Ryan Xu
e1b22023c5
* Janet mbc updates (#84) * Added Unprotect techniques to respective behaviors and or methods. * Unprotect updates MBC * Unprotect techniques mapped in MBC --------- Co-authored-by: Ryan Xu <ryanxu@wustl.edu> * Fixing redundant Detection sec in sandbox detect --------- Co-authored-by: quant23va <105243450+quant23va@users.noreply.github.com>
2.5 KiB
| ID | E1204 |
| Objective(s) | Execution |
| Related ATT&CK Techniques | User Execution (T1204) |
| Version | 2.0 |
| Created | 28 August 2019 |
| Last Modified | 21 November 2022 |
User Execution
Malware may include code that relies on specific actions by a user to execute. Note that this MBC behavior differs from User Execution in that it does do not include direct code execution (user action for initial execution) - MBC does not encompass ATT&CK's Initial Access Tactic.
This behavior is related to Unprotect technique U1339.
See ATT&CK Technique: User Execution (T1204).
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| GoBotKR | 2019 | -- | GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [1] |
| Rombertik | 2015 | -- | The malware relies on a victim to execute itself. [2] |
| Terminator | 2013 | -- | The malware relies on user interaction to execute. [3] |
| Vobfus | 2016 | -- | The malware relies on user interaction to run the executable. [4] |
| CryptoLocker | 2013 | -- | The malware relies on victims to execute. [4] |
| SearchAwesome | 2018 | -- | The user opens a disk image file which invisibly installs its components. [6] |
References
[1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
[2] https://blogs.cisco.com/security/talos/rombertik
[3] https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes
[4] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
[5] https://www.secureworks.com/research/cryptolocker-ransomware
[6] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/