mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
1.5 KiB
1.5 KiB
| ID | C0005 |
| Objective(s) | Communication |
| Related ATT&CK Techniques | None |
| Version | 2.0 |
| Created | 14 August 2020 |
| Last Modified | 10 November 2022 |
WinINet
The Windows Internet (WinINet) application programming interface (API) is used by malware to interact with FTP and HTTP protocols to access Internet resources.
The methods below are those of most interest in malware analysis. Details can be found at [1].
Methods
| Name | ID | Description |
|---|---|---|
| InternetConnect | C0005.001 | Opens an FTP or HTTP session for a given site. |
| InternetOpen | C0005.002 | Initializes an application's use of the WinINet functions. |
| InternetOpenURL | C0005.003 | Opens a resource specified by a complete FTP or HTTP URL. |
| InternetReadFile | C0005.004 | Reads data from an open Internet file (URL data). |
| InternetWriteFile | C0005.005 | Writes data to an open Internet file. |
Detection
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| nemty_network_activity | WinINet (C0005) | InternetOpenA, InternetOpenUrlA |
References
[1] https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions