mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck c3033e4061 Staging (#162 )

* update staging (#158)

* update format/wording

* Capa 7.1 rule updates (#156)

* Update self-deletion.md

Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)

* Update obfuscated-files-or-information.md

added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml

* Update disk-wipe.md

Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml" https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml

* Update system-information-discovery.md

Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml

* Update system-information-discovery.md

Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml

* Update dns-communication.md

Removed duplication in APIs in "Resolve DNS" CAPA rule

* Update socket-communication.md

Updated APIs for "create raw socket" CAPA rule

* Update socket-communication.md

Updated APIs on CAPA rule "get socket status"

* Update socket-communication.md

Updated CAPA rule "initialize Winsock library"

* Update socket-communication.md

Updated API listing on CAPA rule "receive data on socket"

* Update socket-communication.md

Updated API listing for "send data on socket" CAPA rule

* Update socket-communication.md

Update APIs for CAPA rule "set socket configuration"

* Update socket-communication.md

Updated CAPA rule "connect tcp socket" to add APIs

* Update socket-communication.md

Added APIs to CAPA rule "create tcp socket"

* Update socket-communication.md

Added APIs to "create UDP socket" CAPA rule

* Update encrypt-data.md

Added new APIs to "encrypt data using DPAPI" CAPA rule

* Update install-driver.md

Added APIs to CAPA rule "install driver"

* Update set-file-attributes.md

Added APIs to CAPA rule "change file permissions on Linux"

* Update writes-file.md

Updated APIs for CAPA rule "write file on linux"

* Update system-information-discovery.md

Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1

* Update create-process.md

Added API to "create process on linux" CAPA rule

* Update hijack-execution-flow.md

Added API calls to CAPA rule "execute shellcode via Windows callback function"

* Update self-deletion.md

Changed link to master

* Update obfuscated-files-or-information.md

Changed rule link to release to point to master

* Update system-information-discovery.md

Removed nursery rules

* Update disk-wipe.md

Updated link to master branch

* Update socket-communication.md

Checked for correct socket listings under the APIs

---------

Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>

* New method (#159)

* update format/wording

* Update disassembler-evasion.md

* Update disassembler-evasion.md

* Corpus fix (#160)

* update format/wording

* fix tables

* Edits

---------

Co-authored-by: ryan <ryanxu@wustl.edu>

* New method (#161)

* update format/wording

* Update disassembler-evasion.md

* Update disassembler-evasion.md

---------

Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>
Co-authored-by: ryan <ryanxu@wustl.edu>

2024-08-25 10:09:33 -04:00

3.2 KiB

Raw Permalink Blame History

ID	X0005
Type	Trojan
Aliases	None
Platforms	Windows
Year	2011
Associated ATT&CK Software	None

DNSChanger

DNSChanger is used to change DNS settings to generate fraudulent advertising revenue.

ATT&CK Techniques

Name	Use
Defense Evasion::File and Directory Permissions Modification (T1222)	DNSChanger sets file attributes. [2]
Execution::Shared Modules (T1129)	DNSChanger accesses PE headers. [2]

Enhanced ATT&CK Techniques

Name	Use
Impact::Generate Traffic from Victim::Advertisement Replacement Fraud (E1643.m02)	The malware alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [1]
Defense Evasion::Disable or Evade Security Tools (F0004)	DNSChanger prevents the infected system from installing anti-virus software updates. [1]
Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)	DNSChanger encodes data using XOR. [2]
Defense Evasion::Process Injection (E1055)	DNSChanger attaches user process memory. [2]

MBC Behaviors

Name	Use
Cryptography::Encrypt Data::RC4 (C0027.009)	DNSChanger encrypts data using RC4 PRGA. [2]
Data::Encode Data::XOR (C0026.002)	DNSChanger encodes data using XOR. [2]
File System::Get File Attributes (C0049)	DNSChanger gets file attributes. [2]
File System::Read File (C0051)	DNSChanger reads files on Windows. [2]
File System::Set File Attributes (C0050)	DNSChanger sets file attributes. [2]
File System::Write File (C0052)	DNSChanger writes Fileon Windows. [2]
Memory::Allocate Memory (C0007)	DNSChanger allocates RWX memory. [2]
Operating System::Registry::Query Registry Value (C0036.006)	DNSChanger queries or enumerates registry values. [2]
Operating System::Registry::Set Registry Key (C0036.001)	DNSChanger sets registry keys. [2]

Indicators of Compromise

SHA256 Hashes

c2ef46a1b6292f28c0caf08013577e8559c4b0a71bf6fc058968061a3d71ede2
af1713e216913a768ec63cbae98f1c78d6bcdd5e88138a4aba21661ef909ea24

References

[1] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html

[2] capa v4.0, analyzed at MITRE on 10/12/2022

3.2 KiB Raw Permalink Blame History