mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
009ae77217
* E/f updates (#143) * E/F Update, Update Install Cert ID * Small fixes * Update common objects link (#142) * Update README.md * Update 09152023.md * Update README.md * Update 12182023.md * Adding descriptions to micro-behaviors * Fixing dead links * V3.1 updates (#144) * minor fixes for v3.1 * correct id --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
2.6 KiB
2.6 KiB
| ID | E1510 |
| Objective(s) | Impact |
| Related ATT&CK Techniques | Clipboard Data (T1115), Data Manipulation: Transmitted Data Manipulation (T1641.001) |
| Impact Type | Integrity |
| Version | 3.1 |
| Created | 4 December 2020 |
| Last Modified | 12 February 2024 |
Clipboard Modification
ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). MBC extends it to the Windows platform.
After E1510 was defined, T1510 was replaced by T1641.001, and Clipboard Data (T1115) was updated to include content modification.
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Clipminer | 2011 | -- | Clipminer monitors the clipboard for cryptocurrency addresses and replaces them with ones controlled by the adversary. [1] |
| Dark Comet | 2008 | -- | The malware writes clipboard data. [2] |
| Emotet | 2018 | -- | Emotet writes clipboard data. [2] |
| Hupigon | 2013 | -- | Hupigon replaces clipboard data. [2] |
| Rombertik | 2015 | -- | The malware replaces clipboard data. [2] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| write clipboard data | Clipboard Modification (E1510) | user32.EmptyClipboard, System.Windows.Forms.Clipboard::Clear, user32.SetClipboardData, System.Windows.Forms.Clipboard::SetAudio, System.Windows.Forms.Clipboard::SetData, System.Windows.Forms.Clipboard::SetDataObject, System.Windows.Forms.Clipboard::SetFileDropList, System.Windows.Forms.Clipboard::SetImage, System.Windows.Forms.Clipboard::SetText |
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| set_clipboard_data | Clipboard Modification (E1510) | SetClipboardData |
References
[1] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
[2] capa v4.0, analyzed at MITRE on 10/12/2022