mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
3.5 KiB
3.5 KiB
| ID | E1485 |
| Objective(s) | Impact |
| Related ATT&CK Techniques | Data Destruction (T1485) |
| Impact Type | Availability |
| Version | 2.0 |
| Created | 1 August 2019 |
| Last Modified | 13 September 2023 |
Data Destruction
Data, system files, or other files are destroyed. Individual files are selected, as opposed to wiping an entire sector.
See ATT&CK: Data Destruction (T1485).
Methods
| Name | ID | Description |
|---|---|---|
| Delete Application/Software | E1485.m03 | An application or software is deleted. |
| Delete Shadow Copies | E1485.m04 | Deletes shadow drive data, which is related to ransomware. |
| Empty Recycle Bin | E1485.m02 | Empties the recycle bin, which can be related to ransomware. |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Shamoon | 2012 | -- | A 2018 variant includes a component that erases files and then wipes the Master Boot Record (MBR), preventing file recovery. [1] |
| Rombertik | 2015 | -- | If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the user's home folder. [2] |
| BlackEnergy | 2007 | -- | BlackEnergy 2 variant contains a Destroy plugin that destroys data stored on victim hard drives by overwriting file contents. [3] |
| Conficker | 2008 | -- | Conficker resets system restore points and deletes backup files. [4] |
| MazarBot | 2016 | -- | MazarBot can erase phone data. [5] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| delete volume shadow copies | Data Destruction::Delete Shadow Copies (E1485.m04) | -- |
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| clears_logs | Data Destruction (E1485) | -- |
| ransomware_recyclebin | Data Destruction (E1485) | -- |
| uses_windows_utilities_cipher | Data Destruction (E1485) | -- |
| anomalous_deletefile | Data Destruction (E1485) | NtDeleteFile, DeleteFileW, DeleteFileA |
References
[1] https://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow/d/d-id/1333509
[2] https://blogs.cisco.com/security/talos/rombertik
[3] https://securelist.com/be2-extraordinary-plugins-siemens-targeting-dev-fails/68838/
[4] https://en.wikipedia.org/wiki/Conficker
[5] https://heimdalsecurity.com/blog/security-alert-mazar-bot-active-attacks-android-malware/
[6] https://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow