static-analysis/README.md index f0a9ae9..0d8863e 100644 --- a/anti-static-analysis/README.md +++ b/anti-static-analysis/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +12 June 2023 @@ -28,6 +28,6 @@ Behaviors and code characteristics that prevent or hinder static analysis of the ## References -[1] https://search.unprotect.it/map/sandbox-evasion/ +[1] https://search.unprotect.it/category/sandbox-evasion/ [2] InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking diff --git a/anti-static-analysis/call-graph-generation-evasion.md b/anti-static-analysis/call-graph-generation-evasion.md index b1bfa87..35cf8bb 100644 --- a/anti-static-analysis/call-graph-generation-evasion.md +++ b/anti-static-analysis/call-graph-generation-evasion.md @@ -25,7 +25,7 @@ Last Modified -3 June 2023 +31 August 2023 @@ -50,7 +50,7 @@ Malicious code evades accurate call graph generation, which can be used for malw [3] S. Shang, N. Zheng, J. Xu, M. Xu, and H. Zhang,"Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. [Online]. Available: https://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf. -[4] J. Kinable, "Malware Detection Through Call Graphs," Master thesis, Department of Telematics, Norwegian University of Science and Technology, Norway, June 2010. [Online]. Available: https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/262290/353049_FU LLTEXT01.pdf?sequence=1&isAllowed=y. +[4] J. Kinable, "Malware Detection Through Call Graphs," Master thesis, Department of Telematics, Norwegian University of Science and Technology, Norway, June 2010. [Online]. Available: https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/262290/353049_FULLTEXT01.pdf?sequence=1&isAllowed=y. [5] http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html diff --git a/anti-static-analysis/data-flow-analysis-evasion.md b/anti-static-analysis/data-flow-analysis-evasion.md index df6e3bf..de54dc0 100644 --- a/anti-static-analysis/data-flow-analysis-evasion.md +++ b/anti-static-analysis/data-flow-analysis-evasion.md @@ -25,7 +25,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index 4a7461a..2eff33a 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -25,7 +25,7 @@ Last Modified -19 May 2023 +13 September 2023 @@ -51,6 +51,12 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented |[**Hupigon**](../xample-malware/hupigon.md)|2013|B0012.001|Hupigon contains obfuscated stack strings. [[7]](#7)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|B0012.001|Rombertik contains obfuscated stack strings. [[7]](#7)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[contain anti-disasm techniques](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml)|Disassembler Evasion (B0012)| | + ## References [1] M. Sikorski and A. Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, No Starch Press, 2012. diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md index bd336c7..5917747 100644 --- a/anti-static-analysis/executable-code-obfuscation.md +++ b/anti-static-analysis/executable-code-obfuscation.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -75,6 +75,23 @@ For encryption and encoding characteristics of malware samples, as well as malwa |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.017|The malware encodes data in a stack string and copies that data into a global character buffer as a form of string obfuscation. Different techniques are used to encrypt and obfuscate strings. Strings are dynamically decrypted when the malware needs to use them. [[9]](#9) [[10]](#10)| |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.009|The malware has 4 different export functions. [[9]](#9) [[10]](#10)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[obfuscated with ADVobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml)|Executable Code Obfuscation (B0032)| | +|[obfuscated with DeepSea Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-deepsea-obfuscator.yml)|Executable Code Obfuscation (B0032)| | +|[obfuscated with callobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml)|Executable Code Obfuscation (B0032)| | +|[obfuscated with Dotfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-dotfuscator.yml)|Executable Code Obfuscation (B0032)| | +|[obfuscated with vs-obfuscation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-vs-obfuscation.yml)|Executable Code Obfuscation (B0032)| | +|[obfuscated with Spices.Net Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-spicesdotnet-obfuscator.yml)|Executable Code Obfuscation (B0032)| | +|[obfuscated with Babel Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-babel-obfuscator.yml)|Executable Code Obfuscation (B0032)| | +|[obfuscated with SmartAssembly](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-smartassembly.yml)|Executable Code Obfuscation (B0032)| | +|[obfuscated with Yano](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-yano.yml)|Executable Code Obfuscation (B0032)| | +|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Argument Obfuscation (B0032.020)| | +|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Stack Strings (B0032.017)| | +|[use .NET library EncryptDecryptUtils](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml)|Executable Code Obfuscation (B0032)| | + ## Code Snippets diff --git a/anti-static-analysis/executable-code-optimization.md b/anti-static-analysis/executable-code-optimization.md index cdf1fdd..d9df30e 100644 --- a/anti-static-analysis/executable-code-optimization.md +++ b/anti-static-analysis/executable-code-optimization.md @@ -25,7 +25,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/anti-static-analysis/executable-code-virtualization.md b/anti-static-analysis/executable-code-virtualization.md index e2a10c2..42ec189 100644 --- a/anti-static-analysis/executable-code-virtualization.md +++ b/anti-static-analysis/executable-code-virtualization.md @@ -25,7 +25,7 @@ Last Modified -30 April 2023 +8 May 2023 diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index 6b2870d..ef32eba 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -64,6 +64,31 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware has a custom packer to obfuscate itself. [[7]](#7)| |[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads. [[8]](#8)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[packed with pebundle](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pebundle/packed-with-pebundle.yml)|Software Packing (F0001)| | +|[packed with Themida](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/themida/packed-with-themida.yml)|Software Packing::Themida (F0001.011)| | +|[packed with VMProtect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml)|Software Packing::VMProtect (F0001.010)| | +|[packed with y0da crypter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml)|Software Packing (F0001)| | +|[packed with pelocknt](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml)|Software Packing (F0001)| | +|[packed with GoPacker](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/gopacker/packed-with-gopacker.yml)|Software Packing::Standard Compression (F0001.002)| | +|[packed with Confuser](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/confuser/packed-with-confuser.yml)|Software Packing::Confuser (F0001.009)| | +|[packed with rlpack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/rlpack/packed-with-rlpack.yml)|Software Packing (F0001)| | +|[packed with ASPack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/aspack/packed-with-aspack.yml)|Software Packing (F0001)| | +|[packed with generic packer](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/generic/packed-with-generic-packer.yml)|Software Packing::Standard Compression (F0001.002)| | +|[packed with amber](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/amber/packed-with-amber.yml)|Software Packing (F0001)| | +|[packed with petite](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/petite/packed-with-petite.yml)|Software Packing (F0001)| | +|[packed with peshield](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/peshield/packed-with-peshield.yml)|Software Packing (F0001)| | +|[packed with UPX](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upx/packed-with-upx.yml)|Software Packing::UPX (F0001.008)| | +|[packed with upack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upack/packed-with-upack.yml)|Software Packing (F0001)| | +|[packed with PECompact](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pecompact/packed-with-pecompact.yml)|Software Packing (F0001)| | +|[packed with Huan](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/huan/packed-with-huan.yml)|Software Packing (F0001)| | +|[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)| | +|[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)| | +|[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)| | + ## References diff --git a/capa.md b/capa.md index 1c9c82b..f966586 100644 --- a/capa.md +++ b/capa.md @@ -1,20 +1,20 @@ # capa Rule Distribution # -15 August 2022 +19 September 2023 ## Histograms ## -The histograms below show the number of capa rules mapped into ATT&CK techniques (organized by tactic), MBC behaviors (organized by objective), and MBC micro-behaviors (organized by micro-objective). The explicit techniques, behaviors, and micro-behaviors follow. +The histograms below show the number of capa rules mapped into ATT&CK techniques (organized by tactic), MBC behaviors (organized by objective), and MBC micro-behaviors (organized by micro-objective). The count tracks ATT&CK techniques and sub-techniques and MBC behaviors and methods individually. For example, both B0009 and B0009.012 are counted under the Anti-Behavioral Analysis objective. The explicit techniques/sub-techiques, behaviors/methods, and micro-behaviors/micro-methods follow the histograms. ### ATT&CK Mapping Histogram ### | **TACTIC** | **Number of Techniques** | | |-----|-----|-----| -|Reconnaissance |0| | +|Reconnaissance|0| | |Resource Development|0| | -|Initial Access |0| | +|Initial Access|0| | |**Execution**|8| **XXXXXXXX** | -|**Persistence**|13| **XXXXXXXXXXXXX** | -|**Privilege Escalation**|1 | **X** | -|**Defense Evasion**|32| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** | +|**Persistence**|22| **XXXXXXXXXXXXXXXXXXXXXX** | +|**Privilege Escalation**|1| **X** | +|**Defense Evasion**|37| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** | |**Credential Access**|4| **XXXX** | |**Discovery**|17| **XXXXXXXXXXXXXXXXX** | |Lateral Movement|0| | @@ -23,31 +23,31 @@ The histograms below show the number of capa rules mapped into ATT&CK techniques |Exfiltration|0| | |**Impact**|5| **XXXXX** | -### MBC Mapping Histogram ### +### MBC Mapping Histogram (Objectives) ### | **OBJECTIVE** | **Number of Behaviors** | | |-----|-----|-----| -|**Anti-Behavioral Analysis** |20| **XXXXXXXXXXXXXXXXXXXX**| -|**Anti-Static Analysis**|9| **XXXXXXXXX** | -|**Collection**|4| **XXXX** | +|**Anti-Behavioral Analysis**|24| **XXXXXXXXXXXXXXXXXXXXXXXX** | +|**Anti-Static Analysis**|10| **XXXXXXXXXX** | +|**Collection**|5| **XXXXX** | |**Command and Control**|3| **XXX** | |Credential Access|0| | -|**Defense Evasion**|13| **XXXXXXXXXXXXX** | -|**Discovery**|6| **XXXXXX** | -|**Execution**|1| **X** | +|**Defense Evasion**|15| **XXXXXXXXXXXXXXX** | +|**Discovery**|8| **XXXXXXXX** | +|**Execution**|2| **XX** | |Exfiltration|0| | -|**Impact**|5| **XXXXX** | +|**Impact**|6| **XXXXXX** | |Lateral Movement|0| | -|Persistence|0| | -|Privilege Escalation|0 | | +|**Persistence**|2| **XX** | +|Privilege Escalation|0| | -### MBC Mapping Histogram ### +### MBC Mapping Histogram (Micro-Objectives) ### | **MICRO-OBJECTIVE** | **Number of Micro-Behaviors** | | |-----|-----|-----| -|**Communication** |34| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX**| -|**Cryptography**|16| **XXXXXXXXXXXXXXXX** | -|**Data**|15| **XXXXXXXXXXXXXXX** | +|**Communication**|38| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** | +|**Cryptography**|27| **XXXXXXXXXXXXXXXXXXXXXXXXXXX** | +|**Data**|16| **XXXXXXXXXXXXXXXX** | |**File System**|11| **XXXXXXXXXXX** | |**Hardware**|4| **XXXX** | |**Memory**|2| **XX** | @@ -57,392 +57,411 @@ The histograms below show the number of capa rules mapped into ATT&CK techniques ## ATT&CK MAPPINGS ## -### Collection: ### - num: 7 - - Archive Collected Data::Archive via Library [T1560.002] - - Clipboard Data [T1115] - - Video Capture [T1125] - - Input Capture::Keylogging [T1056.001] - - Data from Information Repositories [T1213] - - Audio Capture [T1123] - - Screen Capture [T1113] - -### Command and Control: ### - num: 1 - - Ingress Tool Transfer [T1105] - -### Credential Access: ### - num: 4 - - Credentials from Password Stores::Windows Credential Manager [T1555.004] - - Credentials from Password Stores::Password Managers [T1555.005] - - Credentials from Password Stores [T1555] - - Credentials from Password Stores::Credentials from Web Browsers [T1555.003] - -### Defense Evasion: ### - num: 32 - - Obfuscated Files or Information::Software Packing [T1027.002] - - Virtualization/Sandbox Evasion::System Checks [T1497.001] - - Impair Defenses::Disable or Modify Tools [T1562.001] - - Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002] - - Virtualization/Sandbox Evasion [T1497] - - Indicator Removal on Host [T1070] - - Impair Defenses::Disable Windows Event Logging [T1562.002] - - Process Injection [T1055] - - Access Token Manipulation::Parent PID Spoofing [T1134.004] - - Indicator Removal on Host::Clear Windows Event Logs [T1070.001] - - Indicator Removal on Host::File Deletion [T1070.004] - - Indicator Removal on Host::Timestomp [T1070.006] - - Obfuscated Files or Information [T1027] - - Obfuscated Files or Information::Indicator Removal from Tools [T1027.005] - - Deobfuscate/Decode Files or Information [T1140] - - Obfuscated Files or Information [T1027.002] - - Subvert Trust Controls::Mark-of-the-Web Bypass [T1553.005] - - File and Directory Permissions Modification [T1222] - - Hide Artifacts::Hidden Window [T1564.003] - - Hide Artifacts [T1564] - - "Process Injection::Process Doppelg\xE4nging [T1055.013]" - - Process Injection::Portable Executable Injection [T1055.002] - - Process Injection::Dynamic-link Library Injection [T1055.001] - - Process Injection::Thread Execution Hijacking [T1055.003] - - Process Injection::Asynchronous Procedure Call [T1055.004] - - Process Injection::Process Hollowing [T1055.012] - - Modify Registry [T1112] - - Impair Defenses::Safe Mode Boot [T1562.009] - - Subvert Trust Controls::Code Signing Policy Modification [T1553.006] - - Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] - - Hijack Execution Flow [T1574] - - BITS Jobs [T1197] - -### Discovery: ### - num: 17 - - - File and Directory Discovery [T1083] - - System Information Discovery [T1082] - - Process Discovery [T1057] - - System Location Discovery::System Language Discovery [T1614.001] - - System Service Discovery [T1007] - - Application Window Discovery [T1010] - - System Owner/User Discovery [T1033] - - Account Discovery [T1087] - - Query Registry [T1012] - - Software Discovery::Security Software Discovery [T1518.001] - - Software Discovery [T1518] - - System Network Configuration Discovery::Internet Connection Discovery [T1016.001] - - System Network Configuration Discovery [T1016] - - Network Sniffing [T1040] - - System Location Discovery [T1614] - - Group Policy Discovery [T1615] - - Domain Trust Discovery [T1482] - -### Execution: ### - num: 8 - - - Command and Scripting Interpreter [T1059] - - Windows Management Instrumentation [T1047] - - System Services::Service Execution [T1569.002] - - Command and Scripting Interpreter::PowerShell [T1059.001] - - Shared Modules [T1129] - - Command and Scripting Interpreter::Python [T1059.006] - - Command and Scripting Interpreter::Unix Shell [T1059.004] - - Command and Scripting Interpreter::Windows Command Shell [T1059.003] - -### Exfiltration: ### +### Reconnaissance ### num: 0 - -### Impact: ### - num: 5 - - - Endpoint Denial of Service [T1499] - - System Shutdown/Reboot [T1529] - - Data Manipulation::Transmitted Data Manipulation [T1565.002] - - Inhibit System Recovery [T1490] - - Disk Wipe::Disk Structure Wipe [T1561.002] - -### Initial Access: ### - num: 0 - -### Lateral Movement: ### - num: 0 - -### Persistence: ### - num: 13 - - - Create or Modify System Process::Windows Service [T1543.003] - - Event Triggered Execution::Unix Shell Configuration Modification [T1546.004] - - Boot or Logon Autostart Execution::XDG Autostart Entries [T1547.013] - - Server Software Component::IIS Components [T1505.004] - - Modify Authentication Process [T1556] - - Modify Authentication Process::Password Filter DLL [T1556.002] - - Boot or Logon Initialization Scripts::RC Scripts [T1037.004] - - Scheduled Task/Job::Scheduled Task [T1053.005] - - Boot or Logon Autostart Execution::Active Setup [T1547.014] - - Event Triggered Execution::AppInit DLLs [T1546.010] - - Event Triggered Execution [T1546] - - Boot or Logon Autostart Execution::Winlogon Helper DLL [T1547.004] - - Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001] - -### Privilege Escalation: ### - num: 1 - - - Access Token Manipulation [T1134] - -### Reconnaissance: ### - num: 0 - -### Resource Development: ### - num: 0 - +### Resource Development ### + num: 0 + +### Initial Access ### + num: 0 + +### Execution ### + num: 8 + - Command and Scripting Interpreter [T1059] Count-3 + - Windows Management Instrumentation [T1047] Count-1 + - System Services::Service Execution [T1569.002] Count-1 + - Shared Modules [T1129] Count-8 + - Command and Scripting Interpreter::PowerShell [T1059.001] Count-1 + - Command and Scripting Interpreter::Unix Shell [T1059.004] Count-2 + - Command and Scripting Interpreter::Windows Command Shell [T1059.003] Count-2 + - Command and Scripting Interpreter::Python [T1059.006] Count-2 + +### Persistence ### + num: 22 + - Hijack Execution Flow [T1574] Count-1 + - Create or Modify System Process::Windows Service [T1543.003] Count-9 + - Pre-OS Boot::System Firmware [T1542.001] Count-2 + - Boot or Logon Autostart Execution::Shortcut Modification [T1547.009] Count-1 + - Server Software Component [T1505] Count-2 + - Event Triggered Execution::Unix Shell Configuration Modification [T1546.004] Count-1 + - Boot or Logon Autostart Execution::XDG Autostart Entries [T1547.013] Count-1 + - Server Software Component::IIS Components [T1505.004] Count-2 + - Office Application Startup::Add-ins [T1137.006] Count-3 + - Modify Authentication Process::Network Provider DLL [T1556.008] Count-1 + - Boot or Logon Autostart Execution::Security Support Provider [T1547.005] Count-1 + - Boot or Logon Autostart Execution::Authentication Package [T1547.002] Count-1 + - Modify Authentication Process::Password Filter DLL [T1556.002] Count-1 + - Boot or Logon Initialization Scripts::RC Scripts [T1037.004] Count-1 + - Server Software Component::Transport Agent [T1505.002] Count-1 + - Scheduled Task/Job::Scheduled Task [T1053.005] Count-2 + - Scheduled Task/Job::At [T1053.002] Count-1 + - Boot or Logon Autostart Execution::Active Setup [T1547.014] Count-1 + - Event Triggered Execution::AppInit DLLs [T1546.010] Count-2 + - Event Triggered Execution [T1546] Count-1 + - Boot or Logon Autostart Execution::Winlogon Helper DLL [T1547.004] Count-1 + - Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001] Count-3 + +### Privilege Escalation ### + num: 1 + - Access Token Manipulation [T1134] Count-2 + +### Defense Evasion ### + num: 37 + - Obfuscated Files or Information::Software Packing [T1027.002] Count-20 + - Virtualization/Sandbox Evasion::System Checks [T1497.001] Count-16 + - Impair Defenses::Indicator Blocking [T1562.006] Count-1 + - Impair Defenses::Disable or Modify Tools [T1562.001] Count-3 + - Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002] Count-2 + - Virtualization/Sandbox Evasion [T1497] Count-1 + - Debugger Evasion [T1622] Count-2 + - Indicator Removal [T1070] Count-2 + - Impair Defenses::Disable Windows Event Logging [T1562.002] Count-1 + - Process Injection [T1055] Count-7 + - Access Token Manipulation::Parent PID Spoofing [T1134.004] Count-1 + - Indicator Removal::Clear Windows Event Logs [T1070.001] Count-1 + - Indicator Removal::File Deletion [T1070.004] Count-1 + - Indicator Removal::Timestomp [T1070.006] Count-1 + - Obfuscated Files or Information [T1027] Count-44 + - Obfuscated Files or Information::Indicator Removal from Tools [T1027.005] Count-1 + - Deobfuscate/Decode Files or Information [T1140] Count-2 + - Subvert Trust Controls::Mark-of-the-Web Bypass [T1553.005] Count-1 + - Hide Artifacts::Hidden File System [T1564.005] Count-1 + - File and Directory Permissions Modification [T1222] Count-1 + - Hide Artifacts::Hidden Window [T1564.003] Count-1 + - Hide Artifacts [T1564] Count-1 + - Process Injection::Process Doppelgänging [T1055.013] Count-1 + - Process Injection::Portable Executable Injection [T1055.002] Count-1 + - Process Injection::Dynamic-link Library Injection [T1055.001] Count-2 + - Process Injection::Thread Execution Hijacking [T1055.003] Count-2 + - Process Injection::Extra Window Memory Injection [T1055.011] Count-1 + - Process Injection::Asynchronous Procedure Call [T1055.004] Count-1 + - Process Injection::Process Hollowing [T1055.012] Count-1 + - Modify Registry [T1112] Count-4 + - Impair Defenses::Safe Mode Boot [T1562.009] Count-1 + - Subvert Trust Controls::Code Signing Policy Modification [T1553.006] Count-1 + - Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] Count-4 + - Reflective Code Loading [T1620] Count-1 + - Obfuscated Files or Information::Dynamic API Resolution [T1027.007] Count-1 + - Hijack Execution Flow [T1574] Count-1 + - BITS Jobs [T1197] Count-1 + +### Credential Access ### + num: 4 + - Credentials from Password Stores::Windows Credential Manager [T1555.004] Count-1 + - Credentials from Password Stores::Password Managers [T1555.005] Count-1 + - Credentials from Password Stores [T1555] Count-48 + - Credentials from Password Stores::Credentials from Web Browsers [T1555.003] Count-2 + +### Discovery ### + num: 17 + - File and Directory Discovery [T1083] Count-10 + - System Information Discovery [T1082] Count-16 + - Process Discovery [T1057] Count-9 + - System Location Discovery::System Language Discovery [T1614.001] Count-2 + - System Service Discovery [T1007] Count-3 + - Application Window Discovery [T1010] Count-2 + - System Owner/User Discovery [T1033] Count-4 + - Account Discovery [T1087] Count-2 + - Query Registry [T1012] Count-3 + - Software Discovery::Security Software Discovery [T1518.001] Count-1 + - Software Discovery [T1518] Count-1 + - System Network Configuration Discovery::Internet Connection Discovery [T1016.001] Count-1 + - System Network Configuration Discovery [T1016] Count-8 + - Network Sniffing [T1040] Count-1 + - System Location Discovery [T1614] Count-1 + - Group Policy Discovery [T1615] Count-1 + - Domain Trust Discovery [T1482] Count-1 + +### Lateral Movement ### + num: 0 + +### Collection ### + num: 7 + - Archive Collected Data::Archive via Library [T1560.002] Count-1 + - Clipboard Data [T1115] Count-3 + - Video Capture [T1125] Count-1 + - Input Capture::Keylogging [T1056.001] Count-3 + - Data from Information Repositories [T1213] Count-2 + - Audio Capture [T1123] Count-1 + - Screen Capture [T1113] Count-2 + +### Command and Control ### + num: 1 + - Ingress Tool Transfer [T1105] Count-1 + +### Exfiltration ### + num: 0 + +### Impact ### + num: 5 + - Endpoint Denial of Service [T1499] Count-1 + - System Shutdown/Reboot [T1529] Count-1 + - Data Manipulation::Transmitted Data Manipulation [T1565.002] Count-1 + - Inhibit System Recovery [T1490] Count-1 + - Disk Wipe::Disk Structure Wipe [T1561.002] Count-1 ## MBC MAPPINGS ## -### Anti-Behavioral Analysis: ### - num: 20 - - - Emulator Detection [B0004] - - Virtual Machine Detection [B0009] - - Virtual Machine Detection::Human User Check [B0009.012] - - Sandbox Detection::Product Key/ID Testing [B0007.005] - - Debugger Detection [B0001] - - Debugger Detection::Software Breakpoints [B0001.025] - - Debugger Detection::Process Environment Block BeingDebugged [B0001.035] - - Debugger Detection::Timing/Delay Check GetTickCount [B0001.032] - - Debugger Detection::SetHandleInformation [B0001.024] - - Debugger Detection::OutputDebugString [B0001.016] - - Debugger Detection::Memory Write Watching [B0001.010] - - Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033] - - Debugger Detection::Hardware Breakpoints [B0001.005] - - Debugger Detection::NtQueryInformationProcess [B0001.012] - - Debugger Detection::CheckRemoteDebuggerPresent [B0001.002] - - Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036] - - Debugger Detection::Anti-debugging Instructions [B0001.034] - - Conditional Execution::Runs as Service [B0025.007] - - Debugger Detection::Process Environment Block [B0001.019] - - Dynamic Analysis Evasion::Delayed Execution [B0003.003] - -### Anti-Static Analysis: ### - num: 9 - - - Disassembler Evasion [B0012] - - Software Packing [F0001] - - Software Packing::Themida [F0001.011] - - Software Packing::VMProtect [F0001.010] - - Software Packing::Standard Compression [F0001.002] - - Software Packing::Confuser [F0001.009] - - Software Packing::UPX [F0001.008] - - Executable Code Obfuscation [B0032] - - Disassembler Evasion::Argument Obfuscation [B0012.001] - -### Collection: ### - num: 4 - - - Keylogging::Polling [F0002.002] - - Keylogging::Application Hook [F0002.001] - - Screen Capture::WinAPI [E1113.m01] - - Screen Capture [E1113] - -### Command and Control: ### - num: 3 - - - C2 Communication::Send Data [B0030.001] - - C2 Communication::Receive Data [B0030.002] - - C2 Communication::Server to Client File Transfer [B0030.003] - -### Credential Access: ### - num: 0 - -### Defense Evasion: ### - num: 13 - - - Disable or Evade Security Tools::Heavens Gate [F0004.008] - - Disable or Evade Security Tools::Modify Policy [F0004.005] - - Process Injection::Patch Process Command Line [E1055.m04] - - Self Deletion::COMSPEC Environment Variable [F0007.001] - - Obfuscated Files or Information::Encryption [E1027.m04] - - Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05] - - Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02] - - Disable or Evade Security Tools::Bypass Windows File Protection [F0004.007] - - Process Injection [E1055] - - Disable or Evade Security Tools::Disable Code Integrity [F0004.009] - - Hijack Execution Flow::Abuse Windows Function Calls [F0015.006] - - Process Injection::Injection via Windows Fibers [E1055.m05] - - Hijack Execution Flow::Import Address Table (IAT) Hooking [F0015.003] - -### Discovery: ### - num: 6 - - - Analysis Tool Discovery::Process detection [B0013.001] - - Application Window Discovery::Window Text [E1010.m01] - - Taskbar Discovery [B0043] - - File and Directory Discovery::Log File [E1083.m01] - - Code Discovery::Enumerate PE Sections [B0046.001] - - Code Discovery::Inspect Section Memory Permissions [B0046.002] - -### Execution: ### - num: 1 - - - Install Additional Program [B0023] - -### Exfiltration: ### - num: 0 - -### Impact: ### +### Anti-Behavioral Analysis ### + num: 24 + - Emulator Detection [B0004] Count-1 + - Virtual Machine Detection [B0009] Count-14 + - Sandbox Detection [B0007] Count-1 + - Virtual Machine Detection::Human User Check [B0009.012] Count-2 + - Virtual Machine Detection::Unique Hardware/Firmware Check [B0009.023] Count-1 + - Sandbox Detection::Product Key/ID Testing [B0007.005] Count-1 + - Debugger Evasion [B0002] Count-2 + - Debugger Detection [B0001] Count-3 + - Debugger Detection::Software Breakpoints [B0001.025] Count-1 + - Debugger Detection::Process Environment Block BeingDebugged [B0001.035] Count-1 + - Debugger Detection::Timing/Delay Check GetTickCount [B0001.032] Count-1 + - Debugger Detection::SetHandleInformation [B0001.024] Count-1 + - Debugger Detection::OutputDebugString [B0001.016] Count-1 + - Debugger Detection::Memory Write Watching [B0001.010] Count-1 + - Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033] Count-1 + - Debugger Detection::Hardware Breakpoints [B0001.005] Count-1 + - Debugger Detection::NtQueryInformationProcess [B0001.012] Count-1 + - Debugger Detection::CheckRemoteDebuggerPresent [B0001.002] Count-1 + - Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031] Count-1 + - Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036] Count-1 + - Debugger Detection::Anti-debugging Instructions [B0001.034] Count-1 + - Conditional Execution::Runs as Service [B0025.007] Count-1 + - Debugger Detection::Process Environment Block [B0001.019] Count-1 + - Dynamic Analysis Evasion::Delayed Execution [B0003.003] Count-1 + +### Anti-Static Analysis ### + num: 10 + - Disassembler Evasion [B0012] Count-1 + - Software Packing [F0001] Count-14 + - Software Packing::Themida [F0001.011] Count-1 + - Software Packing::VMProtect [F0001.010] Count-1 + - Software Packing::Standard Compression [F0001.002] Count-2 + - Software Packing::Confuser [F0001.009] Count-1 + - Software Packing::UPX [F0001.008] Count-1 + - Executable Code Obfuscation [B0032] Count-10 + - Executable Code Obfuscation::Argument Obfuscation [B0032.020] Count-1 + - Executable Code Obfuscation::Stack Strings [B0032.017] Count-1 + +### Collection ### num: 5 - - - Modify Hardware::Mouse [B0042.002] - - Modify Hardware::CDROM [B0042.001] - - Clipboard Modification [E1510] - - Data Destruction::Delete Shadow Copies [E1485.m04] - - Remote Access::Reverse Shell [B0022.001] - -### Lateral Movement: ### - num: 0 - -### Persistence: ### - num: 0 - -### Privilege Escalation: ### + - Input Capture [E1056] Count-1 + - Keylogging::Polling [F0002.002] Count-1 + - Keylogging::Application Hook [F0002.001] Count-1 + - Screen Capture::WinAPI [E1113.m01] Count-1 + - Screen Capture [E1113] Count-1 + +### Command and Control ### + num: 3 + - C2 Communication::Send Data [B0030.001] Count-1 + - C2 Communication::Receive Data [B0030.002] Count-1 + - C2 Communication::Server to Client File Transfer [B0030.003] Count-1 + +### Credential Access ### num: 0 +### Defense Evasion ### + num: 15 + - Disable or Evade Security Tools::Heavens Gate [F0004.008] Count-1 + - Disable or Evade Security Tools [F0004] Count-1 + - Disable or Evade Security Tools::Modify Policy [F0004.005] Count-2 + - Process Injection::Patch Process Command Line [E1055.m04] Count-1 + - Self Deletion::COMSPEC Environment Variable [F0007.001] Count-1 + - Obfuscated Files or Information::Encryption [E1027.m04] Count-1 + - Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05] Count-21 + - Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02] Count-3 + - Disable or Evade Security Tools::Bypass Windows File Protection [F0004.007] Count-1 + - Process Injection [E1055] Count-4 + - Disable or Evade Security Tools::Disable Code Integrity [F0004.009] Count-1 + - Process Injection::Injection via Windows Fibers [E1055.m05] Count-1 + - Hijack Execution Flow::Abuse Windows Function Calls [F0015.006] Count-1 + - Hijack Execution Flow::Import Address Table Hooking [F0015.003] Count-1 + - Obfuscated Files or Information [E1027] Count-1 + +### Discovery ### + num: 8 + - Analysis Tool Discovery::Process detection [B0013.001] Count-1 + - System Information Discovery [E1082] Count-5 + - File and Directory Discovery [E1083] Count-7 + - Application Window Discovery [E1010] Count-1 + - Taskbar Discovery [B0043] Count-1 + - File and Directory Discovery::Log File [E1083.m01] Count-2 + - Code Discovery::Enumerate PE Sections [B0046.001] Count-1 + - Code Discovery::Inspect Section Memory Permissions [B0046.002] Count-1 + +### Execution ### + num: 2 + - Command and Scripting Interpreter [E1059] Count-2 + - Install Additional Program [B0023] Count-2 + +### Exfiltration ### + num: 0 + +### Impact ### + num: 6 + - Modify Hardware::Mouse [B0042.002] Count-1 + - Modify Hardware::CDROM [B0042.001] Count-1 + - Clipboard Modification [E1510] Count-1 + - Remote Access::Reverse Shell [B0022.001] Count-2 + - Data Destruction::Delete Shadow Copies [E1485.m04] Count-1 + - Disk Wipe [F0014] Count-1 + +### Lateral Movement ### + num: 0 + +### Persistence ### + num: 2 + - Hijack Execution Flow [F0015] Count-1 + - Registry Run Keys / Startup Folder [F0012] Count-1 + +### Privilege Escalation ### + num: 0 ## MBC MICRO-BEHAVIOR MAPPINGS ## -### Communication: ### - num: 34 - - - DNS Communication::Resolve [C0011.001] - - HTTP Communication::Read Header [C0002.014] - - HTTP Communication::WinHTTP [C0002.008] - - HTTP Communication::IWebBrowser [C0002.010] - - HTTP Communication::Set Header [C0002.013] - - HTTP Communication::Start Server [C0002.018] - - HTTP Communication::Receive Request [C0002.015] - - HTTP Communication::Send Response [C0002.016] - - HTTP Communication::Get Response [C0002.017] - - HTTP Communication::Send Request [C0002.003] - - HTTP Communication::Download URL [C0002.006] - - HTTP Communication::Create Request [C0002.012] - - HTTP Communication::Send Data [C0002.005] - - HTTP Communication::Open URL [C0002.004] - - HTTP Communication::Connect to Server [C0002.009] - - HTTP Communication::Extract Body [C0002.011] - - Socket Communication::Start TCP Server [C0001.005] - - Socket Communication::TCP Client [C0001.008] - - Interprocess Communication::Create Pipe [C0003.001] - - Interprocess Communication::Write Pipe [C0003.004] - - Interprocess Communication::Connect Pipe [C0003.002] - - Interprocess Communication::Read Pipe [C0003.003] - - FTP Communication::Send File [C0004.001] - - DNS Communication::Server Connect [C0011.002] - - Socket Communication::Get Socket Status [C0001.012] - - Socket Communication::Set Socket Config [C0001.001] - - Socket Communication::Initialize Winsock Library [C0001.009] - - Socket Communication::Connect Socket [C0001.004] - - Socket Communication::Create TCP Socket [C0001.011] - - Socket Communication::Send TCP Data [C0001.014] - - Socket Communication::Create UDP Socket [C0001.010] - - Socket Communication::Send Data [C0001.007] - - Socket Communication::Receive Data [C0001.006] - - ICMP Communication::Echo Request [C0014.002] +### Communication ### + num: 38 + - Interprocess Communication [C0003] Count-2 + - HTTP Communication::Read Header [C0002.014] Count-2 + - HTTP Communication::WinHTTP [C0002.008] Count-1 + - HTTP Communication::IWebBrowser [C0002.010] Count-2 + - HTTP Communication [C0002] Count-2 + - HTTP Communication::Set Header [C0002.013] Count-1 + - HTTP Communication::Start Server [C0002.018] Count-1 + - HTTP Communication::Receive Request [C0002.015] Count-1 + - HTTP Communication::Send Response [C0002.016] Count-1 + - HTTP Communication::Get Response [C0002.017] Count-5 + - HTTP Communication::Send Request [C0002.003] Count-1 + - HTTP Communication::Download URL [C0002.006] Count-1 + - HTTP Communication::Create Request [C0002.012] Count-2 + - HTTP Communication::Send Data [C0002.005] Count-1 + - HTTP Communication::Open URL [C0002.004] Count-1 + - HTTP Communication::Connect to Server [C0002.009] Count-1 + - HTTP Communication::Extract Body [C0002.011] Count-1 + - Socket Communication::Start TCP Server [C0001.005] Count-1 + - Socket Communication::TCP Client [C0001.008] Count-1 + - Interprocess Communication::Create Pipe [C0003.001] Count-2 + - Interprocess Communication::Write Pipe [C0003.004] Count-1 + - Interprocess Communication::Connect Pipe [C0003.002] Count-1 + - Interprocess Communication::Read Pipe [C0003.003] Count-1 + - FTP Communication::Send File [C0004.001] Count-1 + - FTP Communication::WinINet [C0004.002] Count-1 + - DNS Communication::Server Connect [C0011.002] Count-1 + - DNS Communication::Resolve [C0011.001] Count-1 + - Socket Communication::Get Socket Status [C0001.012] Count-1 + - Socket Communication::Create Socket [C0001.003] Count-2 + - Socket Communication::Set Socket Config [C0001.001] Count-1 + - Socket Communication::Initialize Winsock Library [C0001.009] Count-1 + - Socket Communication::Connect Socket [C0001.004] Count-1 + - Socket Communication::Create TCP Socket [C0001.011] Count-2 + - Socket Communication::Send TCP Data [C0001.014] Count-2 + - Socket Communication::Create UDP Socket [C0001.010] Count-1 + - Socket Communication::Send Data [C0001.007] Count-1 + - Socket Communication::Receive Data [C0001.006] Count-1 + - ICMP Communication::Echo Request [C0014.002] Count-1 -### Cryptography: ### +### Cryptography ### + num: 27 + - Encryption Key::Import Public Key [C0028.001] Count-1 + - Decrypt Data [C0031] Count-1 + - Encrypt Data [C0027] Count-4 + - Encryption Key [C0028] Count-2 + - Encrypt Data::HC-128 [C0027.006] Count-2 + - Encrypt Data::RC6 [C0027.010] Count-1 + - Encrypt Data::Twofish [C0027.005] Count-1 + - Encrypt Data::AES [C0027.001] Count-4 + - Decrypt Data::AES [C0031.001] Count-1 + - Encrypt Data::Sosemanuk [C0027.008] Count-1 + - Encrypt Data::Camellia [C0027.003] Count-1 + - Encrypt Data::3DES [C0027.004] Count-2 + - Encrypt Data::RC4 [C0027.009] Count-4 + - Generate Pseudo-random Sequence::RC4 PRGA [C0021.004] Count-1 + - Encryption Key::RC4 KSA [C0028.002] Count-1 + - Encrypt Data::Skipjack [C0027.013] Count-1 + - Encrypt Data::Blowfish [C0027.002] Count-1 + - Cryptographic Hash [C0029] Count-2 + - Cryptographic Hash::Tiger [C0029.005] Count-1 + - Cryptographic Hash::SHA1 [C0029.002] Count-1 + - Cryptographic Hash::SHA256 [C0029.003] Count-1 + - Cryptographic Hash::MD5 [C0029.001] Count-1 + - Cryptographic Hash::SHA224 [C0029.004] Count-1 + - Hashed Message Authentication Code [C0061] Count-1 + - Generate Pseudo-random Sequence::Use API [C0021.003] Count-2 + - Generate Pseudo-random Sequence [C0021] Count-1 + - Crypto Library [C0059] Count-5 + +### Data ### num: 16 - - - Encryption Key::Import Public Key [C0028.001] - - Decrypt Data [C0031] - - Encryption Key [C0028] - - Decrypt Data::AES [C0031.001] - - Encrypt Data [C0027] - - Encrypt Data::RC4 [C0027.009] - - Cryptographic Hash [C0029] - - Cryptographic Hash::Tiger [C0029.005] - - Cryptographic Hash::SHA1 [C0029.002] - - Cryptographic Hash::SHA256 [C0029.003] - - Cryptographic Hash::MD5 [C0029.001] - - Cryptographic Hash::SHA224 [C0029.004] - - Hashed Message Authentication Code [C0061] - - Generate Pseudo-random Sequence::Use API [C0021.003] - - Generate Pseudo-random Sequence::Mersenne Twister [C0021.005] - - Crypto Library [C0059] + - Checksum::Luhn [C0032.002] Count-3 + - Checksum::Adler [C0032.005] Count-1 + - Checksum::CRC32 [C0032.001] Count-1 + - Non-Cryptographic Hash::MurmurHash [C0030.001] Count-1 + - Non-Cryptographic Hash::FNV [C0030.005] Count-1 + - Non-Cryptographic Hash::djb2 [C0030.006] Count-1 + - Encode Data::XOR [C0026.002] Count-1 + - Encode Data::Base64 [C0026.001] Count-3 + - Check String [C0019] Count-2 + - Decompress Data::aPLib [C0025.003] Count-1 + - Decompress Data::IEncodingFilterFactory [C0025.002] Count-1 + - Compress Data [C0024] Count-3 + - Decompress Data [C0025] Count-2 + - Decompress Data::QuickLZ [C0025.001] Count-1 + - Modulo [C0058] Count-1 + - Compression Library [C0060] Count-2 -### Data: ### - num: 15 - - - Checksum::CRC32 [C0032.001] - - Checksum::Luhn [C0032.002] - - Checksum::Adler [C0032.005] - - Non-Cryptographic Hash::MurmurHash [C0030.001] - - Non-Cryptographic Hash::FNV [C0030.005] - - Non-Cryptographic Hash [C0030] - - Encode Data::Base64 [C0026.001] - - Decompress Data::aPLib [C0025.003] - - Decompress Data::IEncodingFilterFactory [C0025.002] - - Compress Data [C0024] - - Decompress Data::QuickLZ [C0025.001] - - Decompress Data [C0025] - - Check String [C0019] - - Modulo [C0058] - - Compression Library [C0060] - -### File System: ### +### File System ### num: 11 - - - Set File Attributes [C0050] - - Create Directory [C0046] - - Delete File [C0047] - - Delete Directory [C0048] - - Get File Attributes [C0049] - - Move File [C0063] - - Writes File [C0052] - - Copy File [C0045] - - Read File [C0051] - - Read Virtual Disk [C0056] - - Create File [C0016] + - Set File Attributes [C0050] Count-2 + - Create Directory [C0046] Count-1 + - Delete File [C0047] Count-1 + - Delete Directory [C0048] Count-1 + - Get File Attributes [C0049] Count-1 + - Move File [C0063] Count-1 + - Writes File [C0052] Count-3 + - Copy File [C0045] Count-1 + - Read File [C0051] Count-4 + - Read Virtual Disk [C0056] Count-1 + - Create File [C0016] Count-1 -### Hardware: ### +### Hardware ### num: 4 - - - Simulate Hardware::Ctrl-Alt-Del [C0057.001] - - Install Driver [C0037] - - Install Driver::Minifilter [C0037.001] - - Load Driver::Minifilter [C0023.001] + - Simulate Hardware::Ctrl-Alt-Del [C0057.001] Count-1 + - Install Driver [C0037] Count-1 + - Install Driver::Minifilter [C0037.001] Count-1 + - Load Driver::Minifilter [C0023.001] Count-1 -### Memory: ### +### Memory ### num: 2 - - - Free Memory [C0044] - - Allocate Memory [C0007] + - Free Memory [C0044] Count-1 + - Allocate Memory [C0007] Count-4 -### Operating System: ### +### Operating System ### num: 11 - - - Environment Variable::Set Variable [C0034.001] - - Environment Variable::Get Variable [C0034.002] - - Wallpaper [C0035] - - Console [C0033] - - Registry::Set Registry Key [C0036.001] - - Registry::Create Registry Key [C0036.004] - - Registry::Open Registry Key [C0036.003] - - Registry::Query Registry Key [C0036.005] - - Registry::Query Registry Value [C0036.006] - - Registry::Delete Registry Key [C0036.002] - - Registry::Delete Registry Value [C0036.007] - -### Process: ### + - Environment Variable::Set Variable [C0034.001] Count-1 + - Environment Variable [C0034] Count-1 + - Wallpaper [C0035] Count-1 + - Console [C0033] Count-2 + - Registry::Set Registry Key [C0036.001] Count-2 + - Registry::Open Registry Key [C0036.003] Count-2 + - Registry::Query Registry Key [C0036.005] Count-1 + - Registry::Query Registry Value [C0036.006] Count-2 + - Registry::Create Registry Key [C0036.004] Count-2 + - Registry::Delete Registry Key [C0036.002] Count-1 + - Registry::Delete Registry Value [C0036.007] Count-1 + +### Process ### num: 14 - - - Create Thread [C0038] - - Suspend Thread [C0055] - - Terminate Thread [C0039] - - Resume Thread [C0054] - - Enumerate Threads [C0064] - - Create Mutex [C0042] - - Check Mutex [C0043] - - Allocate Thread Local Storage [C0040] - - Set Thread Local Storage Value [C0041] - - Create Process [C0017] - - Create Process::Create Suspended Process [C0017.003] - - Terminate Process [C0018] - - Open Process [C0065] - - Open Thread [C0066] - + - Create Thread [C0038] Count-2 + - Suspend Thread [C0055] Count-1 + - Terminate Thread [C0039] Count-1 + - Resume Thread [C0054] Count-1 + - Enumerate Threads [C0064] Count-1 + - Create Mutex [C0042] Count-2 + - Check Mutex [C0043] Count-2 + - Terminate Process [C0018] Count-3 + - Allocate Thread Local Storage [C0040] Count-1 + - Set Thread Local Storage Value [C0041] Count-1 + - Create Process [C0017] Count-4 + - Create Process::Create Suspended Process [C0017.003] Count-1 + - Open Process [C0065] Count-1 + - Open Thread [C0066] Count-1 diff --git a/collection/README.md b/collection/README.md index 90280ff..f0034cb 100644 --- a/collection/README.md +++ b/collection/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/collection/cryptocurrency.md b/collection/cryptocurrency.md index 86f5fe1..c7ddaca 100644 --- a/collection/cryptocurrency.md +++ b/collection/cryptocurrency.md @@ -21,7 +21,7 @@ Last Modified -3 June 2023 +12 June 2023 diff --git a/collection/input-capture.md b/collection/input-capture.md index 484ec2e..78ef71b 100644 --- a/collection/input-capture.md +++ b/collection/input-capture.md @@ -21,7 +21,7 @@ Last Modified -6 June 2023 +13 September 2023 @@ -48,6 +48,11 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), |[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [[5]](#5)| |[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[6]](#6)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[use .NET library SharpClipboard](https://github.com/mandiant/capa-rules/blob/master/collection/use-dotnet-library-sharpclipboard.yml)|Input Capture (E1056)| | ## References diff --git a/collection/keylogging.md b/collection/keylogging.md index fdcc01c..c345dbc 100644 --- a/collection/keylogging.md +++ b/collection/keylogging.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -58,6 +58,12 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te |[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Malware logs keystrokes via polling. [[9]](#9)| |[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[log keystrokes via polling](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-polling.yml)|Keylogging::Polling (F0002.002)|user32.GetAsyncKeyState, user32.GetKeyState, user32.GetKeyboardState, user32.VkKeyScan, user32.VkKeyScanEx, user32.GetKeyNameText| +|[log keystrokes via application hook](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-application-hook.yml)|Keylogging::Application Hook (F0002.001)| | ## References diff --git a/collection/screen-capture.md b/collection/screen-capture.md index 74ee764..4a2e4bc 100644 --- a/collection/screen-capture.md +++ b/collection/screen-capture.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -51,6 +51,12 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/ |[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Malware captures screenshots. [[5]](#5)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Malware captures screenshots. [[5]](#5)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[capture screenshot](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot.yml)|Screen Capture::WinAPI (E1113.m01)|user32.GetWindowDC, user32.GetDC, gdi32.CreateDC, gdi32.BitBlt, gdi32.GetDIBits, gdi32.CreateCompatibleDC, gdi32.CreateCompatibleBitmap, user32.GetSystemMetrics = fetch screen dimensions, user32.GetDesktopWindow = get entire desktop, BitBlt, System.Drawing.Graphics::CopyFromScreen| +|[capture screenshot via keybd event](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot-via-keybd-event.yml)|Screen Capture (E1113)| | ## References diff --git a/command-and-control/README.md b/command-and-control/README.md index af801f9..b59d93b 100644 --- a/command-and-control/README.md +++ b/command-and-control/README.md @@ -8,7 +8,7 @@ Last Modified -21 November 2022 +29 November 2022 diff --git a/command-and-control/c2-communication.md b/command-and-control/c2-communication.md index 64e2bee..4136b93 100644 --- a/command-and-control/c2-communication.md +++ b/command-and-control/c2-communication.md @@ -21,7 +21,7 @@ Last Modified -6 June 2023 +13 September 2023 @@ -92,6 +92,13 @@ As "server" and "client" are confusing terminology, we use the terms "controller |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|B0030.002|The malware receives data from the C2 server. [[18]](#18)| |[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat communicates to a Pastebin site via HTTP. [[20]](#20)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[send data](https://github.com/mandiant/capa-rules/blob/master/communication/send-data.yml)|C2 Communication::Send Data (B0030.001)| | +|[receive data](https://github.com/mandiant/capa-rules/blob/master/communication/receive-data.yml)|C2 Communication::Receive Data (B0030.002)| | +|[download and write a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/download-and-write-a-file.yml)|C2 Communication::Server to Client File Transfer (B0030.003)| | ## Code Snippets diff --git a/command-and-control/domain-name-generation.md b/command-and-control/domain-name-generation.md index 6cea1ed..d4447a2 100644 --- a/command-and-control/domain-name-generation.md +++ b/command-and-control/domain-name-generation.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +15 March 2023 diff --git a/command-and-control/ingress-tool-transfer.md b/command-and-control/ingress-tool-transfer.md index 5c8337a..3e3f890 100644 --- a/command-and-control/ingress-tool-transfer.md +++ b/command-and-control/ingress-tool-transfer.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +17 August 2023 diff --git a/credential-access/README.md b/credential-access/README.md index c106f36..d6e6965 100644 --- a/credential-access/README.md +++ b/credential-access/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/defense-evasion/README.md b/defense-evasion/README.md index bf588c0..d38ee81 100644 --- a/defense-evasion/README.md +++ b/defense-evasion/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +8 May 2023 diff --git a/defense-evasion/alternative-installation-location.md b/defense-evasion/alternative-installation-location.md index b0eaafd..fc5ec47 100644 --- a/defense-evasion/alternative-installation-location.md +++ b/defense-evasion/alternative-installation-location.md @@ -21,7 +21,7 @@ Last Modified -01 May 2023 +17 August 2023 diff --git a/defense-evasion/bootkit.md b/defense-evasion/bootkit.md index 018c2da..d1eb5c3 100644 --- a/defense-evasion/bootkit.md +++ b/defense-evasion/bootkit.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +12 June 2023 diff --git a/defense-evasion/bypass-data-execution-prevention.md b/defense-evasion/bypass-data-execution-prevention.md index e747496..b5b7bc2 100644 --- a/defense-evasion/bypass-data-execution-prevention.md +++ b/defense-evasion/bypass-data-execution-prevention.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +12 June 2023 diff --git a/defense-evasion/covert-location.md b/defense-evasion/covert-location.md index 813119c..d57355d 100644 --- a/defense-evasion/covert-location.md +++ b/defense-evasion/covert-location.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/defense-evasion/disable-or-evade-security-tools.md b/defense-evasion/disable-or-evade-security-tools.md index 7024c9f..45983dc 100644 --- a/defense-evasion/disable-or-evade-security-tools.md +++ b/defense-evasion/disable-or-evade-security-tools.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -57,6 +57,16 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta |[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger prevents the infected system from installing anti-virus software updates. [[2]](#2)| |[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of Avast Antivirus. [[5]](#5)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[64-bit execution via heavens gate](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml)|Disable or Evade Security Tools::Heavens Gate (F0004.008)| | +|[patch Event Tracing for Windows function](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml)|Disable or Evade Security Tools (F0004)|kernel32.VirtualProtect, ntdll.NtProtectVirtualMemory, ZwProtectVirtualMemory| +|[block operations on executable memory pages using Arbitrary Code Guard](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|SetProcessMitigationPolicy| +|[protect spawned processes with mitigation policies](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|UpdateProcThreadAttribute| +|[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)| | +|[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)| | ## References diff --git a/defense-evasion/hidden-files-and-directories.md b/defense-evasion/hidden-files-and-directories.md index f0ca6cb..39f1810 100644 --- a/defense-evasion/hidden-files-and-directories.md +++ b/defense-evasion/hidden-files-and-directories.md @@ -21,7 +21,7 @@ Last Modified -6 June 2023 +12 June 2023 diff --git a/defense-evasion/hide-artifacts.md b/defense-evasion/hide-artifacts.md index d30a23b..8d40a70 100644 --- a/defense-evasion/hide-artifacts.md +++ b/defense-evasion/hide-artifacts.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +4 March 2023 diff --git a/defense-evasion/hijack-execution-flow.md b/defense-evasion/hijack-execution-flow.md index 3caf7a5..77724fe 100644 --- a/defense-evasion/hijack-execution-flow.md +++ b/defense-evasion/hijack-execution-flow.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -66,6 +66,13 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.003|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet. [[11]](#11)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.007|WTR4141.tmp hooks APIs from kernel32.dll and ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[11]](#11)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)| | +|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats| +|[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress| ## References diff --git a/defense-evasion/indicator-blocking.md b/defense-evasion/indicator-blocking.md index 374ff02..896d2cd 100644 --- a/defense-evasion/indicator-blocking.md +++ b/defense-evasion/indicator-blocking.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +1 March 2023 diff --git a/defense-evasion/install-insecure-or-malicious-configuration.md b/defense-evasion/install-insecure-or-malicious-configuration.md index d094a58..7eef4dd 100644 --- a/defense-evasion/install-insecure-or-malicious-configuration.md +++ b/defense-evasion/install-insecure-or-malicious-configuration.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +4 March 2023 diff --git a/defense-evasion/modify-registry.md b/defense-evasion/modify-registry.md index 4885974..5996d72 100644 --- a/defense-evasion/modify-registry.md +++ b/defense-evasion/modify-registry.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +19 September 2023 @@ -56,7 +56,7 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112 [4] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/ -[5] https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ +[5] https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem. [6] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/ diff --git a/defense-evasion/obfuscated-files-or-information.md b/defense-evasion/obfuscated-files-or-information.md index 81e34e3..81c1711 100644 --- a/defense-evasion/obfuscated-files-or-information.md +++ b/defense-evasion/obfuscated-files-or-information.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -87,6 +87,37 @@ Instead of being listed alphabetically, methods have been grouped to better faci |[**UP007**](../xample-malware/up007.md)|2016|E1027.m02|The malware encodes data using XOR. [[9]](#9)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[encrypt data using memfrob from glibc](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml)|Obfuscated Files or Information::Encryption (E1027.m04)|memfrob| +|[encrypt data using XXTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using AES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| +|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using XTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| +|[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptImportKey, CryptAcquireContext, CryptEncrypt| +|[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| +|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[decrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/decrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/encrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| | +|[encode data using Base64](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/encode-data-using-base64.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)|System.Convert::ToBase64String, System.Convert::ToBase64CharArray, System.Convert::TryToBase64Chars| +|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| | +|[resolve function by Brute Ratel Badger hash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml)|Obfuscated Files or Information (E1027)| | + ## References [1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/defense-evasion/polymorphic-code.md b/defense-evasion/polymorphic-code.md index b15a97e..3adb14e 100644 --- a/defense-evasion/polymorphic-code.md +++ b/defense-evasion/polymorphic-code.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +1 March 2023 diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md index 5c594d1..1f42d6b 100644 --- a/defense-evasion/process-injection.md +++ b/defense-evasion/process-injection.md @@ -21,7 +21,7 @@ Last Modified -19 May 2022 +13 September 2023 @@ -68,7 +68,18 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan |[**Netwalker**](../xample-malware/netwalker.md)|2020|E1055.001|Netwalker uses reflective DLL loading to inject from memory. [[10]](#10)| |[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|The malware can attach user process memory. [[13]](#13)| |[**Redhip**](../xample-malware/rebhip.md)|2011|E1055.003|The malware can inject threads. [[13]](#13)| +|[**Conti**](../xample-malware/conti.md)|2019|E1055.012|Conti creates a process in a suspended state and unmaps or removes the PE image layout from a given process space.| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[patch process command line](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/patch-process-command-line.yml)|Process Injection::Patch Process Command Line (E1055.m04)|VirtualProtect, GetProcAddress, ReadProcessMemory| +|[attach user process memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/attach-user-process-memory.yml)|Process Injection (E1055)|ntoskrnl.KeStackAttachProcess, ntoskrnl.KeUnstackDetachProcess| +|[inject shellcode using extra window memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-extra-window-memory.yml)|Process Injection (E1055)|SetWindowLong, SetWindowLongPtr, PostMessage, SendNotifyMessage| +|[inject shellcode using a file mapping object](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-a-file-mapping-object.yml)|Process Injection (E1055)|CreateFileMapping, MapViewOfFile, MapViewOfFileNuma2| +|[inject shellcode using window subclass procedure](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-window-subclass-procedure.yml)|Process Injection (E1055)|user32.SetProp, PostMessage, SendNotifyMessage| +|[execute shellcode via Windows fibers](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-fibers.yml)|Process Injection::Injection via Windows Fibers (E1055.m05)|ConvertThreadToFiber, CreateFiber, SwitchToFiber| ## References [1] Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process diff --git a/defense-evasion/rootkit.md b/defense-evasion/rootkit.md index 7818869..0c88d1c 100644 --- a/defense-evasion/rootkit.md +++ b/defense-evasion/rootkit.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +12 June 2023 diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index 7d71c35..1858fa7 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -20,7 +20,7 @@ Last Modified -6 June 2023 +13 September 2023 @@ -50,6 +50,12 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)| |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[4]](#4)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)| | + ## References diff --git a/discovery/README.md b/discovery/README.md index 195b3ff..72e9014 100644 --- a/discovery/README.md +++ b/discovery/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +12 June 2023 diff --git a/discovery/analysis-tool-discovery.md b/discovery/analysis-tool-discovery.md index 8721ebf..2fefdee 100644 --- a/discovery/analysis-tool-discovery.md +++ b/discovery/analysis-tool-discovery.md @@ -21,7 +21,7 @@ Last Modified -4 May 2023 +13 September 2023 @@ -53,11 +53,16 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi |Name|Date|Method|Description| |---|---|---|---| -|[**Emotet**](../xample-malware/emotet.md)|2018|B0013.002|If Emotet receives a response from the C2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the ShellExecuteW function and exits. [[1]](#1)| +|[**Emotet**](../xample-malware/emotet.md)|2018|B0013.002|If Emotet receives a response from the C2 server stating a debugging-related tool is in the list of running processes, it receives an "upgrade" command which calls the ShellExecuteW function and exits. [[1]](#1)| |[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy Variant runs a threat to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one of the analysis tools is running. [[2]](#2) [[3]](#3)| |[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0013.010|Poison Ivy goes through all the running program windows to check if any Windows class name contains a special string to determine if an analysis tool is running. [[2]](#2) [[3]](#3)| |[**WebCobra**](../xample-malware/webcobra.md)|2018|B0013.004|When infecting a x64 architecture system, the malware terminates if Wireshark is running on the system. [[4]](#4)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[reference analysis tools strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/reference-analysis-tools-strings.yml)|Analysis Tool Discovery::Process detection (B0013.001)| | ## References diff --git a/discovery/application-window-discovery.md b/discovery/application-window-discovery.md index 6c7673f..e71428f 100644 --- a/discovery/application-window-discovery.md +++ b/discovery/application-window-discovery.md @@ -21,7 +21,7 @@ Last Modified -19 May 2023 +13 September 2023 @@ -47,6 +47,12 @@ Malware may attempt to get a listing of open application windows. |[**Rombertik**](../xample-malware/rombertik.md)|2015|E1010.m01|Rombertik gets graphical window texts. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|E1010.m01|UP007 gets graphical window text. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[get graphical window text](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/window/get-text/get-graphical-window-text.yml)|Application Window Discovery (E1010)|user32.IsWindowVisible, user32.SendMessage, user32.GetForegroundWindow, user32.GetWindowText| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/discovery/code-discovery.md b/discovery/code-discovery.md index 49a2ac3..141fe63 100644 --- a/discovery/code-discovery.md +++ b/discovery/code-discovery.md @@ -21,7 +21,7 @@ Last Modified -19 May 2023 +13 September 2023 @@ -54,6 +54,13 @@ Malware may inspect code or enumerate aspects. |[**TrickBot**](../xample-malware/trickbot.md)|2016|B0046.002|TrickBot inspects section memory permissions. [[1]](#1)| |[**Ursnif**](../xample-malware/ursnif.md)|2016|B0046.001|Ursnif enumerates PE sections. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[enumerate PE sections](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/enumerate-pe-sections.yml)|Code Discovery::Enumerate PE Sections (B0046.001)| | +|[inspect section memory permissions](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/inspect-section-memory-permissions.yml)|Code Discovery::Inspect Section Memory Permissions (B0046.002)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/discovery/file-and-directory-discovery.md b/discovery/file-and-directory-discovery.md index 38d3e88..8644d8e 100644 --- a/discovery/file-and-directory-discovery.md +++ b/discovery/file-and-directory-discovery.md @@ -21,7 +21,7 @@ Last Modified -6 June 2022 +13 September 2023 @@ -63,6 +63,19 @@ Malware may enumerate files and directories or may search for specific files or |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets a common file path. [[6]](#6)| |[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[7]](#7)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[get common file path](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/get-common-file-path.yml)|File and Directory Discovery (E1083)|kernel32.GetTempPath, kernel32.GetTempFileName, kernel32.GetSystemDirectory, kernel32.GetWindowsDirectory, kernel32.GetSystemWow64Directory, GetAllUsersProfileDirectory, GetAppContainerFolderPath, GetCurrentDirectory, GetDefaultUserProfileDirectory, GetProfilesDirectory, GetUserProfileDirectory, SHGetFolderPathAndSubDir, shell32.SHGetFolderPath, shell32.SHGetFolderLocation, shell32.SHGetKnownFolderPath, shell32.SHGetSpecialFolderPath, shell32.SHGetSpecialFolderLocation, System.IO.Directory::GetCurrentDirectory, System.Environment::GetFolderPath| +|[get file version info](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/get-file-version-info.yml)|File and Directory Discovery (E1083)|version.GetFileVersionInfo, version.GetFileVersionInfoEx, System.Diagnostics.FileVersionInfo::GetVersionInfo, version.VerQueryValue, version.GetFileVersionInfoSize, version.GetFileVersionInfoSizeEx| +|[get file size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/get-file-size.yml)|File and Directory Discovery (E1083)|kernel32.GetFileSize, kernel32.GetFileSizeEx| +|[check if file exists](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/exists/check-if-file-exists.yml)|File and Directory Discovery (E1083)|kernel32.GetFileAttributes, kernel32.GetLastError, shlwapi.PathFileExists, System.IO.File::Exists| +|[enumerate files on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-linux.yml)|File and Directory Discovery (E1083)|getdents, getdents64, opendir, readdir| +|[enumerate files on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-windows.yml)|File and Directory Discovery (E1083)|kernel32.FindFirstFile, kernel32.FindFirstFileEx, kernel32.FindFirstFileTransacted, kernel32.FindFirstFileName, kernel32.FindFirstFileNameTransacted, kernel32.FindNextFile, kernel32.FindNextFileName, kernel32.FindClose, ntdll.NtOpenDirectoryObject, ntdll.NtQueryDirectoryObject, RtlAllocateHeap, System.IO.DirectoryInfo::GetFiles, System.IO.DirectoryInfo::EnumerateFiles, System.IO.Directory::GetFiles, System.IO.Directory::EnumerateFiles, System.IO.Directory::EnumerateFileSystemEntries, System.IO.DirectoryInfo::GetDirectories, System.IO.DirectoryInfo::EnumerateDirectories, System.IO.Directory::GetDirectories, System.IO.Directory::EnumerateDirectories| +|[enumerate files recursively](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-recursively.yml)|File and Directory Discovery (E1083)| | +|[read data from CLFS log container](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/clfs/read-data-from-clfs-log-container.yml)|File and Directory Discovery::Log File (E1083.m01)|clfsw32.CreateLogFile, clfsw32.CreateLogMarshallingArea, clfsw32.ReadLogRecord, clfsw32.ReadNextLogRecord| +|[access the Windows event log](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/winevt/access/access-the-windows-event-log.yml)|File and Directory Discovery::Log File (E1083.m01)|OpenEventLog, ClearEventLog, OpenBackupEventLog, ReportEvent| ## References diff --git a/discovery/self-discovery.md b/discovery/self-discovery.md index 5e6c7de..51126b4 100644 --- a/discovery/self-discovery.md +++ b/discovery/self-discovery.md @@ -21,7 +21,7 @@ Last Modified -3 June 2023 +17 August 2023 diff --git a/discovery/smtp-connection-discovery.md b/discovery/smtp-connection-discovery.md index b1cb6d2..d50b2e3 100644 --- a/discovery/smtp-connection-discovery.md +++ b/discovery/smtp-connection-discovery.md @@ -21,7 +21,7 @@ Last Modified -3 June 2023 +12 June 2023 diff --git a/discovery/system-information-discovery.md b/discovery/system-information-discovery.md index 9523011..cd4939d 100644 --- a/discovery/system-information-discovery.md +++ b/discovery/system-information-discovery.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -62,6 +62,15 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)| |[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[query environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/query-environment-variable.yml)|System Information Discovery (E1082)|kernel32.GetEnvironmentVariable, kernel32.GetEnvironmentStrings, kernel32.ExpandEnvironmentStrings, msvcr90.getenv, msvcrt.getenv, System.Environment::GetEnvironmentVariable, System.Environment::GetEnvironmentVariables, System.Environment::ExpandEnvironmentVariables| +|[get disk information](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-information.yml)|System Information Discovery (E1082)|kernel32.GetDriveType, kernel32.GetLogicalDrives, kernel32.GetVolumeInformation, kernel32.GetVolumeNameForVolumeMountPoint, kernel32.GetVolumePathNamesForVolumeName, kernel32.GetLogicalDriveStrings, kernel32.QueryDosDevice| +|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx, DeviceIoControl| +|[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)| | +|[get hostname](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/hostname/get-hostname.yml)|System Information Discovery (E1082)|kernel32.GetComputerName, kernel32.GetComputerNameEx, GetComputerObjectName, ws2_32.gethostname, gethostname| ## References diff --git a/discovery/taskbar-discovery.md b/discovery/taskbar-discovery.md index 0a0ac1f..4fda06f 100644 --- a/discovery/taskbar-discovery.md +++ b/discovery/taskbar-discovery.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -35,6 +35,12 @@ |---|---|---|---| |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip finds taskbars. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[find taskbar](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/taskbar/find/find-taskbar.yml)|Taskbar Discovery (B0043)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/execution/README.md b/execution/README.md index 7d49e3f..5222ca0 100644 --- a/execution/README.md +++ b/execution/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/execution/command-and-scripting-interpreter.md b/execution/command-and-scripting-interpreter.md index b80642f..44d8a62 100644 --- a/execution/command-and-scripting-interpreter.md +++ b/execution/command-and-scripting-interpreter.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -56,6 +56,12 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot accepts command line arguments. [[9]](#9)| |[**UP007**](../xample-malware/up007.md)|2016|--|The malware accepts command line arguments. [[9]](#9)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[accept command line arguments](https://github.com/mandiant/capa-rules/blob/master/host-interaction/cli/accept-command-line-arguments.yml)|Command and Scripting Interpreter (E1059)|GetCommandLine, CommandLineToArgv, System.Environment::GetCommandLineArgs| +|[run PowerShell expression](https://github.com/mandiant/capa-rules/blob/master/load-code/powershell/run-powershell-expression.yml)|Command and Scripting Interpreter (E1059)|System.Management.Automation.PowerShell::Create, System.Management.Automation.PowerShell::AddScript, System.Management.Automation.PowerShell::Invoke| ## References diff --git a/execution/conditional-execution.md b/execution/conditional-execution.md index d0882ce..70be472 100644 --- a/execution/conditional-execution.md +++ b/execution/conditional-execution.md @@ -25,7 +25,7 @@ Last Modified - 4 May 2023 +19 September 2023 @@ -64,6 +64,11 @@ Some aspects of this Conditional Execution behavior are related to the [Executio |[**Hupigon**](../xample-malware/hupigon.md)|2013|B0025.007|Hupigon can run as a service. [[7]](#7)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|B0025.007|Shamoon can run as a service. [[7]](#7)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[run as service](https://github.com/mandiant/capa-rules/blob/master/host-interaction/service/run-as-service.yml)|Conditional Execution::Runs as Service (B0025.007)|RegisterServiceCtrlHandler, RegisterServiceCtrlHandlerEx, StartServiceCtrlDispatcher, System.ServiceProcess.ServiceBase::Run| ## References diff --git a/execution/execution-dependency.md b/execution/execution-dependency.md index c6184ab..677acfa 100644 --- a/execution/execution-dependency.md +++ b/execution/execution-dependency.md @@ -21,7 +21,7 @@ Last Modified -3 June 2023 +12 June 2023 diff --git a/execution/exploitation-for-client-execution.md b/execution/exploitation-for-client-execution.md index 6d96866..047feea 100644 --- a/execution/exploitation-for-client-execution.md +++ b/execution/exploitation-for-client-execution.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +1 March 2023 diff --git a/execution/install-additional-program.md b/execution/install-additional-program.md index 02627af..083a4d3 100644 --- a/execution/install-additional-program.md +++ b/execution/install-additional-program.md @@ -21,7 +21,7 @@ Last Modified -6 June 2023 +13 September 2023 @@ -62,6 +62,12 @@ Droppers may be described as “single stage” or “two stage.” While the fo |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip contains an embedded PE file. [[19]](#19)| |[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[20]](#20)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[contain an embedded PE file](https://github.com/mandiant/capa-rules/blob/master/executable/subfile/pe/contain-an-embedded-pe-file.yml)|Install Additional Program (B0023)| | +|[write and execute a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/write-and-execute-a-file.yml)|Install Additional Program (B0023)| | ## References "Cyclops Blink: Malware Analysis Report, Version 1.0," National Cyber Security Centre/GCHQ, 23 Feb. 2022. [Online]. Available: https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf. diff --git a/execution/prevent-concurrent-execution.md b/execution/prevent-concurrent-execution.md index af147e6..f8b6bbe 100644 --- a/execution/prevent-concurrent-execution.md +++ b/execution/prevent-concurrent-execution.md @@ -21,7 +21,7 @@ Last Modified -01 May 2023 +8 May 2023 diff --git a/execution/remote-commands.md b/execution/remote-commands.md index 73677ae..151657a 100644 --- a/execution/remote-commands.md +++ b/execution/remote-commands.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +1 March 2023 diff --git a/execution/send-email.md b/execution/send-email.md index 12cb7bb..9002fd2 100644 --- a/execution/send-email.md +++ b/execution/send-email.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +12 June 2023 diff --git a/execution/send-poisoned-text-message.md b/execution/send-poisoned-text-message.md index 01ce988..84e9495 100644 --- a/execution/send-poisoned-text-message.md +++ b/execution/send-poisoned-text-message.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +1 February 2023 diff --git a/execution/system-services.md b/execution/system-services.md index 11bc68c..1243949 100644 --- a/execution/system-services.md +++ b/execution/system-services.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +12 June 2023 diff --git a/execution/user-execution.md b/execution/user-execution.md index ea671c3..6dae7ca 100644 --- a/execution/user-execution.md +++ b/execution/user-execution.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +17 August 2023 diff --git a/exfiltration/README.md b/exfiltration/README.md index dd0fccc..710afcc 100644 --- a/exfiltration/README.md +++ b/exfiltration/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/exfiltration/archive-collected-data.md b/exfiltration/archive-collected-data.md index 704cee4..79de550 100644 --- a/exfiltration/archive-collected-data.md +++ b/exfiltration/archive-collected-data.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +1 March 2023 diff --git a/exfiltration/automated-exfiltration.md b/exfiltration/automated-exfiltration.md index 34b730f..e0edd1b 100644 --- a/exfiltration/automated-exfiltration.md +++ b/exfiltration/automated-exfiltration.md @@ -21,7 +21,7 @@ Last Modified -4 June 2023 +17 August 2023 diff --git a/impact/README.md b/impact/README.md index 41ec20f..3b72615 100644 --- a/impact/README.md +++ b/impact/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +17 August 2023 diff --git a/impact/clipboard-modification.md b/impact/clipboard-modification.md index cab3ca7..3e2c58b 100644 --- a/impact/clipboard-modification.md +++ b/impact/clipboard-modification.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -44,6 +44,11 @@ ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon replaces clipboard data. [[2]](#2)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware replaces clipboard data. [[2]](#2)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[write clipboard data](https://github.com/mandiant/capa-rules/blob/master/host-interaction/clipboard/write-clipboard-data.yml)|Clipboard Modification (E1510)|user32.EmptyClipboard, System.Windows.Forms.Clipboard::Clear, user32.SetClipboardData, System.Windows.Forms.Clipboard::SetAudio, System.Windows.Forms.Clipboard::SetData, System.Windows.Forms.Clipboard::SetDataObject, System.Windows.Forms.Clipboard::SetFileDropList, System.Windows.Forms.Clipboard::SetImage, System.Windows.Forms.Clipboard::SetText| ## References diff --git a/impact/compromise-data-integrity.md b/impact/compromise-data-integrity.md index 2941bb6..f730038 100644 --- a/impact/compromise-data-integrity.md +++ b/impact/compromise-data-integrity.md @@ -25,7 +25,7 @@ Last Modified -3 June 2023 +12 June 2023 diff --git a/impact/data-destruction.md b/impact/data-destruction.md index d2f35ed..d6241c7 100644 --- a/impact/data-destruction.md +++ b/impact/data-destruction.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -54,6 +54,11 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148 |[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker resets system restore points and deletes backup files. [[4]](#4)| |[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|MazarBot can erase phone data. [[5]](#5)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[delete volume shadow copies](https://github.com/mandiant/capa-rules/blob/master/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml)|Data Destruction::Delete Shadow Copies (E1485.m04)| | ## References diff --git a/impact/data-encrypted-for-impact.md b/impact/data-encrypted-for-impact.md index 5067e77..2278e72 100644 --- a/impact/data-encrypted-for-impact.md +++ b/impact/data-encrypted-for-impact.md @@ -25,7 +25,7 @@ Last Modified -6 June 2023 +31 August 2023 @@ -51,7 +51,7 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart encrypts files for ransom without any connection to the Internet. [[3]](#3)| |[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam encrypts data to hold for ransom. [[4]](#4)| |[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker encrypts files for ransom. [[5]](#5)| -|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0025|WannaCry encrypts files for ransom. [[6]](#6)| +|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry encrypts files for ransom. [[6]](#6)| ## References diff --git a/impact/denial-of-service.md b/impact/denial-of-service.md index 3cca080..24d996b 100644 --- a/impact/denial-of-service.md +++ b/impact/denial-of-service.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +17 August 2023 diff --git a/impact/destroy-hardware.md b/impact/destroy-hardware.md index 8652405..71a60a7 100644 --- a/impact/destroy-hardware.md +++ b/impact/destroy-hardware.md @@ -25,7 +25,7 @@ Last Modified -01 May 2023 +8 May 2023 diff --git a/impact/disk-wipe.md b/impact/disk-wipe.md index 2ab6581..8434147 100644 --- a/impact/disk-wipe.md +++ b/impact/disk-wipe.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -41,6 +41,12 @@ This description refines the ATT&CK **Disk Wipe: Disk Content Wipe ([T1561.001]( |---|---|---|---| |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|An overwrite component will overwrite the MBR so that the compromised computer can no longer start. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[overwrite Master Boot Record (MBR)](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml)|Disk Wipe (F0014)|kernel32.WriteFile| + ## References [1] https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=281521ea-2d18-4bf9-9e88-8b1dc41cfdb6&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments diff --git a/impact/exploit-kit.md b/impact/exploit-kit.md index b37d084..5c6176e 100644 --- a/impact/exploit-kit.md +++ b/impact/exploit-kit.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +1 March 2023 diff --git a/impact/generate-traffic-from-victim.md b/impact/generate-traffic-from-victim.md index dd01416..b8c687d 100644 --- a/impact/generate-traffic-from-victim.md +++ b/impact/generate-traffic-from-victim.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +12 June 2023 diff --git a/impact/manipulate-network-traffic.md b/impact/manipulate-network-traffic.md index b63ed88..c71378b 100644 --- a/impact/manipulate-network-traffic.md +++ b/impact/manipulate-network-traffic.md @@ -25,7 +25,7 @@ Last Modified -01 May 2023 +17 August 2023 diff --git a/impact/modify-hardware.md b/impact/modify-hardware.md index 093904b..720e69b 100644 --- a/impact/modify-hardware.md +++ b/impact/modify-hardware.md @@ -25,7 +25,7 @@ Last Modified -6 June 2023 +13 September 2023 @@ -48,6 +48,13 @@ Name|Date|Method|Description| |---|---|---|---| |[**BadUSB**](../xample-malware/badusb.md)|2014|--| BadUSB can modify USB drives. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[swap mouse buttons](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/mouse/swap-mouse-buttons.yml)|Modify Hardware::Mouse (B0042.002)|user32.SwapMouseButton| +|[manipulate CD-ROM drive](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml)|Modify Hardware::CDROM (B0042.001)|winmm.mciSendString| + ## References [1] https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/ \ No newline at end of file diff --git a/impact/remote-access.md b/impact/remote-access.md index c915fce..30ffd80 100644 --- a/impact/remote-access.md +++ b/impact/remote-access.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -52,6 +52,12 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu |[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet allows an attacker to control the system via a GUI. [[3]](#3)| |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware acts as a backdoor. [[4]](#4)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[create reverse shell on Linux](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell-on-linux.yml)|Remote Access::Reverse Shell (B0022.001)| | +|[create reverse shell](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell.yml)|Remote Access::Reverse Shell (B0022.001)|kernel32.PeekNamedPipe, kernel32.CreateProcess, kernel32.ReadFile, kernel32.WriteFile| ## References diff --git a/impact/resource-hijacking.md b/impact/resource-hijacking.md index a312fd5..92b5ad6 100644 --- a/impact/resource-hijacking.md +++ b/impact/resource-hijacking.md @@ -25,7 +25,7 @@ Last Modified -01 May 2023 +8 May 2023 diff --git a/impact/spamming.md b/impact/spamming.md index 62e2bcb..8d47bed 100644 --- a/impact/spamming.md +++ b/impact/spamming.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +1 March 2023 diff --git a/lateral-movement/README.md b/lateral-movement/README.md index be3ce29..44ec83e 100644 --- a/lateral-movement/README.md +++ b/lateral-movement/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/lateral-movement/supply-chain-compromise.md b/lateral-movement/supply-chain-compromise.md index 4a8837d..ffa6332 100644 --- a/lateral-movement/supply-chain-compromise.md +++ b/lateral-movement/supply-chain-compromise.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +17 August 2023 diff --git a/micro-behaviors/communication/README.md b/micro-behaviors/communication/README.md index e0d1424..4ffb46c 100644 --- a/micro-behaviors/communication/README.md +++ b/micro-behaviors/communication/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +8 May 2023 diff --git a/micro-behaviors/communication/dns-communication.md b/micro-behaviors/communication/dns-communication.md index 170f84e..1e6bae6 100644 --- a/micro-behaviors/communication/dns-communication.md +++ b/micro-behaviors/communication/dns-communication.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -47,6 +47,13 @@ The DNS Communication micro-behavior focuses on DNS communication. |[**Hupigon**](../xample-malware/hupigon.md)|2013|C0011.001|Hupigon resolves DNS. [[1]](#1)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|C0011.001|Shamoon resolves DNS. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[reference DNS over HTTPS endpoints](https://github.com/mandiant/capa-rules/blob/master/communication/dns/reference-dns-over-https-endpoints.yml)|DNS Communication::Server Connect (C0011.002)| | +|[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, getaddrinfo, GetAddrInfo, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/communication/ftp-communication.md b/micro-behaviors/communication/ftp-communication.md index c6f128a..ce208d6 100644 --- a/micro-behaviors/communication/ftp-communication.md +++ b/micro-behaviors/communication/ftp-communication.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -36,3 +36,10 @@ The FTP Communication micro-behavior focuses on FTP communication. |---|---|---| |**Send File**|C0004.001|Send FTP file.| |**WinINet**|C0004.002|Send FTP command via WinINet.| + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[send file using FTP](https://github.com/mandiant/capa-rules/blob/master/communication/ftp/send/send-file-using-ftp.yml)|FTP Communication::Send File (C0004.001)|wininet.FtpPutFile, wininet.FtpSetCurrentDirectory, wininet.InternetConnect, System.Net.WebRequest::Create| +|[send file using FTP](https://github.com/mandiant/capa-rules/blob/master/communication/ftp/send/send-file-using-ftp.yml)|FTP Communication::WinINet (C0004.002)|wininet.FtpPutFile, wininet.FtpSetCurrentDirectory, wininet.InternetConnect, System.Net.WebRequest::Create| diff --git a/micro-behaviors/communication/http-communication.md b/micro-behaviors/communication/http-communication.md index 2751858..261ae80 100644 --- a/micro-behaviors/communication/http-communication.md +++ b/micro-behaviors/communication/http-communication.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -66,6 +66,34 @@ Instead of being listed alphabetically, methods have been grouped to better faci |[**Kovter**](../xample-malware/kovter.md)|2016|C0002.009|Kovter connects to a HTTP server. [[1]](#1)| |[**Kovter**](../xample-malware/kovter.md)|2016|C0002.012|Kovter creates a HTTP request. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[read HTTP header](https://github.com/mandiant/capa-rules/blob/master/communication/http/read-http-header.yml)|HTTP Communication::Read Header (C0002.014)|winhttp.WinHttpQueryHeaders| +|[initialize WinHTTP library](https://github.com/mandiant/capa-rules/blob/master/communication/http/initialize-winhttp-library.yml)|HTTP Communication::WinHTTP (C0002.008)|winhttp.WinHttpOpen| +|[initialize IWebBrowser2](https://github.com/mandiant/capa-rules/blob/master/communication/http/initialize-iwebbrowser2.yml)|HTTP Communication::IWebBrowser (C0002.010)|ole32.CoCreateInstance| +|[get HTTP content length](https://github.com/mandiant/capa-rules/blob/master/communication/http/get-http-content-length.yml)|HTTP Communication (C0002)|wininet.HttpQueryInfo| +|[set HTTP header](https://github.com/mandiant/capa-rules/blob/master/communication/http/set-http-header.yml)|HTTP Communication::Set Header (C0002.013)|winhttp.WinHttpAddRequestHeaders, System.Net.WebHeaderCollection::Add| +|[reference HTTP User-Agent string](https://github.com/mandiant/capa-rules/blob/master/communication/http/reference-http-user-agent-string.yml)|HTTP Communication (C0002)|urlmon.ObtainUserAgentString| +|[start HTTP server](https://github.com/mandiant/capa-rules/blob/master/communication/http/server/start-http-server.yml)|HTTP Communication::Start Server (C0002.018)|httpapi.HttpInitialize, httpapi.HttpTerminate, System.Net.HttpListener::Start| +|[receive HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/server/receive-http-request.yml)|HTTP Communication::Receive Request (C0002.015)|httpapi.HttpReceiveHttpRequest, httpapi.HttpReceiveRequestEntityBody| +|[send HTTP response](https://github.com/mandiant/capa-rules/blob/master/communication/http/server/send-http-response.yml)|HTTP Communication::Send Response (C0002.016)|httpapi.HttpSendHttpResponse, httpapi.HttpSendResponseEntityBody| +|[receive HTTP response](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/receive-http-response.yml)|HTTP Communication::Get Response (C0002.017)|System.Net.WebRequest::GetResponse, winhttp.WinHttpReceiveResponse, winhttp.WinHttpReadData, winhttp.WinHttpQueryDataAvailable| +|[send HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/send-http-request.yml)|HTTP Communication::Send Request (C0002.003)|System.Net.WebRequest::GetResponse, System.Net.WebRequest::GetResponseAsync, wininet.HttpOpenRequest, wininet.InternetConnect, wininet.HttpSendRequest, wininet.HttpSendRequestEx, winhttp.WinHttpSendRequest, winhttp.WinHttpWriteData, winhttp.WinHttpOpenRequest, winhttp.WinHttpConnect| +|[read data from Internet](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/read-data-from-internet.yml)|HTTP Communication::Get Response (C0002.017)|wininet.InternetReadFile, wininet.InternetReadFileEx, System.Net.WebClient::DownloadString, System.Net.WebClient::DownloadStringAsync, System.Net.WebClient::DownloadStringTaskAsync, System.Net.WebClient::DownloadData, System.Net.WebClient::DownloadDataAsync, System.Net.WebClient::DownloadDataTaskAsync| +|[get HTTP document via IWebBrowser2](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/get-http-document-via-iwebbrowser2.yml)|HTTP Communication::Get Response (C0002.017)|oleaut32.SysAllocString, oleaut32.VariantInit| +|[get HTTP document via IWebBrowser2](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/get-http-document-via-iwebbrowser2.yml)|HTTP Communication::IWebBrowser (C0002.010)|oleaut32.SysAllocString, oleaut32.VariantInit| +|[download URL](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/download-url.yml)|HTTP Communication::Download URL (C0002.006)|urlmon.URLDownloadToFile, urlmon.URLDownloadToCacheFile, urlmon.URLOpenBlockingStream, urlmon.URLOpenPullStream, urlmon.URLOpenStream, System.Net.WebClient::DownloadFile, System.Net.WebClient::DownloadFileAsync, System.Net.WebClient::DownloadFileTaskAsync, Microsoft.VisualBasic.Devices.Network::DownloadFile| +|[prepare HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/prepare-http-request.yml)|HTTP Communication::Create Request (C0002.012)|winhttp.WinHttpOpenRequest| +|[create HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/create-http-request.yml)|HTTP Communication::Create Request (C0002.012)|wininet.InternetOpen, System.Net.WebRequest::Create, System.Net.WebRequest::CreateDefault, System.Net.WebRequest::CreateHttp, wininet.InternetCloseHandle| +|[send file via HTTP](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/send-file-via-http.yml)|HTTP Communication::Send Data (C0002.005)|wininet.InternetWriteFile| +|[decompress HTTP response via IEncodingFilterFactory](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml)|HTTP Communication::Get Response (C0002.017)| | +|[check HTTP status code](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/check-http-status-code.yml)|HTTP Communication::Read Header (C0002.014)|atoi, wininet.HttpQueryInfo| +|[get HTTP response content encoding](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/get-http-response-content-encoding.yml)|HTTP Communication::Get Response (C0002.017)|wininet.HttpQueryInfo| +|[connect to URL](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-url.yml)|HTTP Communication::Open URL (C0002.004)|wininet.InternetOpenUrl| +|[connect to HTTP server](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-http-server.yml)|HTTP Communication::Connect to Server (C0002.009)|wininet.InternetConnect| +|[extract HTTP body](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/extract-http-body.yml)|HTTP Communication::Extract Body (C0002.011)| | ## References diff --git a/micro-behaviors/communication/icmp-communication.md b/micro-behaviors/communication/icmp-communication.md index 1b8cc3a..73c48e4 100644 --- a/micro-behaviors/communication/icmp-communication.md +++ b/micro-behaviors/communication/icmp-communication.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -36,3 +36,9 @@ This micro-behavior is related to ICMP communication. |---|---|---| |**Echo Request**|C0014.002|Send ICMP echo request.| |**Generate Traffic**|C0014.001|Generate ICMP traffic.| + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[send ICMP echo request](https://github.com/mandiant/capa-rules/blob/master/communication/icmp/send-icmp-echo-request.yml)|ICMP Communication::Echo Request (C0014.002)|IcmpSendEcho, IcmpSendEcho2, IcmpSendEcho2Ex, Icmp6SendEcho2, IcmpCreateFile, Icmp6CreateFile, IcmpCloseHandle| diff --git a/micro-behaviors/communication/interprocess-communication.md b/micro-behaviors/communication/interprocess-communication.md index 14271c3..48a973a 100644 --- a/micro-behaviors/communication/interprocess-communication.md +++ b/micro-behaviors/communication/interprocess-communication.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -47,6 +47,18 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat |[**Hupigon**](../xample-malware/hupigon.md)|2013|C0003.004|Hupigon writes pipes. [[1]](#1)| |[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|C0003.004|Poison Ivy writes pipes. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[create mailslot](https://github.com/mandiant/capa-rules/blob/master/communication/mailslot/create-mailslot.yml)|Interprocess Communication (C0003)|kernel32.CreateMailslot, kernel32.GetMailslotInfo, kernel32.SetMailslotInfo| +|[read from mailslot](https://github.com/mandiant/capa-rules/blob/master/communication/mailslot/read-from-mailslot.yml)|Interprocess Communication (C0003)|kernel32.GetMailslotInfo, kernel32.ReadFile, kernel32.ReadFileEx| +|[create pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-pipe.yml)|Interprocess Communication::Create Pipe (C0003.001)|kernel32.CreatePipe, kernel32.CreateNamedPipe, System.IO.Pipes.AnonymousPipeClientStream::ctor, System.IO.Pipes.NamedPipeClientStream::ctor, System.IO.Pipes.AnonymousPipeServerStream::ctor, System.IO.Pipes.AnonymousPipeServerStreamAcl::Create, System.IO.Pipes.NamedPipeServerStream::ctor, System.IO.Pipes.NamedPipeServerStreamAcl::Create| +|[create two anonymous pipes](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-two-anonymous-pipes.yml)|Interprocess Communication::Create Pipe (C0003.001)| | +|[write pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/write/write-pipe.yml)|Interprocess Communication::Write Pipe (C0003.004)|kernel32.WriteFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe| +|[connect pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/connect/connect-pipe.yml)|Interprocess Communication::Connect Pipe (C0003.002)|kernel32.ConnectNamedPipe, kernel32.CallNamedPipe, System.IO.Pipes.NamedPipeClientStream::Connect, System.IO.Pipes.NamedPipeClientStream::ConnectAsync| +|[read pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/read/read-pipe.yml)|Interprocess Communication::Read Pipe (C0003.003)|kernel32.PeekNamedPipe, kernel32.ReadFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/communication/smtp-communication.md b/micro-behaviors/communication/smtp-communication.md index 33a4c10..1f8cda1 100644 --- a/micro-behaviors/communication/smtp-communication.md +++ b/micro-behaviors/communication/smtp-communication.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +1 March 2023 diff --git a/micro-behaviors/communication/socket-communication.md b/micro-behaviors/communication/socket-communication.md index 4065791..bd03bd8 100644 --- a/micro-behaviors/communication/socket-communication.md +++ b/micro-behaviors/communication/socket-communication.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -64,6 +64,25 @@ Instead of being listed alphabetically, methods have been grouped to better faci |[**Rombertik**](../xample-malware/rombertik.md)|2015|C0001.011|Rombertik creates a TCP socket. [[2]](#2)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|C0001.009|Shamoon initializes a Winsock library. [[2]](#2)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[start TCP server](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/serve/start-tcp-server.yml)|Socket Communication::Start TCP Server (C0001.005)|listen, accept, WSAAccept, System.Net.Sockets.TcpListener::Start, System.Net.Sockets.TcpListener::AcceptTcpClient, System.Net.Sockets.TcpListener::BeginAcceptTcpClient, System.Net.Sockets.TcpListener::AcceptTcpClientAsync, System.Net.Sockets.TcpListener::AcceptSocket, System.Net.Sockets.TcpListener::BeginAcceptSocket, System.Net.Sockets.TcpListener::AcceptSocketAsync| +|[act as TCP client](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/client/act-as-tcp-client.yml)|Socket Communication::TCP Client (C0001.008)|System.Net.Sockets.TcpClient::ctor| +|[get socket status](https://github.com/mandiant/capa-rules/blob/master/communication/socket/get-socket-status.yml)|Socket Communication::Get Socket Status (C0001.012)|ws2_32.select| +|[create raw socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-raw-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, ws2_32.WSASocketA| +|[set socket configuration](https://github.com/mandiant/capa-rules/blob/master/communication/socket/set-socket-configuration.yml)|Socket Communication::Set Socket Config (C0001.001)|ws2_32.setsockopt, ws2_32.ioctlsocket| +|[create VMCI socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-vmci-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, DeviceIoControl, socket, ioctl| +|[initialize Winsock library](https://github.com/mandiant/capa-rules/blob/master/communication/socket/initialize-winsock-library.yml)|Socket Communication::Initialize Winsock Library (C0001.009)|ws2_32.WSAStartup| +|[connect TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/connect-tcp-socket.yml)|Socket Communication::Connect Socket (C0001.004)|connect, ws2_32.connect, ws2_32.WSAConnect, ConnectEx, WSAIoctl, setsockopt, bind| +|[create TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket.yml)|Socket Communication::Create TCP Socket (C0001.011)|ws2_32.socket, ws2_32.WSASocket, socket| +|[create TCP socket via raw AFD driver](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml)|Socket Communication::Create TCP Socket (C0001.011)|kernel32.CreateEvent, NtCreateFile, NtDeviceIoControlFile, kernel32.WaitForSingleObject| +|[obtain TransmitPackets callback function via WSAIoctl](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml)|Socket Communication::Send TCP Data (C0001.014)|WSAIoctl, WSAGetLastError| +|[send TCP data via WFP API](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/send-tcp-data-via-wfp-api.yml)|Socket Communication::Send TCP Data (C0001.014)|fwpkclnt.FwpsStreamInjectAsync0| +|[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor| +|[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send| +|[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom| ## References diff --git a/micro-behaviors/communication/wininet.md b/micro-behaviors/communication/wininet.md index da44aeb..2d4bd51 100644 --- a/micro-behaviors/communication/wininet.md +++ b/micro-behaviors/communication/wininet.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/micro-behaviors/cryptography/README.md b/micro-behaviors/cryptography/README.md index 37dec96..519f04d 100644 --- a/micro-behaviors/cryptography/README.md +++ b/micro-behaviors/cryptography/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +8 May 2023 diff --git a/micro-behaviors/cryptography/crypto-algorithm.md b/micro-behaviors/cryptography/crypto-algorithm.md index bce6a6c..c299aed 100644 --- a/micro-behaviors/cryptography/crypto-algorithm.md +++ b/micro-behaviors/cryptography/crypto-algorithm.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/micro-behaviors/cryptography/crypto-constant.md b/micro-behaviors/cryptography/crypto-constant.md index ac4b99c..b2aa291 100644 --- a/micro-behaviors/cryptography/crypto-constant.md +++ b/micro-behaviors/cryptography/crypto-constant.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/micro-behaviors/cryptography/crypto-lib.md b/micro-behaviors/cryptography/crypto-lib.md index 76fd6db..5b5e9de 100644 --- a/micro-behaviors/cryptography/crypto-lib.md +++ b/micro-behaviors/cryptography/crypto-lib.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -36,3 +36,13 @@ Malware uses a crypto library. |---|---|---| |**API Call**|C0059.001|Malware uses crypto API calls.| |**Static Public Library**|C0059.002|A public crypto library is embedded in the code.| + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[linked against Crypto++](https://github.com/mandiant/capa-rules/blob/master/linking/static/cryptopp/linked-against-crypto.yml)|Crypto Library (C0059)| | +|[linked against wolfCrypt](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfcrypt/linked-against-wolfcrypt.yml)|Crypto Library (C0059)| | +|[linked against OpenSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/openssl/linked-against-openssl.yml)|Crypto Library (C0059)| | +|[linked against PolarSSL/mbed TLS](https://github.com/mandiant/capa-rules/blob/master/linking/static/polarssl/linked-against-polarsslmbed-tls.yml)|Crypto Library (C0059)| | +|[linked against wolfSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfssl/linked-against-wolfssl.yml)|Crypto Library (C0059)| | diff --git a/micro-behaviors/cryptography/cryptographic-hash.md b/micro-behaviors/cryptography/cryptographic-hash.md index f08eca0..50ab28e 100644 --- a/micro-behaviors/cryptography/cryptographic-hash.md +++ b/micro-behaviors/cryptography/cryptographic-hash.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -53,6 +53,18 @@ Malware may use a cryptographic hash. |[**Redhip**](../xample-malware/rebhip.md)|2011|C0029.002|Redhip hashes data using SHA1. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|C0029.002|UP007 hashes data using SHA1. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[hash data via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/hash-data-via-wincrypt.yml)|Cryptographic Hash (C0029)|advapi32.CryptHashData, advapi32.CryptGetHashParam| +|[hash data using tiger](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/tiger/hash-data-using-tiger.yml)|Cryptographic Hash::Tiger (C0029.005)| | +|[hash data using SHA1](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha1/hash-data-using-sha1.yml)|Cryptographic Hash::SHA1 (C0029.002)|advapi32.CryptCreateHash, System.Security.Cryptography.SHA1Managed::ctor, System.Security.Cryptography.HashAlgorithm::ComputeHash| +|[hash data using SHA256](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha256/hash-data-using-sha256.yml)|Cryptographic Hash::SHA256 (C0029.003)|System.Security.Cryptography.SHA256Managed::Initialize, System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize, System.Security.Cryptography.SHA256::Create, System.Security.Cryptography.SHA256Managed::ctor, System.Security.Cryptography.HashAlgorithm::ComputeHash| +|[hash data with MD5](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/md5/hash-data-with-md5.yml)|Cryptographic Hash::MD5 (C0029.001)|advapi32.CryptCreateHash, System.Security.Cryptography.MD5::Create, System.Security.Cryptography.MD5CryptoServiceProvider::ctor, System.Security.Cryptography.HashAlgorithm::ComputeHash| +|[hash data using SHA224](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha224/hash-data-using-sha224.yml)|Cryptographic Hash::SHA224 (C0029.004)| | +|[resolve function by FIN8 fasthash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml)|Cryptographic Hash (C0029)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/cryptography/decrypt-data.md b/micro-behaviors/cryptography/decrypt-data.md index 03ec176..9f691df 100644 --- a/micro-behaviors/cryptography/decrypt-data.md +++ b/micro-behaviors/cryptography/decrypt-data.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -57,6 +57,13 @@ Malware may decrypt data. |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)| |[**Kovter**](../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Decrypt Data (C0031)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey| +|[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)| | + ## Code Snippets ### C0031 Snippet diff --git a/micro-behaviors/cryptography/encrypt-data.md b/micro-behaviors/cryptography/encrypt-data.md index 8265282..1c06f36 100644 --- a/micro-behaviors/cryptography/encrypt-data.md +++ b/micro-behaviors/cryptography/encrypt-data.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -70,6 +70,32 @@ Malware may encrypt data. |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip encrypts data using DPAPI. [[8]](#8)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|C0027.009|Rombertik encrypts data using RC4 PRGA. [[8]](#8)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Encrypt Data (C0027)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey| +|[encrypt data using memfrob from glibc](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml)|Encrypt Data (C0027)|memfrob| +|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Encrypt Data::HC-128 (C0027.006)| | +|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Encrypt Data::HC-128 (C0027.006)| | +|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Encrypt Data::RC6 (C0027.010)| | +|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Encrypt Data::Twofish (C0027.005)| | +|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Encrypt Data::AES (C0027.001)| | +|[encrypt data using AES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml)|Encrypt Data::AES (C0027.001)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| +|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Encrypt Data::AES (C0027.001)| | +|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Encrypt Data::AES (C0027.001)| | +|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Encrypt Data::Sosemanuk (C0027.008)| | +|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Encrypt Data::Camellia (C0027.003)| | +|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Encrypt Data (C0027)| | +|[encrypt data using DPAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml)|Encrypt Data (C0027)|CryptProtectMemory, CryptUnprotectMemory, crypt32.CryptProtectData, crypt32.CryptUnprotectData, System.Security.Cryptography.ProtectedData::Unprotect, System.Security.Cryptography.ProtectedData::Protect| +|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Encrypt Data::3DES (C0027.004)| | +|[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Encrypt Data::3DES (C0027.004)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| +|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Encrypt Data::RC4 (C0027.009)| | +|[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Encrypt Data::RC4 (C0027.009)|CryptImportKey, CryptAcquireContext, CryptEncrypt| +|[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Encrypt Data::RC4 (C0027.009)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| +|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encrypt Data::RC4 (C0027.009)| | +|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Encrypt Data::Skipjack (C0027.013)| | +|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Encrypt Data::Blowfish (C0027.002)| | ## Code Snippets diff --git a/micro-behaviors/cryptography/encryption-key.md b/micro-behaviors/cryptography/encryption-key.md index 63a3687..ca0c323 100644 --- a/micro-behaviors/cryptography/encryption-key.md +++ b/micro-behaviors/cryptography/encryption-key.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -48,6 +48,14 @@ Malware may import, generate, or otherwise use an encryption key. |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a new key via CryptAcquireContext. [[1]](#1)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|C0028.002|Rombertik encrypts data using RC4 KSA. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[import public key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/import-public-key.yml)|Encryption Key::Import Public Key (C0028.001)|advapi32.CryptAcquireContext, crypt32.CryptImportPublicKeyInfo, crypt32.CryptStringToBinary, crypt32.CryptDecodeObjectEx| +|[create new key via CryptAcquireContext](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/create-new-key-via-cryptacquirecontext.yml)|Encryption Key (C0028)|advapi32.CryptAcquireContext| +|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encryption Key::RC4 KSA (C0028.002)| | +|[reference public RSA key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rsa/reference-public-rsa-key.yml)|Encryption Key (C0028)| | ## References diff --git a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md index 88db49d..c86e0d1 100644 --- a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md +++ b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -46,6 +46,15 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0021.003|BlackEnergy generates random numbers via WinAPI. [[1]](#1)| |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Generate Pseudo-random Sequence::RC4 PRGA (C0021.004)| | +|[generate random numbers via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/generate-random-numbers-via-winapi.yml)|Generate Pseudo-random Sequence::Use API (C0021.003)|BCryptGenRandom, CryptGenRandom, BCryptOpenAlgorithmProvider, BCryptCloseAlgorithmProvider, CryptAquireContext| +|[generate random numbers via RtlGenRandom](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml)|Generate Pseudo-random Sequence::Use API (C0021.003)|SystemFunction036| +|[generate random numbers using a Mersenne Twister](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml)|Generate Pseudo-random Sequence (C0021)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/cryptography/hashed-message-authentication-code.md b/micro-behaviors/cryptography/hashed-message-authentication-code.md index 6a4387b..0d45a10 100644 --- a/micro-behaviors/cryptography/hashed-message-authentication-code.md +++ b/micro-behaviors/cryptography/hashed-message-authentication-code.md @@ -21,11 +21,17 @@ Last Modified -31 October 2022 +13 September 2023 # Hashed Message Authentication Code -Malware uses a hashed message authentication code (HMAC) schema. \ No newline at end of file +Malware uses a hashed message authentication code (HMAC) schema. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[authenticate HMAC](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hmac/authenticate-hmac.yml)|Hashed Message Authentication Code (C0061)| | diff --git a/micro-behaviors/data/README.md b/micro-behaviors/data/README.md index 4b43c70..7b816b9 100644 --- a/micro-behaviors/data/README.md +++ b/micro-behaviors/data/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/micro-behaviors/data/check-string.md b/micro-behaviors/data/check-string.md index dfef29e..cf69d7f 100644 --- a/micro-behaviors/data/check-string.md +++ b/micro-behaviors/data/check-string.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -37,6 +37,12 @@ Malware may check a string for some characteristics, such as being ASCII content |---|---|---|---| |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart references Base64 strings. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Check String (C0019)| | +|[parse credit card information](https://github.com/mandiant/capa-rules/blob/master/collection/credit-card/parse-credit-card-information.yml)|Check String (C0019)| | ## References diff --git a/micro-behaviors/data/checksum.md b/micro-behaviors/data/checksum.md index 549bcc2..882f864 100644 --- a/micro-behaviors/data/checksum.md +++ b/micro-behaviors/data/checksum.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -50,6 +50,15 @@ Malware may derive a checksum from some block of data. The checksum is often use |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0032.001|Locky Bart hashes data with CRC32. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|C0032.001|UP007 hashes data with CRC32. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[validate payment card number using luhn algorithm](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/luhn/validate-payment-card-number-using-luhn-algorithm.yml)|Checksum::Luhn (C0032.002)| | +|[compute adler32 checksum](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/adler32/compute-adler32-checksum.yml)|Checksum::Adler (C0032.005)| | +|[hash data with CRC32](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/crc32/hash-data-with-crc32.yml)|Checksum::CRC32 (C0032.001)|RtlComputeCrc32| +|[validate payment card number using luhn algorithm with lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml)|Checksum::Luhn (C0032.002)| | +|[validate payment card number using luhn algorithm with no lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml)|Checksum::Luhn (C0032.002)| | ## References diff --git a/micro-behaviors/data/compress-data.md b/micro-behaviors/data/compress-data.md index dd0a5f8..cfd6240 100644 --- a/micro-behaviors/data/compress-data.md +++ b/micro-behaviors/data/compress-data.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -35,4 +35,12 @@ Malware may compress data. |Name|ID|Description| |---|---|---| |**IEncodingFilterFactory**|C0024.002|Malware compresses data using IEncodingFilterFactory.| -|**QuickLZ**|C0024.001|Malware compresses data using QuickLZ.| \ No newline at end of file +|**QuickLZ**|C0024.001|Malware compresses data using QuickLZ.| + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[compress data via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-via-winapi.yml)|Compress Data (C0024)|RtlDecompressBuffer, RtlDecompressBufferEx, RtlDecompressBufferEx2, RtlCompressBuffer, RtlCompressBufferLZNT1| +|[compress data via ZLIB inflate or deflate](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml)|Compress Data (C0024)| | +|[compress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-using-lzo.yml)|Compress Data (C0024)| | diff --git a/micro-behaviors/data/compression-library.md b/micro-behaviors/data/compression-library.md index f8b4e2d..bb41dc6 100644 --- a/micro-behaviors/data/compression-library.md +++ b/micro-behaviors/data/compression-library.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -36,6 +36,13 @@ |[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|DarkComet linked against ZLIB. [[1]](#1)| |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[linked against aPLib](https://github.com/mandiant/capa-rules/blob/master/linking/static/aplib/linked-against-aplib.yml)|Compression Library (C0060)| | +|[linked against ZLIB](https://github.com/mandiant/capa-rules/blob/master/linking/static/zlib/linked-against-zlib.yml)|Compression Library (C0060)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/data/decode-data.md b/micro-behaviors/data/decode-data.md index ffe4573..4d25a5b 100644 --- a/micro-behaviors/data/decode-data.md +++ b/micro-behaviors/data/decode-data.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +1 March 2023 diff --git a/micro-behaviors/data/decompress-data.md b/micro-behaviors/data/decompress-data.md index b04cfcb..483e2fc 100644 --- a/micro-behaviors/data/decompress-data.md +++ b/micro-behaviors/data/decompress-data.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -44,6 +44,16 @@ Malware may decompress data. |---|---|---|---| |[**Bagle**](../xample-malware/bagle.md)|2004|C0025.003|Bagle decompresses data using aPLib. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[decompress data using aPLib](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-aplib.yml)|Decompress Data::aPLib (C0025.003)| | +|[decompress data via IEncodingFilterFactory](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml)|Decompress Data::IEncodingFilterFactory (C0025.002)|ole32.CoCreateInstance| +|[decompress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-lzo.yml)|Decompress Data (C0025)| | +|[decompress data using QuickLZ](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-quicklz.yml)|Decompress Data::QuickLZ (C0025.001)| | +|[decompress data using UCL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-ucl.yml)|Decompress Data (C0025)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/data/encode-data.md b/micro-behaviors/data/encode-data.md index d0de1b0..1f1f494 100644 --- a/micro-behaviors/data/encode-data.md +++ b/micro-behaviors/data/encode-data.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -37,7 +37,6 @@ Malware may encode data. |**Base64**|C0026.001|Malware may encode data using Base64.| |**XOR**|C0026.002|Malware may use XOR to encode data.| - ## Use in Malware |Name|Date|Method|Description| @@ -57,6 +56,15 @@ Malware may encode data. |[**TrickBot**](../xample-malware/trickbot.md)|2016|C0026.002|TrickBot encodes data using XOR. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|C0026.002|The malware encodes data using XOR. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Encode Data::XOR (C0026.002)| | +|[encode data using Base64](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/encode-data-using-base64.yml)|Encode Data::Base64 (C0026.001)|System.Convert::ToBase64String, System.Convert::ToBase64CharArray, System.Convert::TryToBase64Chars| +|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Encode Data::Base64 (C0026.001)| | +|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Encode Data::Base64 (C0026.001)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/data/modulo.md b/micro-behaviors/data/modulo.md index a76dc80..b9a38d7 100644 --- a/micro-behaviors/data/modulo.md +++ b/micro-behaviors/data/modulo.md @@ -21,11 +21,17 @@ Last Modified -31 October 2022 +13 September 2023 # Modulo -Malware calculates a modulo value. \ No newline at end of file +Malware calculates a modulo value. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[calculate modulo 256 via x86 assembly](https://github.com/mandiant/capa-rules/blob/master/lib/calculate-modulo-256-via-x86-assembly.yml)|Modulo (C0058)| | diff --git a/micro-behaviors/data/noncryptographic-hash.md b/micro-behaviors/data/noncryptographic-hash.md index e37226f..f7c5d47 100644 --- a/micro-behaviors/data/noncryptographic-hash.md +++ b/micro-behaviors/data/noncryptographic-hash.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -39,4 +39,12 @@ Malware may use a non-cryptographic hash. |**FNV**|C0030.005|Malware uses the FNV hash function.| |**MurmurHash**|C0030.001|Malware uses the MurmurHash hash function.| |**pHash**|C0030.002|Malware uses the pHash hash function.| -|**djb2**|C0030.006|Malware uses the djb2 hash function.| \ No newline at end of file +|**djb2**|C0030.006|Malware uses the djb2 hash function.| + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[hash data using murmur3](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml)|Non-Cryptographic Hash::MurmurHash (C0030.001)| | +|[hash data using fnv](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/fnv/hash-data-using-fnv.yml)|Non-Cryptographic Hash::FNV (C0030.005)|_allmul| +|[hash data using djb2](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/djb2/hash-data-using-djb2.yml)|Non-Cryptographic Hash::djb2 (C0030.006)| | diff --git a/micro-behaviors/data/use-constant.md b/micro-behaviors/data/use-constant.md index 5c5276c..a5d9804 100644 --- a/micro-behaviors/data/use-constant.md +++ b/micro-behaviors/data/use-constant.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +1 March 2023 diff --git a/micro-behaviors/file-system/README.md b/micro-behaviors/file-system/README.md index c17713f..be1082b 100644 --- a/micro-behaviors/file-system/README.md +++ b/micro-behaviors/file-system/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +1 February 2023 diff --git a/micro-behaviors/file-system/alter-file-extension.md b/micro-behaviors/file-system/alter-file-extension.md index 4b071d1..0e0c4fa 100644 --- a/micro-behaviors/file-system/alter-file-extension.md +++ b/micro-behaviors/file-system/alter-file-extension.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/micro-behaviors/file-system/copy-file.md b/micro-behaviors/file-system/copy-file.md index 0c7b97d..77495b7 100644 --- a/micro-behaviors/file-system/copy-file.md +++ b/micro-behaviors/file-system/copy-file.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -40,6 +40,12 @@ |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip copies files. [[1]](#1)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[copy file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/copy/copy-file.yml)|Copy File (C0045)|kernel32.CopyFile, kernel32.CopyFileEx, CopyFile2, CopyFileTransacted, LZCopy, System.IO.FileInfo::CopyTo, System.IO.File::Copy, kernel32.SHFileOperation| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/create-directory.md b/micro-behaviors/file-system/create-directory.md index 85aeb08..487cffa 100644 --- a/micro-behaviors/file-system/create-directory.md +++ b/micro-behaviors/file-system/create-directory.md @@ -21,14 +21,13 @@ Last Modified -31 October 2022 +13 September 2023 # Create Directory - ## Use in Malware |Name|Date|Method|Description| @@ -41,6 +40,12 @@ |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates directories. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|--|UP007 creates directories. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[create directory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/create/create-directory.yml)|Create Directory (C0046)|kernel32.CreateDirectory, kernel32.CreateDirectoryEx, kernel32.CreateDirectoryTransacted, NtCreateDirectoryObject, ZwCreateDirectoryObject, SHCreateDirectory, SHCreateDirectoryEx, _mkdir, _wmkdir, System.IO.Directory::CreateDirectory, System.IO.DirectoryInfo::Create, System.IO.DirectoryInfo::CreateSubdirectory| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/create-file.md b/micro-behaviors/file-system/create-file.md index f94b029..90101fa 100644 --- a/micro-behaviors/file-system/create-file.md +++ b/micro-behaviors/file-system/create-file.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -36,3 +36,9 @@ Malware creates a file. |---|---|---| |**Create Office Document**|C0016.001|An Office document is created.| |**Create Ransomware File**|C0016.002|Create a file used by ransomware.| + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[create or open file](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-file.yml)|Create File (C0016)|CreateFile, CreateFileEx, IoCreateFile, IoCreateFileEx, ZwOpenFile, ZwCreateFile, NtOpenFile, NtCreateFile, LZCreateFile, LZOpenFile, fopen, fopen64, fdopen, freopen, open, openat| diff --git a/micro-behaviors/file-system/delete-directory.md b/micro-behaviors/file-system/delete-directory.md index b7581f3..49ae3e4 100644 --- a/micro-behaviors/file-system/delete-directory.md +++ b/micro-behaviors/file-system/delete-directory.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -37,6 +37,12 @@ |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)| |[**Kovter**](../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[delete directory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/delete/delete-directory.yml)|Delete Directory (C0048)|RemoveDirectory, RemoveDirectoryTransacted, _rmdir, _wrmdir, System.IO.DirectoryInfo::Delete, System.IO.Directory::Delete| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/delete-file.md b/micro-behaviors/file-system/delete-file.md index 98ed28a..c11cb07 100644 --- a/micro-behaviors/file-system/delete-file.md +++ b/micro-behaviors/file-system/delete-file.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -47,6 +47,12 @@ |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[delete file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/delete/delete-file.yml)|Delete File (C0047)|kernel32.DeleteFile, DeleteFileTransacted, NtDeleteFile, ZwDeleteFile, remove, _wremove, System.IO.File::Delete, System.IO.FileSystemInfo::Delete, kernel32.SHFileOperation, MoveFileEx| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/get-file-attributes.md b/micro-behaviors/file-system/get-file-attributes.md index c1f5e7a..01facc7 100644 --- a/micro-behaviors/file-system/get-file-attributes.md +++ b/micro-behaviors/file-system/get-file-attributes.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -40,6 +40,12 @@ |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets file attributes. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|--|UP007 gets file attributes. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[get file attributes](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/get-file-attributes.yml)|Get File Attributes (C0049)|kernel32.GetFileAttributes, ZwQueryDirectoryFile, ZwQueryInformationFile, NtQueryDirectoryFile, NtQueryInformationFile, System.IO.File::GetAttributes, System.IO.File::GetCreationTime, System.IO.File::GetCreationTimeUtc, System.IO.File::GetLastAccessTime, System.IO.File::GetLastAccessTimeUtc, System.IO.File::GetLastWriteTime, System.IO.File::GetLastWriteTimeUtc| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/move-file.md b/micro-behaviors/file-system/move-file.md index 09a361e..391ca17 100644 --- a/micro-behaviors/file-system/move-file.md +++ b/micro-behaviors/file-system/move-file.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -40,6 +40,12 @@ |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon moves files. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|--|UP007 moves files. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[move file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/move/move-file.yml)|Move File (C0063)|kernel32.MoveFile, kernel32.MoveFileEx, MoveFileWithProgress, MoveFileTransacted, rename, _wrename, System.IO.FileInfo::MoveTo, System.IO.File::Move, kernel32.SHFileOperation| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/read-file.md b/micro-behaviors/file-system/read-file.md index 630273e..2aad77f 100644 --- a/micro-behaviors/file-system/read-file.md +++ b/micro-behaviors/file-system/read-file.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -48,6 +48,15 @@ |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon reads files on Windows. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|--|UP007 reads files on Windows. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[read file on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-file-on-windows.yml)|Read File (C0051)|kernel32.ReadFile, ReadFileEx, NtReadFile, ZwReadFile, LZRead, _read, fread, System.IO.File::ReadAllBytes, System.IO.File::ReadAllBytesAsync, System.IO.File::ReadAllLines, System.IO.File::ReadAllLinesAsync, System.IO.File::ReadAllText, System.IO.File::ReadAllTextAsync, System.IO.File::ReadLines| +|[read file via mapping](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-file-via-mapping.yml)|Read File (C0051)|kernel32.MapViewOfFile, kernel32.UnmapViewOfFile, kernel32.CreateFileMapping| +|[read file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-file-on-linux.yml)|Read File (C0051)|fgetc, fgets, getc, getchar, read, getline, getdelim, fgetwc, getwc, fscanf, vfscanf, fread| +|[read .ini file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-ini-file.yml)|Read File (C0051)|GetPrivateProfileInt, GetPrivateProfileString, GetPrivateProfileStruct, GetPrivateProfileSection, GetPrivateProfileSectionNames, GetFullPathName| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/read-virtual-disk.md b/micro-behaviors/file-system/read-virtual-disk.md index d957de2..27b71bb 100644 --- a/micro-behaviors/file-system/read-virtual-disk.md +++ b/micro-behaviors/file-system/read-virtual-disk.md @@ -21,11 +21,17 @@ Last Modified -31 October 2022 +13 September 2023 # Read Virtual Disk -Malware reads a virtual disk. \ No newline at end of file +Malware reads a virtual disk. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[read virtual disk](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-virtual-disk.yml)|Read Virtual Disk (C0056)|OpenVirtualDisk, AttachVirtualDisk, GetVirtualDiskPhysicalPath| diff --git a/micro-behaviors/file-system/set-file-attributes.md b/micro-behaviors/file-system/set-file-attributes.md index 73cb327..fb922f1 100644 --- a/micro-behaviors/file-system/set-file-attributes.md +++ b/micro-behaviors/file-system/set-file-attributes.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -40,6 +40,13 @@ |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip sets file attributes. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|--|UP007 sets file attributes. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[change file permission on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/change-file-permission-on-linux.yml)|Set File Attributes (C0050)|chown, fchown, lchown, fchownat| +|[set file attributes](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/set-file-attributes.yml)|Set File Attributes (C0050)|kernel32.SetFileAttributes, ZwSetInformationFile, NtSetInformationFile, System.IO.File::SetAttributes, System.IO.File::SetCreationTime, System.IO.File::SetCreationTimeUtc, System.IO.File::SetLastAccessTime, System.IO.File::SetLastAccessTimeUtc, System.IO.File::SetLastWriteTime, System.IO.File::SetLastWriteTimeUtc| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/writes-file.md b/micro-behaviors/file-system/writes-file.md index 8098f11..b11ba12 100644 --- a/micro-behaviors/file-system/writes-file.md +++ b/micro-behaviors/file-system/writes-file.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -46,6 +46,14 @@ |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon writes files on Windows. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|--|UP007 writes files on Windows. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[write file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-linux.yml)|Writes File (C0052)|fputc, fputs, putc, write, fputwc, putwc, fputws, write, fwrite, putwchar| +|[write file on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-windows.yml)|Writes File (C0052)|kernel32.WriteFile, kernel32.WriteFileEx, NtWriteFile, ZwWriteFile, _fwrite, fwrite, System.IO.File::WriteAllBytes, System.IO.File::WriteAllBytesAsync, System.IO.File::WriteAllLines, System.IO.File::WriteAllLinesAsync, System.IO.File::WriteAllText, System.IO.File::WriteAllTextAsync, System.IO.File::AppendAllLines, System.IO.File::AppendAllLinesAsync, System.IO.File::AppendAllText, System.IO.File::AppendAllTextAsync, System.IO.File::AppendText, System.IO.FileInfo::AppendText| +|[create process memory minidump](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/dump/create-process-memory-minidump.yml)|Writes File (C0052)|dbghelp.MiniDumpWriteDump| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/hardware/README.md b/micro-behaviors/hardware/README.md index 671dd56..31000c1 100644 --- a/micro-behaviors/hardware/README.md +++ b/micro-behaviors/hardware/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/micro-behaviors/hardware/install-driver.md b/micro-behaviors/hardware/install-driver.md index 221bb0d..cbdc21c 100644 --- a/micro-behaviors/hardware/install-driver.md +++ b/micro-behaviors/hardware/install-driver.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -34,4 +34,11 @@ Malware installs a driver or minifilter. |Name|ID|Description| |---|---|---| -|**Minifilter**|C0037.001|Malware registers a minifilter.| \ No newline at end of file +|**Minifilter**|C0037.001|Malware registers a minifilter.| + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[install driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/install-driver.yml)|Install Driver (C0037)|ntdll.NtLoadDriver, ZwLoadDriver| +|[register minifilter driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/filter/register-minifilter-driver.yml)|Install Driver::Minifilter (C0037.001)|FltRegisterFilter| diff --git a/micro-behaviors/hardware/load-driver.md b/micro-behaviors/hardware/load-driver.md index 7633010..81e8186 100644 --- a/micro-behaviors/hardware/load-driver.md +++ b/micro-behaviors/hardware/load-driver.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -34,4 +34,10 @@ Malware loads a device driver or minifilter. |Name|ID|Description| |---|---|---| -|**Minifilter**|C0023.001|Malware starts a minifilter.| \ No newline at end of file +|**Minifilter**|C0023.001|Malware starts a minifilter.| + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[start minifilter driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/filter/start-minifilter-driver.yml)|Load Driver::Minifilter (C0023.001)|FltStartFiltering| diff --git a/micro-behaviors/hardware/simulate-hardware.md b/micro-behaviors/hardware/simulate-hardware.md index 75faa18..c132e0b 100644 --- a/micro-behaviors/hardware/simulate-hardware.md +++ b/micro-behaviors/hardware/simulate-hardware.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -35,4 +35,10 @@ Malware simulates hardware. |Name|ID|Description| |---|---|---| |**Ctrl-Alt-Del**|C0057.001|Malware simulates Ctrl-Alt-Del.| -|**Mouse Click**|C0057.002|Malware simulates mouse click.| \ No newline at end of file +|**Mouse Click**|C0057.002|Malware simulates mouse click.| + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[simulate CTRL ALT DEL](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml)|Simulate Hardware::Ctrl-Alt-Del (C0057.001)|OpenDesktop, OpenInputDesktop, PostMessage| diff --git a/micro-behaviors/memory/README.md b/micro-behaviors/memory/README.md index 885e58b..a96b780 100644 --- a/micro-behaviors/memory/README.md +++ b/micro-behaviors/memory/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/micro-behaviors/memory/allocate-memory.md b/micro-behaviors/memory/allocate-memory.md index 20d733f..0145863 100644 --- a/micro-behaviors/memory/allocate-memory.md +++ b/micro-behaviors/memory/allocate-memory.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -44,6 +44,15 @@ Malware allocates memory, often to unpack itself. |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet allocates RWX memory. [[1]](#1)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot allocates RWX memory. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)| | +|[allocate memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-memory.yml)|Allocate Memory (C0007)|kernel32.VirtualAlloc, kernel32.VirtualAllocEx, kernel32.VirtualAllocExNuma, kernel32.VirtualProtect, kernel32.VirtualProtectEx, NtAllocateVirtualMemory, ZwAllocateVirtualMemory, NtMapViewOfSection, ZwMapViewOfSection, NtProtectVirtualMemory, ZwProtectVirtualMemory| +|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)| | +|[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/memory/change-memory-protection.md b/micro-behaviors/memory/change-memory-protection.md index 5770c36..d5bd058 100644 --- a/micro-behaviors/memory/change-memory-protection.md +++ b/micro-behaviors/memory/change-memory-protection.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +1 March 2023 diff --git a/micro-behaviors/memory/free-memory.md b/micro-behaviors/memory/free-memory.md index ab91dbf..b648a28 100644 --- a/micro-behaviors/memory/free-memory.md +++ b/micro-behaviors/memory/free-memory.md @@ -21,11 +21,17 @@ Last Modified -31 October 2022 +13 September 2023 # Free Memory -Malware may free memory. \ No newline at end of file +Malware may free memory. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[free user process memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/free-user-process-memory.yml)|Free Memory (C0044)|ZwFreeVirtualMemory| diff --git a/micro-behaviors/memory/heap-spray.md b/micro-behaviors/memory/heap-spray.md index 0287bb6..cbd8ce2 100644 --- a/micro-behaviors/memory/heap-spray.md +++ b/micro-behaviors/memory/heap-spray.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/micro-behaviors/memory/overflow-buffer.md b/micro-behaviors/memory/overflow-buffer.md index 9624f09..df1a4a8 100644 --- a/micro-behaviors/memory/overflow-buffer.md +++ b/micro-behaviors/memory/overflow-buffer.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +1 March 2023 diff --git a/micro-behaviors/memory/stack-pivot.md b/micro-behaviors/memory/stack-pivot.md index 7058bba..53a9081 100644 --- a/micro-behaviors/memory/stack-pivot.md +++ b/micro-behaviors/memory/stack-pivot.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/micro-behaviors/operating-system/README.md b/micro-behaviors/operating-system/README.md index a13ddff..a3b3bd6 100644 --- a/micro-behaviors/operating-system/README.md +++ b/micro-behaviors/operating-system/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/micro-behaviors/operating-system/console.md b/micro-behaviors/operating-system/console.md index b513389..af733d1 100644 --- a/micro-behaviors/operating-system/console.md +++ b/micro-behaviors/operating-system/console.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -29,3 +29,10 @@ # Console Malware modifies the console. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[set console window title](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/console/set-console-window-title.yml)|Console (C0033)|kernel32.SetConsoleTitle| +|[manipulate console buffer](https://github.com/mandiant/capa-rules/blob/master/host-interaction/console/manipulate-console-buffer.yml)|Console (C0033)|kernel32.SetConsoleCursorPosition, kernel32.ReadConsoleOutputCharacter, kernel32.WriteConsoleOutputCharacter, kernel32.WriteConsoleOutput, kernel32.WriteConsoleInput, kernel32.GetStdHandle, System.Console::Write, System.Console::WriteLine| diff --git a/micro-behaviors/operating-system/environment-variable.md b/micro-behaviors/operating-system/environment-variable.md index 71894be..042e15e 100644 --- a/micro-behaviors/operating-system/environment-variable.md +++ b/micro-behaviors/operating-system/environment-variable.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -43,6 +43,13 @@ Malware modifies environment variables. |[**Kovter**](../xample-malware/kovter.md)|2016|C0034.001|Kovter sets environment variables. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|C0034.001|UP007 sets environment variables. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[set environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/set-environment-variable.yml)|Environment Variable::Set Variable (C0034.001)|kernel32.SetEnvironmentStrings, kernel32.SetEnvironmentVariable, System.Environment::SetEnvironmentVariable| +|[get COMSPEC environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/get-comspec-environment-variable.yml)|Environment Variable (C0034)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/operating-system/registry.md b/micro-behaviors/operating-system/registry.md index 360dbfe..bc2703f 100644 --- a/micro-behaviors/operating-system/registry.md +++ b/micro-behaviors/operating-system/registry.md @@ -21,7 +21,7 @@ Last Modified -24 May 2023 +13 September 2023 @@ -81,6 +81,22 @@ Malware modifies the registry. |[**UP007**](../xample-malware/up007.md)|2016|C0036.001|UP007 sets registry values. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|C0036.006|UP007 queries or enumerates registry values. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[set registry key via offline registry library](https://github.com/mandiant/capa-rules/blob/master/host-interaction/registry/set-registry-key-via-offline-registry-library.yml)|Registry::Set Registry Key (C0036.001)|ORSetValue, ORSaveHive| +|[open registry key via offline registry library](https://github.com/mandiant/capa-rules/blob/master/host-interaction/registry/open-registry-key-via-offline-registry-library.yml)|Registry::Open Registry Key (C0036.003)|OROpenHive, OROpenKey| +|[query or enumerate registry key](https://github.com/mandiant/capa-rules/blob/master/host-interaction/registry/query-or-enumerate-registry-key.yml)|Registry::Query Registry Key (C0036.005)|advapi32.RegEnumKey, advapi32.RegEnumKeyEx, advapi32.RegQueryInfoKeyA, ZwQueryKey, ZwEnumerateKey, NtQueryKey, NtEnumerateKey, RtlCheckRegistryKey, SHEnumKeyEx, SHQueryInfoKey, SHRegEnumUSKey, SHRegQueryInfoUSKey, Microsoft.Win32.RegistryKey::GetSubKeyNames, Microsoft.Win32.RegistryKey::OpenBaseKey, Microsoft.Win32.RegistryKey::OpenRemoteBaseKey, Microsoft.Win32.RegistryKey::OpenSubKey| +|[query or enumerate registry value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/registry/query-or-enumerate-registry-value.yml)|Registry::Query Registry Value (C0036.006)|advapi32.RegGetValue, advapi32.RegEnumValue, advapi32.RegQueryValue, advapi32.RegQueryValueEx, advapi32.RegQueryMultipleValues, ZwQueryValueKey, ZwEnumerateValueKey, NtQueryValueKey, NtEnumerateValueKey, RtlQueryRegistryValues, SHGetValue, SHEnumValue, SHRegGetInt, SHRegGetPath, SHRegGetValue, SHQueryValueEx, SHRegGetUSValue, SHOpenRegStream, SHRegEnumUSValue, SHOpenRegStream2, SHRegQueryUSValue, SHRegGetBoolUSValue, SHRegGetValueFromHKCUHKLM, SHRegGetBoolValueFromHKCUHKLM, Microsoft.Win32.RegistryKey::GetValue, Microsoft.Win32.RegistryKey::GetValueKind, Microsoft.Win32.RegistryKey::GetValueNames, Microsoft.Win32.Registry::GetValue| +|[query registry key via offline registry library](https://github.com/mandiant/capa-rules/blob/master/host-interaction/registry/query-registry-key-via-offline-registry-library.yml)|Registry::Query Registry Value (C0036.006)|ORGetValue| +|[create registry key via offline registry library](https://github.com/mandiant/capa-rules/blob/master/host-interaction/registry/create-registry-key-via-offline-registry-library.yml)|Registry::Create Registry Key (C0036.004)|ORCreateHive, ORCreateKey| +|[set registry value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/registry/create/set-registry-value.yml)|Registry::Set Registry Key (C0036.001)|advapi32.RegSetValue, advapi32.RegSetValueEx, advapi32.RegSetKeyValue, ZwSetValueKey, NtSetValueKey, RtlWriteRegistryValue, SHSetValue, SHRegSetPath, SHRegSetValue, SHRegSetUSValue, SHRegWriteUSValue, Microsoft.Win32.RegistryKey::SetValue, Microsoft.Win32.Registry::SetValue| +|[delete registry key](https://github.com/mandiant/capa-rules/blob/master/host-interaction/registry/delete/delete-registry-key.yml)|Registry::Delete Registry Key (C0036.002)|advapi32.RegDeleteKey, advapi32.RegDeleteTree, advapi32.RegDeleteKeyEx, advapi32.RegDeleteKeyTransacted, ZwDeleteKey, NtDeleteKey, SHDeleteKey, SHDeleteEmptyKey, SHRegDeleteEmptyUSKey, Microsoft.Win32.RegistryKey::DeleteSubKey, Microsoft.Win32.RegistryKey::DeleteSubKeyTree| +|[delete registry value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/registry/delete/delete-registry-value.yml)|Registry::Delete Registry Value (C0036.007)|advapi32.RegDeleteValue, advapi32.RegDeleteKeyValue, ZwDeleteValueKey, NtDeleteValueKey, RtlDeleteRegistryValue, SHDeleteValue, SHRegDeleteUSValue, Microsoft.Win32.RegistryKey::DeleteValue| +|[create or open registry key](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-registry-key.yml)|Registry::Create Registry Key (C0036.004)|advapi32.RegOpenKey, advapi32.RegOpenKeyEx, advapi32.RegCreateKey, advapi32.RegCreateKeyEx, advapi32.RegOpenCurrentUser, advapi32.RegOpenKeyTransacted, advapi32.RegOpenUserClassesRoot, advapi32.RegCreateKeyTransacted, ZwOpenKey, ZwOpenKeyEx, ZwCreateKey, ZwOpenKeyTransacted, ZwOpenKeyTransactedEx, ZwCreateKeyTransacted, NtOpenKey, NtCreateKey, SHRegOpenUSKey, SHRegCreateUSKey, RtlCreateRegistryKey, Microsoft.Win32.RegistryKey::OpenSubKey, Microsoft.Win32.RegistryKey::OpenBaseKey, Microsoft.Win32.RegistryKey::OpenRemoteBaseKey, Microsoft.Win32.RegistryKey::CreateSubKey| +|[create or open registry key](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-registry-key.yml)|Registry::Open Registry Key (C0036.003)|advapi32.RegOpenKey, advapi32.RegOpenKeyEx, advapi32.RegCreateKey, advapi32.RegCreateKeyEx, advapi32.RegOpenCurrentUser, advapi32.RegOpenKeyTransacted, advapi32.RegOpenUserClassesRoot, advapi32.RegCreateKeyTransacted, ZwOpenKey, ZwOpenKeyEx, ZwCreateKey, ZwOpenKeyTransacted, ZwOpenKeyTransactedEx, ZwCreateKeyTransacted, NtOpenKey, NtCreateKey, SHRegOpenUSKey, SHRegCreateUSKey, RtlCreateRegistryKey, Microsoft.Win32.RegistryKey::OpenSubKey, Microsoft.Win32.RegistryKey::OpenBaseKey, Microsoft.Win32.RegistryKey::OpenRemoteBaseKey, Microsoft.Win32.RegistryKey::CreateSubKey| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/operating-system/wallpaper.md b/micro-behaviors/operating-system/wallpaper.md index 2d85c2c..89ccef3 100644 --- a/micro-behaviors/operating-system/wallpaper.md +++ b/micro-behaviors/operating-system/wallpaper.md @@ -21,11 +21,17 @@ Last Modified -31 October 2022 +13 September 2023 # Wallpaper -Malware modifies the wallpaper. \ No newline at end of file +Malware modifies the wallpaper. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[change the wallpaper](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/session/wallpaper/change-the-wallpaper.yml)|Wallpaper (C0035)|SystemParametersInfo| diff --git a/micro-behaviors/process/README.md b/micro-behaviors/process/README.md index 352326c..3b0abba 100644 --- a/micro-behaviors/process/README.md +++ b/micro-behaviors/process/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 @@ -26,8 +26,11 @@ Micro-behaviors related to processes. * **Open Process** [C0065](../process/open-process.md) * **Open Thread** [C0066](../process/open-thread.md) * **Resume Thread** [C0054](../process/resume-thread.md) +* **Set Thread Context** [C0072](../process/set-thread-context.md) * **Set Thread Local Storage Value** [C0041](../process/set-thread-local-storage-value.md) * **Suspend Thread** [C0055](../process/suspend-thread.md) * **Synchronization** [C0022](../process/synchronization.md) * **Terminate Process** [C0018](../process/terminate-process.md) -* **Terminate Thread** [C0039](../process/terminate-thread.md) \ No newline at end of file +* **Terminate Thread** [C0039](../process/terminate-thread.md) +* **Unmap Section View** [C0070](../process/unmap-section-view.md) +* **Write Process Memory** [C0071](../process/write-process-memory.md) \ No newline at end of file diff --git a/micro-behaviors/process/allocate-thread-local-storage.md b/micro-behaviors/process/allocate-thread-local-storage.md index 033dc40..f9fd69f 100644 --- a/micro-behaviors/process/allocate-thread-local-storage.md +++ b/micro-behaviors/process/allocate-thread-local-storage.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -38,6 +38,12 @@ Malware allocates thread local storage. |[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter allocates thread local storage. [[1]](#1)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon allocates thread local storage. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/process/check-mutex.md b/micro-behaviors/process/check-mutex.md index 286783b..5a9e197 100644 --- a/micro-behaviors/process/check-mutex.md +++ b/micro-behaviors/process/check-mutex.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -37,6 +37,13 @@ Malware checks a mutex. |[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists. [[1]](#1)| |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware checks if multiple instances of the same mutex is running. If multiple instances are running, the malware exits. [[2]](#2) [[3]](#3)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[check mutex](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/check-mutex.yml)|Check Mutex (C0043)|kernel32.OpenMutex, System.Threading.Mutex::OpenExisting, System.Threading.Mutex::TryOpenExisting, kernel32.GetLastError| +|[check mutex and exit](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/check-mutex-and-exit.yml)|Check Mutex (C0043)|ExitProcess, exit, _Exit, _exit, WaitForSingleObject, GetLastError| + ## References [1] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant diff --git a/micro-behaviors/process/create-mutex.md b/micro-behaviors/process/create-mutex.md index b78d534..74356ce 100644 --- a/micro-behaviors/process/create-mutex.md +++ b/micro-behaviors/process/create-mutex.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -41,6 +41,12 @@ Malware creates a mutex. |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates a mutex. [[3]](#3)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik creates a mutex. [[3]](#3)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[create mutex](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/create-mutex.yml)|Create Mutex (C0042)|kernel32.CreateMutex, kernel32.CreateMutexEx, System.Threading.Mutex::ctor| +|[lock file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/lock-file.yml)|Create Mutex (C0042)|fcntl| ## References diff --git a/micro-behaviors/process/create-process.md b/micro-behaviors/process/create-process.md index a6f19eb..ea632a9 100644 --- a/micro-behaviors/process/create-process.md +++ b/micro-behaviors/process/create-process.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +13 September 2023 @@ -58,6 +58,15 @@ Malware creates a process. |[**TrickBot**](../xample-malware/trickbot.md)|2016|C0017.003|TrickBot creates a suspended process. [[2]](#2)| |[**UP007**](../xample-malware/up007.md)|2016|--|The malware creates a process on Windows. [[2]](#2)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[create process on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-windows.yml)|Create Process (C0017)|kernel32.WinExec, kernel32.CreateProcess, shell32.ShellExecute, shell32.ShellExecuteEx, advapi32.CreateProcessAsUser, advapi32.CreateProcessWithLogon, advapi32.CreateProcessWithToken, kernel32.CreateProcessInternal, ntdll.NtCreateUserProcess, ntdll.NtCreateProcess, ntdll.NtCreateProcessEx, ntdll.ZwCreateProcess, ZwCreateProcessEx, ntdll.ZwCreateUserProcess, ntdll.RtlCreateUserProcess, System.Diagnostics.Process::Start| +|[create process on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-linux.yml)|Create Process (C0017)|execve, execl, execlp, execle, execv, execvp, execvpe, posix_spawn, posix_spawnp, popen| +|[execute command](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/execute-command.yml)|Create Process (C0017)|system, _system, wsystem, _wsystem| +|[create a process with modified I/O handles and window](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml)|Create Process (C0017)|kernel32.CreateProcess, kernel32.CreateProcessInternal, advapi32.CreateProcessAsUser, advapi32.CreateProcessWithLogon, advapi32.CreateProcessWithToken, kernel32.GetStartupInfo, System.Diagnostics.Process::Start| +|[create process suspended](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-suspended.yml)|Create Process::Create Suspended Process (C0017.003)|kernel32.CreateProcess, advapi32.CreateProcessAsUser| ## References diff --git a/micro-behaviors/process/create-thread.md b/micro-behaviors/process/create-thread.md index ceda669..0137968 100644 --- a/micro-behaviors/process/create-thread.md +++ b/micro-behaviors/process/create-thread.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -40,6 +40,13 @@ |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik creates a thread. [[1]](#1)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon creates a thread. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[create thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/create/create-thread.yml)|Create Thread (C0038)|kernel32.CreateThread, _beginthread, _beginthreadex, PsCreateSystemThread, SHCreateThread, SHCreateThreadWithHandle, kernel32.CreateRemoteThread, kernel32.CreateRemoteThreadEx, RtlCreateUserThread, ntdll.NtCreateThread, ntdll.NtCreateThreadEx, ntdll.ZwCreateThread, ntdll.ZwCreateThreadEx, pthread_create, System.Threading.Thread::Start, System.Threading.Thread::ctor| +|[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Create Thread (C0038)| | + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/process/enumerate-threads.md b/micro-behaviors/process/enumerate-threads.md index e2add93..33e0ffc 100644 --- a/micro-behaviors/process/enumerate-threads.md +++ b/micro-behaviors/process/enumerate-threads.md @@ -21,11 +21,17 @@ Last Modified -31 October 2022 +13 September 2023 # Enumerate Threads -Malware enumerates threads. \ No newline at end of file +Malware enumerates threads. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[enumerate threads](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/list/enumerate-threads.yml)|Enumerate Threads (C0064)|kernel32.Thread32First, kernel32.Thread32Next, kernel32.CreateToolhelp32Snapshot| diff --git a/micro-behaviors/process/open-process.md b/micro-behaviors/process/open-process.md index d309951..1517095 100644 --- a/micro-behaviors/process/open-process.md +++ b/micro-behaviors/process/open-process.md @@ -21,11 +21,17 @@ Last Modified -31 October 2022 +13 September 2023 # Open Process -Malware opens a process. \ No newline at end of file +Malware opens a process. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[open process](https://github.com/mandiant/capa-rules/blob/master/lib/open-process.yml)|Open Process (C0065)|kernel32.OpenProcess, NtOpenProcess, ZwOpenProcess| diff --git a/micro-behaviors/process/open-thread.md b/micro-behaviors/process/open-thread.md index be66cfd..dd608b9 100644 --- a/micro-behaviors/process/open-thread.md +++ b/micro-behaviors/process/open-thread.md @@ -21,11 +21,17 @@ Last Modified -31 October 2022 +13 September 2023 # Open Thread -Malware opens a thread. \ No newline at end of file +Malware opens a thread. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[open thread](https://github.com/mandiant/capa-rules/blob/master/lib/open-thread.yml)|Open Thread (C0066)|kernel32.OpenThread, NtOpenThread, ZwOpenThread| diff --git a/micro-behaviors/process/resume-thread.md b/micro-behaviors/process/resume-thread.md index 3ece938..13237f4 100644 --- a/micro-behaviors/process/resume-thread.md +++ b/micro-behaviors/process/resume-thread.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -36,6 +36,12 @@ |[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker resumes thread. [[1]](#1)| |[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet resumes a thread. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[resume thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/resume/resume-thread.yml)|Resume Thread (C0054)|kernel32.ResumeThread, ntdll.NtResumeThread, ntdll.ZwResumeThread, System.Threading.Thread::Resume| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/process/set-thread-context.md b/micro-behaviors/process/set-thread-context.md new file mode 100644 index 0000000..d4edb12 --- /dev/null +++ b/micro-behaviors/process/set-thread-context.md @@ -0,0 +1,31 @@ + + + + + + + + + + + + + + + + + + + + + + + + + +
IDC0072
Objective(s)Process
Related ATT&CK TechniquesNone
Version1.0
Created18 September 2023
Last Modified18 September 2023
+ + +# Set Thread Context + +Malware sets the context for a specified thread. \ No newline at end of file diff --git a/micro-behaviors/process/set-thread-local-storage-value.md b/micro-behaviors/process/set-thread-local-storage-value.md index 9aa28d9..01fb659 100644 --- a/micro-behaviors/process/set-thread-local-storage-value.md +++ b/micro-behaviors/process/set-thread-local-storage-value.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -42,6 +42,12 @@ Malware allocates thread local storage. |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip sets thread local storage values. [[1]](#1)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik sets thread local storage values. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/process/suspend-thread.md b/micro-behaviors/process/suspend-thread.md index 493f38a..61df206 100644 --- a/micro-behaviors/process/suspend-thread.md +++ b/micro-behaviors/process/suspend-thread.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -39,6 +39,12 @@ This behavior is related to Unprotect technique U0101. |[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT suspends threads. [[1]](#1)| |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon suspends threads. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[suspend thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/suspend/suspend-thread.yml)|Suspend Thread (C0055)|kernel32.SuspendThread, ntdll.NtSuspendThread, ntdll.ZwSuspendThread, System.Threading.Thread::Suspend, System.Threading.Thread::Sleep| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/process/synchronization.md b/micro-behaviors/process/synchronization.md index 818ee35..5996183 100644 --- a/micro-behaviors/process/synchronization.md +++ b/micro-behaviors/process/synchronization.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/micro-behaviors/process/terminate-process.md b/micro-behaviors/process/terminate-process.md index 055975b..7c26fa9 100644 --- a/micro-behaviors/process/terminate-process.md +++ b/micro-behaviors/process/terminate-process.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +13 September 2023 @@ -44,6 +44,14 @@ Malware terminates a process. |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot terminates processes. [[1]](#1)| |[**UP007**](../xample-malware/up007.md)|2016|--|UP007 terminates processes. [[1]](#1)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[check mutex and exit](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/check-mutex-and-exit.yml)|Terminate Process (C0018)|ExitProcess, exit, _Exit, _exit, WaitForSingleObject, GetLastError| +|[terminate process via kill](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process-via-kill.yml)|Terminate Process (C0018)|kill| +|[terminate process](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process.yml)|Terminate Process (C0018)|System.Diagnostics.Process::Kill, System.Diagnostics.Process::WaitForExit, System.Diagnostics.Process::WaitForExitAsync, System.Environment::Exit, System.Windows.Forms.Application::Exit, kernel32.TerminateProcess, ntdll.NtTerminateProcess, kernel32.ExitProcess| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/process/terminate-thread.md b/micro-behaviors/process/terminate-thread.md index 6708c06..692cd6e 100644 --- a/micro-behaviors/process/terminate-thread.md +++ b/micro-behaviors/process/terminate-thread.md @@ -21,11 +21,17 @@ Last Modified -31 October 2022 +13 September 2023 # Terminate Thread -Malware terminates a thread. \ No newline at end of file +Malware terminates a thread. + +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[terminate thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/terminate/terminate-thread.yml)|Terminate Thread (C0039)|kernel32.TerminateThread, PsTerminateSystemThread, System.Threading.Thread.Abort| diff --git a/micro-behaviors/process/unmap-section-view.md b/micro-behaviors/process/unmap-section-view.md new file mode 100644 index 0000000..76d4619 --- /dev/null +++ b/micro-behaviors/process/unmap-section-view.md @@ -0,0 +1,31 @@ + + + + + + + + + + + + + + + + + + + + + + + + + +
IDC0070
Objective(s)Process
Related ATT&CK TechniquesNone
Version1.0
Created18 September 2023
Last Modified18 September 2023
+ + +# Unmap Section View + +Malware unmaps a view of a section from the virtual address space of a subject process. \ No newline at end of file diff --git a/micro-behaviors/process/write-process-memory.md b/micro-behaviors/process/write-process-memory.md new file mode 100644 index 0000000..4f89178 --- /dev/null +++ b/micro-behaviors/process/write-process-memory.md @@ -0,0 +1,31 @@ + + + + + + + + + + + + + + + + + + + + + + + + + +
IDC0071
Objective(s)Process
Related ATT&CK TechniquesNone
Version1.0
Created18 September 2023
Last Modified18 September 2023
+ + +# Write Process Memory + +Malware writes data to an area of memory in a specified process. \ No newline at end of file diff --git a/persistence/README.md b/persistence/README.md index e7899d7..c537067 100644 --- a/persistence/README.md +++ b/persistence/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +12 June 2023 diff --git a/persistence/component-firmware.md b/persistence/component-firmware.md index 6a0c18f..675cec6 100644 --- a/persistence/component-firmware.md +++ b/persistence/component-firmware.md @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +12 June 2023 diff --git a/persistence/kernel-modules-and-extensions.md b/persistence/kernel-modules-and-extensions.md index ba730a4..cd0926e 100644 --- a/persistence/kernel-modules-and-extensions.md +++ b/persistence/kernel-modules-and-extensions.md @@ -21,7 +21,7 @@ Last Modified -3 June 2023 +12 June 2023 diff --git a/persistence/malicious-network-driver.md b/persistence/malicious-network-driver.md index acea38e..97a8d7a 100644 --- a/persistence/malicious-network-driver.md +++ b/persistence/malicious-network-driver.md @@ -21,7 +21,7 @@ Last Modified -01 May 2023 +08 May 2023 diff --git a/persistence/modify-existing-service.md b/persistence/modify-existing-service.md index 0aac670..d7c9aff 100644 --- a/persistence/modify-existing-service.md +++ b/persistence/modify-existing-service.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +12 June 2023 diff --git a/persistence/registry-run-keys-startup-folder.md b/persistence/registry-run-keys-startup-folder.md index fa9b8f7..ba04251 100644 --- a/persistence/registry-run-keys-startup-folder.md +++ b/persistence/registry-run-keys-startup-folder.md @@ -21,7 +21,7 @@ Last Modified -6 June 2023 +13 September 2023 @@ -56,6 +56,11 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry creates two registry run keys to ensure persistence. [[18]](#18)| |[**CryptoWall**](../xample-malware/cryptowall.md)|A copy of Crytowall is placed in the startup folder and a directory at the root of the system drive. Also adds multiple "autostart" registry keys. [[19]](#19)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[persist via Run registry key](https://github.com/mandiant/capa-rules/blob/master/persistence/registry/run/persist-via-run-registry-key.yml)|Registry Run Keys / Startup Folder (F0012)| | ## References diff --git a/persistence/shutdown-event.md b/persistence/shutdown-event.md index 4a7a620..e690cee 100644 --- a/persistence/shutdown-event.md +++ b/persistence/shutdown-event.md @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +10 November 2022 diff --git a/privilege-escalation/README.md b/privilege-escalation/README.md index 07660a7..05402e3 100644 --- a/privilege-escalation/README.md +++ b/privilege-escalation/README.md @@ -8,7 +8,7 @@ Last Modified -31 October 2022 +29 November 2022 diff --git a/privilege-escalation/install-certificate.md b/privilege-escalation/install-certificate.md index bd38a3e..1e33119 100644 --- a/privilege-escalation/install-certificate.md +++ b/privilege-escalation/install-certificate.md @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +17 August 2022 diff --git a/xample-malware/AttackFlow/Conti_Process_Hollowing.afb b/xample-malware/AttackFlow/Conti_Process_Hollowing.afb new file mode 100644 index 0000000..4aa7d3a --- /dev/null +++ b/xample-malware/AttackFlow/Conti_Process_Hollowing.afb @@ -0,0 +1 @@ +{"version":"2.1.0","id":"9135324e-310d-41dd-a64a-13779a6c89cc","objects":[{"id":"9135324e-310d-41dd-a64a-13779a6c89cc","x":-50,"y":300,"attrs":0,"template":"flow","children":["d1624e4a-65ed-466f-bb2f-188c450204ec","22cb1a0c-720a-40b0-85b6-92eb3c5de59d","5e37ea7d-9fc0-4a23-b4f2-08c6a382281c","4ce2d51a-6043-4207-907d-71d990e999e4","40eed92b-40db-42a4-80d9-cbd668698ee9","ff9c6b7d-a669-4357-9405-d0db6ec06080","b23ab297-722d-4286-95b7-dbde1ce8686d","75702c1d-cddd-4eb2-a9ad-0462d4d79af5","7346feac-0932-45e4-adf9-776744b850d4"],"properties":[["name","Conti Process Hollowing "],["description","MBC micro-behaviors supporting Conti's process hollowing behavior"],["author",[["name","Lauren Parker; Dez Beck"],["identity_class",null],["contact_information",null]]],["scope","malware"],["external_references",[["d598d4172253ac426bff91681781414f",[["source_name","Malware Behavior Catalog (MBC)"],["description","MBC defines micro-behaviors."],["url","https://github.com/MBCProject/mbc-markdown/"]]]]],["created","2023-06-29T14:31:45.553Z"]]},{"id":"d1624e4a-65ed-466f-bb2f-188c450204ec","x":-50,"y":-360,"attrs":256,"template":"action","children":["36cac045-5f72-4eb6-90ba-26eb9e10b7a3","f15b3204-3d02-4f5f-b7f0-bb917fc49a99","bf9cdc50-54ba-41eb-b008-81d58eea33a2","12976f15-f891-407a-8fe3-7c55e4c1b04f","57471d3e-ae8a-43f4-8d43-1f565e7d37bf","bd40da77-3456-424d-9c1f-0a62fd7b297d","e0a66b90-0983-439d-af79-118ddc3439a5","ab197d5d-9363-490a-942a-787530137898","180bca51-e80f-48f0-baaa-2d1884cbd704","4de4bd6b-6663-4625-9b12-e302023660e3","f760ced6-88d9-4ef5-8eb5-af250696e47c","a92325eb-d694-408f-b7d5-82ef3a3bc76f"],"properties":[["name","Create Process"],["tactic_id","OC0003"],["tactic_ref",null],["technique_id","C0017"],["technique_ref",null],["description","Conti creates a process in a suspended state."],["confidence",null],["execution_start",null],["execution_end",null]]},{"id":"22cb1a0c-720a-40b0-85b6-92eb3c5de59d","x":-50,"y":-40,"attrs":256,"template":"action","children":["c98cd814-17fb-47d4-bbee-83f6af948379","e640610d-ddd7-4266-8a99-55b665acb83a","da439112-c2fc-4b4d-a98e-5134e7714f68","4a942a80-5a12-4e63-8c28-51665937a55d","094a91c5-8aed-4cae-8bc0-1dcac19d260b","5abbcce4-bc84-4292-a9b5-5cc7ab2604fe","8d8972e9-093d-4af0-9e04-253e4510d6a7","57602bab-bd7a-45fb-9d0e-dc0eee5cca8b","b7e36e60-6d45-4127-bc1b-1f2398f0ed68","d85f8fcb-ee14-409b-be33-eaea4e426288","39212449-0d3e-4b14-8e52-9087ff3c5f8a","e7658794-9c85-4406-8fc8-a890ac0638b5"],"properties":[["name","Unmap Section View"],["tactic_id","OC0003"],["tactic_ref",null],["technique_id","C0070"],["technique_ref",null],["description","Conti uses the ZwUnmapViewOfSection function to unmap a view of a section from the virtual address space of a subject process."],["confidence",null],["execution_start",null],["execution_end",null]]},{"id":"5e37ea7d-9fc0-4a23-b4f2-08c6a382281c","x":-50,"y":-210,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["8e22468e-c3fd-4023-bdbb-654eacc44ef4","30d76d12-9a8d-49fd-891d-f88bdccc60a9","c7a6b961-5837-4029-b2d5-55b4cbe646fe"],"properties":[]},{"id":"4ce2d51a-6043-4207-907d-71d990e999e4","x":-50,"y":300,"attrs":256,"template":"action","children":["e44fde87-e915-43d6-a57a-ae625324f1cb","8e9b1b5f-d7de-48a3-a657-335347033fdc","674af530-9a60-472b-a330-e2c1a1ce4a79","160e98ff-7d68-4851-bbb1-be0baa3ff0c3","60bb9b77-bc8b-4b68-b53c-5e4933e6dc71","425ca36d-b9a7-4699-a269-0401cbe29e27","3e4bc19c-cf28-4ab5-930e-ba441e4ae76d","e1446535-d9c3-466d-a8fb-3698c757ebc8","99ebf0ec-5574-4dcd-a45a-747a453c0703","1e97bd95-1acb-4d76-8602-daa29adc2754","8d64bb54-72aa-4438-945f-be08aa7531d4","c29a8d09-fc65-4e24-a50c-c56db5ee7c62"],"properties":[["name","Write Process Memory"],["tactic_id","OC0003"],["tactic_ref",null],["technique_id","C0071"],["technique_ref",null],["description","Conti writes data to an area of memory in a specified process using the WriteProcessMemory function."],["confidence",null],["execution_start",null],["execution_end",null]]},{"id":"40eed92b-40db-42a4-80d9-cbd668698ee9","x":-50,"y":630,"attrs":256,"template":"action","children":["d8bc3d36-59df-4ba7-b678-2c1b8671e100","b0c38a62-48e9-4ace-a327-ac72c116e9c7","4ae4661a-2116-449c-8989-f13e2f2c0e35","6b1cad1b-1b2a-4e8c-bbde-20af33e878ed","66b39108-1edc-4740-bf6e-701c0f1c35d5","5c5bb155-44ab-4567-bc0c-0785ad92ab9a","1e6b27a6-c733-42c3-9905-b95b0d2713c3","c7a70c89-d411-431a-a05b-fb243b866d40","5e598dcd-1f3b-45e6-9b3c-d7c619b22f67","bd21ad2e-1e61-4b97-9492-fd92bcd5c5f2","db00392b-3331-4c2f-8c8d-ac2d2c31be47","609eec1f-1769-45d5-add4-3b5eab531754"],"properties":[["name","Set Thread Context"],["tactic_id","OC0003"],["tactic_ref",null],["technique_id","C0072"],["technique_ref",null],["description","Conti sets thread context using the SetThreadContext function."],["confidence",null],["execution_start",null],["execution_end",null]]},{"id":"ff9c6b7d-a669-4357-9405-d0db6ec06080","x":-50,"y":950,"attrs":256,"template":"action","children":["bd85e01d-f5a1-436e-b3fc-8bc4b83845be","1ab22dc7-9f93-4e78-96e8-1dfa509c66c6","5516bec4-21d1-4e52-a086-c00f6d95802b","fd02bbf0-ebf5-41a2-9a45-865cc17e574b","1015b1a6-ac67-48e2-99e2-d00aaa006a8a","f8172cfa-dd96-42ce-8ac4-c456964a221a","6644cdf3-5e68-4569-b3f0-180ea1e91bf0","7f91a411-0dfd-4198-a94a-4ff2bb1f7d0b","8ed43c0a-b906-4d74-86c1-ceb47c9cbceb","a7e56146-0028-47b7-a85e-79a5497614ea","20c636e7-57de-4097-a460-ee7f39c18ede","140626c0-80e5-4008-b0f9-24808607d11e"],"properties":[["name","Resume Thread"],["tactic_id","OC0003"],["tactic_ref",null],["technique_id","C0054"],["technique_ref",null],["description","Conti resumes the execution of the suspended process using the ResumeThread function."],["confidence",null],["execution_start",null],["execution_end",null]]},{"id":"b23ab297-722d-4286-95b7-dbde1ce8686d","x":-50,"y":130,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["46088024-b154-442d-b2fe-1801b66329ec","ed7d221a-544c-4d83-b811-230b8dde58f7","b3812f7c-481a-4468-af78-c591431b51f6"],"properties":[]},{"id":"75702c1d-cddd-4eb2-a9ad-0462d4d79af5","x":-50,"y":470,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["eddc4a45-e932-4402-8fc4-4923b6071679","a0ad6836-d2ef-4a41-91ab-c91e04a968c6","a9e82eaf-b201-4628-8db5-2a8b344a033a"],"properties":[]},{"id":"7346feac-0932-45e4-adf9-776744b850d4","x":-50,"y":790,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["33a5f867-f19c-4da7-8fa4-bdb4ee38e6eb","600f6c0f-1dd9-4299-9c63-056b825a4dc8","630ac24b-e111-4fc1-b4b4-0e02f633d53b"],"properties":[]},{"id":"36cac045-5f72-4eb6-90ba-26eb9e10b7a3","x":-136,"y":-481,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"f15b3204-3d02-4f5f-b7f0-bb917fc49a99","x":-50,"y":-481,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"bf9cdc50-54ba-41eb-b008-81d58eea33a2","x":36,"y":-481,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"12976f15-f891-407a-8fe3-7c55e4c1b04f","x":122,"y":-420.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"57471d3e-ae8a-43f4-8d43-1f565e7d37bf","x":122,"y":-360,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bd40da77-3456-424d-9c1f-0a62fd7b297d","x":122,"y":-299.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"e0a66b90-0983-439d-af79-118ddc3439a5","x":36,"y":-238,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"ab197d5d-9363-490a-942a-787530137898","x":-50,"y":-238,"attrs":0,"template":"@__builtin__anchor","children":["8e22468e-c3fd-4023-bdbb-654eacc44ef4"],"properties":[],"angle":1},{"id":"180bca51-e80f-48f0-baaa-2d1884cbd704","x":-136,"y":-238,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"4de4bd6b-6663-4625-9b12-e302023660e3","x":-222,"y":-299.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"f760ced6-88d9-4ef5-8eb5-af250696e47c","x":-222,"y":-360,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"a92325eb-d694-408f-b7d5-82ef3a3bc76f","x":-222,"y":-420.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"c98cd814-17fb-47d4-bbee-83f6af948379","x":-137.5,"y":-182,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"e640610d-ddd7-4266-8a99-55b665acb83a","x":-50,"y":-182,"attrs":0,"template":"@__builtin__anchor","children":["c7a6b961-5837-4029-b2d5-55b4cbe646fe"],"properties":[],"angle":1},{"id":"da439112-c2fc-4b4d-a98e-5134e7714f68","x":37.5,"y":-182,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"4a942a80-5a12-4e63-8c28-51665937a55d","x":125,"y":-111,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"094a91c5-8aed-4cae-8bc0-1dcac19d260b","x":125,"y":-40,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"5abbcce4-bc84-4292-a9b5-5cc7ab2604fe","x":125,"y":31,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8d8972e9-093d-4af0-9e04-253e4510d6a7","x":37.5,"y":102,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"57602bab-bd7a-45fb-9d0e-dc0eee5cca8b","x":-50,"y":102,"attrs":0,"template":"@__builtin__anchor","children":["46088024-b154-442d-b2fe-1801b66329ec"],"properties":[],"angle":1},{"id":"b7e36e60-6d45-4127-bc1b-1f2398f0ed68","x":-137.5,"y":102,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"d85f8fcb-ee14-409b-be33-eaea4e426288","x":-225,"y":31,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"39212449-0d3e-4b14-8e52-9087ff3c5f8a","x":-225,"y":-40,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"e7658794-9c85-4406-8fc8-a890ac0638b5","x":-225,"y":-111,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8e22468e-c3fd-4023-bdbb-654eacc44ef4","x":-50,"y":-238,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"30d76d12-9a8d-49fd-891d-f88bdccc60a9","x":-50,"y":-210,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"c7a6b961-5837-4029-b2d5-55b4cbe646fe","x":-50,"y":-182,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"e44fde87-e915-43d6-a57a-ae625324f1cb","x":-132,"y":158,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"8e9b1b5f-d7de-48a3-a657-335347033fdc","x":-50,"y":158,"attrs":0,"template":"@__builtin__anchor","children":["b3812f7c-481a-4468-af78-c591431b51f6"],"properties":[],"angle":1},{"id":"674af530-9a60-472b-a330-e2c1a1ce4a79","x":32,"y":158,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"160e98ff-7d68-4851-bbb1-be0baa3ff0c3","x":114,"y":229,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"60bb9b77-bc8b-4b68-b53c-5e4933e6dc71","x":114,"y":300,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"425ca36d-b9a7-4699-a269-0401cbe29e27","x":114,"y":371,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"3e4bc19c-cf28-4ab5-930e-ba441e4ae76d","x":32,"y":442,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"e1446535-d9c3-466d-a8fb-3698c757ebc8","x":-50,"y":442,"attrs":0,"template":"@__builtin__anchor","children":["eddc4a45-e932-4402-8fc4-4923b6071679"],"properties":[],"angle":1},{"id":"99ebf0ec-5574-4dcd-a45a-747a453c0703","x":-132,"y":442,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"1e97bd95-1acb-4d76-8602-daa29adc2754","x":-214,"y":371,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8d64bb54-72aa-4438-945f-be08aa7531d4","x":-214,"y":300,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"c29a8d09-fc65-4e24-a50c-c56db5ee7c62","x":-214,"y":229,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"d8bc3d36-59df-4ba7-b678-2c1b8671e100","x":-118.5,"y":499,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"b0c38a62-48e9-4ace-a327-ac72c116e9c7","x":-50,"y":499,"attrs":0,"template":"@__builtin__anchor","children":["a9e82eaf-b201-4628-8db5-2a8b344a033a"],"properties":[],"angle":1},{"id":"4ae4661a-2116-449c-8989-f13e2f2c0e35","x":18.5,"y":499,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"6b1cad1b-1b2a-4e8c-bbde-20af33e878ed","x":88,"y":564.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"66b39108-1edc-4740-bf6e-701c0f1c35d5","x":88,"y":630,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"5c5bb155-44ab-4567-bc0c-0785ad92ab9a","x":88,"y":695.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"1e6b27a6-c733-42c3-9905-b95b0d2713c3","x":18.5,"y":762,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"c7a70c89-d411-431a-a05b-fb243b866d40","x":-50,"y":762,"attrs":0,"template":"@__builtin__anchor","children":["33a5f867-f19c-4da7-8fa4-bdb4ee38e6eb"],"properties":[],"angle":1},{"id":"5e598dcd-1f3b-45e6-9b3c-d7c619b22f67","x":-118.5,"y":762,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"bd21ad2e-1e61-4b97-9492-fd92bcd5c5f2","x":-187,"y":695.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"db00392b-3331-4c2f-8c8d-ac2d2c31be47","x":-187,"y":630,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"609eec1f-1769-45d5-add4-3b5eab531754","x":-187,"y":564.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bd85e01d-f5a1-436e-b3fc-8bc4b83845be","x":-137.5,"y":819,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"1ab22dc7-9f93-4e78-96e8-1dfa509c66c6","x":-50,"y":819,"attrs":0,"template":"@__builtin__anchor","children":["630ac24b-e111-4fc1-b4b4-0e02f633d53b"],"properties":[],"angle":1},{"id":"5516bec4-21d1-4e52-a086-c00f6d95802b","x":37.5,"y":819,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"fd02bbf0-ebf5-41a2-9a45-865cc17e574b","x":126,"y":884.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"1015b1a6-ac67-48e2-99e2-d00aaa006a8a","x":126,"y":950,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"f8172cfa-dd96-42ce-8ac4-c456964a221a","x":126,"y":1015.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"6644cdf3-5e68-4569-b3f0-180ea1e91bf0","x":37.5,"y":1082,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"7f91a411-0dfd-4198-a94a-4ff2bb1f7d0b","x":-50,"y":1082,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"8ed43c0a-b906-4d74-86c1-ceb47c9cbceb","x":-137.5,"y":1082,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a7e56146-0028-47b7-a85e-79a5497614ea","x":-225,"y":1015.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"20c636e7-57de-4097-a460-ee7f39c18ede","x":-225,"y":950,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"140626c0-80e5-4008-b0f9-24808607d11e","x":-225,"y":884.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"46088024-b154-442d-b2fe-1801b66329ec","x":-50,"y":102,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"ed7d221a-544c-4d83-b811-230b8dde58f7","x":-50,"y":130,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"b3812f7c-481a-4468-af78-c591431b51f6","x":-50,"y":158,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"eddc4a45-e932-4402-8fc4-4923b6071679","x":-50,"y":442,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"a0ad6836-d2ef-4a41-91ab-c91e04a968c6","x":-50,"y":470.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"a9e82eaf-b201-4628-8db5-2a8b344a033a","x":-50,"y":499,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"33a5f867-f19c-4da7-8fa4-bdb4ee38e6eb","x":-50,"y":762,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"600f6c0f-1dd9-4299-9c63-056b825a4dc8","x":-50,"y":790.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"630ac24b-e111-4fc1-b4b4-0e02f633d53b","x":-50,"y":819,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]}],"location":{"x":3.3333333333333335,"y":630,"k":0.75}} \ No newline at end of file diff --git a/xample-malware/AttackFlow/Conti_Process_Hollowing.json b/xample-malware/AttackFlow/Conti_Process_Hollowing.json new file mode 100644 index 0000000..cee9560 --- /dev/null +++ b/xample-malware/AttackFlow/Conti_Process_Hollowing.json @@ -0,0 +1,172 @@ +{ + "type": "bundle", + "id": "bundle--93acca4b-aa04-47de-abde-0b299110e13c", + "spec_version": "2.1", + "created": "2023-09-18T15:12:21.410Z", + "modified": "2023-09-18T15:12:21.410Z", + "objects": [ + { + "type": "extension-definition", + "id": "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4", + "spec_version": "2.1", + "created": "2022-08-02T19:34:35.143Z", + "modified": "2022-08-02T19:34:35.143Z", + "name": "Attack Flow", + "description": "Extends STIX 2.1 with features to create Attack Flows.", + "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4", + "schema": "https://center-for-threat-informed-defense.github.io/attack-flow/stix/attack-flow-schema-2.0.0.json", + "version": "2.0.0", + "extension_types": [ + "new-sdo" + ], + "external_references": [ + { + "source_name": "Documentation", + "description": "Documentation for Attack Flow", + "url": "https://center-for-threat-informed-defense.github.io/attack-flow" + }, + { + "source_name": "GitHub", + "description": "Source code repository for Attack Flow", + "url": "https://github.com/center-for-threat-informed-defense/attack-flow" + } + ] + }, + { + "type": "identity", + "id": "identity--fb9c968a-745b-4ade-9b25-c324172197f4", + "spec_version": "2.1", + "created": "2022-08-02T19:34:35.143Z", + "modified": "2022-08-02T19:34:35.143Z", + "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4", + "name": "MITRE Engenuity Center for Threat-Informed Defense", + "identity_class": "organization" + }, + { + "type": "attack-flow", + "id": "attack-flow--9135324e-310d-41dd-a64a-13779a6c89cc", + "spec_version": "2.1", + "created": "2023-06-29T14:31:45.553Z", + "modified": "2023-09-18T15:12:21.410Z", + "extensions": { + "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": { + "extension_type": "new-sdo" + } + }, + "created_by_ref": "identity--80e22a31-d9f8-4938-a101-0987e945b78a", + "start_refs": [ + "attack-action--d1624e4a-65ed-466f-bb2f-188c450204ec" + ], + "name": "Conti Process Hollowing ", + "description": "MBC micro-behaviors supporting Conti's process hollowing behavior", + "scope": "malware", + "external_references": [ + { + "source_name": "Malware Behavior Catalog (MBC)", + "description": "MBC defines micro-behaviors.", + "url": "https://github.com/MBCProject/mbc-markdown/" + } + ] + }, + { + "type": "identity", + "id": "identity--80e22a31-d9f8-4938-a101-0987e945b78a", + "spec_version": "2.1", + "created": "2023-09-18T15:12:21.410Z", + "modified": "2023-09-18T15:12:21.410Z", + "name": "Lauren Parker; Dez Beck" + }, + { + "type": "attack-action", + "id": "attack-action--d1624e4a-65ed-466f-bb2f-188c450204ec", + "spec_version": "2.1", + "created": "2023-09-18T15:12:21.410Z", + "modified": "2023-09-18T15:12:21.410Z", + "extensions": { + "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": { + "extension_type": "new-sdo" + } + }, + "name": "Create Process", + "tactic_id": "OC0003", + "technique_id": "C0017", + "description": "Conti creates a process in a suspended state.", + "effect_refs": [ + "attack-action--22cb1a0c-720a-40b0-85b6-92eb3c5de59d" + ] + }, + { + "type": "attack-action", + "id": "attack-action--22cb1a0c-720a-40b0-85b6-92eb3c5de59d", + "spec_version": "2.1", + "created": "2023-09-18T15:12:21.410Z", + "modified": "2023-09-18T15:12:21.410Z", + "extensions": { + "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": { + "extension_type": "new-sdo" + } + }, + "name": "Unmap Section View", + "tactic_id": "OC0003", + "technique_id": "C0070", + "description": "Conti uses the ZwUnmapViewOfSection function to unmap a view of a section from the virtual address space of a subject process.", + "effect_refs": [ + "attack-action--4ce2d51a-6043-4207-907d-71d990e999e4" + ] + }, + { + "type": "attack-action", + "id": "attack-action--4ce2d51a-6043-4207-907d-71d990e999e4", + "spec_version": "2.1", + "created": "2023-09-18T15:12:21.410Z", + "modified": "2023-09-18T15:12:21.410Z", + "extensions": { + "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": { + "extension_type": "new-sdo" + } + }, + "name": "Write Process Memory", + "tactic_id": "OC0003", + "technique_id": "C0071", + "description": "Conti writes data to an area of memory in a specified process using the WriteProcessMemory function.", + "effect_refs": [ + "attack-action--40eed92b-40db-42a4-80d9-cbd668698ee9" + ] + }, + { + "type": "attack-action", + "id": "attack-action--40eed92b-40db-42a4-80d9-cbd668698ee9", + "spec_version": "2.1", + "created": "2023-09-18T15:12:21.410Z", + "modified": "2023-09-18T15:12:21.410Z", + "extensions": { + "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": { + "extension_type": "new-sdo" + } + }, + "name": "Set Thread Context", + "tactic_id": "OC0003", + "technique_id": "C0072", + "description": "Conti sets thread context using the SetThreadContext function.", + "effect_refs": [ + "attack-action--ff9c6b7d-a669-4357-9405-d0db6ec06080" + ] + }, + { + "type": "attack-action", + "id": "attack-action--ff9c6b7d-a669-4357-9405-d0db6ec06080", + "spec_version": "2.1", + "created": "2023-09-18T15:12:21.410Z", + "modified": "2023-09-18T15:12:21.410Z", + "extensions": { + "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": { + "extension_type": "new-sdo" + } + }, + "name": "Resume Thread", + "tactic_id": "OC0003", + "technique_id": "C0054", + "description": "Conti resumes the execution of the suspended process using the ResumeThread function." + } + ] +} \ No newline at end of file diff --git a/xample-malware/AttackFlow/Conti_Process_Hollowing.png b/xample-malware/AttackFlow/Conti_Process_Hollowing.png new file mode 100644 index 0000000000000000000000000000000000000000..99a9421b413da339601fc6a9f177d25db8a1cfb2 GIT binary patch literal 106467 zcmd43byStx_dZHXh_rxoBPgMybeBj;NNhkrR6t5_)7{-5uoY2|4hexxcZZ~OcWjWZ zyEdLr-0!$|e8(N*_s1RMoN+kseq+U4&wS=H=UO4^&lK=+@8P1Lpx`Sh%4(vZpcbK^ zU|C^ffh(EiLJz@zP#rZDq)`g{sMk?Y=uwnprJh3}Tj?K?pUaJ2_b&x6rTti9Sxu87 zd>(6m>}1TF5j=5uSydA_W})4~Rc(TiBqz&^6Z<@#{>xHYW=rQ|u>-fd?1H0bYC$RM zungPdN?6dXyGca^+W$QUox2JGq@ZEBNyXF z-glv_^*uoAK4{3lKWERFMlzp<{ec*}Tu}Sj#bb^8X>FFS5Nh*(y)z7^D|BCE_W5a+ zvRl@zPDSb0^2Go7?dHYqTFa>%v(IG?R1;z_2Q?hz}r-htUHPskbj&dWT~IOi}`1SkOLP=zKSiR&>-wP zkj6Ae&9!RR{J(z$?Qf_5-B{aPWJBM+uFH88+n^{d6w&{mkwXqqk)5VrZ!xLA z3M)EBuh92OJ>k3cCbA#aZu##A|M|mq&)sj8N_2M4Bf>w8cJFDBp>kWmzozQnt^U^q zPd3S@Tyt7&`_&WcT^AN+oxQU(W@c7JXPt^!L0sBZN}{T0JnVrxP5pODe-u_fvCy?I z{{}7JmX%88m~58*Pi5c5~B&RR*{ zGFsM<31B^Qm*LQ{eONU?8N1t&aB(3@bU$``_gH@K=IP+4Xd1*cG@OIH_QXli50d(~ z#&p&<}sVL^+Tdo|YmXjCXPNyNwG{?U?xpz^a7ZF?aH z>(`9dkC1EApVlWi85*LNOTQ~I_Tr_P84CwTml=~Ee`IPGdO^Q{sf;<Cn zsKo3a&??A^&JH&x8P6HG806Y!YV?P=?ECVj3R20LQHik)(B$FbrwRnBB88(U>LCEEF0lU`a+g<0eh=6O`Omtf<7nhG?YReJ*l^hd)-q9ThB+h)@(n zuDem0VckdWQ`A0UtUTID@rTwzIMI?FgrA`khH!m>@Hir|xH9tYy6$)}1&71g&Jc}9 z`EId%IaF-CykDA}_6=eA|wZ#P^8BY;s;RFSMRaWqNq8MQO7Q;jl3#`U1`+ zldBW1;j=j_tWoNSyR`Z6h3_|Vno~^QClS!oT+5lz_f=-kbBDhZGiCRQm^W^`@9g3F z3=QZ%X@G$~6N5hM!8x+zyZssN$ENDi4{9*-@@hQtvZ!Wek?mAPk6TuD^>K%b_L6b= zD_{(sImiU2iS9TK`UAQr&EOJEHq||J$=eJ$#jlH}~3$ zO;5s!ws3I#nNdTNB3kia&;34@lzJK@wzSDA6&>L?%t2un?hQZIetzIjUcltuYP$kW z*P>rf!PG3!Z7!=*{;+)ly z0(^f)4bQ2#g3i0_gxM9Uix$(P4|0qiwwX1xmHcoiHPNo_^E)NsHmADFX4)J~enmSb z@#3Rk@UH=uR!&knmx>UKCO>Z*u_8rd)5XNb`>Ax(_)`z{p|Y0(}9(>NY6wh~wlsjd)~k}MMsL+X52 z5nz~9V-?=XP7DYEN24IQyaDaK*efl9daWt_V$FJb=la0pJ}ORUd*F=9imN@T=u zz8hm`lo%QS+H`@V4!7QM8Ogbu*)3_B!*=ZJQ7y3Bm$+MDX-uNhwy!;2A}r3O?BIZB zzCHRt_|nQmgwu@W^3`Els%>@Bg?mh`f}=%e;O#NmS7Ton;q0JeDI_;bp}17Ef}zpX zcSaeODLHD}o!BeVZQO8gBxK~Wfq3Byvq+_+xN#CgklG5S`EXrJ_j5Rnh_ct}l*UJ7 zyF`)gdH@;qp=Lbn_A#8O<5oBx+8E^0$TeIgEyqhbSpKEGeoxa+Fg}@(1@n|~l}i|7 zzD;wX|Hw4`a8OkHWFSk zbLhXXd~N+}sO|-PN4TPsam8fd=eztJ`R%;=HLbihgl3NKk9xPLmCjQYIWeW-U&YS( zS5m?b9BS7lEM8V6v_VG2{YG}!XYn!GCk+d<YeNYw*d`EjQ{#CHS7Bl~+WP?%@;5abg>9Z-w^Y=gJXxe+9~y zn^~xjG3V%)6t8|vOevb|+7e3M+$hSf&_B1rXg5etDqPvT6n5`gcX@fs+f*#}tM8-MsNcG}Zswk-mML>XutK&|+q>rqL-d2# z5WWMS=}yoQ`unO`xC|{le=0vWOc;|w-xzx?n!nvH5*A?n{enCcN9*IZNqBoIK={3k z;)2^<0i37%pS0Iq>sj$tV>S}fyY5u%5$73_XI?7A_Ug`Bb~ch!wLW>*F14zHiH9Rg z41iU&HSgdMhs&P5vn@&z)w@dp`bDw`HZ*aUC*b2&VgtOfuCCgqL5o} z{h5<&d*X>|WBI6W&Ht`uGjOI0Y)@n+B#bAqq}d~qa?a%Af&zHX00hj%Dv`36G6vUYAnKoGkClmd*9L!rkq_~P<^K1x=$y}?Zv-Jrt zNf>{_6TJ`ZP~B|B!T6KzpL?^oXT1eergfbTV($Rhiwy-B+? zS`2_UGS-E|*%8VoLCZyYVnq@4=G}p_@Kn@vl5bX<7-C{#KO}!`Yw!p$U0_9_r1U5}O97vcX)u#%gqbStHNZ(RTCL08oGo*k zHgA-_z?{JjPl@|6ioW|6xa?YtmOC}iGbJS%1PGs(b#BbFvdAj6Cn5?@#j&wvr_H4y z%H6s#vQiZ+{$$c2)*VHHmYx2wKe<{YCo-6y%59kXF{C} z)%{vjJa6-?n3tfcJ|(YTd6xM8HZey*O+5 ziW(evYOSa~|20vgego$(+=wP`0<{76dnRPuzgQg$?l)_Gg{WEv4>Nnt%^K;mDAq?l zi^7$zv?=<Z9l=ad)Q$UX|My)ndt5!D#uXHy`- zlbbMgU1It7m_1GinR(M6TjuQ{`^Gfo;!yrSflqkJ1A0UbG#Z{cGk+qM#q6BTik$?Oq~zXsad%~0Gxp1fic#%-6|4^` z?_D5@)q3TfmD?tD1Zbf>ebpmo-(HQp9>ep|Ru6MCEVd3ijP|C%9v?kez@_@KU>-|r zVy(z8;VGatyAs3uy7Yucung(;&!HsTd2B&0S=tgpKS*LC#;QXcqa|E9)GD^S?LBHN z{BMl~eCPYV{Ks50gj|;F!0M!rQ|$3EzsdwY#o*!)vMVYd=H_F;pj z!0e#jBq#&l_$^1B!7sEUXLLXKo?;V_a$~XYRTJuzv+AaujxbPpb`8b5U<>#!Pss)K z7^HA*e{8MUz=-1>HJjlvmOoa~6o5LNx)?`Ni!DZ*PN!e?T&fZhr1$)?J<9j3w$Oc6 z68X5vDhM^mhS|piFoKEU1L+^Ub}t(q$6dgxeWl(H{=O~j*mxgprls51C^^;lgU{~g zr=_SH&HWnm@jIq6A9e>emfvgi^JJ*64gS6|3UU}Rc+cHP%I4veZCV`Rw81 zH!n*|)=amOzLI$np5YMNby2do5}cAB5UM*>Omw%?EgLh9YFJd9Y5E?H+8d-46XheK z4*}t5?QUDJz{s~empzpUgEr2+!F_~E0DI4ROS0i9fX@>#&1zoqk$kCq&QmlA1-;v_ zkkcKU5Zqc3W?T#u%n%%G{wBvJ!x$&e&PzT2WAPU$SxO9q0Xy5oe7!TI(AOdaE4ges zvAb~5X?bH9dE~7k)9JXcN=BA78g{)}tJM1=1StV<@t$7{RKL!Q?utI|q0~>Bl@=np zO*I_uG=gJ)c33L28*tj!{mVX(U-Y^EON~&sw1_rpfdmX+>6;j!RDce4=g~Mlt4|@r zYn_EXz9jR)5VN_6G*R96hu9zT>mu=A)u zSo|~VhW%N+^@f9}2n8oT5Cw#7+V^Vag^}dYP8H`Lj%@Xo|L+}!W@v_{ey}lq0VxRV z=8exlBnCtn_S4=K${R+>1>X4w-qe~nL4ah9j5n+?y6Q(Bk~M-31J+1x@Ja&78o}g& zC{b#quP_!wpLnQ1rQtNRPPqh43#LaSEpi|&!Y<`>PC$OBD^2q4H`o0u$8;8v&0Gj4 zFK~2~u6xR?9OOn`VT|_PZt3RYv~DObnEjlSChRDW`<~nA?q4N9 z5=T}kemMVymh+RWcfyhpHd>Vt!?-sh~Qum@@$F00g7S zDAayH<>>577cp9BEuOd4LyxfeaxYZ3L7)p4G*0m|HgK8*nV+GE5ac611I);72V_~4 zY9j|_&JWqs)?5C_o>(g&2ca~5u(T2R8}dfPeWXZ%I(b95tu4!}d63hAzigiOMh~qIN=i<@u%fB9J#BaGacrnjeu zG^m*<+DH4ly429n(9elilB6y`vXE2)!33a-A7)&#-*1iBIPQFbms`sk* zBTIonWnzh0dv#=IM@KaHpRT3=JQfj=8s?*JGZ3mU#{Uz$eAg@a(y;hu@Jm2AG0UKg$e2lF`gLg4?9_P6)iuB8s?>^N3dL8&Wf=&X`YTX&jGW1=8iIVrFzabo| zG2?!qs`TvHU8uQM)>EQjTv>dy4_6m1E^|J&3>WzA7i8C`YbrzgKJr_A)yjUx@$TgJ zWrW}i`$9lf*jO}!%+g|%L}GUmw^i!za;t17sS7)?8>8Km^X9Z3A3k{0yEF7H%vD7t zi7SDOQ)ewoOH9xYfj%6JVR0bZyhX|*v$orpt6*`I!N3r9S{2o<5K}?@fF`V~Mo|Cb?gzvp$T(uL z{jj(*j!mUKlBT>aQz2?UhXrY=pD?U9UF-w!S3M4yA;1F3u{*mGI9bHSA!o;6bK-+Ao^Vz+FmR4qkbUAdbOu zAbJLfS0IesAJ0_Cf0-VF%^*!Um#zV4ya=&8R-%6jY^v!gJXfb6mqF~p=3(};^r7gf zPuCZ#jHb=v9%qV^6*d-#g;s}!mJrP#eBNW70)74$#U@fQU-7+Qz99ldT@olGr(~A1suBod{+q3H6bAY z0`JRzxXjUGfr?}#Uir!ayz1xFt7vh(fx4+1kzo0iHJlLH0F1C36n|jwQVa=a>VFjl zhsOet;D0}jz)gHuLW_h_c0r&^gz8pNQgO>7)riI$|A5(@s7G*vN>qTWBHf7~)qDW* zYxGOlb^#GQdvIbB5+|y7ur9j6XgYDm`}(3qiK!?l#Uws7Q2wTzu(bNg%h|^7rI?U_ zfX+ujTQ2^$!_l8S&y=`~s-J)58vd0ba|-~#fYmDt3o>D>u?AkteprIX`H>O?0?9Bl zamS|;7(PO-kz)R^O6Q=dxMnN>rG{E)6^C#@Q-8gakEFi8*cL&uRg@4H#{@{L!`YuV zE{hR@OKXFfT#HQ+b&HWAUybWMeYIz3?gZ_uI;{;bxLh8NVWw();d?VAdwi9vp5Ysc zUm?f4Y@;j52MHM(Nu~FUDza<%tHFg~w z&wADG@CV}al-v{hZDrHV@9_v~e41d~5U7hxOafB$)c|8A;ndzjvTvo~Z$~^89r5lP*K^yS~?BaF+w~>1wBHIou5~ zm;JBsvyD7g8*KAh*F!^_e1pnD(ftml{pk<0Z)zVP4Py@2Nq5#lK=Cw*nrOy?IY#6A zZ(wzD+@%tH_ne{O+Wx^6LClXt;NUuqK1_cTdC-jRyEjh}OoA(r?|!zPZ8278RIT#J zS#4*uAQd+OF`Dm0-*W;9TV42qQ=icsx5jzL?7!pDPS0K)3A${RwDZNEZ2jo3_B8&cOy;uR$u`oh z|Kn9eC{0t$56gaM8o#4wsRF8#ctlRz$!30bNJA8pxdHUgtIP5z2hu4iDV`6RDB2k? zf_$hB)El45d(*3?328LDDZaPk7My`*{@I$)g1PMoBmG97#QZEQmb<44!0-{2S~|>W zV>qV%`f_*wWHE{y5gDC~7}iqj1na>Z_`ow;|3^s=UM#%5OZ=GdE|~6&e50DtLq~t| zLGs|$jgh?NUuqKg9BlQ1Dah>Kcr1z-QZH;v1@oS$V2e9n3&>7Q3tq@Q>_vv>s|6>- zMc|iQ^5dSz{ZJ66dlRzS0>8!U&s+dwEF}Vym>)s~(vGpMVdULO#-4AwgF+&JF3&E3 z6e2@)FV7Aw+QKP6dYc}aKm9Zz4#xNr$xK8Efo1DnfGzM1UMsHm~8x2GCX9$Vf$>&ul3yZf;>=rq%!J8@mmXfKe5 z08^?Ykoy)OAA-~G73qKZ+mfX3EP2+1# zDk%>|)1Z#VbEI<_p?cIw%NmCOuH=zrANAo5J#=qsu7shc*lBarVbU;n_V;s?#u-%+Drw!e#pH#S?utZ1uCjhS(0ABIIyk|{p|1SSU;5*MS z|7xMx)IAC_#!jtIQh=duQu>~V^1FA1t`gYGlrb`5gtW{lpX>5;i*kAN#hCpWz}j*y zxW%}5mGO9^t^F6FJag?FMevG&ZS8XPot1&PjFio}WEv6Y@4;uv960p~(PE6iD)5mE z)zCC^Z#(eT^C}06-nZ|K13RaA2<7=W?N9XOap|5c)^OTl=A7u!a)^mdFEa3O^#mE! zxlb(aYY5@wxl8iQ^SkQ5%;l5sbp(#0=@USg6`1ZxD!bcFib(D+eda7eGlg;9Zj|P%-3}K;VIlkcx>)Zd%K3d*eJ^CaH@Qko`ctxf@M@ zQ3n}Epe?I5R4lZT33N?9|L1Xy9z#Cm5rmsi0 zh{5N7f)~maL%(HZDZhG^B}5(hsPX`pj6+dh|05|WY5Zw96xqE!HsEz~pwlj^=|g}| zGZsj=9p$@&wdn9mRZz*$Fm3aAeSQ6r6;R{t7yQHjA@(65AsnoLM#e>npD9MtNpL-W z)idDusxNK*3HjLD;qNhUfW-UR5|>I2j*iO-x)7q_ke7WaVr~_p7kkYPCwrzTA|DD{ zT3T*czuWQ7@5GA>_lf_|ezK@BX(K{y$AWwOZ%H>60UzMv)X8Tb+BIzs?3`=#E06kr zi3CJ0KD|AP21$$?2c=!|QqD*4*B3cF%Ezz5fg^h+VDtNHlV-iAM~aaBmj?zFPmgw{ z^Thn^kb&jd(KhE|dsNcp`EhqFi^}tOq!%LRhCG-0_{1sK7?BI9t#-e@Jm!$DYr(Tw z12B%;{tx{hDl(RssI>hAN3>A^R~bcGl~@B!7j@A*H|+|*Bgc5T1et2J>WF68N3_#* z17@oIeG-HP+mfm4mvRjqZCrt3H%e_cUkwNd942ilI{|JQ(c*Yw%_mEE)mhKLCq|l2 zPM|Jp89~ep3{nu+b(W-6K8Gd6^^v@!J6n5Q7cP*!a1){LbiV7I2fjQD`m25Eabpm- zUKWZtHnl|H0lFt`>kGbYdOk#k18MbagGTUhax7b7%&~2NToucJ`dsBM?t(Z$09@%K5XlYdD|{j>va=-#M^$5~luP&OJu^7{^eq(WoeJRMcBCnQ}m$t9ZKl<&>B z0n1q~tl1edD==*aRHnP^&95c!*#rR8RT~?>%kw_lU|%F9NhI&gEc*jQ9_sm-vJzux#!dWkVVxlnJsIC}2HKe|=tmo#&{hou~5+ zY99=Obaq{kf#xnOo-d0t@y9>^v(98QS&@MBUSE~sLZLD{I8?0hf^Ub}DWAOmPD^0h zv*GfhIdE_P9ULLw+1VMhv}Atx^XWLD5)-!ROIkeB-t}MED%RHdZ~)N`{bI*IVRrE8a`T-P+@~LmhyB;f0Ww z;uqjhDN;*)QPk9o-TGawLLv|y5^Oiq7D2@i58hH@jyHkb$&mLKLI?Tr??hwXLXS=vU^Z-9qV*ZDj*TgF@SN%8WEKUXPWi}B(LR`{zcp^R^5A;ZM4pT!#h6dx2 zNG!Av$+Yl8CK!<#%7WGn?o}}TMdyki`~rU?7I_da4;}e0QiJK|{F5L15O^bcREfV$VE*5mz?97Hmo&^}tUS!Z=*N zBwerwS2|c=&h^ckH&@ny^*5fHm;}^3 z2^_*d^1b=;1;ZBi%VJJTdpn*pwI_%;M$A3}@3YC1CSmiNPmIo%1^ZUr_0@Uln_sMB zy#LM4$EL_udfh|FYYT}b{6u|#97u}PN01%a^JjgQ#*S3IsD&L`HVXt_`VA}qM`74* zTDTFTKpO*)euFwGyIMYq_8}mBngqCx=IlTmIe2BayzZ2+@Mh^gFv?a|q|05!M1Y3I z_I%{;PDq~5;jC-10_x8b-N1p*f{2Z=qEEPk;B^WW|N$yB)>=3br0sfou# zPzhFVeB?3peZMiR1oJq0QRT24YK-_Yru|VNdKIipq->0g>`ot;-(J9Cl;Ppz>>h~& z0$Lsg!zo%*AO@~K4udqS&%#Qo?dY(JIkWT}PgH<;xUl2OYq9Uwoot_mPkETFlNTOZ zD;DMPMbY&m;rZc>bHnR>Hv_K`?Z>50|YfklkFeKy;p71!H&JLl$CaHKm zD4q2zonx}n_5+JOy)`!P`EmXALxak92|&N<9>|bcu05WK17SjA5p-~qW1Fet0GQy- zh?pUye<8gp9sT0u!>Ol1%^9;|^gjlwt1-o2(TX_ddtL_!7Xru7iR82U<9i+$qI~%c zJ_N9s7N6)P;BWDW_Lp2J?UxL7-_T0I0Jx~%0|=HHmh?uv?mXA9sx(d9qq?J1ZG~dW z+TA4FA~oMso)ayYq7KJzb>&S+&JYD9vb*#?$mJgp0>zx<(W67+oj(w9Z_;)|UGl9+ zRTn8(0c-sO@A}=QCxN^LBmJMU3Z}Kh23#a6Hpl}Y`vbQI#X}s(JB0qS;Jg3-WWoQ( znJ=1P0&vR(%uGy~iWa=Qys`1|%wW0u7_&FrBPJ$(zgU%@pO0d-unv~gy!2mDbpuGM zQ_hn%#N_1JVjaM-PuG0tX8YvMs9R_lgQSk*C1!YsJ3txQ-|yyDNq^#GzQ5F|S^if0 z^78ax^~SV-*r^C~kEKxq+XMinH5g{SANfnoJBinU(PmgZp}sRwVip9TQUM59Y$R;Y z;=z+v>7x}dqTGNs38CF*Y(vS^A5sOpd2iNCc17qIy$n5i5by)o|uM2MkWF>rR44of11oA zRS2o&0CGkm5*Rpi3-b?Y#ohIgXa%|$2jC``{8eGqhh50}#E%SC6i;Rof^;p{lDYGicni&x?=h~@Ku zojn?;PLdVxrgNKA5DP*IXfaX%xy<^zgIia6Q_IPbAX(yLqMf7pEt=e{`bD13Lz=lL z8WGlA_(5a?XD(3jnORwt0VUM-t~*)4dr|9J4nr&Xxe9Yz0y9wRaqgTXIsY+%LtB#p z?tWV8DzgL1#Ck4&CP7@4HUlh$06#w6YbH3PIC#ti0fFmtR2T?6AmrcPO;>ZgCR7d{ ziNCK^c1buhX6$7o7qdV{iB9eY%B_lch>JiA^9J$_t2Et!{K!t01BZ)VN;EkTvOpgI zv(mM_1^W#wfd4}9{hIpa!O^5`H^?i5Mwhs{?Ir#$d&9&eAFgh@0T2t)iYM)Fbp_^! zL#LI98=F_OP8Z@L*Zh&4XB5OG-^T*fSAcq6w!L@dyfc+^9r%;iy2B^pCJyFoYQaMn z!G%8v)&NXo#P4iAh;F!MpA9lv^}v5Cl2(jkx9+^K+v>3+BsogDg8=iT<9rk5;UAtP zvZsiqLlBE)K-kU%Od3!^bx)!Uwis~Mx*sqqLGAg?@EH|%Fo`JP-_JRhoeW7=;c1Q# zR=yxAKc2Ld)&08y`5@dux(Vm)-`|?h(Y-6Nc>Pw<5T$|mM4IsBM1v(@Asp{kK4Ont z0`V~sP=qx@%9T8LuS;XG9hbCw76y~`>%!xMeu+&(qfGe-j2E%5B}fD=#BxC)!#Iee zL5!cIl)nZfz`3Y;e|&h#l-Kp8Z;uSKDZSAZ(!aFag35bcEYgKBThoi|NnD>snOjW3CR;GFM&2Qqa*N{DZgHB3N4R z&^V6W9T!G(D2Rp!5BAT;4^W7UC2qVKCq-7!Q)y;LdV_)5J*H(7!dEl^i7e#)iQBuF z|K{fW#X<2LQ6o%uEtSpSM$LfXfC7WiKh`q$_>iy;5`3YcfLpP`>nI(7{!JQ}JM|-1 zswzkdb|Sg#|AF5?#?jEUIqPowtD6KNAyO%Fg-G!*=}6tE4Jv;#zbDh`#ZTOSWvPAx zlV0j}{0k5AoxsfBleDF!Q8&K(yxRXM2{132J0Q0= zWZAfhpn38>dU*KxDVX{{6kCR(F8k)EOL1!N_izJzAL{Q}HV5K&`F^v;=}G350St+| zU*Z~m2ljx4X&_U9U|N1{Imvj`<3w2t09pZe3<%o{LyQ>_qQ@H}Du4pAO+Tm*`o_0P znmsc_ErYa(#=V`Ni+2t^i!&e1%oO+H2&DQ4*X}jpu?W1j6)LtRKRP>`oW0VyC&HQJ zh~^UA{mloCjiZNcXoYBkc_4Fdku*RmeK1;kzgM_5_b2Hs4P=fKn_LvpLb72|3pDfq zX)Gue$e95R^**O=;V>;@J`^MwlmU2SP>FHrmnq(%7W!Q8cdP?sv&&PU0v=k9yE_0h z*556toXMrqXlrlpo^K99=D}Qhf{BRMpmWs=R3i*IV7nLO<~BmK_QRF=@57YLV*Cwu<7q=Fwu1c z)J{f`A7p7J6JanetFb~SdmE5+y-oQ@b^@8Ro#;su)`~iAZ8ZLLk-nSPFGOBr2pVFr zdt6~NY2N6I*)?A4?E*3n%OG7kN>gR8#*4iGYnm}J-s|zYJk*VHcb`^MV>6kf2K;T* zV`oZun)e*2L8CH__m(rG#E0rl9YK0lqoNqy_|l>BdTniuv0`%ebqI*&W)#}c7M51h3 z=KS_vfZWD%l-EV(J$9@kEc|=eE1WZKyJFL*ln`wI;pGuE&f7z%Ie>@mgIuSAPQG3S zI%ShTg*9PpvoI88{;(FrCA71@uU5UT6snyzv(Rs0* zCQ+IVI6(jRGj}e1KF?EMTpf-Xk2S6#Ie0xo?p!D;9l;);I+&)a!KAdFWkh3Q@7JO~ z(*QR(+{i8>Vh})-YWszTVnChkH)@Gru^D}X$;Ec%>|N8)D{21$@hw_>B6Krb+8yJo zeexWgf{&7<48w$?Q+U|o{?udDKs48;;K5#GLD_DbES~q4m%L3ldb%ocopbz)eDdPr zLVDG0ajl?#jfuhosV5>9l)E;hn zT_1amTn)b3V!iX~ry!yDFWY0wH4p%etuB?1L4I9*bc?XW7MQGdvck`)I~+B5o7tNx zm~@NIU455H7O&p~IH%!Adt)MjKOgW(-ZWk|IEGtN9AU1&TDp0T-WM^zKo0r2o4mw_ zt?>*kv^r~QL(%lbqG``t1Ddoq@+q0%k~h`GpI>TuKJ_4ceS$J?360+KHZ$=lo;Pjr zj;!Qyyo05j=C?pA&~jKCl7zSb{-zL}A9v;nFX4ja>uzBEg^YfJj`7Hp8JL4YKTO(p zoBcc}bEeJBp_S0Z^*L3#RWY#8pX~h%!XLbYjS7E^O&fYj*@BM72anw$onmEl9m1uK%_$E`%t>v{dJA5+u=RCcvtHa8I`%byCXfmY3G z{lTQgfpGCi>f=GEFQ(Nt5#OzbzA7Q5;zKB62xVTD8N~w-mAbP4&x?5iuL1195-~XT zO|1nHH(8X}Q8J`mR(LOb&NBF}WP`fIZw!MLdwEeWK$}nJ{0NqOZqce|GQ!;ojE3#4ogpd+`Ndc9rw|`?-HtN}PH3dSgTIr~*XbnFgq($Da3mXpLXBuh(jn|Dl@9Si zqCfzDhGMFbBtvP68@sBr7znAz0j7^Nf%w`Pi3%2L$kH~TTnDN%#*LBs@6m60U7yb$ z9$5zSPp`)Iz5Hk`V9aq)bdI?>cHBB%gx{p=M!_lYf)3$LNm+X#nLaUk?l$Nx6d= zXABXEF7r(RjQ(OFV?fC&u&p0$Y)r$Rm%}C`;C^|MoZ3u(hr#!FK@~o5rzd7k@3!lx zFDefDLuty?^(ioIfZW*n(%xV4eB*Ipz}`LSR*C^44&T*KVa;RWU}z&A z7{TeHAU6VofY&B7q!*_3$;XF(N6=eXw&Ql$Xfcy?9pN+hc$FH{+;8m1ncOoict<`- z1kfSq9n}(XzhX7xu?EoxO&dG?A}b{tQI*2n!1&_Gm;2kM`x}Lpq9Q7j=;&l@OFS(M z5TSp_1bFPs?w|+~(ndN-Py46v4Az1A7!SL>(RUu3KkDY0mc^2R*uv)DJmYz8Q_F?h zBnwsXOE&H6o<8s$Fu8+wpm4I&THB!2BFlgFR$6b(@37$4^no<=4ug_j>KbqPrkHoTyQQ8Z-}VvO^z zcp<*L5~X9_X=rZwOt3qnTTkdBd2)x_pzSE1!4#SSYia*2{sGal8@?K_+HkL0aJA9X zlmMIRrRU%nKjEFWU0y*8kH|sW@hm~azQyd0^mA&e4-)NV-A2h_-^5XA&0FxeKdvm3 z_S=0=V)y*|pis#K$_eU^Mg$%G%Xmx{8CneP%i`1Co%zc9!9Q8N#Rdqm9M+0Ii|0!4)FtN*`pB^V)~(-jZ*XfA^WScKm!+DTMH$aJ(Q--YThK81DE}ga{E?7p zf5)0k$Gv{~6DdPbY~^!SgJt~1yX)e^6+hEqKj>zZg|62g;87sh{{ z3;$HO`Wt;9Zu}G4-}~Khy_H;p z{oQ!!{AJu53DY#VTY6HV8Ph8a%`VAQJcn*>s10J6x1a><6lr!vPlx=tE3SmTJghsr zZA*59VK47S#M&GdlkFe>*O0qrsiX2GvH5n$pmPDYD+1i2cBzOqWE;aMg(&;Gb?XNR z#sy@A zQjpEd_Yg6??|4aYlk5?DkWc`&eA1)dQ~-w&U?4->|0Ugngh^}5H-8IdF_8Q3KChC= zI=;Lqw^bMaTb>xP&r1jad$mAvG6p1%V7lzTStf7F&cy%fqO$*wx@eIDF}JnuLLCER zZxr%j#n10Ciuc7TvKn{pys~a(Y}sLZ#_nw*RUH z2u(`G$54S6iwPeMHqlCr=SSQ$U-9!F44&D5+GarYv|mSw8bCpHuW9oX4CsOztRKdG z#`pDD_82(b7de<>b!A9O0ZLDK`<$bJJQWf4lkZ##HaY?<((x zM;~_-y}w{pgBdQhsEMEYBM%Jtt-ZdLE821oq6?J9IonWO%24t->7P8u0fIOmh!$mt zs|iAiP=cm+sam@~oOJCRSBlDhg?}Ol&p4UEJ1~Ly<89yPWNR@l{x#`jLnH9OCR^q* z!gpJRV|0};W zBNk`QIEjwuGnDP;EEV&O{f#HqF*KnPKdm#qm-Mx9Hm;$ZmB;;Lk5N^x&i%Cf-Q6NJ zG*db6|JqQGhbr&AMTCkx6#-eEf^1Ha?%lUvo`E&RQ&%z6XvT- z#yPS3fzJ9ezJO-n<`{&qf9;tEClAcrGjY#+Xsi|o)19cZ{{`zFgUO8eef__mPk=l< zVR`$0aD0^-@|c8t493=-?n#-<|GsN$6P1Q1d@zV zamx4DZbs){ZDzIRG4;ctno^n=Q>1unySHOwaV|PrtG+1xpMx3x$8P_65^Vk`7DG{0 zWNZG%Z~wZmtcH(%sJQ;m$qzSO_R?qa2~{m_PPiGnzXwcAs3D6rXWiP+6+g>@?M3n- zb_f$Fii zYH_yAKePR}#Xz@3o&sSwIRM7%{=8YU_vOP(e|%7wa2(+GKL`K6PF{Fqy{0QE-Rp-m z+JC>WRT%7nx99LQ16yNl6Z`6 z@~}5)fpBJlaN{^>p|#O(fy^7Kov){Xb%$E-CE^Uk(#!kH-K5-fOY9r4`RK4Xyc;{g zm4w^91!dabUi^5~dbb!^I0Mq73r}EvM7Q3!&dt!#+4kT1d#5@aoO56?4yp_2=yr7* z92~&*zEHB*q$CBzzD(GcXBx*W8#i;$DT!!WNABAIg5x<^5hzISM%Gc#v`c;T;}a{= zgd&y9U1&2f3Ox+hKWhxh=m$DH?dA51Z7)Y!{QzjYll(n7M3+#M`?vB($l5ut?)W9UGZdSr)W^aHU84`d;kA zgWz{>q9@AAX-SGNGIs$z(RGM zN3}s^T+Gj(Lbb$T=CrX`+c}V#TzWgSorQpFHfCmZ_(jGct-#mS*AUx*qaQTjCl3Iv0$Zc7 z$CcsIE&&lg{Yfd^cHb)1$o6+TtDz!GBSH1e-%~ew1!Nns@-p}JBxRehQ7W_YiS9_9qV*-DSc^{#g|LNb}7QL(O=Ly zPdEYRG|=adjQc@OQ@Xc#J0vP1c3v#*tIOq=!wXkor zIa*B4P`??Zf2J=OnWR;}(z)P7sagIq9M|x=FC;cyi{99_llVdHS_e1b@SB!yU9kh5 zuiZ46n&0FTD1@D681QtmRbDxxwszl*5~5N!_5{Hpj4;v=gN($XT^ zd6BRl8&Ak0i2pQ^a~*RZvCpUblaQ83cC#Cw(qSJildByXlX{CqMaS8v=S6Imn1F;I z)Z<*MqTRLak7^>TliA3x%|QVv!e=c_y_3hwUAd|$;J62Bl5tMrVoZ=K+L4tm zJXH2BU&n)=$#~;=)JU;;YL@+Ns^1H|mP|^ZL>TPjqKE8#y*C`5a5!1YEWoPlTCNt2 z-hQyOiVl-&pML6hAF|i z;YE`^7o;}{xof$2Cq%9(P^N~h)9L)O5co#1fJ znRCwl>+k2De9Qi=xWntgxVVR?E>(%``&(F>J`}M=VOodS#tw}=rODQ~3(C%BDkzf)Smt z6F2XqWzW$Ll~=guhhn2i6M@uK`U`&%@g=QtU3Il|4R z)|Y{QJPs%4DP3BkS{s4#vRQ%=NMt<=i1T>c4kM`czf)>Lp+QdK&(r*Zhppn;-Wq0^ zu`@{~^5E!-drA;>VJ1HNEe-{*L1IDZvuSm=*Ph)QLF0W{07K$n-NU8YRc-P*nEOK1&O&)_}y(3oBKd~y>$MU~cbqoLY1p<9I_P4{N# z9F%HDkB)ZWToz_sTILRqaz9c~MAAzobHtE(E#w@AHlWc)3qA$F>K1~?PZ*wK8M z7ZJ))QB)Q!Oz(of$EXWTT5W8M3F?={4JcG79aGZ@;WgA)wye0^Okx-5xeJvdUhYjI zr2WolwGaAewq|3IC91 zmhT!{B{rm=!!K#XKQk+G=1Ydlj+!o@;O~E4z#)YL*dkd6cO2h!YP>d2p_fcF=IUSZ zcQ7we2b`dVZhrU^qNR;`+*@lN0}CIlU!>5>ZNe|RT-}Q)Uns7j)2zGw6vZJMNOMUaBcPd0`ln zxc1ED8)Y`%;3tFO_38P>w^wy1#k>s*dUy2xq#;@5_whgrm&lx?SW?9L{#GRBa7#`o z3E7p!+IX@zz_G;kwJDswY^&m(evNPqn-yyd^}6?XQ<^DcZB16krKS0)rhj915P2=i zPlX>yK6wuTp6c@tOSp%)a!!7Yu&-6f0>s)2GEbQL!MPxyFE$Cs#xQe zuY)*7Uuf>N`Lb;`$Ctmo`>bo?iw<#nO7=GSqZ`bSj}QuPWTsM@b3chRM2uK-RAJ)r z1KjEjcfnGB1(OO>&gdo|ZMir#9L6=XkjE9hxY%-&2r0A4txqOO5o>fix0R_Egss%0 zH?vLKLb6-?Ya&AGtP*O(r$0?nm+^@KN8 zy>-;-JdT!3sa$3#n{|0H(Fd!8DV!a+lu1WzP0ghK{s&EBlb1E2?RY{~=VD17>opXX zhxi6}2Qt&$0~H^Z+!TL{y}MYvTWQqpr8f z&o^Hn+Jym_MiyOVIIGOQZUomCjdb$W=%+%Dl_HE36v&3)PJ;r)bzWZo1z#cmI_q_} zIp&5k!3oLr^?bU6Y16%8xL(VF`MGxZR1oZiUE##SW6PM$__d6J?8e`l_#><>FVy8h z9jVp4p5&_KowKHON~6U)2{K`48;1Tl2?#Tm=?egF*|bau^1Mtiy~EN*A4A(daK`Gx z{(PL^=Jlw|AH-i+DZy@H!D{{+SlaJ{){0rDp(G{`TYSaffeoqIDVeaVJvT2hv12U{ zJHyA$v>TGR#Jj$Q5%vrIt&iaB*B1}dI3Ad6${Z9crM*thy)E7#$yO9-@`Pfli}&OQ zvnY>>*N@&=nW%P)`l_A5#3-dK=pE>zJ%eCsBCnB;4Ikr0wHL5w7^Rg$ahlGVEA@Z~=Aox^+Lm(`=Z+tF=y8KgPHfT~W|rx_w4-Z9C``=( zFemQBXO|{*126UMU+ax;K00140?d+67Q(8)`%q)-bw=}t$F$9tYlk)r41>9d{3#(R z!#76$woz^QSb&T1beUo;emeg3a5`cClZD45wa{(B)wRsZn>LY@=a~D#*5N;dQQtf8 zOFIu4AU#rx9&)OW_KWK>v+Bz6M0r^;;?L5Xu4gJ)b$g7y_e4^U5HLE^Fh%vo-sx5tCxVG zD~gv5*-cfZN)h57f3N7D|7_35TzuZxbLs!SZtYNWTB*&*|Ed4(+9&B+KY)ZQS-9vv zTg#9>BAXX{qRmfIu)5fRW#z^e?xi_Te0-zxoFyHUP+@f^xd7AC^4#Itme6K?fO@_v zPEJY&i(u|F>nsh&N}M2YrtuQ5%4=IPrT9Pr1mACc;s}&%7c6GE2A40r$oPxJ#t>GS zFa6tpdOFZxX}4l2yJ4sv;a4T0 z%7YL3+u~#Lc7A<){9rIGv%fh)Le!ke)Qu~<9belw)z$vxF&?b1A_>%O1zM9I z^mV6S`)B2@Zy4=QxQiQCZTBQ5uObU<`erM+w4Z!AVws92VK+GTt#TWrHr+K8Xvb&L zcqhTJskgGuYU??9dX?^w?l<2!M=#K()e$%t1;$g^*J%fp2}+(>6JEc4IZr3tUp@VU z)3lOITj8_Z3W2G54ljrq6{ijq4+H`PO1gG?sCL2w6>viCt`zI_YSqs@H~rZyXdfIL zG;2%dL&kqnBAXc^>o9G2s$}+4H}ZCCa-*Udhac0bNwWNuX>MF`B5#G9nv&Pk=bXC4 z)Y8%==0Volx4W*jT{W^^RHzs%U;ci1`3pj`5Z13LOl@~Qe@|sP*>Ub+WMcq~Bl2`{ zuF*B3mIxs>Ae}X%t0n1YN?=}+48m4X68`%Y`r9U1nPpJ+&eUGVTf7-?M#4&e-KDGj%32w~anfjtzisfrdj4wBXD@Wr zalq9tFcwa^;__A`(w#j%hmp-0;^x}bGTS79ITmC==DyC!T7#>*BmJhBG4eU_iuZ%3 z?C~MEr5Caf$rkfv{8yL1%vj*KiCoUS=4Bw*SDY=$Rk~nuGd(bp{JH<7V={(t3hRHKUy_Ih@-ysl>!xnJy`|t*OSyNLA4M?tEq$XSU$Qd9cdAWLEx`>yHBgLeO(Z&s z%>@ov*hmD?d4a3ovE*;-0z1}{0Gj0qv(M&y{V^b`2n8-3q#(S6@3KJFfa{D|MOLP6 zZpB(ZkkG)2N+U){(F5k1_7c+QN=Yd*hM6}sv8J_C1dMk8dI0F8q@g=0-FGdb)NB zS(4tqeQcDDUo-b&bh(`RjAZ3LMLSY=nj&9Tqv5I3^Z7%5{u#h#~(E2 zU{4E`t|4EtNrQ_9Hw_#CBzG@FdydgHm?!AI*Av!x4Ac!Ed4YatdX*Yg0KyoEbwO61 z>JL0I!NBz+J=BQ8pQeB&#uz#&pTlRg z0+xZ6p86M8V5lBBtj4sylV3gU@va?=9DEiN6GJOc)`5`a>NQZRCBfkka*hXZFo(Cf zKkfu1pVP<|9H#D69^>e*FF{#Y$ZO9s1IX3CI!!C#Lw*qYP>+`m9 zEAa&GExOw&H~$?BXxoIIkFc2nc?9p1Msr^beOhr?4#yJ+ZQH}vTVz7;50MUX0ai-= zA>LZ!;BAfQ&z7kh2cpd1YTYCYJ)v=~UI_2oWVmjq>S8o%Wa%CdYZwyWf>LM#iNgJd zu-%ykxi z-4w5zQA;M!7|9iLjL-qLd=E`l2}@V06ay=rRH4~ufiep4ph77T$*85Tr}(cxbXz+- z0yW^>{EZV;-31S~=J;bP70PbNuYvOI@BtpfOIt1UTlxlVsI1@O5u@G34}kXtl&g3V z1UveO576F7P&+IFEmuPQHL!_Ycm9x}i|HIF?^FEdV{04gV31d6qm*kC=WrWk#we0O z_>9)3mm>dZ)7`)Ywy9Alf+^& z$AmaOE-n=)FtpM>jwZIyV*uR&`C00 zqoDz^Uczr+>1>fY3@m(^wz{gX@CDyT0o2sc_k%{lwIG&GOsBlbNJl50jh(#*NPU+9 zxCstO9N+sf#17-7cHm%D-8S;}6sQ0Gehdg8m%v~xwS#ID7;hw>{#&dVhQ}>BKCu+T z-v~$Rnt@0?1xoIo17^REi9_Ub=j_L6Yn_v57r}-B|Mm!&ZJgkUWX9V1kPdaVz~LF1 z1xknSV>F`8?Jo|Wm3_OXfUq+HdNUFQ@K8ke>H)*#L-1GsOP>s&{f^cKOTdsKDLHwW z>H0K6ix(m~9*C?Ql1&CWp`wVJ&f9=0k_gOXH&96EZtsJ!Xzt#mAZIpx8}pi9Z-IqjalQ%*pP+Ztg5(cu~|N3IvXN69(Y`Fh4>YJs|s`%$M^;K&BzB4lw%o$PKlwi(CHc6?+QM;n71-vco6TJK0g<5WQ5n<%H8S{_6EJ+( zyaAbD3EUo)_>KY9ahJK~Ak?6IQ8Sn|?{}x)2v$3(Zo1TF^xYC9WS0e_x23bjpA1y8 zUn4b+5Thlg`PLDzB`{xY(UsEx2IhYrD=JUpuZ%-7!K-RG1V@i$pmd4Ls$afp#*)zA za_U#Y7N*4rz7ODGguBecEe%sZ4KPw^uj>sEY6ZaANM45q_-Zx^tO8-r#G(uCy-}d+ zzPdVTLJbH*+ocq(JAwX{-K@$X5jf6`CemJWgl$x@sd~S>2@FhJB0RPqj}4JRm7hSe zK@&4gSMKtDQKqKN1qeIUn;TIt7YV=D!^)=v$Te-|`mtI!djOr(ziA~Mx=~O0WWf+L zOOF<^y;o?<7O;s)T9>rz1;oPP1-~CEi&_H}mWWF}5ZxoZ_N~u=es25kQu#8t|6?it zx&mO;pg?5W&E-BqAOGOqwT2SRHJ&kk6*x_=W_Y z9gvi*C%43){KA_cOM72SJB(~pJ5GMoASX#x2)Tt4BpSlNNPNJjxE$Gna;2p? zziFU_-5|`cB~I?~LXk3n&-d{pk@j-h8;4tfA?=s7VCet8bff@tJCJ96Lg_uU7XtSb zNfLV^H-S8`IkhTbw*}JKlF7vTY5%|r*z3P!|N0{tE8kv@>B!-RM})o$Cyq#D!TWzF z!+ifglVK`$Sv%6e!%4wGryOs%cb%~I0#SlP)3}{Jfm)^*fjrZwwlN`t(;u|67T!GS z9bHI0z!_mA4kERZ-2$TqjOhuj8mCv7!MDqXf08|1w%V${1)SI^st4JAfX9?cc{d1a6lO52!G?Y#) z&+ANtj1in1U=0Aa7+kx^J6m7Wr6Fh@p_MaK}6> zrPjjuANR2!Cnu-BtOFn1L1jMl`Wgdk;VzKr@L1=fP-|es?6K4Lb&jZ*7`IDVpfv@F z8as&C;KTW9eSsJ^*}z@|9ZUbo3wnTX8-9SSY6fXhikM zUY=k{{eB6QG!?9L6Cx&AUKDrm%^R8wlvW*#tV|{Wktv9>(ollZQuEq{{l`W4c`r&0 zK|HVMcLAK39T+E3IhS!57eI+_k1GH`NyuZ%WK0kUpb+kxMy3Fp1>}QjI}Zo4ljX6% zixgIao^hEQ_zFbl-~w5}FikQD{63ZcDtqz-rS(T)1RH!$Ug$#TL3)bfM)scWFWOyS zU7`fRlpjc0Rl9)_)({SKha1NApN-4-uHQEZCm=r8%p5;`p^8mOs!yRnPja6i8WMaH z62d|RX}=q#?{cH7NU%xH=Kk5QA~qr#ksMVp;tIQgLy=b$c?+9@0?W=Qh4!t}xtXr} z#tQ6wDz|Reac6JzF>jbzq0Vo!x??lnG1+f&r*k*e6r;LhWHVolXvB+y48aN{92J0` zISII1+qn^p2*C8nZLMov`UZFlVnk1Xe$N@MUlZC>>^$3e3|Il!jH^UyqGLyyqx^A4L~IO2hby)0Zzn=ewO)JNIXco|9}}9Yu3Bm+z3INP7|O7 z-UiyI7*idfk@=b}<15(_ZQaF&U^z=#b3a_y2Ba^?wAP>NI3#r zWc;hPUA*M<>V>2)?E>E3JOnS3T79KFcec(Eug{RS1M8m55G+>;j6~!3JCS=ET(fN z_kflT0bb2XpnJ9l23)b^3-G5ipwS}7TVcBtR<{p^pgfOg`heBn1}|XIk0bC~Y;hp$ zeJAd+;1rsjzxi;Q3R4k6gvr96Xl#yby@NulSpbRm4#CT&%VTnHjZ|C=W;iA85`{M< zl8|m4Mt8jNyHC<%>luH;VUh)`1)H)Y7uFo^xlDNHK8n(@x?vNCeXlHMl7wd$==Z7? z7OY;E!zG`hwBFKBURH4drw{D8!(lhH7 z0401CY+jMNT!D>cryc~*QYS3K$yg~corq#mYJ2yaqA(F8QMV}uokVHsFF$5DCZ>cP z`fKg;@&}7Ag!Pg~d3Ms;w<|8E-!pp(m`R@Ywx2?KaYDF20Jw~s;8tXti&Q>KO-ZS7 z%u3&b>W=;n4hSyb4%Vx- zaNe>KQdM_l^f9>q>n45DDcZP=0nUqufsvTbTc!wii_-@ul~$5pVn_B0Cyv6v0l2Wh zH(>ei{!>C3%J#|u)D{@L=7RVt_kmh2_K5+mJU>Ek;mSJUWgWO|c0&vrCVDQt8Sz&>7r z0*v4UNA9xQkc>S5jYWQ4fZR_~lLgw~yAAnz;G5k=e=|s7cQJ|c_%p!hnRe~FH|UDQ zTI#^wjEe0pt4Bs_zn7f`Hh!_BQ0{6!VGx-|KqJr$0JqL4ybi0(MC-^~X>Zs5$8|vH z#!#WpX+9|X*I^SBBv_@AP;+1mUz_*EXB{UclYt8M3i zmmu)}*2U<{YZSK%N)p@IvsI4oEIj_$4F;bB;EuIBq=-?*XB-eQmwCmXh>zhtwjgi{$Kb6d!K@HI2gMGWs26wJvGw-Ub9a+c-+nemeXnLp@z=wf8d zz3a7_<(bqI<4=uxuOHC`WxCQ)aeJfelc>kmxQV6euM$p{w9T@nnXJ_LJF#j|;Qu_9 zzJXkHOnTL>dd8<13`Gu^zDRjALpmf`QdRI7^`?i)-vD-6o&NI+)zMOmN!aigXoIBC z>xRz;t3%(i1FpRB%|!f>0tvV6fU%skfOP^PxOJJ-Mp3>4AV?nr<>Vv~wM<>hfi#Qi z)h^(-_J4o1ZjIti16MIDLs#|vRBS4_XNL5Znvr|Ij}Cgp5rA{1B~yngv_r^Mezb#u zQ5%_^AGsl{tik*cQI^{-X?d|(QQz_K*efxapOJXsG=X8WFy#QEUOoZ?hP3a-n^tc$`6_#Z=K zi)BnH7&)U$JE;fAA|=P(6E8G7;$~c4?gmuXx~)z~tY+E(-&o0+?bQkpJZ&{b=@EBR zJqwfseutwh41^RoS$YWn_wi2;IZs>!j7XD>9zTAe{6}811y=#^YJ_YfW2)w3Hv!r6 zn;N4x+tUitxR9fELi*Qx4@hwMdW@g={bp{#={50bsVptO!R{N8mWe*_Phh%SL+f9Q z-3Hr%y!V^>^Z0av^GSpTN|)^j3aw&dHn1W%&1|Sut%`+U>VrK4Z#9JIVIA7;eMbFp zZ2f1+;s4xXU9>}6Af!8EbGQ?OK7j@9S~#I8bUlgv8!Ku_6bWLv_9D646H;D2AUkA1 zzYRpdz9ucFDlL32#Y4Rxy`&`GQT1P`z{g22CD6t>)lIRO2;6W8$_(;<>O?A8)pw?~KtLM$dP9-&XBfws*LdebNV z*?%n5mHglQxodR&t2Wi&%DKP;@3a6|q0zG(P(&UD5V6U6Z@1rfbQd22$gk&<0T7AF z#C`dE7hE}#6l1zPaXHPn+G%>L6`%hrr~}nzQ&Ce-f*Od`knGt-1hlSk|Eq)dW+1e+2?YTg!8?F5bl;wE zul7t!OPc_UVaJQpeNblLq?3JJ1IDg8Iil>v(U=4~2LY=yDAU$C4<@95c@%h>SOeuh?eSK}7 zekU0`GYyjNyL~8AChx68Rn~C)7NraKxY+M91JltA7&2g)j27xLZ31Mn%t5~}DE>=| zO@n~&D@fzVfnM1jB(GIb6sK$cO@eYs@kivV4@pKXwg0iMgO8@}p90Lz<$4DO(ioSrn-(%b=LITt0Y&m@!#HOwZ z@>Is=E@59xD?33POU=qP^9MM2wNN@y2iU0IoBHzB)+2D+Wyko^=9`0VZiDKXhxi-KTg{SM=CTl`53PcUA)t_&C@yfMLH}tL1S>f4MmX z6@aHNfU2`ID42OHtyqNAZ1`VpKA8l}j`hJ_@v>;om9QK8ynM1xM&?BicTud3DN_sZ zV#ji6oCDgcZQsKt{GbbE`84Br6R2$YLMXY8z!e+*xFwD&h<4}_Be1MU_yT|*u5HHQ z&3|&SKuw7$8cB2kPzlcgmT`Q$e=|vo&n4|0aZaS?3gtKDq(ozG47wKKCR9uZvSUqD z-m(o?*c9H&h0u|rPkI7Llnd+Rqh#ya!}yPmVA<571P)V>{RM#Rn{| zIQ5nscNIAH=p7@v)fY7kKQ*8rOpmx}1fvDpQ?v34q3A&ObG*EcDKw16 z(d6jU?_~6cE>zGKH{gRAD>-m?&S(dKG^!C1Kp8sl5&(Pp|KmTq?;=MC>AZO&?z};{ zg&c!_-YJ!g#_*r%zKIUY&k5 zueC!O(msDTd2kmPOf9XyU)6jviWE84fCYNAAp=SZ-vE+(0@e7NH(h!6+Ogo(F>E9W0AEn| zAeXBzg3+fN80I9=Tv?C_lz_DScsJmB@|(uW0?4q(L33b}LQj<1pnA_9RH}(sdw2a$ zq)ui*+Q53xqObwQ@_B~e@u2kw2qV53>@u?tIQt*aolF7riKj0WyPD)1lwVnP?)&Jv zl&Cg=@&*7R>(Qeff=&A!G=;PJ;l8Edb{u!fT@5Fye%C@df*Hvb2BekWFAxBJ)P29R z(nikVN{~j<39RxW0#+#j5u-0qBa+It5mtDdGgtY0-OYr9`4Y5iJ4DU^EBNlBvT0VM z{ohJdU{nT52@~Lz-zs6EqLi{2$t-`yEJ&sBy@UnnQ4yn^jwtKF762_{dv+AbLQr}{ z8#=#V9@u?9F6ld{Elr2#39%dZ6c-hBJ2e~`r9WK-P2F+F?xiRx5Q=-gi|DmXdSTJM z3WQCbRC6F0-2xG>NA0?LV6SSz#VZt9=p~<~sQTbUou{)exCOC~kQCW6nII-%bOgPZ z^2D`$lvjy)8+_EMxH>x|zDRK5yd`Ac|7Lyy)dbxk)6aV|p4A8n7o~%skQV!3Fox>h z1mQh(C(sx^zWTe{We!oJcL_b(o*ZLuXgBQAp$dbIXmHkgfPCsXg4=Ka#1MX9-(9fEQ^Rw%j)k;hS;*o0E8YmG_0$lOO>iu6DMfTki#^ zEIXCN+4`v$@Qj;y^&Nur%gv}0FeBDi+Re1)9s_W)FQ92o|D`2&U+V(R{D+8o;HO`J zu3IIjBbWh4OV8NPGdck9NORx2eIevC*fS=QfRgvhNopl9fOt@B=wi!W&J6);#=sF5 zyMGC-fmxNvh^q86kIzT9^&*kM=0A2o2i6hrl3op2e!D)dZgNK`t~jnN=Y$X;?6bW) zWp<}MK|4s$mQIWTs}k@O)YxMC7MGS|&isL+wfI|@?ejTtpRSroJkxDZV({-=PuCEo zP*@B}OoA-1w}KpC^UaQt4%c=&nyDh@d;nuY0G<4Ixv2BaSxV=Dj%1CMs8*V!FBnbP zdmI9~HE&wBo?M@&x0S$Sx_R#ZH4!@9NKS>xm=p1GQ>aS%{rxHdS_g%pkf@^8V5PeV zlYsr0C*tqr@Gjs=L@rX69*MT{ou4I-$89W_^!2zXsg6*6I^aOwKJ=H(N&Mh8-dXjt;Z{>Fk}d#(UEDxas(IT8vZ{TmAzbeQdnL?u#~^<(cY_xBHZMi4P<0mD=GPAlacGZI;S#Euqe{#8DJPNu{e*y3%vzX{lAnbbf z`fotII&&5v=1XQaQT~U)mb90EK`LF< z-zQ+-5Z z#mC>oW=~M@0%Iyt{rb(Hz7u-OvEj_;Io$0htUCpThW@)Y<)y}D*_QyX1KZADI%Tk4 zJ^@R1azJcHfY&CHsH8#}P92$cKr&tRYQfCa6w_J@;xCO4ilGtCO_OH zKndTrLt*n8fN3A}$(IkjptFrcMyypt>rYAJXDl$HI8)|+qWBk`E8$la6;_OG*!WY` z*rdumx3;0LhE<5vMhRV2>PUFJP8&Nm`9r%-@A_YKj{#e^R$?L=+GGAFmXucBsGgm& z{msA~q261`-nr#x5|@WRr&qen>i?+niVQP>2o-Lu7t}=_UB0k?gesAmi}CW6WY6)5 zN0$Htzjen2r(&|>%SwK&bd=>X@*O{~tuFMJf&_qS_nG3E1aH9>w?&ih;$0J!9hS>O z5XyedFQT|jKGoneyPs3?nh#TXBuJ2uny1$-8@`!n;N|P%v$2W0WOiIF|^tAuw+xj)uQJiQDPrOnJ z4@3>vb^yXMWzf=kMr6;n_1Pu=hcinnjMNH4Ag!o5vKK`2Nt#Tp_!KeN9nqUYMXz4V zlxXo{?M5FBC)B`c#PDeB5=JzYp>T-3WB^DgEq+>^SiAScRO*Y~H|d;pf zn202pK=XVgPwK7m&{ikWn0cnWg)ha8i6c7e^$&~AGi>}63qGkwRG6jdz#VXlPSPV6 z{cTQSKfra6c)L#C&*8ikNo!(MIHXAzau|%Ex{JtWhSm&i@yGYLK3_>E1hj==-JLte ziys~<Z~MNY5pNB?eB?QRm}V9?6+5;JqJ(!6&jOual40u8YM? zN495zb1{K+J~ZbHrr2C}jA$zKV-KQ@7ZP2%I|a z0pZ{xZd6#98NL>lL0hZ!>XuRfvsj}|&^XLFjCiQQ^>%pY!>)jIP&pXRNGDETkyc#E<-9((GtD^Wiw6gfScEvV7P?KP)s}#xppnE~5U)FO@2X*V_ zdKuYB-rnj<-eYTWCC*P^9XqDDl=`L~*LHuYgWllt9WUyH)6bL8mL%%H1<|^tBrSS{ z@@M*@5AHbeT*n#j-I&;wcgZLx(WghH%RPCWEY0o_lU&fR%)1bwX#e@DB?c~hiiqp- z(d+m+lI1p29IOXTG&p#S)j8KS6dkx{WI6M4EbNM8%fzOLzU7mmK*DmXvG_1mb@5SC zA*AMLM7coMU-b;1*l8T%99YGh3X1yF$fWSt7LI4$SbuNmP;|!Bk$xZw`uMJXt?)e^ z6$f^n-OTNed*JH5P6!Uv^lsWxznb*H4{anbBE7iB>t>=fGab>|0yY=F8GB*M(Vj4} zIu&zvyqbR~xW!Ts;IJ@mYxPNg{Qmq?;>VBlm#~NT;}}ERXzq3w&MN}ZW>43o zh3&>{13Wi0zw|lMn5}|5;e7n9Ao*c)WyT#{gsd&zJIgvo&Z~RV@6Fpc1NNrw$NIrf zLrTkESz@?YK3B8gH%vVyk7G6UEurp=aOkL0!gTM;set_~u!Ies&t>x-!L zo29HkF%J)&>N@=E>xgDN3P9I4HPE?k5?&NHs9Qp?5QIUQpwClp#X5FPY6%KPCAA9M9SyQ+0Q^H1$e0rAvux1#79?YNLONFPgnrD!KDuG0lN*e0jxjO05yjgC7%5SKpH!8i)P0~7(##`Yf5q`**`-=kJWf0S za+W{UN z!du2GKmkz>hKIUIg*m@nflBhNs(9}c1c$pWsCwYyS+fk_VGhia8X0Kiq}1+TfSt?S zZ81&z-^^f(Fh#Sy7wG&ys#Y86+Qn*47#RtyxMVAmjpGMDES1%iz}UqcAf*hc(9A zRGB#cF<^x4!-2IUx+^w~Uq_lZVxyc$-5Y9dfE(+H0l!Q=BxfVBHC|3W^8TRq_%<$Y zuOp55S6+e*toL2fHiB5G9GJSk6zAQ8WFHuf9_ueEN0mSOvz$m56>K>FFb>Pj`t13G zuzJ05UbYfVsvF)_Ca>7^3lc1q-uHa$+XWET>($8Q*}GfMOn-5~C|ZCfV7r9NnHHNo z5b@kn&}Q1o@q^GUQQH3WYQ|R6pb(bL9`azwK-9I=r6LB79X7p&f21@#V4!esZdOnA z7bgQz6n}H@q>F1%c`|LnYE=1vZMM?x%R%bRbRvhqgICNu9alm_~P zi^!wagzAubfNmwH6bN351}#=b$Gp(oDoel!}1n>DTG(S)vh9@^ZSAj z6cYz_Pmsz#;)gfm2gV2D>yx*WsyJ!iZ}!=r>Zn4$rs594CaCrl81>#-9sqrTBo7`- ztLp=>ADU~@^}QLdJkduN?`GS7|B{THDEWvGZKbO%I#SEB6q?9!_~5fbIVH~ex0@Au zQ}i_j(`nFOnKv%qzq4^5x#f|Hw<{K{Dmrk^Ubza zIwJ=Y@fyc*32Tj0Apq51{YXG|kj=tBmBS@}9^!jT(Y|8gJ90?`Yz5;B@@h{ld0O4) z<&cVB5K@8m)Gnr}$bK^l?+W|~f(m73{;8yTx-kd6{dsQ1VWk_;3a=^H6W5PHzdIa} zT(8VcWRc0*{6axqG6 z2Yo)gqwu&rOr$;O>8T$DNiWgMK$X5hVbfdlTqnd*_ol)#nb_RuR88etrXlunzuC)j z*jJ}xWs9B0H}H3^Bu?bL^VeE?g-u1*dmlq&msn% z{z$yY3!O%PHc6fdi!PZ#jYV{XE@*q5}O?5+|bo?H6+z+k5)uGgj)F1ZYr(q@~M^1wzE@EUTmI;+2fdX+cCQ z^*n_akMu)le3pu?9tIyD6RbtzcJ%!-3mZrFJHF*clcp=jDB}spi@{(J@&f_M$aSFisba6elE$I7Z(Fh{io5=3?Kuv8L2j z*OwQR)8BqPx5Ye6Q(qijVbwx*KTstEvB038Ms1_EzF5jEe=B3o@;#Z+YX?|)5$=># zX@)1S8qqSUlvrzDUb@EWilsly!4@de^YrdUN#g2-H`~(sbk89Jl6@{jLR%H;z(_Vv z%fat)*3ZA{j`eKrdxvARS#nOY?IPjz;6XR8a^FhO)h#>3$5D*5s@Xsl(6D*QYOxe% zZj;LTQ~zBZ=qce#)jX}ZqQ(Cn9;u93He!fsk^iC-&7+dGr%yL`jRKPe(48Asr~>P- z@)bQt#&Sn{CG2)t1lE~U%r%(Zi#Fxuvgi&xAWfmsjK}oWXTpxC3s*YcJJ84H`;(FG zNn7E|(H!JP*L?%KJC{EuqT&in*hT-%6^*&Gj7>!`_!x4-Tq6U*PsOtvVveh@@;Z`B zm6uBws!Z(Dfv59peorzRAA1vfd>>!yCw$y2jae!t?zUF8fHqt$z>woA*a{EXRFNaRrzB+T~D zIH>#4nretb{W*Q&kCtwlh|?7eNi(r0w|q;Da))aMQjK$%(fwxUpK0Nwba)D3#!T_z zL|y>af2XY=JulT3b*U1}jx~x`#dOP%T^Q7bOrVBYQ;)Jkyv7B|Hy)>&34i|kn%l2{ zi0ZaI4O~x>TK@B{t`RXch1Jm^zn8l)tT0+6%%JOB)1$%oql?P(zvb(n`+bF^pS=ra zho+Jd4|zH2GdXxac_i+E*f%Bomy=Nf)Er86y-EEP zb{9jK`7gRM*fi0Ty5wg94D1`{g&S3LIx=KV{M;%^?z5j(uOn`VeSt;sjVULd#PRsO za8;tnjN&*-e&@ zvX?=zry(LeZZ)-DPM~7yv?Y5&QC;EICh~mQrMMC7F`#oB)u}GkHt@`eh1^8uqK1}^8COa*8*Hl{eVz54WM)tM0;COQM^jM*vsQ6U0?&q`+BFXMV$$&N1 z@l)lL78lO9W92cV-ddsd;s*-j$e{Yun?WO-OQEuE6@mvUlIb}F$pj+9Q-5cl6HA0Y zgWt6ciK9ghFyStOE^G|FoKX5RXkvAdNVoP?H#Z#tSrGEN7*_p4c0XG(n6aPC77WWTTLv(GyUu=k9##Nqcp z`V*rs$=hvtyN)own^PTHprEj>WPK$d{bq%snB{?g%SlCu8f`8XmuxPJgrD9Ts?%H9 z4pGIUHPM&mqU^>;wE3`nVqjCYT8$=~lhB2J?ZbS!MKR(6kEXXi!A}lQ`n2a<&?LWp z=Fqg&-ow~Wivu?42A$>(q0JF~3e87>xV_Z>gR{4ci*kMYeicEGMp{5h6iI2MLs}{6 z7+RDL0Y^$2q`MIjY3XL@kXAst1O`xAy4mM7uJzpi{d}I-_kQPEGt8CeaUS{odHiAw z;APIH@F{9dtz<)vVIO|r<&MI^<|b+q`@}_-ucFwKCK+{3^@M|s`*q(Y5YdYdl77U5W3H#2 zn9`Kfn=bi`ZaEs?Jr*cZpNoG=w$$Un|Kg>5{Nmp(zetR(!LV~xEc%mAI^T6n)sQk7 z%pXi92};V50d2B^suHz$^yrsSq3^vi4Tz)3w`C|ZRm+Sg6v~ZzV*N>_BIsh2-*ev&wvCPGT#atlAw-~aI8!?h>28}3t4F`J686IXP0|}Chljf^4@zpM0ga=x$I8cEoBiT-~UkF^p?bU}xWqlJ2 z<&)|%a*fS+biNPT+(+xK1fRDr{n z@Cugt3%7n<3}okC>m_D9V@EQUQEB^dhh9f7KKaha$c_H?kc z93)8jOVmQRi5HTw;bo7pObO$N*;G|v%zvIZe?v&X_M=ZiSn^}Ev*1jMJc#^uJ{rD6 zohZRfg_`p|Gf3ZuUA%!3)u;fckuHG_-62QzU3CT z@WGGgtTxwfv%g`Zcw|96_x>Zh)DpcgiSgf?gN(;g;WxLr+ui@{mc6pzHriL?!xiHX zj)^xz7$#>JV}X`HL(k2h9?WeqrdFCM=C?oX<-LA&ExUTCVn95j=zqYE4ENf#hS^dV4 zBkGzPg{CzC290JXNfPduNnXz?b>xeApV5ikL)6lmO!3|?(sC)9T-ZRKETF|M?GF&J zp4!w=^M&U4&%Cix2CgNQH#~TGy^xG);Rf%q@WJB`yF^higL8_LaOVecH-z1>u6azL zmr@#wG+pg~0?nLu_+X|ZiO}fLb;dY$3d!z$Qr1X345w>iHs)a7W!VF3ooo@`I~Vy) z$HNnh;7Q~i%{WI^6vswugKa!EQQR^#=)sbY|1H@zQJh1Yh@D4|nxn=+>3rLqh7u#z z_(Q9RJW0q(2A5OBoj5%4<|sPPoh9kH-_Aeagk&yR@Xi?QSn_hJ45bz9?Hj50$8PPm z%{ajnyd6gOIQU7^oH0IFUT}X43*a%|soSicPD=~4h_34Ak`_r0n&7BI-mZ~spG{M; zH2!CvBMJvCOc-}LNc~f`B5Y%hj@H1M?dc$vpq#YB*9-BMyUr#xKapU0A8vQL^!Vl&;x{&~cgl@$!LD9izfSgqH!yUY_F_deP3|Y! zVi9iVjg@}#>}xl5ozLT=L`_dJxwH(F2njCCBLru@s%Py)bBs}%eWWAiY&y=O zQquTy(3GRA1x7GM|*RtXB1+E-l zPBKZ*RkH+(jeE(amUO>eB)RA_cS$Qhi=QRJP0o-ML(SN8ca|ZQ%P3~R)8dSF<9Wf} z9ee7YmD@#hB>YNhCL1D=0`yj*U9mFriM_oF+>a+lnnS^qi@V;k+E3|qd+2~Ws>oXR$?SlF^a$-3%!7N=e?@GPxezlAa zxOwxrXnleY-2F%bzFRJLXOtLK70EXPE(`MGDSiK5CL*?*&;th~Gw zRK3F;Gz6of;&M5IAAf(rl`fNt-yCicbgzIMRa{Y|1HIhZ^z)@^A&)gRQAe2rMH^(@#XG6FX!>Grvjq1&@*y zF}OUagiWq{Rx}dwR`>aVm4$Q5&1;T{v!KWCmlJzFs)FM$u|i1q{01eb{3tTC+j_b> zJ6Mj3{}zdYSrqot15cm7bsm2S1N85$$YI7?U=Sr`<-P(G}Aubdqnn)u;G z7u=Q_uT=4i{I?e%W}GdlgwvY6#HPul9f#mm3zsG6{vhd-U}Ipd{QUV3bbWT{bZq6H zVxN*oUndv`GeEBHcp*X+W#$*jiI{lCppR%x9=B8zRe6%iJjIGjNYHb1EV}?bwWQqH z(ss2(5BW%giSDW)j#hBtC)bH;TRG_Cui*zPAFyE8IE27>YkiF@6k?aMwgL+6hJB<jNRkP;HqHB%$#LofKnlS=MB2A zWnfn_nK`SB^W8Z)JMC*MEG*oYthWmgJEi+`ZTFu=YcB>A zA4Jct-zZ;n=M*u>sC@!^#ZaQbR%wGStZ7udW-qOOSo3xpb^Y?#W-|Y>c;*aTo z|FWcy(!@%0?4l$+-2=^nmYTGql=M;SSlzbFH6LdJov7~rF#GM4`=X(<=yExslMPf4 zL%R7qo8JJMZh*!Zz~L0vWJusl@0h1sZnLs78B*-SwebyUk z)6DCY2fvKXpvs(DoifG=9Sb_G-ha=JEW*7g$4#%!wCA566|lKCi3|Lby~zcW$y>Z`60{^z9sUXakFHxzi+ z4PEc&loy{_{@&EJepV+^lHS&4*Mz!!bQxIPV|zXOIzIb<@6Bf(&UE=v*f1MQZ_V*GxPw8=Y8kpC_qQ|KJ#5zh zzFFP;P9uHK2+$_)V}e*QjbwAi>cwip!!!%XJnEG9Y600;gALwCI7Crc(7&{J%B(`9X zfe_9lp`872`00}r)Pg9ygY5hSvD666VN22Rp(}%4>m^(^*g}}~;l^Y>UydHw za_&8m`1{5dVU4+#l;iQd^-)Mep${rlmssl95h1P9ydFXp_cnA2F{e< zK*yHGW2cq$(FGXQumQ=8XdR{el|=P;;nKHTEgFA_|9L|zW*}VSN1q`?xhhWa)}|vig*7<+-#LVkg=jcF{?lQ{@9z3K zO15-aWBPgH+JGGWLXFv34nkaMKxudF`=*C**1F7Crh-zTeuqcE|bj^$g;lpJ8Czde1OSl}&j|1M8QZ3l!x;0_dpy)PLY-rF< ze1(v-{yXkvg!Q9*s%l+tQ|O=wb|G7BvgzS&(Z;#A^@gs*ZbI<9w&IIf36<@7&bExs zN!1;`JHRz4@Rwk>uGDru^B8M99QB6fspCwZs={<((j^|PYh-*?>7DxJr1l3&(2SSr zC#)Z=RyItX;*)!kxZxi5#W!)6N#WtOuc}Gyr_Dcq?&M>kew&PPRP>4Rp67PIzq4hb zGB-Nf{jMdKx|Ly9@sTs%b>)kj?vthKSGK9%dL|YY4dt2h;R!16Js_^B~{P5~eWTDds+2jhE^=S!^X_Ix?y} zj9&=NTtj|aVN1_?xAgktySvME$uM{CRL?q_+_NiLJS*L+Exa$Ak_Sb~G|nAWPKF`R zQX2=RsCB-bzJB%dQdCD#X<&tI#zc-*>)Y6+j@9$IIV%|#>q$z{J9=khq|+xR?HmoS z9f+-m^Qs$poeSBGo~4jiI4j$lvmfT0#m-Mz&0lGx9EGahAORyJyTGBuPD9*0vND&e zdDyJJTv76V^I&p%=IX;_VYH-;lJ-`m3OVUCQP7VH{2I?f{j>Kwbx!zZvHYF#pGG#yfVpiD1S=D22TV^ZV`vewm^!2S2 z76~=T!=v3V$$4fqUD_0GYpIYtT5O?}tIVFt>lw;dWYjk(S`}?OqyFL>qUrGpM+bv% zB`mpWRLjfAY9MvAY){$ReA+E;@;E=0CgyUUuH@*lg0VckLfOvTmY`srt&v!GOkgI& z087;VkFxvTCtHRR-{;bIN(u8s{vOzDntbxr?41d3GE)87`l^kj>Vu6hkEd;y5)ApX z-5AeyQ`5PW*c2;cqQ@T?k;zq$Z2mfRby__=9P%}_c2hMR-_QBdP&9h!lCHm-s^x52K zTTYG&_UYatc*T^^9t*Q(b}Ke&RG&q4SIBr?Xz;UK>66m)+E0a5zPOT$+$h1{EB8O zH@ZqZJHr|DGhr)`zAAz+0U(=!R)rW8Z!D{tDTxTBHaMIobn#`Tqw?i~d01Kp5FTxh z#nsY<;-&WS2<1va<5!qHp>(%TwQ3?l5G*wbn)+BIBxrDJ=(P5G9P7n6l(mI_Qzh%& z22)eoV11J2Eyow46?&mYWx+aT+8tH|gH94yNbt%47{%bNFG67I9t_rk{iPBcWl8?O zPuTh(m^dM)2~~AMa)RM@=>+Yr&#CStb$njyhgLbJgKtz0py6C63?D=lG}LNJB+?}9 zIo+Ue@)?6|q-&BVZXXWBlXE3G5b~Y}IOsqml7{ zuoc)je~nKZ&gVvKPFWmoU)j`5e%LM*GrTiF&)zp})KuRwm#pu_<)EpQs^wxhS9*Hj z3MeUewP@jO+>&XUn|m2=w$xYb=6CC)x50JoJL<^c2qlH}h-@7GDD)IDvVNlP&-3I40 zSvbQojj&A=6*nvVa@zC*-%f3OdB*BTX2NqX!l5D+Vq%pBzjfX5PoZfpM`Lo+>G866 z%i0Mz9t@T=O~0BEGfIyML!1lN+PvwkZ>ys7MPl4v_hPFG8L6q==V^-4y~a959g{Z1y?>9Ok4h*xN^`>Dg|2As#Y@2#H zi5Rro;=(%p)&9O{5>{n9eP{??vk=d#=e&RZoSR^dx+FZ@s$!ate^Rebc}5g8#xs+q z(-4}l`8waIjY+4ZwzfZ^n5}GkOzU+`j^4K#+WRFj!`#3SZt~kZmK91h2OeC^cLjKd zGL)DvU2DjES~OqUCqx4?cjqg%P|}X;D5og(d7N!QGhO<*pNxY&LWKBPAbT=i3NOnC zqqz$Ek*Tq2O~VJ;R5fv(Uef&9SE^#({lvNr>j|NW?i^Nkx%1zQx*kBwnHkPy!^ReO zqf=i(#|(LjO%^x3UQshi`GCLDY&vnfcf5$RDi=0slOB2g0VC*kp5fOb-PoyWSI>N< zN54sPw0&u&M?>q1&xL)lZ>tM$9tTz%jm*ZHUsk?Ke0F7=`do40whU~(h^>U2ugmyD zlfJg;7lOR?Zqg%)lL2LMAH<6T(`-56TG3`$*+?C&XiwKV>ln-9p%u=D;;c_}WvhB> z$=TRlZJqARiO$r?QLBHm+7|PW+bX$qPi+?+eQS~iT#s$SCGmMSw~KmedvR-H7qo5s z!Dj_aSawcPxA^(zVl30HbTw?A-5D!y*B`IYyE@pHTCoYFpk>mu@zWA1cXS99vYVR_ z?cD+_OS>``vfdF~L|> z^Nc*%eS1^PDrRw>KmKGI8Y0sA=lR%h$xP(#l-st`W?e;g|A9}Maohow+hZ9jeC}X5 z81rn+oai#WRt=P#8wKq(SZcBP&%fC(|=#In12(jAcABHAwSFX-at~n)t z6r{J3v#YG?OQT9a^MMO2_kins@S4p&_ARn=_Rp zyZNF#wo1JRi_zq^ODtUsUF!F9r)#VgO?7-ai_5tSwQI)g612g6>P4q`>$`jL(GzRH zZ0&0Hn+nBrjQUCzLOjlRMdr+s^p-YLQo-=Xtwg1ZUTwgWXTc=27 z8R+haotR%_>DeWob_Gpu#1-SESrc%ZwJyPsH3H&OD}&v~cmbE-qs_gNP+Ngr7M`=k z)O3Dtg)(RQ#hhFEK(YI)@E$e`>0r*~Nf%jrRe*bJMTPNqIfp45F>s_En^kBE& z_OLxrU9QRF&d+(wo->{&4y-j>@6%meWFrH|GV`=-mcBQdc^+}7Xr#$)PFF^x5~DF= zi7d>N_NmD{9K~s9^K~xscotG&M@N>0e=F_J)?$@-LcJH)c*YNM?*^V_$Jc^I%&r;O zIo+h6w{I;keU@N2KWoVdH*J;lYA24n(R}OJaio}{S|l>fQJE@^X^!u#!il`n4TGCD zsEXx?<4sLjP1h2}7i7jA&i=ch2<#+;@6bEu{D659VT*70dGnK1noz^ z?mhJt3l6xK(yna3G3YPibGOzzUFZ8PACB007Pm$WaUPv|)7*+8k9+r!GU6WJnKy6K zhYWWrwij$V+V~~Opj{f*9ey?362b5DAKsfdeK;Cw3FjJra>rE&k-_&$V|w60D-|J& zXX@E9zV&?loE`F@y=yq`tIsmh&xfw%5t%eI9A`Tv>;NA2ao&=%?T2*pa^z>$E;>I@GPRRDnO@;t)S- z-20o@(!yOCm?Ws^O#_c~tiibsW8+(?@|J$8I#OG^T|^y()wl6Y~IpYsUQpN!^%VZN=zCgX-eJ*>4$8D}zO z&YC&uSu=rzjtU`@y)LBUsu6Oqv;(}~Bi(h?zLxh|yPuZy6NqI-RA?}_ZqKTg%3U3u zJ)SApZ`X(YJT0lI7OK(8LVNY-{^^a@<7d)>wREFzFAWzQrBfE_zS10BS_+$D&qoTp zgfmgei6qO9?k+lqG28f2ePL#0e~+MONMz-=m@j_lGFD~~m|s-1Q5;(X@lE8P?f42m zzk1?OLv@~%JntEdAeb%YfDhqYDi=0$R(+t+B?-lEXFA#K|8jVt(qQ9I61es01+M=$ zGV%t8BVz>;TZ#ZFkzMS1HJXQCSRB#cuU9^A$V#%{C{(a=$~5*Yh*dDXeF@QhE81HQ#dQ(Zeo*ZjA& z(QXXwH&UYY&l=;_7S`|*c4|Xj@6$#<|5g(ju=a&i1=d=x!xGXZx&NZyRtKYx_1Bu8 zv87k}tnR=KkX0gjy!!gdhnoT-f4W(jKZ)frvVG0}LN?laAKD)5;9TcFKe|qoW9z># z(N@yzW_?3PtC8{q;n;vVZz4lVg0GnI)Awl2yb%5vk}fdcB$Zq zCewJC_@9(iNVnZ@mq(4dwPI?H{?>~J-E=@SxK@{?_N_{Llq-9thTb3?$kOb>_qU| zB%cJc6X=7^$M4%9977IVi1x7mHVON^jbJf@ zpVX&4|3iNO3%@*SC4M3iM|ZJrc`xjf_fg>3VdieIEOzrk0d7VaTzz9Mzv+y5hTM)y zx70khqQfJVP^b1TveJB6S-|TmS)$3PF2{|P{U!co%W$zqku@nS`4{o zM9^k|%V!S7XbD0^7Nm?QGJH=|v7n|syI5A!Sp@}6+q_lhyuB~L<-kFLzkXOlx09~B za~Pho!L}uCXETAQV%yrhv;Xyoboc8;@~A~L3vy!Z~qK#p7Z37DGAu+M|`T^ z{(@T_GB>(jd(-Z@gnKLNw}NSL(dJcD&~liz|9e1+t{rP<)8NRg_Y;mMx~0(8NWVkP zs0a4nic)Y$0hZ6q6S_AUeOR?0cH^&L74fNz>LsF32$ZPhN7${8j%D|1H0yl2^#lKw z)6j>InR+^xXs~glP&b?s@?7AM}iWzOZTJKQRCf}sI_oze>peTVTtXzp< zlnRvt`j6B9_s_NQqqSW_BHp6dNfQ-VysunKMd8}o(`BBq>+&FRV@hK+QTow#Izi;4 zZS`njy#2>rcdaM;uBab$Wr%V^#&ZhT7~iQ8%T9-gF}(&HCZy1ZAjx7;weju-ekmu} zV1=Ri5MRapXDLXLM{qOvD1b6dRohyFoKiJ+`LBQKTJOrr>?g}Vv+I=7$-rk%0{|46> zAvg#ew{h=;5Vbh&_&?vFoceP z%^Mvsr*(?{lpR&M@`&x8wT(rT_BJUKmD_{@o=h--+r#hJatq`jR41|4Md=tnMju& zro@R`57Jak_WuWnsq&=>1oB~w18TIBpyO(Jjo}dlBm%6O&ThTl?Rl@WFBeO+R}Q+* zAPyyX8gq7=TQhYd8D6Ka)@K`P&W-@jVMVpIoYt?WKHY2A1%pCH~|grKltELZjA(8GnM49H?0@q*)D^RR|UBtT2vJnPyj8M z#^RU9pHPgZJT=C41}Xqjmt={$gMI|@rT`#>n6YG`J!o3tK{`_25|H-BJ}Z&S*?F*E zeU~QC1OOxCXpOy*`%1E<4Y;ymm2@E&CtFD`go+G!Mb2d*qDd*K$Z0V+^eK_Mg@^d#v%JNE>TtKv(5MEU|6F(U+<&Ucmk zC`uZ(gjTUTdUuz*sO(=~0ab)Il*+DU>#;tdK28MO*T<4oCF9vx&dy5^QdeX zg-N=wo9iaKQIkls_7_=T9^UPtEo|zR8cS}xWkyIgnU6eEP#YmF@vZ_E#A=vE1_nm( zizM%jC-Vs2BUqg)yz#)=q5h8{!AHUZ=3XsV7Ym8-K0CDlb z`S+iBW8EsNc;}uA&|g{nlYe8hFcEO3hhT4iGwGL^%EZqGrZw`}&&@zO?es4hlb10T z?mG8#IZ>^Im<~Vkm*7UN(b?|x4q}x`h*JO<0DSI%8AKx#)e9h3YrdRVUBTEBbaZ~q zGFcZfb$E|4L&;0Iye~Zfv+1ik{sf%{Z6ZA~A0i+bLIflTv9>!Ej^Jq6;06mKy~4OO zi#dqeDL9nG0H|<4*az9{c}mMPBAobDwlF$eTJvaZ_-Ov~uK~S)eJ)DILf}ZWzi>m+ z_xUH)lXEqpJ0XPfm{4}|LCG4H+I=zg!|V52?K|msnznbN14e&WWRQaOE&kW!D#qMu zU!B2e-47s08ZXj)zL_dgZk4$f2F&s(Sg)Ygn{e&731lW)G9-Y_0YsyXTaLrRsP1Y$ zzjt;MQOlYrs|lJ_2R=4HPv1BncQS z3)DuXdp~9^0<{x7MkVK*9;)F%$COAw*-MLL`2t~7t{jQ_de7-i#`u4G0X{$B`>!J* z<1HBSw@~L2!x&YAgvx>{O;)J?;Y5mR4)6QSPmk9N=FnamdHe}b3Q*V5B6~OjEf~f~ zkzr7&dI8a1*zgofodCJ{3&0tU0dm&aH}6X`h!qo1{c;sdGF1RJUA>##d{d(o&75R9 zK&(vxc<`6(Z1Wl+tZguduy(q)oM?0>Uw839SercW6tpr(@cy$;{&?aAsQLVWlgrqw z1)2`{Y$m>ImB4JFo*if*jbZsZ{plpv2l5%=`g2N3N;JRO4eNhEY+go6rq95}avVYM ziRJFVANPTBczNSa8%|mEO)vv9r$AMS;}|WD>zlP>Z!QbbJ`F$6Nn>q5wBg2})Kv&d zoM;_}o-`w?;_c_DfOmZqN|};FIhNApQ9#v~ljpG(P13_ho(bpzx~iepGJstQ#|QyV1q~&K zPH79i__;&F;gq#47^8=TR^)`njl3Jrwt+B%oSeD2bB+-}-Bbdk==f*(kF$W$KV@{e zOMYaBwF>|z5eI)DgbiRax6XNAd5#xDKEp{ksC!8C;MB~r*UT(-gNeAHEKsG3V0-Z` zV>9?&^Yg@JX{S~ITq8%(i~}v$=z=4KqKE_hi{Ovvz3~Cxsk9OThtzLuoQIG(yKI9qK z93A!?ozV^hcrNS@)hD$|5@rHJR&kH+-t%$stGdkrSli{m+RuAkoy`j?{qn`(D8;<{ zrUihg)IV}a`A`1=lb=;Q-$X`;`fKLBs0!uubzZy8I0nsn>41a1bslmRiQTmG4gao)VENtRPM{_* zNqf12c?J+y&s&8U9xYW*+f{(}o(Tw2bxEte0-#rBvkZ@J)cgdS=LR61hg=A6$#kK? zn-0eG4`-aeeJ0I4hh5%DC+s%-o0`&jZuT`IyfVjO8=w^VWMSx5KfBsB$xH4rl-$4< zY|(WDm+uZJ(P;ijAQ@z7R(sDcfng{(h{iPuXGRdf3^sufNVzr)&g7<@{gwkzV$ditMUpVv!Y55R)af<+5&Ovr(15j2YxMw1P7(}HfC@M#{4NOv@C-h4_ zePxjs171Phzpo$!%fhgry9PF@ZM%708sI8$q(tt00tdfWK3GJzoVyAh9L8(Ln^c@Nv z49keUL1&I0@r&OoTcUu1^lf%hJF2_%9EHP{@M3{{a85M15@dPnzTZYlObF33LDUMF zE0?XAN!bW$%Cq8LZ;_4mHOPdK^Ip$S1H?ss^KL>pLGQEa`5By7k%X@D`0MNCAX*)Z zA~@WM4x9Jb3lFCipVM_CyqiEpMl}>bBlNnou(-ar4ig|^bHH=>3_)!%93>Eh4AEhT zRp4<%1Z?h!QkbU=?zJN23m|4IUpUw#m{t4w2pXQ}DsTB2v)%LeAqcu98gQ?zmGTMk z?kt(fMjUV=gw`>&Gafvi@_B>B{jm`MdDvAbJqW27{|XyeEB`O`sB?W(|d0M zg`!q~vA*q2VEIz#<)!EkNbiMl=!ql~Ut`O@7}z>MHQP^{=3B{REQPm|2KYW{)^)~VV%7L zmD1s%|Lm*w7Fss|7f=F=Io2r-mqdzNv8M@qE=89}6t&D$W5Ur_atf^r9|kDSAkF(_ zJpr9QH)>b?|M%hF*DA47-4n$=z6bf7-MhngP=OpMrv0tKrNzp)=%8)}bSx11;e@h) zE<6zWVW7f_-tq~c0yGWC&hZHeT6N(Xv@_NvjW&RPr=_Kpu*O&b#g%t~%>p&cdH@00 z0656JN2k!f3N^w2A+_RBpzn2f1|F8p#za{)PzIv{f(7YdS&d~%-jKWhZ;Vh1m`j6p zh(EGN{lIyoa!+uBJn@V-i?_~z2F@!8j0#!bm$8c<;J}1#)UOv;0F{-l`%jaMf!bUd zpuFn>nKeTrS5VG^Tm;aL^Sl}aCf#mBWZ7%;qhMx!w(A(g7GM(`VF_yhqfo8@?$*HN z`s;gZATH(Y!U~|9kP0+RfIeC$pf*H*U6YU|MyvBfZCQn{MsfoAoI8l*CIBPV0-S9z zWL_e4AS2cuL{I}64l;HI}QE;`@yKY(mi5%x_DlhFM1cEft=2lQopT3DsEXmw7K%9*yF83uqu>K2~ zhAMvyCGxv>KorG@KUm3Ji<1j>qnWoT2q}>!9f5%h=&*W!F$4OuEQjFQckQ}>#>V5L zIdFSkCc@t47gD{Zg7znVz(ImYwi|%86af^l6=N`xNk*K$npkSa%xO zf9u52Db(5RwiDp}T?Yztjet_<+KNH0Q5x8GooXP^So|F%Tk$hy8V02l!2m$TR z??XesfX4a3#a%mTUs(qer-%T3sF$(^gk)1dhrtd+%rb1pjFfkJ*f_f!`nkS#+a}@4 zUvQuUcNaAUxs|MK0rr}KS@3?i4)BdF+FL5MC=-NLA`n80{u82pR(DzhsYN`H+CbQ6C5e zvLBtjAp5q<5X=b66N!FfndT_Vrr`xR>-->ibdya`%=35@oCSL4B6b9W6vU9wBT6Aje=a(SIg(NIDR@$jObe4(6eLL zW8EOE0QoWKjYE*y;XQ={ZivqMzyI)We1t6dZenz-%e4_>D|P}iY$}!U{-`dGCGN$k2$?h zLMw)gYZtLC8)w0Ku6{9a=acPiJuxso!VheqJS)BwBOFXfi~Z(ixq=9q-r~Ton`sU~ zWLJXc8yqAt7Xy_9*!H0a5Q3`eDrdYqC)QChf8qrY^){#bzxe^D(o*ySkY`^fkXy98 zyFS+J?cD%k1DfAMWC>$H{lsi+3gmz`g2ROtoIq2z{s%En>d9#IUEsG>=vKUVoXGg( z;cm<@6lf8FUXf1{e}xd#+y2i&2oDyfEfNh^uvP)q_Wh_&=D!Ym#ZQlg4Yrpq81tK7 zM4}T(62UXek4lVDyQ$in)1Lx1P5xk0kV=V`B+(?bmp27%>aO6aOatYKMgFCbo8ya+ z?|y*QUki2wo8GvGTVbpPUt0Yzr(fl!udwkCc6+q;u7T9ZEYOY^Tmy<9E@TI3gvmP69@F87*1%pH(&3q`;RDc8jf0sU3VCXA!h>w=#KxY9vAuHM!sZzvw-56+I zwciFe%8vQX#}*oSW{{|v-}2=F5N+~8IaLfvGROf30cX#}6)=kp`ca*wChbK)Gr|=F zMpNKxvlSsl9A4yb%@-#H#n4Ft)1e4Uvn1jQzDCGPbe>Zn9fThdhSl_LBKTg%Gpt*- zbBM>XQvQR)(O9jHfmJ}#g-YBDah85qR!S#9TN>RDu9&o#VYoX0)#(Sd9&7;g?=(OU ztOIc}AgzSs_*I>uW7hjCM!w_=Z9|uMoQ;-eZ=fwbUK{q?z*{W%Mh(6B;ZgI|?8;!e z^=g`P1fbS`LpdQ}z~Fg#J!oJvYy$0rD6aSQSaRv@ANjF=u5)VBa;Bvf^BcP3&lo7=qiOTV4Es#JUDT)IHxn387{=>FuSyBs z2W6PovByyrfF9N6b?sECG~u@mgKWk$xP^9hU3C8cL(o8zazVooWmiNXi^ur|ND%;= zI!OOFiQ=S8Hj2suN%a2pO#j2bgZi8Hqn)aQlTPW;!J3j6M|pt16IrT2vm~&gk5Jxc zpv=<&R5RA_-%%5Ggp%zxKuN8PIb zr3S-4J3n9`0(Bzy9-s!piYWRIDT5W^7$hEeDFo0#hH29s!MO%n(a?TN{>|u)f_!cR zNa_GRkhl0gpmX~S%4Gu_auqOBdLWZ+3$oV@A1i=xVFQph`2x0Ben5W#uJXmqHc-iI z6a_QF)i#sd!hmtR39>VFPz@qKugNa-SX9|`~g6l0?HotAg^2w<)O0` zVhvJTn=sZ5od@_JvOji3HPGxj14?24CeNopD#8+^c`8CV>bp|}?6*$aYGLqY(o`Vr z#N~DR7^sL&2>(6Rli;YHamWx1IY?>w1A^N33eIa!{4m{j?yI1 znp~Q?SV^_F+4|rgKqq0Ys00%Im z;@2;GkZ6Na3*1wn)|1L8rvhtm-Q*6AxM~8AU~o+c@T;j8q!M(@2+ehMlc9Kk-)+l4 z4#7|o_KT8_1$`JKH4ERdbE=Rzuk<@IL$URLs2Q~X0A5G#PoUtU?+zS&yuv(iOQ4uV zc%!tP`Z@%UJp`GZIyt&f*5cYW$ma)PQ793~w#`^kGGiNP*%P#8ehSkuS$GS)>kroC zeGXt}hSXmggf8br;82WDwBvt^c*gx9Ce7<8M&97t<&cZKF5UqVf`!yc;GYe@=1I~= z5ux0fq+Ot%(a4wrG+c!>psb;ML3Vb>1x*cgwtwd^7+0{|G|q1X6oJ8u@e(8PBTFDV z27!{XyKjCGE&6O0@ffOX{4B}`{O2wv&fs7-FF;|AC{m~A45kR(2F{3s-81YqucdGS zp+X$(6_B4^O&0dWa`+|L-{q;{12$Td1W6Pj0kfEfq zfP(Kni2WhQiIkD^f2m+VC!u2Lgxa%ErQ-}pbk6Eh zu4?`nM9^_%bat*P3C#pvdV;KQvT&jGNKQBrlfo5gX*6ZPC#?X9ddPthgrBs$Csr10 zJ&t8F_N(|(Skg2VEOHOa&*22z#cvp5#*`O}&CRon&lQ$!N+3tYi4A4v?{;9H%+ z*k~;8nSGfVlI4!aN=l2LjR-V0MY^>YR~f7|%#La{6b=>>pHlY+ynIDS8BVwlv~b2w zvcLB$KVByB!#%Ij1YQ*v1BTxesU+D;>zB62qmP7FVi4T7;t4Q|jJZX2yBR;jHKR+_ zYCuu~SaQWUgi~2?@V$FUelJ@cM&x?yBy>EX%s;MA789q%#P=*zT7iTUt+$kZpzw`$ z&5QfMKo2pfR;DC!+mLLgjCO!cgb-~oS9ut{X=wk$=o@j7ov7FE?A1o9JQ|7vyIE&h zN48Ohz76uvD@+!OVc`bA?#H0qb(YD_k`M?VQ;XVI0vg`(IRRs&NQO#Gn3Ff(hcYG$ ze={aqp!)*i(CDHTN{r!oN-a2cK&Zq}40JYISwEnUfuSZ;4a9o|`#l!?R}uPLFS8H*Co+r?P>VpEzH1UFhvv1}tKNSsmd%qrA z{Yak4wJyNCe)}0MC^(IQYT+jhLYFzkG8d3m(5trjU67+)MIG!{(p}iW$Elc#OD*`F z)Wo39>9bNkHz+SPfE>vN*Z{&Ss>d4K5)EC;fJh-qmgG`-c@c=GOah&TO@4)9{aWwd zlAUkhtD7rzTvI@(ccB-7OC$7SR6%LniL1+CKiV#>^Vl8K)HfhCv9q7R@2Y^3^E8W! zWrje0eGI6nHUPB}L!wC!&=G(8K1y}~$~#nk06GeSo9{**bl#^gOSP+iXsJi!(vWxH zGV3y~*$4XtrjbVW?SS8zHt=xvNjX!AK^PagXLhPK*JVVG7og$PH9i7vu4$U-(0~F` zGYh$_lJZg)pv+g_u3T3(OlyKFbyNa&Y0_8~i-5vrr*B&ouZEHbD21{(7lDUkAklPm z1kp$?!WUy9mA#9*AnjXBXaP1ksB8)C7IoH8^0c1^R3VMF+4r|*r$z07o2;zlyML45 z?nb|$J>pMbgDWVT^0Dv&xt3U2B87fuAS&R5&Ii?@!j5J`eg@{{_J@w<_omO%fH zAiu36wI{Xrq;D4Z-!m6bftl4q!P}UEuS?^|A2Yfr^7S6>(Nf7aaLMU^47KE^T!3d; z=jQVYs)kmB2VZ~GVK9^lM1RNS4b%_5;uR4*vIl~0AfMF(?W5WgyrT^YL4ahajU}=e9P`L49+m38e1U zPXj4*<#;pPAq@gHT}uNTxG9a`Vlbo4R~on1XH3Di^=^~_OzSZR175o?B%b<-q#h`9 zO&FVH0EV0s#g2Wk+0zZ%+Y99?mjFe7|4@Nq-Db>&T9yx=If!hI&{LwkkwGnh)1p!<* z%K%7atL&@1c!f^yo3JWvun!3~G@L;dCr}s;fYdsROIMmN4>;wRMPi#JlYl%=DWo(r zunh!*W?IO<1C^A9pT0OYpf4e!vLz2Bu(g0L^ce^OHqpy#nDNbcv$7NV~gc0Ju zx;XwghcTT+Uv-F!l$!5P2t*A5speNj&ZQ={T=w|y z`jh|g+>B&j|Cyj~=jhHgDiUMTGbe(KlHLH$$}_@I2)@vr;6}#(iASX?A|4IRB5VU^ zMPkXbg8Vn<2C-SBWyK2_7}bkLZLJgDLWbwDWVuwqXeKTI%iqx1J3kSZ)~kC?NEJ%` zQQUHn8py1aKCBHQqzo99Ah+~$8vS!oHzD~3jA*RaVyPMbpCOpksndhFpv za74?W`_T}B=x@d0CVxMl7Yvtj!qSvq1uv~j^HN9GgWF>HyHsuO9Q`mmR=K83f@r8Y zj#UT^_P_R|2i_b3j8VC6tb!eiq4VKcVy}S(F~NHh{4a-I*6{`}LRFBUo4h>^H!$bE z5a?W+2Km>o=`-|6%~u!O__Y3|UsH(1@Ac=4q+SZjzvDq-;TtFRG$`=Np5j(Nebn7y z(=D{*xf{`X{W?K4pe&fSNwwAobwAdC+?1_rOXKKfi}utu$5h)HS4ZYuDJMV|Ry@C;SFF*GrSMIjCU72Dadr3DFDZC{p-Jn34v_LL~lSus89)uY#IUM|ycS6MT zPoCQ+6_wL-X833YOE5Yhfy?7IMe@K_{3bu)195&8hl-QcTt-giNjVyqIN{~96mgMA zV!_-k$Qei%NcNi&Spy>KRkm5L#c1#IarmkV}#CB3W9!zvL`h96SwI7mfihJ01 zxkqR`Dhz>o&H+)>O8g6%H_c>vHy@N6?>)G~f7hfv?T~Oqa*rYB20v*EVfBtdEIBfm z_T6)Ksr1+lh}8O&cX@f)j`8iYQf?&1pT%6`y;CXIyEo*q7jW^D@Fq9X=D0XN=9}Ec z=I@tDs|C$KWKul@kgzu5?9|L&;qhJDtTe0L1kf@uq67o1ER&3%V@P4OG z+jZW4$`KN?pgcj|KLnVVy#6*ltcKpeBix$Jl+3wfmL$Q`N;i(|{20a8>O=fRXd;2b zaP3?nsjPy&1V9IJJQI7m`)IYw7=E^!5}aHR!=xR%3%RYekfaR2`;u?GN0^orLCBHT z>nDk2bK9TlJ`?X(YT=y3$+dARU} zR6#&|OH+udli@2}&=s6NvGo^&0PRNQh_dsgg8lGb3IqE4e9nm$nlHFUp9Of{R+w0H|9gez!bNW&<>dqaqsjon7ZZ)l%?Gnni6H%@BGw%j-Q=Qt&Ir!)9 z!ns~=3rO=w;z)gxJZl{fcu4xJKh=zziF0G0kS~SclIPs&cv+B%=YBAeRBMg&yp1dM zG5SjhQz%i*b0!lo{fWtx;od1x1tSF)hsU)ja@u#&yHJ0J^Ol)VTU>jOh&-&7%U7-5 zJ*%5_RAlHH<%4k%FeDz*EifNRzK9+}*zZ>j2V%js?{0Txd|8PvZf4%?-JiWjWu~)- zeMBB0sToCnhjabbu;nv4ogiGwMRfM-6hMsbo8q3S_swyeA0psxZy$j+rPnVU(4OeT zqQ^X`5=3ey^QHRaDZZ`kNDF_ui|lMTWdATDu0|}+FBYvG$eIQ8!(BlvC;Wf|6lnuH zTS8{eB6SGaJjik$kfkjiOVHIk?Z(M^qGM*-ZZ4(cUj9;A{PnqB((sP^N4_`VKJ%bB z?R`Hho131~ey}A-nnGOf9=fk_pawAYwJP2~QZTvy{u z>m=O}`SzN3KYe!SuY29FWFQ}65P=7L4UQF=61VT=wDDG4x$?~5vs7WfNN}9Lj$qothcCTa$u1e2Z=f23 z&3ITb2!%4=5&o12=;{g@MHiCsoYs^WQNYy%MF*A+mqIQO#YEAg9UE~)ema1}9XN(0 zxOkziO^UIy6)3M2g6fxwpNJWM4Mj0GQBjPk&es%(l+Oh9Vj(q6m0%;F11yt*kXdh6 zJuuu_>PNw?kp89BI}H>-N8FXq1E#VVLtPMhDsey>evZTseSx11664(-LwAvq%!HKSqI ztgEyih=C_ajCz_82C`|*)+Wc{)zggE=iO2n}CG|NLbV^C#tOqw5tYt^7YfgOK9`h3&*I4SU!%3RF0L1)WY9C7kl}6{P=v-GR({J zurE6X1|yZAN{nlZFyt@nd@Vy{4u3N zzXaIR)AQBGXQpV=nQLCz5`86oEf!*_DPkI|vwPGs=jOV6W&e3*MnCnok4>}P4U_ML z{ztx2#I?|{1_4{9o7^iPdvdmvFHegvD1v-^D9O@-Q}!`MLdMY}qO2HJ8G*3+!CqqV z4mM2^Q%q6J_Xhr3mR=Vf%?WO+DUAD*x?aH(scN|-wpa#f!0w|PO$@^f2QZ6JWYf6T zIkOe3Ic=#y>+!b^rs#*Rm{*kkQS;tQ`Qj4QrGI(YUGMDh!+=VWTCIB#0cX|;wJ+F8 zo3G8HzP~WkHZGs5u^s6`CJlPU(~y*Z$na=w#vWWS3|Q_-=AY(gxcxM}s?BrJS^g(& zaku%j1?&DpolHcgaC1{eihkwV^cp*J{8@az?ob+r7Ufji0$dI%eM0}_wsc&wu2)*i z=lL>k;zcyw-1M_88=m<(yb?~esU{$JjLnO!nkAQvAJDS(?3M;^*UK&YjDhr~y|^VJ zruppJS9F9eu^Zx0#ZvBMAE6;$5I=inwL3%#cUUaDHoLE9HQdAh8!~b!^yzsMeS2u9_n+v`{)HZ%2ghA;wc?a33Nu*I-1J5*)HgFidMNhl#^ zODnKa2qkDgH{b(#MS^)A)B_33aQBtvBI(hd3Q)b>ozLj8?-02v*>%Z_k|xYoyS=rf z%zXLN*dz9b&4n9zis)7IO^`cq2d4CW(P&JoZs;UzmXBl)eCmYD9eAZvf>$~70exYp zQg-IIml6zZHpBBRJ>Y+%GtxjlZ^&_n6xtJolq#fEtyc?Ltre?dzZJ zY_&WKUkoM;&w3U3I@`j`zfC+9AGMd2KJmqva`Wr;*Q16OHwvx_G#70YPkG4SRlZ9p zG|26A$ZoBUD^U_U=h=KA@CzF|`@QH3{Z!5!+3Iua^wv*!{=n!$hhIDzb4j0hw!eJO z+z_v1=-~LV^>sMolRYjf^CniOfZBOnllFN*3FGVJq=om8Uqa6Nq?rjgVAUbWTtYVvpd-LaJUtSXuOCEizpR+~!?vq`r! z^JtSJYY&NdgcZD=B(XDaug!akl{oNgbYQ!F2Yp64BR9t5OVnlnR?-0uAoUKBsIT$^A7u|vr7r3NV^Emhq5c^2>bqn=hLT6HXkWNWRSzzAZQkorq_ z=JFRA^cn1)%r*Md+SYYxt@#DWnI?r zZxn#^cS8Q+x4g)g-yTL><4*d(_z2?o)V;=MD^aU);JrXI~Z%xtJPJJ=#P>ly79BMEhsNucv*@2sCQvbn zqE^K;`ST$nyjl!qNaxWKUKSshr-z*7i)Hyx$3otp*FS((6lxN6EgQZAzZ5Upu?Jmu z?D0^f$MxZA6wA(hKvF4#+n55n7j&t#cqJ$+c~y z(Sj)71^qjlvH4>pDGgmaxEDE5*IE^d6T?owVSx~xS7-OVldS-X`38_4k|owU2=* zZwO;hj&Gxj3S8{#)}|;zn2#?0tn1h)q z!y-6}m=Sz7dD(Vds(!d2odB;pnP@3ZzT&3Jfc}bqpso2^Vjfm@#I92hdN)giaS?4B9U>s&#KsZ^VP(pUXf^e zUD;ypck|P~f>#uNfz+HZ?@0!CzLJI%W-Rwavm36y%aAn3a4aK=ed2v5_ftzbDtcSp z*q6^qwwaw-3dDn$2HLHkdFIjJDC;pODxGWA2xsIz*03QaY1j6_bYVKVyj?>tWW2(w z)AV~zUElm^-p%*1B-e~mv(w4$etDgu=A%f`VT!Sh&zHM^+t>U|`Rg2v-Ti#j)4<#i z6qwJiz^G5MGDuYXEHX1TW=z*`@kBYo6P99~TVL|0#OvdD-IH7T;C;&f~4_d#dA>@vjQoKGA? zrZnP>Y%I|#=+8Jc3?D3IljBz^XRf!HZ%SLMzMHeoz%q`?2{*im_O{? zUij?)TyrA2971xOYJWH^&Sdl8VlI-7eLy!-E-|O=9#oep?VsS(h#~OJm}idHaYk&5 zATjRT=-St#Eip434=UG8(SLq+&=a=5KlIMAKBhL675gsnW%g?_5&b%OMxt>DjZ}*r zSG`b@*u?LRdDA6x377GgX?QqHRfnhU+K0*w3xSFb4(tt{k;9&geL0edE1kNPkec1mJ@(vRPU&}8sq_zC$)^E60V&Dr6nu<& z7}DW9{-6C*2=jaeC~%jcX{`!6&}!|xh1?cHUd}u9BpP@RGs%`R77nmo!w-0pn}#FF zY0R5^{-brC`S%^mB2c<_yjby$RWLRS{~FVSV=A}x_3r&6C|k2)zCB6hzKQYa%UrmD zwj=i7Z&oABYVL>UI;GvY8-8oItSs4?Y^+>WLuJg#;-6@$m-3v!sZk#fq|i}eRWq7% zdpK?q!V;zyH%w9R9%ciPm{}QafYPmMxTWtxvFu`+qeCfI)+p)nWp!iD6OjES@SqsX zd6F5@h%e)^32~jQhAWuP$mnU=T~oQ5!^GWXO8<~}*BYmB?!KaublUAXBm#fo{zVzL z_bd$3bqv%gO}}04Lfx$LvFA*A*m;2snG~z6>D_iOanu8RX4T(J7#XCJ3l|H;BY%cA zWrL%Fa(zWn96>j?evV1+L6WTh749AvYdY&U!@Aif&s%ZMN&6fBig~|&6N5%Qe!00% zx8aYZ`kINPz>MpqThV7y$mO15<0#+S3g4j<@NQ=*DYaZ2W2BPAIX_Atn8D#MNQTB%%$Ix9UdV-4)6EE3P!?zIB zN#GZnd_D_TNKGqg;#aqp%w>ECBT#E3YAVf-4NRm}o24ixZMWp@5}V>>BARcj#OVnP+?ph5lMQw3;^pR&C8ee3&r{RgZ+Ya6Wm>El(EK^L zT0SONIOwrmE3hMx%q225hWG*tK}*xI=}B{1%CBO z6&r=0i=#M$iP`)mdeaO)>RRDk?oho5S`YH+P8XtOPwF;WY)|ksY9!mWO^|*gFns5ZUdm4!(7jMsS;}_lyC*ozDxt&50!b`yV zdbItebby>ua_H0g1{F#n6}>Ifr6eodjxTM|_cunK9eJpT3^x$c-`d=4BwycEAZ-Z@ zITv|c-}E$J#7i7*z5Vi9BB@vkelrcO!uovkN@!_r=FP`9Zi4Kcc7nlt_VF@jo-%Qz ze=<>v0yQ(wllyp;*VaRrq|O#yIEf?dzpp_=?JDyFJE-8wS$}0v)Fk7+AdJ&}RG377 z;>K)}Dvr2D-5ahX*KzUd2aX=koEx}tvgezw4As9sM@qdY>#s6M7Jq>>bZ413EkFqW z?p$Ah7C!@bBjJVU7iEub2`zN<4>S&N4B)mdq&qsu^-72kF1|ltNs>K7v)5@1*(mUD zEb$1M{WF*^mG{0l4zQ4!gQ$PWo6u;XHk0o5B`40g-{jQr`dJR zbWPa__xJq`lIWV|5*hhot_NX>KKe4xNb}jZl7^YPJ=%sO@@zaE{#OP8x+eAN6bdT* zMzNk)T$D2oY5IDA1FTVf0?bViN51t)V)GJTN@W*NR{OL&)BmLzA76lUv!$d1hThX} z=a<#kjeYubVp%*zYlR=u~2G_zf)_Rt{RZm!fE)1Rqa_)UzYYAoeyc3*v(p+o`*X{@wASB zl&9eMJt^NK(B-_@X4>eAkl6L%ze`=G7qDbDk5=J19O~p(j9j={`8isH%2djbr* z4!Sc024~r?qn*vTd%shhT`+%5n{c&8hkVpUTUEWr@oR9d~2Q9RVjeEvbhhE7_A(@4nTDfh7x--8O%Q@S*yJp$;qUw9>`?n_C zoBgqhIYQ9vZBUW3XQ}Sd+ZOM!Zg%mv=RRW0k>tBBZ+#OjZB#jPMu2tc!%bK9h3zXC zd$|fi&^kF%kd=O$Ye_7jrDc=`$;ujG{_4fd^q_8 z%u6@eHX^>e;i%DzXwJ8ZpOju5kvHs22~bHt=T!B4`I^h}N|q(GOxpAY z*BJ=Z83itJ?`?LC?Fd=-zr@FeHc!p)`eQkIp7uH$xMj1wEa02hh7wE9D_P>(_E)qLIN0wYZ757uYu0zQil)oST&qzH(cbi?L)l zB~eNF)ib1d*v4l7WX0M!U-(+reRmsc2 zr%!p!XE5bPgQQ0V!#JT=Js`-33_}NEWgObdW?5*cxwTC=N*XA2j)A^cH6>Ai+s0@R zR$op|gV&G}0?9^yGxAmP3^7g-FYG>M?hknwH4DD9ZXI^f+I-35rLxC0_6nuE6}QOp zKVNZPcv__~qw>6k7xHyj#4)*d1ygeW{rdm;aEbZ5m$x-uA|F!Tdb4lKbo$f(eNlfOg7TKi$KVHolBbX4^qSde z$Mg)!JFDun|MPs2@9zobqwcc5T9JwTkZaajo09h5Uz-qRx7lZ(e}UR&Hkk{$EE!&2 zpuXFj6CNa$LlpDhk8O}d$$&otLr6}DF_k7h5=THc^%l!b?e1oSxwPe-+~f1h4a!?2 zlwlWK)q)vIT1fosMsbIYz3)}4ZPzn;_-Qx}v`E)3;Bdh;=@LP9_02@$e;#N?qLXoOi`Ve*?Kn>yns>7*LZMu=#+N6+QY83E?&gNa^j}ZjrT3nT0{}{Z zZ15mp1G>wd1Dc=->`_1y(vb!sNM3zG{O#$5jP(%GNbVa1R|bJsjZ!7}DHF5F;Mxrw zW=Br_N+sc8e4h+{tEdK07_Y7G@kHMy?cdEBAm$ng5ARTIkzF8b%^R+LU^WHXunN`^ zXuxeH=Q6musp6N`k@>ijVOG!?y(7p1>T9c@_Y;v5N1R)M!w?ZgFg|DqtPHFa__Z)~ zW#Sm&zsMQ!b{2rZ*Zqqhjy`C$21&-d64)J(Za>=*wpd-NO1UM*?c1-4VQqYfgthUL zc>M8l5mHXD;Z6hOMz5k#J=VWkfD}RYRkyc@{CgNz3BBRia~HpzSpj)50++a!jtF>! zXT4klW^+uGT4P`{v~Cl{XvJuaC&^?&eiTVyu}%kpW-q<>g_!PwP7}|KF#INw&cvkz z?$edh6}u=e3`N(PqUuT8vuaSYaX>^$%%dd!BkY*+DnY2E(;K^v;HxFSJUJ`${x|gT zRpk>V27>Z#aeD)5K9264#cs5{NN7zX0JAaeizevXydVBar3DS+JjG zDtazgvUx23W^2$VPi;m49}r?QmeA0Vh`(e!8D#cFRsr+v0;zn*ie4dvC2|1GFDnP@ zO`1N1!}~+~1^(N*=Tp);*h5;f9UBxJDMyQR$L??#$7?=l3JtI6}5>~t*90I1u(6N(yd}rLVaD$w-$n=Buy^6P> zcxL#f=`yPjq4@I-xDMwp`%!^%%Aw$HK~LAx^Qji&+;M8APn^4Vb;e+?=xA@r%uiZm zu-pI4+G8wS(re$sU%cM7@Aqexg=Y;dJ7461(oE6Z&F@=X8ZfYOol*-3RjABqIzXQH~GZU2z!Ck z_Hrk95*Ilz02y8;x=lSXFZ__7jr3V!;#B!1$(KAt@bv9CJ~(UBzxkCEK3n#o>BJf^ z9@oZuv;7d!sW>pO$H}hPu`aUk$d+6X0BVZ8G`*6ermUBu%OX(H)M4k|6|Ff` zEMtf`PMwVJKd#^lPj|&qF#NVQvKxJM<3f1-C?_RsrULVz5Rj|BA@$=yL65-L?!C9H zU?f;Zm8!#~Q*__1=FGzFDTM&dx~r?J5SsXZI^MefF#{J_MhWf}a1H?Y2b>^wqvyVe zQQ3K?EdicU42WTM)i#kXE^V1t03bEix>MtaFY?{(-r+k8q4GeDM7WtRy+*#+_Tt{% zm$~i-C`gD@^`I>>dqqN40g_t0hA~)gYKw@srlq#Jgq|==Q*%}yUo4GXi(K}AKRk%8 zPO}&?>By%rmOPx&ZbAy$1ZW*Db7w&(tDwVNmS8n&?nge|qgPY;`-W)$2iZblQT6WQ zxjp-IGI@pkah;alg(7lTcif*d6_*)#gK6+XE= z;SRR@pBst2!L77qEoD-8~IOSI-|Vj5O)ixmn*@T-@FpV|VCjvsh~)T-9+T zn(E15TN(PvUUW2SG5TOiROtJdj*xAO_Eh}?PDN+$w<8r~>|>MEbezK4+{H!}qdx#} z{l+Jq@?D#T=&MY@slw;I$xV|Ajg4*3i}ctx!>;8&d`Enwjl9umRfxD}y1hJF%Cy5-bK`koRbD%XMiSn@Q~ILB86(>py~Yme!bKK}tGbTe zx`kDWirntwyG_zY>ps1+P{bCN~_h--?o)oUoo%lX07q9VXvyPd&vb6Q!+0;+~EpY#7D<{-AmBQGiwmNan0Su=7vTVXOgy*$N=Z#%gg{hYFy z{AUOItqO*|k1OL1W`@gEs)oWeUI4o8@M-u#z(5rAbX2jORH?|P9>Qt{rBPE$&iizS%XR z#gIxOSfZ(~dpVDd>UF2y6}K+i@vg9{HSgoY0;RWXrQ|4!5`n_xYp-2Awd4E^o?Rh`awecNYolq1n z8NrWRj@wJa&M7_b;uELZxbKJznVcAH8x9&yE>N+m4kjE(}(rN!g9h!J(H%xM$w!v_~$>Nnu;`TTM~RF8Le+jy=6jMQ#8+& zELqU9cwBufvNTd;VmFrLDYP|RZd0_~6G^mF&1rYQJkdDHM8_KUXyJ-l5WK+}S&S@7G7Fyind7 z0u1H5O~RP>dgFPRm zzH43wR#|^im#pk{2Yb5L^Th8g7KpCgpuMo%nM`@d7lcM?}e;vPF3sYT}Szn zo-};_61KHEl(W^!xsvJf!@_)eD02A?NL;-nzH+wDa>YJtnn? z`C)ld-lZ>GvidY)mZ2fw&(#{RnB`Pw96~m>#Eu220-xL^bEU$V5XRgRzHvvSr=E2< za;g8_sN18#J4Hrz#wVp+lT}=<3-LYnkNPifM~00G6r+3&2e*}yE*ubXM6R4LwR1i= z>7BdZba@+p$f=amsJcC&a&L3WZJjS4OZEWE5`Ey^RN??+9dXa$Sp2j{I6e!Z0@ zY8Kb7QGN&igJ;R?wB!OMy=H4|3x|`hEP^f15eICqpbG5U3w1`{sY-;Xma>Rd-i{UL ze(i{ik9vjI*e_7x%&QXEUxKGAb|$o6z5{dW6YN_biP2bE|JSA?`V>#4ev(kN?KIV# zY^q|d_X?smypGS2obPMx`Kem}X!E>Lw}{AG4f3oE-r5T4x9AIV2eO+BEEVN^(yei- zc|2MrYp7`Y`JMS5m7QKwuBW4x$o#CB{kn@RJHAly#zIm=ebkNo%qrVz0=b@wBMn>HWv@;Tb4L$H)m}!diF*LN6Cb8eq3whR4T4F>J3zY zgHwbCiQmZZQM|DdqGMGOqDMKLm{&qtkBc;qMVmbt!e6EcSOkep%RV`~bIoHU;rd3l z;Qjs1w(n%ve2_o&9Kcmwe5@?P@7?S*p~28R0_~}wdyg(7i@wplAN`mbjOWWb_isLx?hRj_Ieuu^HZM7S%oojh zw|Z25WPr!Sp|Mlc7k{#Mo}1I%cgLqtoqD7)H`4BIe7hj+&B6L)c9GeaHqjjtPM5m_ z>m`qEUnFxH;z@Gn7tP6L$q4nvpTk@Uu<}1v?ZEY=t6DcUTX@`4+6QwNk}t^{O?3O!dO)&491~g=70*yh<1=&Ui4=Jp-+IsV z5*8RoCTgzcJxv0emt;mKyU6-gx_INS(ol_|kh|n_ysa`-rhd0Yc%gIom*ld)sI^yo z(B1_GT7h+zp?d$ZC#!bx$LB9KhmZ?kJ!FD%xJS1o4_PVi~ z>NWnbTs<+ek3DL!s#VBh)Tz(y4A!od(ZT&>^@GM1`8BuCjuxqPOoS-5$(u6N#Z~E?Yl<`p?lK4 zVGuw5W{ZYu61;6_a9`379?;MwJ&&Y!+OqpzUl+ac8`VH`I$<=M^s{Hqe zKfjM_mAZQu|6cjS=}c@onz5{jt@OsD*Dcj{I*aXL*Z?TL%c+*F+cy3*wW99%$0u^+wV<(i3D6@C_HALgBz zQ8<_ZmDW^8YxENoGX@kcbQYIiMdvrkKEF>Ik@DMz4?}zRB7NGKw!RU?RBR@JyQC4V zIK`ORBmvU&jnP*tUgKU9MyLDbWsTG@=_syzCzvWeC><3J?BQ-Is`g+laZY*WgnO59 z`>E&_#^)Esdy7Ahni^3uyTqbV#_b_@6us|LW4fBz82QZXI!`(piV=G?&$bdj_e!lC zX9RS+P+5ci*D32J)BC^c8G&TgMry)4NG!_&l5pTr+|6j*VljvB3#{?i_K z$G?+r{Qd6x>E)6k+v5eEnW;46J5vR89Ihzh_}JTTn&!VVO@$DuNHh7`uDt!_-Q)Mp zqj*`8;un6AO;-(>25ErW-me$40V$@x_`|={*qeCmJ>CELARNC)le6aZM&*r~J9pPZ z?-aE-Rj|$JMW^ui4+X`PD0>$*Me(e?f#BUEoU}{B9S_z&uM0kvqNu?oJQ2S2uEn1L zEB734PTAQ1ERXvo?%NO^cgUYDZ=mLtk;Id|I5!q{vc|EtRo*PTR-v-(g9QE7odvgr zs}?yip}uhH)t?tLbiIfnj}~-;S6{AP^b^-l8%+!*K_#?kjL`&1#X__lri_$Sj-vA4 zT%ewamh(WW1o=qrv0gau0yPQ@*G$3iG~&&ZoW}0(=^Kmc=Zm+tDptvkWUq~7njh6;QbN$VKJ6G@>KFb zvLX2B-$zu8MoJgAl^{+D!}JSIb+m|{?eB#wl(~h)Z6+lnf=1?%;u zUf&beEYKN*KqpajHH3x-(iP2i#q^yPs{V|4`z3e{D1@nt=h6gQQ83 zMD;*7)9b|?cyw0dFkucGP|7eYF*XrHD6Tm3jSEj${a43()5r`kh_s;KKm!u2mtR1n zhNSbbY8(Xb!yTR`)fW(b7FNjV2ia;J3eLdeKp1VI^~^YMy;ns}Kd9U6a1S2=sUhhY z#4rjIhZh6ba$o7X=Z}XW@Fl*CUpnoe7|{izU3D@qP$U1f$i9bUD8m1Zz2F6ZR?k0x zH_~w#y<#LwR(2xSkjqQ?8{Cc5pWA)}msgIin313?nw-#IKZ3>%K@DwDJ^v$;o;hWO zcd#FLXQLmi<=+ea=L}mJ*S+c<0GHC**&&54a&DtS)6_DpVW5(q+O2_@F^~`1zk`v= z*jvfMPU-m2W{eyc)b02{l?+1010TiE!JKJ zQuLQMmDu;><%1Ai<>Q^T)nl*aq8fdGv#utYMU{cPsBZc7+CG9uBh?f)@daD}_Pi+c z(l|hub&c3sZ7YnPwmyq}LCK)v;ZN;@-TCNMpb$Ye=8jS@@=Bpb`1cT((1AmoO4!lf zT6}e?rUnwRJqQ*qo>iUiDK>@}=sl2@eD||Ht5stNIn4P4-v$9bM)fE}Uv>aUO&KVn zCj7DRR-g;9YID;?mI;B>p@GlB(4#E|ox!9FZcuWYL=>n>R)@PAqev&BqxnCzkZu<0 z2jH_CwAYT`(v+~kqu_dIw)DBKVi|999tEXL+{2(JeD-bk@L`vRPzt^ESYNBm0qWR9 zdlc>Rj5E@(4VaK>0H#qVqzyzMJ(KrNgO7#Qc>< z2V=*e>WE;t|3JloRp9Nzaz@;UkUu16`r z>OLkf9RI0la=3qreun;Ng-9w3q%AL}H+Xj@MaaRHNipg(y*1N|MXb3s=u+dOCJ!wg z5pW4d_O8zFlrd&``q0N*2&3?$%6!X(oqdPZT5ljB&u{XHW2Ma~zhv z*WR~8ArO5;oE5?y`Dl)d0=a7qhGqj9Av%*Y5I+WJXA@|~Zy37YpJk17I)`6Olk|Qo z0lY2%KSS~H8E(Qy3I(EI!t##5dfSmV-(U%XAeKZFqToPUwl-dEyRDV^=; z&CDjc8CDVb<|~uMdH|jeJ9hGhcVaY01i$4pJEjWp-xK76SO$;Rp^?4N?Cuj3v@DnL zqi%2Xk2L&6o`DUYanwXZ&&%rxC<413i5&)LFo0?j@RJ z6A7iG2PU2#6MOYvR~gWs5=5igLhIj{%>Ru2&pAVa`YA{30xS0P zui*@<33-TQnMTm_1HecHN9HL)`kILF^sdO92!A?)QF{aDYG9;#5Pk#xepZH|`@{#N-!i??8{NI$I!m-7;2y95CzOCS01mI(RfHJNk$CBq--A8~5CXAPH z9LH;jc7ow^Fh?0TJgzGEF6g?bhVaKCO`lbQY5g>EYzvSfCTf+`!*$=23P8~_42&^^ z(0ol-ru&We;3h(Y-VkPE0^2p?s20P32~CFx9R(gU z#E2m#z63I82$qd_5Z0sxlR|{Ec?HmM#k8+-bJxHj$s$c2gO7DJ!}l0PE#_W0oX{QkJ_vw`r3S777rm+>;5V5GVD5M9ztggs=K86OvwFOxxZ#g}-Z@&J zI=jO?PXXunU2~QFg`OyQizT!$Yc}e>4-kvm+VLKna>P>_*Z?$ z9A}vKBvSnR_>-6@i9dQ)Gfe#qpAj1O6p-CkgQ*=$ktq#(8N2KGU+{dL04&8+(potV zz@h_yM%nlRv0Au43P5p7Zwgj`LRStP)Vh=QXV-zz(N>Dv^PXcDK+h8Z4oKb=Ta;e} z`1A4p@}HH8J~nHnRq_$6oZu${U`qz9jf_&?0*ryN>ROK{9Nnrh6n<1m8$2T{cCR}M zz*Ex*f47)o7Z*oCMc?);qW)K;N!$h7FgYf8AJtsW*-+yJ7vrku&zwXRbs?KZ8G4pe z`x%1_vtAuk<#s!BNm{*KlPI3ihquR5;_>fN1jw`2uwz64q8T}iucQe1(QSQZI!fd# zE=4`@@S?x>#;hEpsm$-ln8#kWB@KU44siULM3{cOn|$z*7JqC0*IcUu%zKVqKQjyH zXARkBX`~o%N60}Su%H98W+|REXCXMzv4c->f8R%B#m?)bL z*2EB6)eCo=xy-uEGGaqu{V9q;L)r@z5kG_ZW566v0XV~u2&WB?fuys;wGoVi+_>ay zfOPx5-t~j3T(K|;5O6)+aXd{t9P79Pr^=fsBDf9Xd#g#~NB{rgKUao@ozFYE-?hc8 zc!P*=!0&gB^#G${gf#v+{sjOF{Mh$1Z=n+%5~kCXjgUKW#(#x^1CS*>fDj+Q_eO{v zGQdJH>$ShiS56Z+V9t}m9#En!EdN&vz$*x4osOmp)IRK4XQ2AuW-*4FXL8<2x96!O zsp1;}ZLc3a9=e@WnY*t-^vlha7g+2?4o$%Sicq8bpl-hRglB*%TU(7RH-8{MNXilI zLdO;7*Ul0Liv2l?Ey7sE(2l*vQA4fYaL!K~J<$Qeur9|j@gOPUzixh*wX7YR%*)$< z!-JgiDM3vJExEq|660ilN*K{qvcJyt>lOFjTeug|)gB19o(fgwGGeL#O8MV+tpe}5 z!$;sPOi}QYk%P9VuML85i>()^H;i7d!2p++L{OVOO|BfmVTVhtWrhstbwU5VO_Yw~ z`VTJTr2N+(h@{qvM*i992cUShN(;rSKqk!QVNxSR70ZBQc0wGb&kwS2lp3a{ zsC!XrV32Vl(d|r33J8wN58@5N=8pI2r!2JiDQ-qdj3A5D^lTPhDcqoC)or^f!gc)VVlNp-nl#cFqL5iP5SutC(mV+C1|AN=K~_`&r=tQ3k6c7X z^kAi8C~l1Wp1sL>(@7&!=IwSPxIq|t@I4Mc#aVuScM0C#N^u6iZBW#L;DPo*+d-|ApaICVF0 zn+DObg%NtWCR{+_L(>*9G$&9kw!k5Gyjo^`lNQ#z-PLWanokBVp^^5J@aOWDf$ zR>B*f?-U!@0JB76e$x`b(mW<#KeiO2kZ~g*C0d2aCFK>LMA?ZCV+r;iTFNe#4rz#W z+9wex9i=Ct6GvlNkT^;*0hEFTX{n!$bcX4r6v@ocWfizN)9r*ds+!hmnIGGcxl_k`r|VGruS z7oRJ*;qQqLEr?XXT{o0lfB^X?hGKssJ$F!-ZpQoJ_$?eHS}6G8W%QtWto>Mta_9>( zu*J(9(|%X#LL&~-)xZ)GQI-XNwvQRLGsE) zLl})Cb-EBk>o;vxq46GO#{2&(aA57WKeBrxid5bQY2p7|q(WETBazCxB^cN8vCz>UXAnN3=*K)qz zdu!D;)dI%;8SAP07CQ#?Ec>%K1Oi=QTCbB#qo0vyjx%8~O6+MVC&@$`$QE(nMx1YN zNGE>WNm(}Yex98&)Sd5S57i&vbD zy8v8G1LfFmu6I2;*BXK5_~JP-3GDhRGK~cp9Y*DStA7(Avu@0PRJ46SMD>A*&iC-a zGO*eZlM+lwxAulH8(({zq`V$>@%*~cHoylj{pTq6(A2RQ2OYJa;e!uk8m^m|3yL9s zFdx(dC0@w!vj{?geevfZg3{#6M4}J^@n2Gk95I)@Gi@SiuJdIU8T#yfiyF`B_zp)> zjimR!NO?A{dGuw8H04bgNL9|F`n*&l;(qR z0x3mA9lYq}GsqGYjf>B0*!|}%1e#R(pTK6*P@YLzLv{Lu)B|)}yZXMT*gGBc8oMW@`^sCw~y$%z9v zZ2eiEa~r28QDb6I5__E~BUXNzOhlqz|LB2#AZ{)_Be8#Lh@jijZNyifUjH2(jCE%J zN#sL)T_D&Z$c<7^+O{Brqlk6gHa5AOIgm}Z{@G$_%rwR3%IF?kNc)6&YIedSEPB8b>|O1GA+QO)qDu2u)6V+X7*-{qv6?)kiGt1YvpzY z^ZZ$K_?QkkyJ$Z9e|<%Ec6L`Mw{Kku=y@o}7K4O;2<@XUenR)(KiQtytw(LygHJLF zISgt6>lg=!OV@Vxw!Tk+?_-aku^p;L?zlsd;2tCnNCSCcQUx^(8ic7N4h>etMh%ll zFo|rZB7}v7r0O9{ZIIDihE;;3?;Vh0#(fruplkkopfDZ>cf<*aACRdT)o?(H0eHIz zJVi&2o@HcO6&#vVNjK)xL>`!aO^)zJvfa=tIRUQye33h>t4$i7z% z$T9?FiujKbo_`)MaP2DW`?9ERddn@V48uU<#nGL^SUMESV=4>_ln>CXv7Lc(z3+@yh^rjfNMxcZsP?f}bm zH9u?OP(5L}Y{Pq8hg9H5f1ztYP{j$pgY+1{fR}XS(MLTw2B78y^bo8$`f(r$NA#eb zbn)xbTH>zYj=0Iy0?UG<#J=8K^#S&9nd9*M3bk0o6fY^6;yef?$n3X8D0pY{B%$k zmyBOCZi5&yV0s#7eh5-q_KAY#HaWDs7;Lv68NAih4NVw6<8=?f zuIa=mB_iy(O@utT^)Zw3#p9*d)R^{PD$o-c+3ytU^?i3k2z9-^I9kkGD0x3n9`l_W z$4ybMnXsf5g8>P`!HSnruLMdCpSkRy?f<_i+Vgh8F;Q+@1(ih!OY{|Q6GNTk5xWd>dN9qLKdt|t|Btci zyFhIo0yDQ(i~d$nCSW$;50$jr7THg}AsGh5wLXINud|n*_S^8CyTg=AH>U&iQo=le zxU}DQCp4%8tiPz#XfYMNnZ0H4G0ACX6;S@gmp{V{0-?!%y?Mmj4c}o#vIQ^t!UtI) zN_Z%LNw?VGr_j{l-qvcm=UN%~j6zn_-v5oe-hbt?0ZD+BpLrS85S2?<^<`#*UDSiD zJ%R#W%jl~7_2}BhCNiDF2)qoi{tqqQ_Do0|9qf3t`L^N<-^Sb6x(s6sY!K!dhwVSNZu4j%j zGq)@BCERIK$Q>PX8#7E)t-Cluab*SxT6zo0vcSD^<75JWE=D{OQ^u=36a-q<7ErzDX-{u_#I zb=xH!q6qA8N)mad&yeCWC{wMhI7iCLTs-d)rVKq?qwv;+6}4d~&ubl6FMGLEmV`@A(_rSX8~?*O95ZP(%CPQ_u&a#^Au}jtu`lti5$q zm2DTV`--4QgM<>&B?yXicMB>aU4lq=EkPOt2?^;k071GzmLR2+fGFLqgp{T7dL5cx)7*aNt4$*M3@pYSaX#7qu=PVq7!t$KN8%7B@m>ul+)n9_W%R^AjzfR$# zf1=|b--5qS2kv+D3m8bLDdaJElX|P9@nqR4$CRDAEnURb4u-hxfMLfsdm~#vv1~n>f$J5iewMj$HOJ*w!^)}$$RTeMZvwZSk}gy%3AXYO7kHbbx2g_ z{{#+prkXQpgj!6pvjF0D55$v!6r+Iwj2c@7xVZ;K%t$trzA7r#nBAa~zYx6Vcd|{7 zl-r;I!MH~~Oxg>Mj0uT*cS0=?#yO$Jx}hgbEqbro9m5_RUaF}40SZhSPR346I6Y{Q zhn+84y+}$CzBn_-iOdgQ$lLr%X;9^JRS0AHNU{idwltVO>+|72DT=C*0dv~3e`Jsd z)tkg3q-2aTskQcF~6(97Y?(~DKW-~kO5Z(5e%p1GW~0cxQyTJq2enN~6`1)JV| z`vW9{=r$j(T{3LCG7dCv8%UU{bgY16*fZEa=3)9DA=hJY>lc7X6YTe`(Nh_3dkQGa zj(dA*Jaw%*z5Bw#8)EYx#Tn(4&sVStBjxlSa#~~N8I-IS?go@52h7@z7Mz-z!bL)d zl!j?Lj)+T=ULKIo-m0?n65{7Sbz4dBd;;mM`WCE9o6(Fn7Ky?`s!&99cak?~oo1w) zA5ZtS1_X4@LfPNVg3^ad{HbS~BvM^+V3<0@&)om>ff?rmjOar?#ft)P$CK^q^r z7jTd%;}gQ9uaR>HITR(vE)x3%aqJtQPzUEMU%1m0t1OTl1V zMipvTNr0z~pT5awU?5cnyY_*GO4txQ!C#FZJXTIa*>D47M^KK0ym!LhK0<4c$A7hL5^eQK}Q)|*0^PbpiQ&KAX-tL{FF_JdTnQhyU_s~CP9 zAyN^469)Wsj zEZ=oz4)qK7H;P~+iH3JTI!UD2XE)vbM{>r-+s)+RiJ|8LQl5Vkn0JB!cEa^2Cs$^1 zagkSR@XB<3P-rjL-3nHo3bY@+}NQ-V?`x|~VMR&sBJBGQZAbe>r)h56~Z z?x8!r-_@TO!^Nbn)aTb>Vmz*wzPP{;Ppt@D>nJz7lS)wZxKa1meM>EtC$yA;i$NX1)Z!M>*djH=-z$B8gkp|Um4pOBy6 z(4w##|KdDA=wBo(QbY=>D;b+cE`}_Ud)ze_H7|@jzx6pQm@?3sqzIc)1g0)8c@s1; z`#hhfS1_jK=p*Zs{_4_9xb=@_Nx+ua`Vq`xe%eC0#%-|GX^|Q8k3RjAH07}flMk3yH5y4B(y7gF-$8Dt!H;3S7Wi+b8?Tnyh3eWqcm?5KY#EvZODtH7#Wm%B;wVq zgg@*1M^$F^hJ=jto%xVY{ug$@_wY<5C*=M~#n+;UMNZ7~w3^B#4GVlKS! z&t?E~lY3G$x|vP?kRaacoj^R)?zI`DLpRM7b6yo?KG_}F1xvOV30(4h%kbqkP5p#h zh#Oacsi{wElihf_{w#jV{JF%U#-!a{A0|6C`fmTw5J7*sD>LWn%3>J>v3Op~2EOSI zO}G4tOJbbwWBljSB_IED4OjU|u&$GIT2aQZH?U!g&m+TlsUn@auGQ3@Ds9WUz9Lq} zmm+Jt$Vk|I+x=pMuQ(z6AC zbhb~=Q+7O56VUV#owR5Vz+H=T-vfis!lc>a^;CgSpC*-fPZDOkIH30<`mCA)PBp76 zVLcE@6;cgekWq?ZS`SfHubj3>)wvY!b`&_BIbA<}Ob@Mbzx$|sylt}TxCQZ*HzYd%@J&whle)=j-5@4-w1vCA~j$bDEY}^yM6vR z_;U=81gUNx!--*)+d8*SugaiiaV9;#%vPaAfLdLurgn+i-!5Y=owVD>P)}C+$Mw3U zm88kX?(k}HuMN|;$6Fn;JaWTAl=m_1zqaOUf)Yx&_n5KdU1yhOk8V&8o(pu?cY8yU zhSX|-Rh>HxBTTT2saN&0?=NHhLhNyc+tvgww6+4^rmg_Q@J{|V#mu>UI+w_5N& zRT*X?%><%g6GRo!NPwz?$g?fp=QmHyM=#;g;)MfC=Kt3&tm46QFA zu^SJq|I-WbTuvp0{6skUd0@wbCZD{v7hS|Ct_XXcUvp35jU&3R_~hMk{$xR)vowq9 zIAk!u*AsC`@u|N0+2F^M2x#k7SlDKAC*+K0puzTnVPIVpO1V3E7FBoR-{!HL-aZZg zE|~r7b++8SInTpfRyD$^vJh&K&j3r`FElPSIskrBY?z5_EpYq(yLjxV>7F&!8lspUSDvc`4qsfuz?_lxK^?cY5ZpTtLo!vZKAH zK6!Cr3B?m`uk``H_>nsBCREY9{q%P(`+rxuSGc<#?R@7^WF(nsybaG4X537Rc4X2J zlI7#bRax{oWV*nsFR5LvQWTsYCu#jh=-LSS;7iH*N&J<7M_+}saq@z46EVHl(3RF@ zYmBR7qtEE{ntG(A-tFgX@J&`Gl0l0N#k6L2>=Xv|>oiP%0@+IM%`1Fzc&2oB<(V(3 zD&Q%cShe&kt!D5{%V$VDzURF5D^Fyn!Qb|eWYpy=kGIa$SHbn=oBuX6b+RkOzCju& z9^cSDO{DTb@Hb}wgKAcWWLS8~1;r^UBez%@cG;{?ACg^WiMq>Z_90HT@Ah`Z?Vh%Mx;SGm>)-u@r-(uh2;|UB7Re>qa!3|G!A$!F=yXG zQJgkhqQa)>VR~*!5CA~P@7CSWtrVe6 zMmy5}^i@Xe)Ki*KDy*7vsA6BTVMS%(kCH#sAUWa3zIx1D8`OJCkP`QTOs~o~l^y|Q zcd!+N$KpD^lf5{yGFD9fj3w%~Y#JtqAqBkJp0tSX^}6haLoiGN=`OLD-m`2*iX;?? zk$g0PDiETiOYiC(9nh?YH_D`DmU=10kb23)RH}cXZ(w_;p+}BlO~W7M8+dI^j@Q=R zS!EUeLd{GRqTfphxR*G1mtPz0^X*FZ`P*LS(oRIfL};0SpB)jYij&zF>T+lzo~O6k;a=Dv zK0`&$B|rDNfl5DuU1-q-yy4o@z4^9u(qt?C4*eK%#wV#I&mw_GtuU~QcQ^#?4xh1l znhF$>5@pb=aZ4JU~ zdm9aqr{tgWC&{7fe4a>0fiZh3#!V__smy&t^h_3g`kt_vl(qdGUs zmX{-6r=I8D+92F+F}%9fY3zZ$4*9p_eHbbC=Ri5-qIh7MmL%3?6Vk69!JXzKahs0n4+Xn)75Z81e=ZL-ner(KK!6du;~>s1-xNk#i7e5?Z=r2;6XYG%kb<{3%A;DmeKS2yvJmm?XDa#%5Ll@qOTP$*u2bnOw~a| zBk6QLPlQpqr@d ziEhQax7DjF7z3P0Q*s1{Y{r$~is)>3;cT4&rj9kAAT{4sy$a1l_@|1dUx$D1Ym>B3 z(ozsCONY69fjWJ<$z@0c*EAMCU%~m-H;XfvLkO3sc~?LBb993hZV%*sSxCiW zG^SmNUoGs&4t-F%ALrT&C9UiC}I7pj@+j!%vT5tFT9dO}P-&1gL*-{H{5+3c|HsvrPx6Ac- zaiYrJToOOwAx-Bo_uKrDAv<|1yS7Ow^;nH#R(V!!C5M@gUH-?B;d9c)9tPZs*Xb+-s98S`R_8tIkjW!B?& zfDDwj_}4*|LKYMI15|kU5AqU*sM%2a#YA zD*RKoDaoLz{V|AE2A`JEB72f6LS><)VYk()oe$3fr^qc^B0MC{xBQaBn zqW{Iyc!n^R3oM#s2XFZjzNxJs@`-VI|81V%=TSd>e1-Ll2`iBcF-N5YS;h4HM(7>a z%{3*}o7?=(8zRla{EwM)u0o)uV566P`vW>|mL%(t$m8-9a+sQn$ugC&#U)YkV+o-LaAF78W8`+oc)#V% z@i~mwik?m5x4wHfgM4T6Fuw>rFBDeQ%o&KvIZE z(@}5%gORFYV$ch9wil7@YAy*E>f#zk?-b*~y;%;)bqtY~BNc|)@yefhC@b4p-Gt%b z!P0ox^MWtNZac`;5o%pkL5Y&JFdKUCAjmqTNsDz0kAdOtXk9k>sar_rTir~uK`UI_ zCn1j?4Sh>V>Os3L=J-bi7f4$$m!Ao+OE~-Qi$LsG7PlK8U&K;gambF*ApYH2^F8yJ zfBb!KGE|PpON&Q(*^i5rB{H&$t>j|m=Gz&^5?*ria{hF?`ZI&h|3%RXlGK8yj+B#P ze(9HK!S94L`BbS56tJj~?M8lMfC`IHNjfo!n^(`c9DUb@NFkmrRH=5=(D1(>M_*%9`*hIfmURdWf;3u-(Z=)%z5l>KCkyRG=JyiZyEk^myzOA z3seV;^=9o-`}!>Im`L1FJ@=2fySUE3cvy|6Q(aHTHz0+% zFard<;Ocy zN4Ow(?_(&IAbII4|ESwo9n}?L|Gmn{jSnYj7yLAMIcsvNGdq2`TkVmt==R-@ip|;# zeCma?!D=4UO#i(Bbpp&wga59Vzc)Bx@umoI9{0{_>30G8sIgTJQ@ME(5tsJeHlD5m z=T7BEUqvGv+Vv_iYeBW*Av3&J2WI(&G7YuI7GVD0=G<2Q|NM?P$mt2jR@k{MvUVvZ z-dentW+xT&_wz-!RXakTsouNCglmyT8-^}-x?BF_^P7{LXgpY1+;V!MDK$vV3v)v) zP&n`_@#WImTGJH%UP|RH=-W-(`882b?oAFkEsT^Ioov<*_dTS7AE`-Fh@hZnDNzP0VmQ^7d zqn^F;>lSA1_Q~maaYe+K3zfjOH3}XfBGORVL}aaY(AmON!l$s!N=9b?fVw*T@2;|D z;!V8_17ktH@_{H1=RKSMUxw#E|~a3 z;bC0_^)DV+7cL6t{`;I<-0@+*(_{169+>}*`(63Ig~I;asfA^g=TS;Ib z7M19_N_gM?=&1fox@EcqAO`=iAlNuHRe`gr?vU`WY7pBrNcJKgU)^>v51ob%OvqdVxBS9i(s_}UsZ&7lxS~!ob(lQj!`T<|I@d4)Hd_r z3u}6#!Jd7dyNwqIdqMgL1Jgf8*LRJ2EZb`v2#r;zULC8BDsYd>Vhrwi zaTQu~8Gx3xhfA&trNklyvsj9R7h{Kxi=$leJiU+I$|tv)XGMP}uh?&&>((c|KdAOX zlmjerFeyjrmLT2Qo6AB2Wgp9Xww9rVhfc9QS0nnvZ);n<@xgajg%ordzPlsuFU?QF zan<4BK*GvuzW1kJeKU5mIHHL=i9;hpAM6t-XbN+4`KWJ}7-M_|rbuZsvoeaLsg?Xz8?tY8`o`)IBNB8RY;lx?$2KWI z17$Pc+i~eZD>-+G-9@S$CFJ9k82A!(1gAozozTO01FvcE|fpEs!^W~pl?w2h1 za|^hrs;QiiqN&m^)dHIu({5E4ucF?;we}~m!h#-6+?b&gZ_1JOrm^j7A2#lXd^vsB zd0daK{HSs1o~8G?u|-J8VwmlS(17618s5rCReSU=on=Yl#8m2vk?rcy0B?$scU1zr z^IT~~wGRU_gloHZSMJng46M|QguKx=SlOc7U0q4D-^A-jCuexr)ww&ESjE3}tacn4 z;FrPP(ZbyJ7WkqH{%A$QYc*%RDeE#%_9|4pH`nm?*0n+tXi*ezG;8F zu5H()qcc`fVqZ;Uk5AV`H_`aL`u^Z3*Sh_UV&lS*`?i%oJGivPo@-86EM<+4imvNh zbu|{1b$k=jYa7&$)oB?@^<{*$MhzeOPy|(FKhfMH-jJZJJ)|FjRngpxmBw!$pO8R4 z{PT0-m}i>J+E*%}PvarF@-c(1H-*N^9c>HE>t)5}YF)+vt;eQ5@J^(i*=O;b0ONhTZMSwK2g0&1!(un8Msa5>1d*nlHq8Y+cxyq z@+uRr;jg~@5Mg(?dTn+PPMy=gMWD zHDT~RSIBPCazeDq&7mV`mosjxbY|sNBjRTxbZ>b7((K*gq8xw@Qrhb2n#vJzmh~px z8}pOWR2SWJiPhL@#uMB5;WBnt&o=Fo{BISDAg;*g#k zrBeCQ!imx^#wj1#U|HyYwikYIJ7ul^UC0-&l4jg$T;`I)_k<`(htFp|sM-B^#ab+u z{)E%?jTyd16|7`sVyyRO%n{d0T8INVRM&zI42()~a9l*avL1M^9bX%)GB<1Xk1Em8 z9-B`Rs&g&9zQr_JDtU$mwii%U7pkYODD=2k@3=5Kg99F+Wh@ERKrbV}3GCMxyaUC<18oEp+OCBOy2L4-5F&8{ z2L?8&pyxY)&^ous5t#&+rh-WeG=eg8!p)F3zLRLOgHSoe6&U#D6P^p%&F8Dz48xDX z4Y-Z%))LBHa+~oE4rVV@Gm>2H;-YsPo@R?^c}!71HXoFen>*N`Z@hNGFW~A@eZfNR zs6|_^-aV|VHsxjP^0I!?cA>U)z}i$ryM84{>AIjpg`R7T;P2Qk`cfQceF;u>Us$e% zU17s6CjdJ{X<#f-U*+~wRrQ$%3-8oI6vfy$-BVXe``*Iz=OG4rdut66cOJbfuX;C_ z$tbhL6H-R-tzhtbt4n&wvG1cN^e@gxh4LoZ_gWS)VQ*cAHw^BGD0ZB@YunqD+!!uxG|nOYWt zBdnWrw11u3-zO{7(bKav;V!6VEjXzu;N`tmshAd#kMsI@d?IcD$oLT3vZ3>R>V|=2Y^)cI@3p zO32bL+gIIKF-T1MUQM!356dYmHp%mH6wTMp-PLlVCco-SDZ24_6zmzxWX?+*9 ztZ^iTU2WYIRoGG;_S_@&Yj|Hqs~pTGCxrK7$Y`9T!xIw!5Ziw0q?I^bT)cE6{=#%H zb7$c#L*r_%8s2T0P8!_qxoRipgc;FRckZpYWlH#I!F;#x-$x{UueL}{O0p}XGEh4- z)y@-S1w|8I<8bY{6+$eQ=s0RB6f0eRY6Q-^e>cnV*l%KuPQU${c0=v~3HhntUVIS` zb4Axh58ZrP8!aJ$RJ8xci}zxr8Tk(>xih_}>Nlc!ZCj!_k%+4q_&c>{9#(rV$<}aw z3{jpYNGbWr`%Aa*-CIk$>iap@?51Vf94-dzgeoYyvFzw4*=H3bO-{^m7rZ%2&^LQk z=iGQQbKl!<@;-8AJSw^?Z(Nt_E0CEBZS2o*A+>MObIa+&+SeVw*l-ScZVE^2xHtF< zxcM<3$#TT@WBQXR?&)c-^t9eDny}n%EOc>DRyCgpEf^de4$=}7ZOaT(XHe11%tQwU zP^}0$xMIt2@?3QaCdj|0i+)m=uPWEx6)*Bg?<^5_nc0(?_^0byPJe8L>?%~g35ulq z1ZpZ@t<8UFVy|E2G_yY-V0m-0z=;O8@D^?!{N9zm>OK$qv1WVeOYu@^b9Q~^WUEvx zQipjiPlMVEINxbBei6WCl0yy@#XkGwc7e9beQ*wm#0guiuPw3Gmc=EQ_MJ~Wm#FS@|ySTo3tLmy_n{^+# z9KCArV<%XdKFxI$#3H*(!F}FWX(*VlB}>$ncRus=tB zn2k+DWTN$xsA?;e@pPp&`**h`jGHA-Hr5{5mZSS~cE4-zF#LNODOau-qtT;1&8i0{ zKA{=Mb6P@rDx13u(Hd(tSuG@zr(5+D)u)*XzqkwX@;(aMPZnEUsQCOPY{I`kgU_{o z%=vep3zf)IS>Kr=JgSe*>Zg2E!P05z&tKhk4mj`+a*Nfu9v1xQ&(hA9-L?1jf;Ltu zYhQD6@F(}zn^nCRK3wA*GIEWfqGPCiP~tFltqok65kKRS(&#n);SQxl1C(BXc3GL% zqX@cklRK-dHkzFz{Tl%}JrqAW@E>fk;0&ghkXkFtn=kE-6$!@b@Z=drF&e?q%w&lo z4gFHDDA|8)U-IH$-<_ukt0Zjn{K+IeFYy$W=da(ZJ@9{Vp>|sQIm%qzq@=LA zeBI<9Vh2gD#RkqODozsY1fX}4ip;GxA*f}bAJ~|HY#*@u6*zR@bpui(VuIyJJxSRR`%0` z!^G7?UzN0=?!O+>2t3Z=Sr2i3qtal49#7xSd!zs|8=dGloyykRA7Iut;)r52r)Fet zMlsG3H%7eFiFM;1)!+OtCf#h4+?rR7BzhU}Nx}$F3v+}tdJOc-ftdf|BJCrjDMy#z zy*|K+aj>ppGnr$aLuQ2h4gM+O+$AOrhGL%oH%lFRQ6H0|#>jT8DKOy_69%V4A@WN5 zDL8>7h?Fkre!zcU)UR$F8~@MWSCQPo)~{J{Af6nas&*KeR=lmRZv(pd`*%n)yQ}M# zDdZXNNxt4Lalkm2OcBz9@kl5aa4>5A{0WlFxWD3Z^6qcUEzL&Ckh20j56i5cqhUzk zEM5UU=Zd;y`5pU5RSN^J74XNPKxp6gjN-mpwG74I-_*{5b%_uJ8)YE1{M4@I&_dEa z_auj@B(gJ)8pfr=L}Uc@sF#eED%bB9{ z2ywe%%nalKJI~x0B!Ty97s7bqKJln19q^-R|1ORH?FU6Pj4dc3vM)_dO=auwfC9GN z+@~nj>Jb+59dr17{h&;Sb-seA0ighn?lCOUuj+*RAh-ghGz6p*eH+1~fO4YO(1^_) z>hlP+;8Kdh!3pSWs-gVV`tS-O8iEh8dg@W|?j6#cTn&YUx?V)2$;HW8hP0m`BGct~ znLT!f?&KR~qR>EGy*K4ImFcskG6qfT@8@;a zkhH^FT=`J+)@EoFtPg5RO{8c4_m8g_$rSW|6TA-i=(`a_KYT}tZb5zzME}*G^&LH? z=@(tA{6?FCaQhxZ-#+y6RzevWTqm>;4 zQa`if5$;*E@M3S4Bgve$j?sc)fUaJHAu_2u3jrUkA*i8UkSItf3hD*{&BiJ5$`p>8 zI10suh`x$PL2+yko%il*FxaKGjIUq{@+J(}=}#|c_K(-Onh(j%Slg`LQt4o@xADd~ z@M%$G+7g8(dIF{t7%W0TMKuN*dPJRC2@TAhvHi~|xM-VLxXk8}*(fwpzG$R}{YC_j z-G|^ss6VOkV?8$EN~s*D+Q@1qq41Zw1ymwag?2p`93IadjWT9z>{uE_7i3 zusaF>+tZWtd8(=0=fGtt?x;i4_b$ZTZa;2|fgo!QQB4EcLU7c+eZ&CzqV2clJKO^W zo4I*$_g)4O#f@Dbs(SW`9Xl0CJ7IUMgfT~#0-T@=xJ)?S(9%7D%a8!QmxDMkQaYBy zG{~ReHF@|hzAKFjQ6jggc~82C2Vi0b#7u*3KQRoAd5a~OYNowHD$76&8(tv>&GY^T z6T(%$`Qzeb6~7#B{77zS*jqC;rF`+iag9;xI~^}49clXFLRO=Pqs;6?^Zlfd0iG%!Y}UBSOW3O)uxC)yFW zAAL=+vM5yD1Z?>m<^Fcc(g#q69Dxc%Mo3VVM+a-tFo@e%OZ<)tXx5-!{|II?Iq4+` zIgI~MwgJN$O#qk97Hn=f2~U$|J00bZ(mez1c8V%*q0&0 zXXK+s)pjYzYmR=dy`c>Cp6gdu=0Jn(Fl6W&h3HR;jWCC=v^kPkyn&jjt_P?Wod`;H zV*;V4Fh?MwR?;)4Z+T9i&Ijh0H2QkLAm#T2UAodF^zIDoco(?*b_z^JK#FUaXi?4% zZQnD|dFU!iyR$-bAaAv{FwZ4Qq)3@M9@1UGc{%Y}^PRw%$xpD6p>_NgoRiC=m@~%R#z`ONR z$31$o2w!vpWJ)lU_qC{diq&{Df+0Z2Z_%a*p-fj|wE6WB^cy-#ogVaNaBV*K`(wU( zWaK$9;Cs+zBFcpjR-;#)lqNw5TPFJ36F{BCjWJd}Gm(U|J|LUPc$kM7r)|akH}%Gl zjX-1et^^QmF2LQZY6?0(79})k1&3$0nBVMFcp&c|N2Mt0gwiX;ZGbEtp+DI;f7Hh7 zd*`z#)Ac!o#I`r--HT`_PolV7K_*}3K$;w2umMZ15{gFxyCT07K4GCWvLq)Eoh^<% zzegM9@*vzBS|rKI2Y$ z{)azXUB8I2m7EkeR+mBDaDDtavDBYZ5Q1^Ny6v)iE+9lNEGp6J7%54h!39cao7Xlp zTn*$)&IUp7!>4nM0xZrf7h1jSMJKF`3w!pk$+8K=egiqExxKz$X*92+9tO)ffefr!2E(NcBbMS?p z_dy$_(%kF_O?>Y1%EN_E z+Y#Y%=eN%vNFqa8gEwcd&%BC}_i;M+H5gr^a7irZ-MdabsoE{^ zj;}|rjh7pz~>QZ!37W~(!n zGGoG#L5!#VZ>P=whZsiQ_`fgu_ujF*{` sUS_k*rm3D@%2eWkRS@qu=b8bOq&l$ z`z81Sdd8P8@(3VpKP2ts$QRPdwNP8boH2YD{$Ik4nY%5R?+;J}C}2NSt^Qt&IgHIQ zhwJ~r%i;S$aXE$TOcf?&A9e-KP`N~%-`V#ikVAHzG%Ru>+P?UrQ_AdBzS-F8lG?uQs-}H&3`FkmURyIOJhRxi{fZ4TJM; ztR$;br2nu4z4Z(kNq+y{J@O;pZ@IS+Cw;g-N6r4wZ39FqpBUck zlW7_Qvki@m39t4&eysEz2_lYP_LiS)Nqbv|Ax;^@WnG^3AN|jG{Hj|Tg(!l)LV2HH zHksc#4qDB{1fR{$KBx!Ia8Y)4D?*=3UU2JIVIPTMluLi``6_+|x-^o6X!Pmzi+UIe z8lY)bp@-f(@_LWtk=@EvW8(xw)X{EpSrnSalh5!C!Z+s^imn%`;PnFEx@4tmwk@J1 z^&7GgtAWcZC+qUny5msl{Hh$z5otC>1g#5LE*XS3}W z0TNCy@#X_j5xe{xrm#0v8cS3&)Avel4Nx@I;L0Nm+CtI6+ddydJr^>3wmJkKwBqW} z+j3i>a3(@^QGm~Q2mKxT;BQsbqQ_!hk{Twbo6iiQ50?vykS-9w#*G2ijtu_<*MPz- zk;+{7$IGC3L4vb)r|^-`T*yv-c+1A>#|n@bSd%{c1F?ji4X{00`j;7`jz;s~B znzCaeiZu(;?{kx)Fnw>YBaBh^w{|yf{M1Qg%`t8{J!Rl=+-YiwP z9amIHRLqzjr$}Hh?*@T~@X8uMl*=GMrM8dn+d{yV zKr<0$$@`YC#g4eo^jH1F9RXe)eUBa(Q?WW650H)w>G%K1Ue<1u+Lfk@pE(Hs{FsS( z3p|TQaLQBwBDa6E+TPah@LN{;f&v0X%m7=zo7DKHE%u7Nne{CIx>yz+L+It%sz}%A z=(|m`goOqVS*sJtA+3Qb)1#No_GatVE-s_4yGZJYB-GzwxcxzwEr^mmvV#S1ezII` zYim>dG-GnStb<|o0NRDB;M4l&=k)8oCU@?bVLY-JplnkVxGv|v9i46pLR9XR@7`S< zA{u#So#a{#9b>J)E_~mDqRNs>2MUeH)Fwf!&hTA~(agRW(2l9#pDX?d{{IL#+V_{x zoE+Hc5))1>ggsTlAh{pb!L~GX{Q|8e@tW^%7R%c^Hz4X~k%*{|1cp(No)Uc2L+k0_ zF>Ll!5XAyA@d@2(_n>2lwtg#rvLn zGGJ!;VJ~(**xFjsN9YY7zy^w`f5;LZ4?xm$CZ~r(Ji^Rg_b~$r9wr%CBK|t!Jsuw+ zt#>na&wex`^A12ctORku`f^wjyW;rM%Aoof=~yHINcsRGQ=`7mNOlb1deQh-?qDXn zTTp{Vp^T?m(x}}`W-)YY+RMXD_K(DE@E;B%YsCYynf=>z=TDb;+%m)Dafyaz5vCKk z%fGxwPZxOoe)hEB4*PR|j=VerdFvM*vF{g_NO_S%tZ_Jzs za~axNLdFWe;}w%#ND5(quRuaCMPPIQ3NqSjzA;}3NBbVp<+YO^N>Y5>wcr6syjr>I z(DLUtIdu;7MIs-pVeD3-nI-uP$6|8gK{IY)vY2NvbI!}O=%kdgbf=Y>eq`1G!ZQii zvy;E@;Fa^)^XrzRtpRFeNm;xxR~R?YD+&SaPNe6U$%ACMw>qm?i%!6&!x;0eEu;Al zB>;bA|L`vSu{uYwq%!-6`>mKu>%nGqtnVK@^C)e`ZCc9U{TtI)gS+|+!uqt0JgL9- z7TV=838rB^*;h*#7q^`5ue}|6c<=ZkVsF38V7&gxQbrV}nt>b83Kqr!Wo-`|4{}uh z>w3cf%@;>p<^P=`1SEkW!8&iDMh7l1G_n!={X*u=IiZ+CBSjXzP!jC-7r1$t;)nEa zu&*6k&oaNi`wTCb$4o8JndHSfgV-bF!Ep3z_NryTn_;0a9JqwN2ZZdzgUv33Rijmh5 zk5nsHz3k-pXnmtQHI+IIu$#A%uQwh3{%H;;MFr4+>jZC!3`FTh&~|#QwSPWCjvn2>DEGohjEGB{Jp@e4Q{V4#88n&$i3RRvg;a$D*6L9cL?dO_D z;ehlkeemb@dk}Gw{{adICY?Y~kOz^+eJG7VaFoRS@)XW3!6%1qdl%bh5ymB)p9sB~ zmYE}Sq}WJIDR^b5#B=brILa)fZ3xL58rAEDvS+x(N&MMpDULqvj@OxLctUqZ69OlR zq;jyWVzNOTj0Ff>a)*BQ1EeYGIG>@jk*g0$=SVa-mQqUmaI(5e08cEQPDNWsr~Y&f z)CQ%x=Lo6i3+cF#4&;HlQzWl(G7dpOwbM+qC>Mj(n%Olvw>}v`mwDw!w-8Q>N(VmE zYziFb0n7!52$rl3gC(nB!wEn`9VTNSgv%AWKxZ0O)@~)?v^EtH~ zxE5PDv;aIvuhI9|4%pt&Uda}P0__A{I9qt{37t7lrq4^2!k`~vm+fL1LwBiz4o$n0 zKL@`GBe&mKJTk^5Zft8?QWG5qPT48AGZT77y_phG94dz;{!yh1`RgIlzYyNC|H8sq zE@W)NoTl!_bM?=W6tChuqs*n?t}Nu7+Bnk%*8lKMhCku!v&b8bfp6t0y#0PU5I=ok z@hnGN28vam$qf4U{G+B*rohr$Lxh>X1|u?dAuNUvUWeD(0$Q5kU`&kHF_&9#rh1Sg zV?i$4mj&5APqvVUNQ#x(VtT6RG2Emm<))YJ3Nbi?)c0wYY-;JgsTl8ENO(@H+w{=u z@aNmEEj*)9@WfnT3NReBI->H=m1P4(!YCtoAFGJa;T90W0{1wF70bvwQCfDhRj&7M zzc4#usXkvTStS?SQAHB^ef*es#Jtk%Tkicvj4ht$!Q@BkxF)Dmz?h0)=Het&G#3RR zoxAlI@Bjag2jNr#N!ENJfsH8`QQUxY%$TZ&fUec=v+(VMKlUghhf>2-Y17&U)GnX9 zuZ<2MSp|dlZux4?aUHT)T?j}Pu?-L^8L`n*j8r#;WqZuacK!CT;8F(HcT9AV`=5X4 z3034}?ge+v2?7!?V^D$Tr6edxi-7X3h{w3q7(y|44>5?8>wuaL*6!_Emyn4`cmTUC zs`;Pv4hiLFY+0Kh?hv*eD#ojG_+fLfbAR-OTf|? zgGnbdCz^}1U~m!8@QpOdCyz%nFAju$v_uGzP@Ai3O(XAbi@`@6(r)~~=bv9f4B`QB zDlu+{_djzLxoUIUgV)cl1l6ISQaG{5qx&o(!XChvh^JdCMXtODR=5UQ^ZO>jbmzJ; zKJx2YT!lQd6U{KERxZCy`n0;u8zh8XU{cp1MH+}-aqF4l5?@XjsVnVb8DU`wZB|aw z4rXE-8iJg{kz0q3MwQ$N;*oZK3DWU6P&5v|K0Fd{NRN}27v0X~v$z~&ugk?$0<)<0 z+iy=oHp*;Rgf*+bm zD^MJ-?1*Oe;%Au>(-w7rS|Sj zma0bbH{>vwe7sVWjNfOj!K5|MPI|7J6i1xHv{SZXOxis3>c@EjNj4`roB(hpJ6gL;ifmj*H&$vzuhD5QOU z!<*Z7kn!@EUKdgs-#>S)0Z+`DaDOLm@!)=KK|>+|%xMrf}xgb?U~%trvy*fbx5IU}u0JEMbhZ<tavi^F z6p!C!aN`xy*4F-Y;M>D6g;WB|ZfTGlO(*|gcI`=RS^1bQ`@=5r_KWs2&juY6(Xyc= z`*L)P7xdPKO0o=Y{-;HwgKI0u=PT8q_NB}w-*S(;9a<#pzEq9_rHtmT{)MvYF}QQJ z;KQsTvutdiiu|KvafR0Df7Er};cWJ8AE#Et9<_@g#w|5lyGDW{c86#cDau`{L2XK6 z2Q^F8ETyz=M5|V6Q)(1#l{RftVwF-+d%aiO_wzo_bG*l!{Fhuuu3vKGN`B}0{hpui zeW@k#sal4~A;L)B)jH01^aWNlsQ3in;+YIXm-XnN54ZU?Qvf*J+hGIWz}+PAA5+ht zPBvZZ4e*2{USyCtS!r8%LNL&=W0~LXWi~A$kZF74ql=uL0bZ__7AtX% z3z?w04>#_~&hu~G5ebd#eGl8wq+gt27rt2PAv4OEH(YOzOz+Z(nTLA|=(&_2| zDZZaiw22n(*TBJwQ@{s(etGK=Rcu*t#u{parZ5HhWZvCs{nmVzeXS8dG8T>zAULzN z9F>o2TKnIQ4vO=yx_=7)6D1MBtc`GeQEb6d$LdS>0K>Y9X2PqEbQRq7srM} z*DNM~M9`Rx@6PG0?>b+nVu>`aE{&XS&wQiq!t`hXQ-94=E|0Wn(-%=Zm`zT-|&582a^GvJwVq3rUkQd(rmh!X=40gYe+Fsy5_^h$mrOZa{UcEP*aNE zAYo=x04a2+$2Q$DzF9LDGW(gI3fDf^{n#EP%9GeH7_5?Ib!c`+7wQ${Etn&EZoMT(TAfCO|89cC&s6F9^>uJzE2k zBk)FiB<@5a6&Md_7PyQgX0B&wq%*cg1U*SdjJ`@7cUL6`b=VaBNyW*p1(vx_HZZfv zFpZ7f4$5d!n7TBx*=au$q4b5)yCbxcv)!-0%QW^}$WE(G{Bp^+a`^Q%zz-V;FrMQ! zA=?GJ6R%(O#4|z@koOD2gbslM&K$12_I7LHj#?x7!ECQA8yB4b&-x;pzb3%7oDjRgfeP;ern-fq`ji`0D4D$n(N5Vh=F$MTdSD}`kE=tnF2`@e5_zG;#S0~sr z+EFG=bdhVK(0;b*=;i6RTT^5*c;4sCeNMy8QEl#1;=*9aO1j{DN5SnUVa!WHZ`qVk zcQTZX&SmEw4~5i~b)Ca?dCm(*2r@xD>1QM#27is?oui zTfffb2vK%`tGAn}km=f71VF;yard1`lAdfg&hHL!^vD{#;sjVJ_7r?gqxhq@WR`_H zXV{K>esim(D>OouI&SAUc28XfQ#YU@fUK!W^WwJx?b`u;ytJ8CWlzE(*z@eV82mrt$sfs&e zo5(FdFH;an*vI2^H`(N(hiI3ZQ8lUQ&+`1 znU4g<7pht2@`o*?b~sx&9KF#Y%pS4dDl+Aq(iw^5UBq|$++h(>+Y=F(gR)r1cl}Bm zeuRKS=6eO9=tyeR#9ckkwSd9fS~2TOr!849rbA(9zM(Ms@R4Ed+G!_l97i~FEV4aO z&*N|mp(kh$&^jNj>V=NY`)FHJ>oXcDOmy3SDFZQsPb?=3AI0XWFb?hYCQ{7Zu&2F@76%DC76i@Oo8BT=EH^8usTj!lEGOSG(LJ(uE)Feq;pno)5e(9sEpP zof`S9uum!uDaGyXk!CNDmLEK`8EO$By{VS2KSP*$=cG>_x(-dTtdkkSasJcuEV(EB zV?N_|eknhY?V@8c?~HrBC9fRxOCENZRyr3K=6*KATW$FZp~P~`bJrvq$5mg+6*^{s zk#^6wI_YlHS~WsUFIEZV9FcIdg4zt7T=kq*dQwMt967<#(;>S6I1hsBe|+RT&)ol1 z?n<3|_xFwHqoPfm4qd^dSiSa%a7wejPRH9QKp@LX186X=3HtHpy4~m&so{DsF%L!$ z`D-~D&i0&=Q>ea?iC>w_HU}@r-IfgZD+a zWCAz2ApheH&nMt+N6!K>itWGq!&C9!)Dc4b>s!0iZ0EcP+~^woW_lW}i8AECPg`yZG*j zR`6AFubuB}vdF_b9$B0SMLy+kRI0Wz`(D>iFp+qQIH*?bGDUsmAWyoSS&8XpRmNxi zh(Xei7j`r}(%L@Ebbw6_zIUP%jBD~H^zB3I5) zy3i|QGtO<6{7Uh&72HZ~3+Gq#lj?bJ^Lr-sqQ|^6vq*2SBxN`6?WNA?xQSq4%XqT#;cFXWJ z(0}a+Y|4SzJ;7Z6*J4`~zbF@#S7z@!QfwHe_lg&aUKOgoRH1_R^e;r-%WbthC->$j zo>>2Y*ff)JN_!{6%&PO}cVJ%K?@dZFNf?e>*~+%xYEo1R@CxU0`-p5 ztLwYG@XA0c@>CE)HOkg6n6&F#JxNYo_yP!nlg^L_!L>VN;Izp#rJz|g zC*@$hG*OCqAT|(psS8SQ3KNB)DJDfaMXY^IQK7PeEozN=`9XQ%pJp%bsxQ!yf6s-Tc!v;%JfK8yZp{UnkP(4Y&mqJaRUhW3of%ao54Z z=^4U(rsikw8T-G!jjI=rkBZ#o_LweRrMb71i|^vpx$V&PmRjWxF4)(~c$&49;=og*1qxA6FD8{K>HI`s$8s$SUxvK?APA2m-E z_F7x;wI%qN71I6ry#~>V$c#8IiegWnrX^mQfiepKC^Rx=TCg_Z9E=_+V>WHFYjlN2 z0E$m}!NYC$>oSHP>UmyXco%#*CF6{$yj!;J#v&UEe&xOAzJ3A6Ap$b@VL_M!BLv zbx26x@DAUfNXa>xYiY+wyx*Hybv;3~6m!m+RP)x8TfE(^ttxFpi1hfelyaZ(XP>ai z2cyhYMw1JeT!|?bujJLK0wVTw{75 zIgptEA5GVYjHXEDhU9vxlxeC((zs#T#uE?1#}Cpk0~4xOqx%0OlKl80Z6{*3v+}Ub zu0&E!nq~Y3uohBe z_rT&jJX8Il*YNFfsU}14+5Nvj?$ijIc&)pz3iQ(KB#`0 zNNKL1;4VKmB>AB4RU4%jWh>Rb_hpr|4Y{6ux=P$OXpLgxBBXinOG!cvWb^RMfP#iV zkY3JExD=I&x=x?95;Hx|sK%fO-p&%rJ}MhBx9eIz2#{pZUw3>sbMm}i=$c-lM^7RT zP0F?m5eL&Vp{cP|)FxC7IVXn(%Hmnkscaq|k`S{_y{2Htg@f%DUZI6KBSl@DLpd@SYBJI@~9rGik)3`Pq}uWU$~v zWtdsNtet+%r|WSZ#9AU_+lP{X3BY*$B|@Kp z;gDjk$Ak2m0v7dVH7X|2CfF{l5QI7Cn|{5@VZ~2l{P=33-BWq5)yo{$g@?Y1DLTaT&p6fCy!oI`E(MvuY#70-)Nc?m< z=m}d>n9tDFFhI$6!iLel-Q)_$_K04e}(oV;t*poGh>kQ67U>GEmb#2|!*u3sxAU9*!@Y35*1e~_9Zs0#~*a@z_#2(LPl8ykz`osObCzYlpUM8LYzHWjNyG&p?_;a@JU6cV2F8Aipzl zZYm4mL@}ODzo@8CL?n6(MF6QjH#9ZTw<@}l)D>1I+%F(lGc|lCx2q?sV9GFIHM5z! z$UE_ZV%~rnvOaRrKZyj4#|-GAWKh~)>u+Rr#Vg7uR5Puf_^bA_%A{<5c1RwFH0N&K z%>#lj0C3DN1%&w5G&`PFEi?4%4DUpO?XWl&47BuB%u_w4Ez6C8Yiea;Z;{ZXrP3$T z&6HziHg%uSp%v4a+MUNEAVx3HB(iNlFUV+!Nw;bS`d@CIVvO>P?dKgcJ{5Y>B*2kR z(}sEKn#DQ$w8Ujkb-h)fqnub?p3vi!PmqxUIa#G7R2l}gbHi@U;CotH0OQG*74c`B z(4iIKTngYQaL~NB3*_FIfkU!I4`jfpYbB$JI!F`e<%y|T|GTK-Gn=SxRAB)Z{Kjv- zWV&F*`Lk_B8n(U`mBT5&(_iWcGfy5svf%5~zvrD)py+ENnbVlLnit|O} z6FL22`HZC2w#QjOHGVJmb4W9z=hr=iFUWb?XA7@bgIV$ETbvc?+MpL>)cDzcbhzU4 zR~zNN#f^;TD$|J)=l6FRY(9bBT#JyMl{{<`cP!@C&DWWetLEa?SxQ+~b^2ll^A|OZ zCMNn%OFr~cmSu+?(K3`x^32StVpN_F{%*&*ue2=HOosBbMRBH11zt$xM-X-j#Ta|B z+Dc$B9*paR#zN^F{phS8i?{0EO{kZ(#db$Z^jmK9QQq^@SqR%TCWsS5pb&l;Sqw{+`O?6Y6J{dWB zE77C-fh5cB`6vj+=?Xb*sZO85RN*5Da!b&fN_}!u{iL-X*R!}(`kB5fu5GrTfTFPv zq)I-7ckYH7DG`VrE|ZEx;-LD z8?Q7f^&N!$oJ~6aKwjJ~3gW#s6SKtY;8yx9h3NXoIJ4mk_jl_LX}d4^RDlh3=8m`hkk4%{3>H z8Y6WZg7IA2p514!q7R08wg7TLx`R}%sVt*Z?&qFNnM(RbUIG5qub7}{rg*lCfO87F z01OHOei$ik9LVVF$b5lm`JW(H$S;4n73*sAkx?yCNVN3fjl_y`<}@u#@*T})^?;~$ zZs(@UaVc@>xRj`TQ?pB(oe}@rNClXrKlHU-C^GQB4=|>qzvpchgZKog z4Q_5~ArROG;z{o}!S&j%F-BRcG)KRZNg|$hLcoL}fTfWP|44eF*_KFztJw7PIF%xw zW^TV<%`4PzP@=7%--dCtTVJ`j|5BQIU8Usk^W#v|i73`|bx+)=S~tS{QNtdXi8Vy(ME`;4Qwe+{^sd&Ux?bG;YG z%XR4tKa~Lpp{Ti8dWQFaps&L#ebD;P3Lmpz0rvxN>K7lLIeZ+zaWsE7^|={s5@D17 z$=SVskgK4BBM7v?N{(K*SX+Z(%k5!vZUPB%_n+66#QN0Z2z0Vm(0rnt@~V<0(@Pcw zi8x#L)Ac!|5}fEl~&8`=5&SNgj0S0l5)&2p1!lY$x(F=KmwX!D!E zW?Xg1H#TL#ql)(q2AU49`kOhP^Yq-w@4i{PHddAN{${{w+2Q;-E9%Dx8Gw=0bt*2q z1h~7dD;WLN=vAXhL#|XwI|v}Jd&MSWGFaqyc5DLvp@jh`#Nmd87w^*MtX04xQEoVH_07nr3${4aTr25L(;X$Uy|bhpLxKd5@( z2GakJ+4FF?lQD-_ha8mBi6}GF1FoO{VC?-&d7*Cc66}sWKO^ZRPy-{$FZj_IfB!zn zfnVsVF7hV~`h?2ekElC^tqe1E4>bv)8h1&dGcb4V*G}AiH&N?52|Akt;Prs(0PuTq z(9>Q7z!$137ltklDQ4%_55J#Pno&L{L|9-$hNK|8r`U5cD z+?quEe)adI0mAyg4QY_Z*?-X*5usI8IrjSu4?h(hL-_u+blTfFh5(M!0F7OfwmA;q z*oR>2mSLv`!QouU+1n2_Z@qbb`+^d{kc{^iee*ZX4;^nm0sZU0*nrS=oxLIN=2w)> z@s{^3Lk-Wp{`-T^4GQ`6efATlP0llz!(zkoJ8vdnCvd0x5e-#G`?>J|_5c0if1d>{ ff7avkv-3w1!Vf-|4{EAl>42NLiM4SJ+!gmfq<}(n literal 0 HcmV?d00001 diff --git a/xample-malware/README.md b/xample-malware/README.md index 4914665..c636945 100644 --- a/xample-malware/README.md +++ b/xample-malware/README.md @@ -20,6 +20,7 @@ Also, please see the [FAQ](../yfaq/README.md/#other) for information about malwa * **Chopstick** [X0035](../xample-malware/chopstick.md) * **Clipminer** [X0038](../xample-malware/clipminer.md) * **Conficker** [X0003](../xample-malware/conficker.md) +* **Conti** [X0050](../xample-malware/conti.md) * **CozyCar** [X0034](../xample-malware/cozycar.md) * **CryptoLocker** [X0030](../xample-malware/cryptolocker.md) * **CryptoWall** [X0029](../xample-malware/cryptowall.md) diff --git a/xample-malware/conti.md b/xample-malware/conti.md new file mode 100644 index 0000000..9282c85 --- /dev/null +++ b/xample-malware/conti.md @@ -0,0 +1,58 @@ + + + + + + + + + + + + + + + + + + + + + + +
IDX0050
AliasesNone
PlatformsWindows
Year2019
Associated ATT&CK SoftwareConti
+ +# Conti Ransomware + +Conti is a Ransomware-as-a-Service (RaaS) malware. + +## ATT&CK Techniques + +See ATT&CK: [Conti - Techniques Used](https://attack.mitre.org/software/S0575/). + +## Enhanced ATT&CK Techniques + +|Name|Use| +|---|---| +|[Process Injection::Process Hollowing (E1055.012)](../defense-evasion/process-injection.md)|Conti creates a process in a suspended state and unmaps or removes the PE image layout from a given process space.| + +## MBC Behaviors + +|Name|Use| +|---|---| +|[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|As a part of process hollowing, Conti creates a process in a suspended state.| +|[Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)| As part of process hollowing, Conti resumes the execution of the suspended process.| +|[Process::Set Thread Context (C0072)](../micro-behaviors/process/set-thread-context.md)| As part of process hollowing, Conti sets thread context.| +|[Process::Unmap Section View (C0070)](../micro-behaviors/process/unmap-section-view.md)|As part of process hollowing, Conti unmaps a view of a section from the virtual address space of a subject process.| +|[Process::Write Process Memory (C0071)](../micro-behaviors/process/write-process-memory.md)|As part of process hollowing, Conti writes data to an area of memory in a specified process.| + + +## Attack Flow + +A partial attack flow for Conti Ransomware based on [[1]](#1), which shows micro-behaviors associated with Conti's [Process Injection::Process Hollowing (E1055.012)](../defense-evasion/process-injection.md) behavior. + +![Screenshot of Attack Flow (process hollowing) for Conti Ransomware based on Vipre article.](/xample-malware/AttackFlow/Conti_Process_Hollowing.png) + +## References + +[1] https://labs.vipre.com/how-conti-ransomware-works-and-our-analysis/ diff --git a/xample-malware/wannacry.md b/xample-malware/wannacry.md index e9d1b9a..37ec98a 100644 --- a/xample-malware/wannacry.md +++ b/xample-malware/wannacry.md @@ -36,6 +36,7 @@ See ATT&CK: [WannaCry - Techniques Used](https://attack.mitre.org/software/S0366 |[Defense Evasion:: Hidden Files and Directories(F0005.003)](../defense-evasion/hidden-files-and-directories.md)|WannaCry uses the +h attribute to hide its files. [[1]](#1)| |[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|WannaCry creates two registry run keys to ensure persistence. [[1]](#1)| |[Defense-Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[1]](#1)| +|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|WannaCry encrypts files for ransom. [[1]](#1)| ## MBC Behaviors @@ -44,7 +45,6 @@ See ATT&CK: [WannaCry - Techniques Used](https://attack.mitre.org/software/S0366 |[Discovery::Self Discovery (B0038)](../discovery/self-discovery.md)|WannaCry checks the size of the file it loads into memory. [[1]](#1)| |[Discovery::Self Discovery (B0038.002)](../discovery/self-discovery.md)|WannaCry checks a string, keylen and a magic number before decrypting a dll. [[1]](#1)| |[Discovery::Self Discovery (B0038.003)](../discovery/self-discovery.md)|WannaCry checks the data lengh of a section before decypting a dll. [[1]](#1)| -|[Impact::Data Encrypted for Impact (B0025)](../impact/data-encrypted-for-impact.md)|WannaCry encrypts files for ransom. [[1]](#1)| ## Indicators of Compromise diff --git a/yfaq/README.md b/yfaq/README.md index 39a88de..ab60478 100644 --- a/yfaq/README.md +++ b/yfaq/README.md @@ -12,7 +12,7 @@ * **MBC v3.0** - The latest MBC release (to be released soon) includes behavior detection information, expanded descriptions, and new properties, such as version and created and modified dates. -* **STIX 2.1 Representation** - MBC content is available in an updated [STIX format](https://github.com/MBCProject/mbc-stix2) based on a new [STIX 2.1 extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications). +* **STIX 2.1 Representation** - MBC content will soon be available in an updated STIX format based on the new [STIX 2.1 Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior). * **Attack Flow Examples** - Example attack flows for [Shamoon](../xample-malware/shamoon.md) and [SearchAwesome](../xample-malware/searchawesome.md) reference MBC behaviors. @@ -144,7 +144,6 @@ Observables that do not reflect on the malware's *code* are not captured in MBC; ### Do malware behaviors and adversary behaviors overlap? ### Malware behaviors and adversary behaviors can overlap because adversaries sometimes use malware to achieve their goals. However, MBC only captures behaviors associated with malware *code*. In other words, MBC behaviors are identified through analysis of a malware sample's binary code or by observing the malware on a network (or in a disassembler), whereas adversary behaviors may be derived from a variety of indicators on a system or network. - ## STIX Representation ## ### How are MBC behaviors captured in STIX 2? ### @@ -194,6 +193,8 @@ The OASIS Collaborative Automated Course of Action Operations ([CACAO](https://o To illustrate MBC's use, we defined a playbook for [Locky Bart](../xample-malware/locky-bart.md), which is available in the [CACAO example repository](https://github.com/oasis-tcs/cacao/tree/master/Examples/CACAO-2.0). +### Can Pafish behaviors be mapped to MBC? ### +Yes. [Pafish](https://github.com/a0rtega/pafish) is a tool for detecting virtual machines and malware analysis environments. Malware analysts use Pafish to determine whether their analysis environment is likely to be detected by malware. [[1]](#1) We studied the Pafish source code to identify its behaviors and mapped those behaviors to MBC. The results are [here](pafish.md). ## Relationship to ATT&CK ## diff --git a/yfaq/pafish.md b/yfaq/pafish.md new file mode 100644 index 0000000..bfcc79e --- /dev/null +++ b/yfaq/pafish.md @@ -0,0 +1,35 @@ +# Pafish - MBC Behaviors + +[Pafish](https://github.com/a0rtega/pafish) is a testing tool that detects virtual machines and malware analysis environments using the same techniques as malware. The behaviors below were identified by reviewing the Pafish source code. [[1]](#1) + +|Name|Use| +|---|---| +|[Anti-Behavioral Analysis::Debugger Detection::IsDebuggerPresent (B0001.008)](../anti-behavioral-analysis/debugger-detection.md) | Pafish uses the IsDebuggerPresent function to determine whether a debugger is present. [[1]](#1)| +|[Anti-Behavioral Analysis::Debugger Detection::Process Environment Block/Being Debugged (B0001.035)](../anti-behavioral-analysis/debugger-detection.md) | Pafish uses the BeingDebugged field of the Process Environment Block (PEB) to determine whether the process is being debugged. [[1]](#1)| +|[Anti-Behavioral Analysis::Debugger Detection::OutputDebugString (B0001.016)](../anti-behavioral-analysis/debugger-detection.md) | Pafish uses the OutputDebugString function to determine whether a debugger is present. [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Instruction Testing - RDTSC (B0009.036)](../anti-behavioral-analysis/virtual-machine-detection.md)| Pafish identifies a VM CPU by checking the difference between CPU timestamp counters (rdtsc). [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Instruction Testing - CPUID (B0009.034)](../anti-behavioral-analysis/virtual-machine-detection.md)| Pafish identifies a VM CPU by checking the hypervisor bit in cpuid feature bits, which shows the presence of a hypervisor and/or VM vendor information. [[1]](#1)| +| [Anti-Behavioral Analysis::Virtual Machine Detection::Human User Check (B0009.012)](../anti-behavioral-analysis/virtual-machine-detection.md), [Anti-Behavioral Analysis::Sandbox Detection::Human User Check (B0007.012)](../anti-behavioral-analysis/sandbox-detection.md) | Pafish checks for mouse movement (speed, clicking activity: single and double), and Pafish displays a dialog box to see whether a user responds to it.[[1]](#1)| +|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md) | Pafish identifies sandboxes by checking whether Sleep() has been patched using GetTickCount(), checking for common sandbox-related values for username (SANDBOX, VIRUS, MALWARE) and file path (\\SAMPLE, \\VIRUS, \\SANDBOX), and looking for common sample names in root drives (sample.exe, malware.exe). [[1]](#1)| +| [Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Drive size (B0009.015)](../anti-behavioral-analysis/virtual-machine-detection.md)| Pafish checks whether the hardware has modern characteristics. Sub-standard specs indicate a virtual environment. [[1]](#1)| +| [Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Processor count (B0009.018)](../anti-behavioral-analysis/virtual-machine-detection.md)| Pafish checks whether the hardware has modern characteristics. Single CPUs indicate a virtual environment. [[1]](#1)| +| [Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Total physical memory (B0009.014)](../anti-behavioral-analysis/virtual-machine-detection.md)| Pafish checks whether the hardware has modern characteristics. Physical memory less than 4 GB indicates a virtual environment. [[1]](#1)| +|[Anti-Behavioral Analysis::Sandbox Detection::Timing/Uptime Check (B0007.009)](../anti-behavioral-analysis/sandbox-detection.md) | Pafish uses the GetTickCount function to to check how long the system has been running (a short uptime indicates a sandbox). [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish checks IsNativeVhdBoot() to determine whether the OS was booted from a virtual hard drive. [[1]](#1)| +|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox_detection.md) | Pafish checks whether the ShellExecuteExW or CreateProcessA functions have been hooked, indicating a sandbox. [[1]](#1)| +|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox_detection.md) | Pafish checks whether the module sbiedll.dll (which is associated with Sandboxie) has been mapped into the address space of the process [[1]](#1)| +| [Anti-Behavioral Analysis::Emulator Detection (B0004)](../anti-behavioral-analysis/emulator-detection.md) | Pafish detects Wine using GetProcAddress(wine_get_unix_file_name) from kernel32.dll [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Check Registry Keys (B0009.005)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish checks the value of several registry keys to determine whether VWware, VitualBox, Bocks, or QEMU is running [[1]](#1)| +| [Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - MAC Address (B0009.028)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish identifies VirtualBox by checking whether the MAC address starts with 08:00:27, and it identifies VMware by checking whether the MAC address starts with 00:05:69, 00:0C:29, 00:1C:14 or 00:50:56. [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Check Processes (B0009.004)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish identifies VirtualBox by identifying the VBoxTray windows daemon. [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish checks for VirtualBox shared folders (network share). [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)| Pafish uses Windows Management Instrumentation (WMI) to find a VirtualBox device identifier or a VMware serial number. [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish checks for particular files on the file system indicating the presence of VMware. [[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish uses GetAdaptersAddresses() to check whether an adapter is named "VMware," which indicates the presence of VMware. [[1]](#1)| +| [Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - CPU Name (B0009.026)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish checks the CPU name to identify virtualization. For example, Qemu is traced using the CPU brand string 'QEMU Virtual CPU', and Bochs is traced using either a typo in the CPU AMD processor name, a CPU AMD Easter egg, or a wrong value in the CPU Intel processor name. [[1]](#1)| +|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)| Pafish checks the TLS hooks information structure (TLS_HOOK_INFO) to identify the presence of Cuckoo. [[1]](#1) | + + +## References + +[1] https://github.com/a0rtega/pafish diff --git a/ynewsletters/09152023.md b/ynewsletters/09152023.md new file mode 100644 index 0000000..0b38e4f --- /dev/null +++ b/ynewsletters/09152023.md @@ -0,0 +1,17 @@ +# Malware Behavior Catalog Newsletter # +**September 15, 2023** + +Hi all! + +Recent MBC activity includes: + +* Finalized the STIX 2.1 Malware Behavior Extension, which includes new STIX domain objects for MBC objectives, behaviors, and methods. Documentation and the JSON schemas are available in the OASIS [STIX Common Objects](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior) repository. +* Preparing MBC 3.0 (release date 29 September). +* Preparing release of the STIX 2.1 representation for MBC 3.0, which is based on the new malware behavior extension and will be available in a new [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository (release date 29 September). +* Revised the [MBC FAQ](https://github.com/MBCProject/mbc-markdown/tree/main/yfaq), adding new content and updating and reorganizing existing content. +* Updated MBC for ATT&CK v13.1 (full review resulted in one minor change to MBC). +* Created a [page](https://github.com/MBCProject/mbc-markdown/tree/main/yfaq/pafish.md) showing how [Pafish](https://github.com/a0rtega/pafish) behaviors map to MBC. +* Submitted a [PR to capa](https://github.com/mandiant/capa-rules/pull/776). +* Continued MBC website development. + +Please post questions or comments in [Discussions](https://github.com/MBCProject/mbc-markdown/discussions) on GitHub or email us at mbc@mitre.org. Your feedback would be very appreciated! diff --git a/ynewsletters/README.md b/ynewsletters/README.md index 8cdfe7a..6d38270 100644 --- a/ynewsletters/README.md +++ b/ynewsletters/README.md @@ -1,6 +1,8 @@ ## Malware Behavior Catalog Newsletters ## +September 2023 + June 2023 March 2023