mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Desiree Beck
c2df3d4e10
* Changing conti name * Mbc 3 (#125) * update version number * update links * update version number * update version number * update version number * 2.3 to main in matrix * link fix * v3 faq update --------- Co-authored-by: ryan <ryanxu@wustl.edu> --------- Co-authored-by: ryan <ryanxu@wustl.edu>
2.1 KiB
2.1 KiB
| ID | X0050 |
| Aliases | None |
| Platforms | Windows |
| Year | 2019 |
| Associated ATT&CK Software | Conti |
Conti
Conti is a Ransomware-as-a-Service (RaaS) malware.
ATT&CK Techniques
See ATT&CK: Conti - Techniques Used.
Enhanced ATT&CK Techniques
| Name | Use |
|---|---|
| Process Injection::Process Hollowing (E1055.012) | Conti creates a process in a suspended state and unmaps or removes the PE image layout from a given process space. |
MBC Behaviors
| Name | Use |
|---|---|
| Process::Create Process (C0017) | As a part of process hollowing, Conti creates a process in a suspended state. |
| Process::Resume Thread (C0054) | As part of process hollowing, Conti resumes the execution of the suspended process. |
| Process::Set Thread Context (C0072) | As part of process hollowing, Conti sets thread context. |
| Process::Unmap Section View (C0070) | As part of process hollowing, Conti unmaps a view of a section from the virtual address space of a subject process. |
| Process::Write Process Memory (C0071) | As part of process hollowing, Conti writes data to an area of memory in a specified process. |
Attack Flow
A partial attack flow for Conti Ransomware based on [1], which shows micro-behaviors associated with Conti's Process Injection::Process Hollowing (E1055.012) behavior.
References
[1] https://labs.vipre.com/how-conti-ransomware-works-and-our-analysis/