mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
009ae77217
* E/f updates (#143) * E/F Update, Update Install Cert ID * Small fixes * Update common objects link (#142) * Update README.md * Update 09152023.md * Update README.md * Update 12182023.md * Adding descriptions to micro-behaviors * Fixing dead links * V3.1 updates (#144) * minor fixes for v3.1 * correct id --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
2.9 KiB
2.9 KiB
| ID | X0017 |
| Type | Adware |
| Aliases | None |
| Platforms | Mac OSX |
| Year | 2018 |
| Associated ATT&CK Software | None |
SearchAwesome
SearchAwesome adware intercepts encrypted web traffic to inject ads.
ATT&CK Techniques
| Name | Use |
|---|---|
| Defense Evasion::Subvert Trust Controls (T1553) | The malware uses certificates to gain access to HTTPS traffic. [1] |
| Collection::Browser Session Hijacking (T1185) | The malware can modify web traffic for the purpose of injecting Javascript. [1] |
| Command and Control::Proxy (T1090) | The malware uses mitmproxy to intercept and modify web traffic. [1] |
| Collection::Adversary-in-the-Middle (T1557) | After installing a certificate, the malware inserts inself into a chain of custody, typically within network packets. [1] |
Enhanced ATT&CK Techniques
| Name | Use |
|---|---|
| Execution::User Execution (E1204) | The user opens a disk image file which invisibly installs its components. [1] |
| Defense Evasion::Self Deletion (F0007) | The malware will monitor if a specific file gets deleted and then will delete itself. [1] |
| Privilege Escalation::Install Certificate (F0016) | The malware installs a certificate. [1] |
| Execution::Command and Scripting Interpreter (E1059) | The malware installs a script to inject a JavaScript script and modify web traffic. [1] |
MBC Behaviors
| Name | Use |
|---|---|
| Command and Control::C2 Communication::Receive Data (B0030.002) | The malware receives data from the C2 server. [1] |
| Impact::Manipulate Network Traffic (B0019) | SearchAwesome intercepts encrypted web traffic to inject ads. [1] |
| Execution::Install Additional Program (B0023) | The malware installs an open-source program called mitmproxy. [1] |
Indicators of Compromise
- /Applications/spi.app
- ~/Library/LaunchAgents/spid-uninstall.plist
- ~/Library/LaunchAgents/spid.plist
- ~/Library/SPI/
- ~/.mitmproxy/
Attack Flow
Attack flow for SearchAwesome based on [1].
References
[1] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection