mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
RazviOverflow
53771d2293
* Deleted deprecated signatures * Added new signature * Updated table to match new CAPE signatures' format * Added new signature mappings * Fixed table header * Deleted unspecified API * Updated table to match new CAPE signature format. Fixed existing signatures. * Deleted deprecated signatures * Added missing class * Added new signature mappings * Deleted deprecated signatures * Updated table to match new CAPE signature format * Added new signature mappings * Updated deprecated links * Updated table to match new CAPE signature format * Added new signature mapping * Updated table format, signature, and link * Fixed existing signatures' url * Deleted deprecated signatures * Updated existing signatures * Added new signature mappings * Deleted deprecated signature * Updated table. Added new signature mappings. * Deleted deprecated signatures * Updated table to new CAPE signature format * Added new signature mappings * Deleted deprecated signatures * Updated table. Added new signature mappings. * Deleted deprecated signatures * Updated table. Added new signature mappings * Fixed broken url * Updated table * Deleted deprecated signatures * Updated table format. Added new signature mapping. * Deleted deprecated signatures * Updated table. Fixed already existing signatures. * Added new signature mappings * Updated existing signatures * Updated table format. Deleted deprecated signatures. * Updated existing signatures * Added new signature mappings * Updated existing signatures * Updated table and signatures * Fixed existing signatures * Deleted deprecated signatures * Updated table * Added new signature mappings * Updated existing signatures * Updating existing signatures * Updating existing signatures * Updating exiting signature * Deleted deprecated signatures * Updated existing signatures * Updated existing signatures * Added new signature mappings * Deleted deprecated signature * Updated table * Added new signature mapping * Deleted deprecated signatures * Added new signature mappings * Deleted deprecated signatures * Added new signature mappings * Updated table and existing signatures * Deleted deprecated signatures * Updated table and existing signatures * Added new signature mappings * Fixing typos * Fixing typos II * Fixing typos III
2.1 KiB
2.1 KiB
| ID | C0033 |
| Objective(s) | Operating System |
| Related ATT&CK Techniques | None |
| Version | 2.2 |
| Created | 4 December 2020 |
| Last Modified | 30 April 2024 |
Console
Malware modifies the console.
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| set console window title | Console (C0033) | kernel32.SetConsoleTitle |
| manipulate console buffer | Console (C0033) | kernel32.SetConsoleCursorPosition, kernel32.ReadConsoleOutputCharacter, kernel32.WriteConsoleOutputCharacter, kernel32.WriteConsoleOutput, kernel32.WriteConsoleInput, kernel32.GetStdHandle, System.Console::Write, System.Console::WriteLine |
| Tool: CAPE | Class | Mapping | APIs |
|---|---|---|---|
| bcdedit_command | BCDEditCommand | Console (C0033) | ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW |
C0033 Snippet
Operating System::Console
SHA256: 905b9db8cf5a3001318b28ee5dc674f8f65ca1e4306aab9e331b3bba24e7b8a8 Location: 0x41B4CDlea eax, [esp + 0x50] ; load an address into eax push eax ; where to store number of characters read push ecx ; coordinates of console cell on screen where reading text should begin push ecx ; number of screen buffer character cells to read lea edx, [esp + 0x2cc] ; load address into edx push edx ; address of buffer into which characters should be read push ecx ; handle to the console read buffer mov dword ptr [esp + 0x68], ecx call KERNEL32.DLL::ReadConsoleOutputCharacterA ; call function to read characters from the console