mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Desiree Beck
6ce7ebadf2
* Create malware-types.md * Update README.md added link to malware type table. * Update malware-types.md * Update malware-types.md * Update malware-types.md * Update malware-types.md * Update malware-types.md * Update malware-types.md * Update geneio.md * Update geneio.md * Update searchawesome.md * Update chopstick.md * Update cozycar.md * Update gobotkr.md * Update heriplor.md * Update hupigon.md * Update synful-knock.md * Update mebromi.md * Update blackenergy.md * Update cozycar.md * Update cozycar.md * Update drovorub.md * Update evilbunny.md * Update gamut.md * Update gobotkr.md * Update cozycar.md * Update kovter.md * Update kraken.md * Update mazarbot.md * Update blackenergy.md * Update matanbuchus.md * Update yispecter.md * Update cozycar.md * Update up007.md * Update teardrop.md * Update redhip.md * Update malware-types.md * Update rombertik.md * Update snake.md * Update snake.md * Update dark-comet.md * Update badusb.md * Update dyepack.md * Update conti.md * Update cryptolocker.md * Update cryptowall.md * Update locky-bart.md * Update netwalker.md * Update samsam.md * Update wannacry.md * Update adwind-jrat.md * Update electrorat.md * Update gravity-rat.md * Update poison-ivy.md * Update terminator.md * Update clipminer.md * Update webcobra.md * Update drovorub.md * Update dark-comet.md * Update attor.md * Update geneio.md * Update malware-types.md * Update trickbot.md * Update dark-comet.md * Update dnschanger.md * Update emotet.md * Update kovter.md * Update heriplor.md * Update trickbot.md * Update ursnif.md * Update mazarbot.md * Update shamoon.md * Update bagle.md * Update conficker.md * Update stuxnet.md * Update vobfus.md * Newsletter, editing E1510, E1560 (#137) (#138) * Adding Newsletter * Create 12182023.md * Update README.md --------- * Update e1510 (#134) * Update clipboard-modification.md Update to account for updates to T1115. * Update data-encrypted-for-impact.md fix parentheses * Update clipboard-modification.md * Update data-encrypted-for-impact.md * Update clipboard-modification.md * Moving Archive Collected Data to collection, some description updates * Updating Last Modified --------- Co-authored-by: Ryan Xu <ryanxu@wustl.edu> * Newsletter, editing E1510, E1560 (#137) (#139) * Adding Newsletter * Create 12182023.md * Update README.md --------- * Update e1510 (#134) * Update clipboard-modification.md Update to account for updates to T1115. * Update data-encrypted-for-impact.md fix parentheses * Update clipboard-modification.md * Update data-encrypted-for-impact.md * Update clipboard-modification.md * Moving Archive Collected Data to collection, some description updates * Updating Last Modified --------- Co-authored-by: Ryan Xu <ryanxu@wustl.edu> --------- Co-authored-by: Ryan Xu <ryanxu@wustl.edu>
81 lines
4.1 KiB
Markdown
81 lines
4.1 KiB
Markdown
<table>
|
|
<tr>
|
|
<td><b>ID</b></td>
|
|
<td><b>X0030</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Type</b></td>
|
|
<td><b>Ransomware</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Aliases</b></td>
|
|
<td><b>None</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Platforms</b></td>
|
|
<td><b>Windows</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Year</b></td>
|
|
<td><b>2013</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Associated ATT&CK Software</b></td>
|
|
<td><b>None</b></td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
# CryptoLocker
|
|
|
|
CryptoLocker is a family of ransomware. [[1]](#1)
|
|
|
|
## ATT&CK Techniques
|
|
|
|
|Name|Use|
|
|
|---|---|
|
|
|[Initial Access::Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)|The malware is sent to victims as an attachment. [[1]](#1)|
|
|
|[Command and Control::Encrypted Channel::Asymmetric Cryptography (T1573.002)](https://attack.mitre.org/techniques/T1573/002/)|The malware encrypts messages with a public RSA key. [[1]](#1)|
|
|
|[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses http to communicate with C2. [[1]](#1)|
|
|
|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|The malware links many functions at runtime. [[2]](#2)|
|
|
|
|
## Enhanced ATT&CK Techniques
|
|
|
|
|Name|Use|
|
|
|---|---|
|
|
|[Impact::Data Encrypted for Impact::Ransom Note (E1486.001)](../impact/data-encrypted-for-impact.md)|The malware launches Internet Explorer to show ransom notes. [[1]](#1)|
|
|
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware creates an "autorun" registry key. [[1]](#1)|
|
|
|[Execution::User Execution (E1204)](../execution/user-execution.md)|The malware relies on victims to execute. [[1]](#1)|
|
|
|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware searches for user files before encrypting them. [[1]](#1)|
|
|
|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|CryptoLocker encodes data using XOR. [[2]](#2)|
|
|
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|CryptoLocker queries environment variables. [[2]](#2)|
|
|
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|CryptoLocker accepts command line arguments. [[2]](#2)|
|
|
|
|
## MBC Behaviors
|
|
|
|
|Name|Use|
|
|
|---|---|
|
|
|[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a hash value generated from system information. [[1]](#1)|
|
|
|[Command and Control::C2 Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives a public key from the C2. [[1]](#1)|
|
|
|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|The malware uses an internal domain generation algorithm. [[1]](#1)|
|
|
|[Command and Control::C2 Communication::Authenticate (B0030.011)](../command-and-control/c2-communication.md)|The malware sends a phone-home message with encryption to start. [[1]](#1)|
|
|
|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|CryptoLocker encodes data using XOR. [[2]](#2)|
|
|
|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|CryptoLocker enumerates PE sections. [[2]](#2)|
|
|
|[File System::Writes File (C0052)](../micro-behaviors/file-system/writes-file.md)|CryptoLocker writes Fileon Windows. [[2]](#2)|
|
|
|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|CryptoLocker allocates RWX memory. [[2]](#2)|
|
|
|[Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|CryptoLocker resumes thread. [[2]](#2)|
|
|
|
|
## Indicators of Compromise
|
|
|
|
SHA256 Hashes
|
|
- a2bc3059283d7cc7bc574ce32cb6b8bfd27e02ac3810a21bd3a9b84c17f18a72
|
|
- 0be1f445537f124b5175e1f2d1da87e2e57aa4ba09ea5fe72b7bafaf0b8f9ad2
|
|
- a79d1d1727c2ef415157da46d4afa89e1c8ff815af08c3932bf74acb12438913
|
|
|
|
## References
|
|
|
|
<a name="1">[1]</a> https://www.secureworks.com/research/cryptolocker-ransomware
|
|
|
|
<a name="2">[2]</a> capa v4.0, analyzed at MITRE on 10/12/2022
|
|
|