MBCProject-mbc-markdown/micro-behaviors/file-system/delete-file.md

ID	C0047
Objective(s)	File System
Related ATT&CK Techniques	None
Version	2.3
Created	4 December 2020
Last Modified	30 April 2024

Delete File

Malware deletes a file.

Use in Malware

Name	Date	Method	Description
Dark Comet	2008	--	Dark Comet deletes files. [1]
Gamut	2014	--	Gamut deletes files. [1]
GoBotKR	2019	--	GoBotKR deletes files. [1]
GravityRAT	2018	--	GravityRAT deletes files. [1]
Hupigon	2013	--	Hupigon deletes files. [1]
Kovter	2016	--	Kovter deletes files. [1]
Mebromi	2011	--	Mebromi deletes files. [1]
Redhip	2011	--	Redhip deletes files. [1]
Rombertik	2015	--	Rombertik deletes files. [1]
SamSam	2015	--	SamSam deletes files. [1]
Shamoon	2012	--	Shamoon deletes files. [1]
Stuxnet	2010	--	Stuxnet deletes files. [1]
UP007	2016	--	UP007 deletes files. [1]

Detection

Tool: capa	Mapping	APIs
delete file	Delete File (C0047)	kernel32.DeleteFile, DeleteFileTransacted, NtDeleteFile, ZwDeleteFile, remove, _wremove, System.IO.File::Delete, System.IO.FileSystemInfo::Delete, kernel32.SHFileOperation, MoveFileEx

Tool: CAPE	Mapping	APIs
clears_logs	Delete File (C0047)	--
removes_zoneid_ads	Delete File (C0047)	DeleteFileW, DeleteFileA
ransomware_recyclebin	Delete File (C0047)	--
trickbot_task_delete	Delete File (C0047)	DeleteFileW
anomalous_deletefile	Delete File (C0047)	NtDeleteFile, DeleteFileW, DeleteFileA
deletes_self	Delete File (C0047)	NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW

C0047 Snippet

File System::Delete File

SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6 Location: 0x409BB1

call    FUN_00404E80    ; generate file name to delete and store in eax
push    eax     ; use the name generated by the previous function as an argument to the next function call
call    KERNEL32.DLL::DeleteFileA       ; delete the file
cmp     eax, 0x1        ; if the file was successfully deleted, the previous function call will return a 1 into eax
sbb     eax, eax        ; isolate the carry flag from the previous comparison.  This will only be 1 if the previous command failed, otherwise it will be 0.

References

[1] capa v4.0, analyzed at MITRE on 10/12/2022