Ryan Xu
275c8feec3
* New malware examples (#103) * fix typos * add new Use in Malware entries to behaviors * new corpus entries * remove extraneous ref * restore original IDs * fix typos * Update registry.md (#101) Update C0036.001 per "Registry micro-behavior" Discussion. * Update registry.md (#102) Update C0036.001 per "Registry micro-behavior" Discussion. * correct modified date * fix PR comments on formatting * Editing references (#104) --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
2.5 KiB
| ID | E1204 |
| Objective(s) | Execution |
| Related ATT&CK Techniques | User Execution (T1204) |
| Version | 2.0 |
| Created | 28 August 2019 |
| Last Modified | 21 November 2022 |
User Execution
Malware may include code that relies on specific actions by a user to execute. Note that this MBC behavior differs from User Execution in that it does do not include direct code execution (user action for initial execution) - MBC does not encompass ATT&CK's Initial Access Tactic.
This behavior is related to Unprotect technique U1339.
See ATT&CK Technique: User Execution (T1204).
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| GoBotKR | 2019 | -- | GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [1] |
| Rombertik | 2015 | -- | The malware relies on a victim to execute itself. [2] |
| Terminator | 2013 | -- | The malware relies on user interaction to execute. [3] |
| Vobfus | 2016 | -- | The malware relies on user interaction to run the executable. [4] |
| CryptoLocker | 2013 | -- | The malware relies on victims to execute. [4] |
| SearchAwesome | 2018 | -- | The user opens a disk image file which invisibly installs its components. [6] |
References
[1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
[2] https://blogs.cisco.com/security/talos/rombertik
[3] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
[4] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
[5] https://www.secureworks.com/research/cryptolocker-ransomware
[6] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/