mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
275c8feec3
* New malware examples (#103) * fix typos * add new Use in Malware entries to behaviors * new corpus entries * remove extraneous ref * restore original IDs * fix typos * Update registry.md (#101) Update C0036.001 per "Registry micro-behavior" Discussion. * Update registry.md (#102) Update C0036.001 per "Registry micro-behavior" Discussion. * correct modified date * fix PR comments on formatting * Editing references (#104) --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
1.6 KiB
1.6 KiB
| ID | X0037 |
| Aliases | None |
| Platforms | Windows |
| Year | 2020 |
| Associated ATT&CK Software | Netwalker |
Netwalker
Fileless ransomware written in PowerShell and executed directly in memory.
ATT&CK Techniques
See ATT&CK: Netwalker - Techniques Used.
Enhanced ATT&CK Techniques
| Name | Use |
|---|---|
| Execution::Command and Scripting Interpreter (E1059) | Netwalker is written and executed in Powershell. [1] |
| Defense Evasion::Obfuscated Files or Information (E1027) | Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as Base64, hexademcimal, and XOR. [1] |
| Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001) | Netwalker uses reflective DLL loading to inject from memory. [1] |
| Impact::Data Encrypted for Impact (E1486) | Netwalker encrypts files for ransom. [1] |
Indicators of Compromise
SHA256 Hashes
- f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be
References
[1] https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html