mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck 6ce7ebadf2 Malware types (#140 )

* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

2023-12-20 21:54:25 -05:00

6.7 KiB

Raw Blame History

ID	X0018
Type	Wiper
Aliases	None
Platforms	Windows
Year	2012
Associated ATT&CK Software	Shamoon

Shamoon

Shamoon is a data wiping malware.

ATT&CK Techniques

Name	Use
Discovery::Process Discovery (T1057)	Shamoon enumerates processes. [5]
Execution::Shared Modules (T1129)	Shamoon links many functions at runtime. [5]
Execution::System Services::Service Execution (T1569.002)	Shamoon creates services. [5]
Persistence::Create or Modify System Process::Windows Service (T1543.003)	Shamoon starts services. [5]

See ATT&CK: Shamoon - Techniques Used.

Enhanced ATT&CK Techniques

Name	Use
Impact::Data Destruction (E1485)	A 2018 variant includes a component that erases files and then wipes the Master Boot Record (MBR), preventing file recovery. [1]
Persistence::Modify Existing Service (F0011)	Shamoon enables the RemoteRegistry service to allow remote registry modification. [2]
Defense Evasion::Modify Registry (E1112)	Shamoon disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy. [2]
Defense Evasion::Hidden Files and Directories::Timestamp (F0005.004)	Shamoon modifies target files' time to August 2012 as an antiforensic trick. [2]
Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)	Malware escalates privileges by impersonating the token through using LogonUser and ImpersonateLoggedOnUser then ImpersonateNamedPipeClient. [2]
Impact::Disk Wipe (F0014)	An overwrite component will overwrite the MBR so that the compromised computer can no longer start. [4]
Execution::Command and Scripting Interpreter (E1059)	The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion. [2]
Command and Control::Ingress Tool Transfer (E1105)	Shamoon creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory. [3]
Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)	Shamoon encodes data using XOR. [5]
Discovery::File and Directory Discovery (E1083)	Shamoon gets a common file path. [5]
Discovery::System Information Discovery (E1082)	Shamoon gets the hostname. [5]
Execution::Command and Scripting Interpreter (E1059)	Shamoon accepts command line arguments. [5]

MBC Behaviors

Name	Use
Execution::Conditional Execution::Runs as Service (B0025.007)	Shamoon runs as a service. [5]
Communication::DNS Communication::Resolve (C0011.001)	Shamoon resolves DNS. [5]
Communication::Socket Communication::Initialize Winsock Library (C0001.009)	Shamoon initializes a Winsock library. [5]
Data::Encode Data::XOR (C0026.002)	Shamoon encodes data using XOR. [5]
File System::Copy File (C0045)	Shamoon copies files. [5]
File System::Delete File (C0047)	Shamoon deletes files. [5]
File System::Move File (C0063)	Shamoon moves files. [5]
File System::Read File (C0051)	Shamoon reads files on Windows. [5]
File System::Write File (C0052)	Shamoon writes files on Windows. [5]
Operating System::Registry::Delete Registry Value (C0036.007)	Shamoon deletes registry values. [5]
Operating System::Registry::Query Registry Value (C0036.006)	Shamoon queries or enumerates registry values. [5]
Process::Allocate Thread Local Storage (C0040)	Shamoon allocates thread local storage. [5]
Process::Create Process (C0017)	Shamoon creates a process on Windows. [5]
Process::Create Thread (C0038)	Shamoon creates a thread. [5]
Process::Terminate Process (C0018)	Shamoon terminates processes. [5]