mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
a92e8ffdfd
* Adding Newsletter * Create 12182023.md * Update README.md --------- Co-authored-by: Desiree Beck <dbeck@mitre.org> * Update e1510 (#134) * Update clipboard-modification.md Update to account for updates to T1115. * Update data-encrypted-for-impact.md fix parentheses * Update clipboard-modification.md * Update data-encrypted-for-impact.md * Update clipboard-modification.md * Moving Archive Collected Data to collection, some description updates * Updating Last Modified --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
2.6 KiB
2.6 KiB
| ID | E1510 |
| Objective(s) | Impact |
| Related ATT&CK Techniques | Clipboard Data (T1115), Data Manipulation: Transmitted Data Manipulation (T1641.001) |
| Impact Type | Integrity |
| Version | 3.0 |
| Created | 4 December 2020 |
| Last Modified | 5 December 2023 |
Clipboard Modification
ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). MBC extends it to the Windows platform.
After E1510 was defined, T1510 was replaced by T1610.001, and Clipboard Data (T1115) was updated to include content modification.
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Clipminer | 2011 | -- | Clipminer monitors the clipboard for cryptocurrency addresses and replaces them with ones controlled by the adversary. [1] |
| Dark Comet | 2008 | -- | The malware writes clipboard data. [2] |
| Emotet | 2018 | -- | Emotet writes clipboard data. [2] |
| Hupigon | 2013 | -- | Hupigon replaces clipboard data. [2] |
| Rombertik | 2015 | -- | The malware replaces clipboard data. [2] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| write clipboard data | Clipboard Modification (E1510) | user32.EmptyClipboard, System.Windows.Forms.Clipboard::Clear, user32.SetClipboardData, System.Windows.Forms.Clipboard::SetAudio, System.Windows.Forms.Clipboard::SetData, System.Windows.Forms.Clipboard::SetDataObject, System.Windows.Forms.Clipboard::SetFileDropList, System.Windows.Forms.Clipboard::SetImage, System.Windows.Forms.Clipboard::SetText |
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| set_clipboard_data | Clipboard Modification (E1510) | SetClipboardData |
References
[1] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
[2] capa v4.0, analyzed at MITRE on 10/12/2022