{ "type": "bundle", "spec_version": "2.1", "id": "bundle--b71d833d-50c2-4555-bebb-b0e2115432a8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "objects": [ { "type": "malware", "spec_version": "2.1", "id": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Goofy Guineapig", "description": "The Goofy Guineapig loader is a UPX packed, trojanised NSIS Firefox installer. Once extracted, it masquerades as a Google update component. Goofy Guineapig maintains persistence as a Windows service. Goofy Guineapig provides a framework into which additional plugins may be loaded. The backdoor supports multiple communications methods, including HTTP, HTTPS and KCP. The configuration is embedded in the binary, and the configuration for the binary analysed results in command and control communications occurring over HTTPS. Many defence evasion techniques are implemented throughout execution.", "malware_types": [ "backdoor" ], "is_family": false, "capabilities": [ "anti-debugging", "anti-sandbox", "anti-vm", "cleans-traces-of-infection", "communicates-with-c2", "hides-artifacts", "fingerprints-host", "installs-other-components", "persists-after-system-reboot", "self-modifies" ], "architecture_execution_envs": [ "x86-64" ], "x_operating_systems": [ "windows" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b24615d1-ed34-43f1-9a0b-ecef5b1ec143", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Create or Modify System Process: Windows Service as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ], "description": "Goofy Guineapig maintains persistence as a Windows service." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--26ca8e76-80e3-4969-807f-74b2d099c098", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--b24615d1-ed34-43f1-9a0b-ecef5b1ec143", "target_ref": "attack-pattern--2959d63f-73fd-46a1-abd2-109d7dcede32" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--12bbf144-ce0e-44f8-a907-98db7698b5bf", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--b24615d1-ed34-43f1-9a0b-ecef5b1ec143" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6b3afa7e-8249-4e2e-adb1-333b02f38b47", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Masquerading: Match Legitimate Name or Location as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Goofy Guineapig masquerades as a FireFox installer and a Google updater. " }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a19f4907-289d-4a85-811b-bc8890754462", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--6b3afa7e-8249-4e2e-adb1-333b02f38b47", "target_ref": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--014f3c8e-5c23-42b3-a909-582a08e1ac2a", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--6b3afa7e-8249-4e2e-adb1-333b02f38b47" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--68e3f3f1-a84e-468b-b854-4bf6f77a81b9", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Virtualization/Sandbox Evasion: Time Based Evasion as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Goofy Guineapig checks the time register twice for a delay of more than 100 milliseconds and will not continue execution if more time has elapsed." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9158d7a2-f1ec-4a09-8fca-fa4cf6a437a8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--68e3f3f1-a84e-468b-b854-4bf6f77a81b9", "target_ref": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c8f26dbb-993a-4811-bcd5-710f04e732a5", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--68e3f3f1-a84e-468b-b854-4bf6f77a81b9" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0cbe52aa-8761-4bf2-ad91-738e52f37877", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Virtualization/Sandbox Evasion: System Checks as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Goofy Guineapig checks the disk size, physical memory size, and number of logical processors, and will not continue execution if any of the checks fail." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4284619b-68d5-43ab-9974-9af1e2f88ddb", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--0cbe52aa-8761-4bf2-ad91-738e52f37877", "target_ref": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cc62516f-463c-4535-a6ce-9d7236a69d4a", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--0cbe52aa-8761-4bf2-ad91-738e52f37877" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--66ee351b-79d6-43d7-8596-e99f38f7cd13", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Virtualization/Sandbox Evasion: User Activity Based Checks as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Goofy Guineapig checks for processes running on a system which indicate that it is being reverse engineered or debugged and will not continue execution if any of the checks fail." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--76fb5773-bb84-4c77-8b5e-6d5e59f156df", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--66ee351b-79d6-43d7-8596-e99f38f7cd13", "target_ref": "attack-pattern--91541e7e-b969-40c6-bbd8-1b5352ec2938" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d106bc1f-2c87-4efa-af97-9f0ef37975b4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--66ee351b-79d6-43d7-8596-e99f38f7cd13" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7b69046e-e7a3-4278-b2bf-4f8e687ffe63", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Obfuscated Files or Information: Software Packing as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Goofy Guineapig is UPX packed and packaged in with a legitimate NSIS installer." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ea775d27-0bac-4b44-9d51-4ab843823d94", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--7b69046e-e7a3-4278-b2bf-4f8e687ffe63", "target_ref": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b3c0feed-4505-488d-8427-2e169c2cd724", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--7b69046e-e7a3-4278-b2bf-4f8e687ffe63" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--02e2c78c-286f-448e-b999-6484fa5a55fa", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Deobfuscate/Decode Files or Information as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Goofy Guineapig contains stack-based strings which are obfuscated with single byte XOR or subtraction throughout the binary." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--308d5784-0f7c-42f4-9039-1a30e2c5253c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--02e2c78c-286f-448e-b999-6484fa5a55fa", "target_ref": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--243bbff9-9dfc-421c-8a90-91e028c6f517", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--02e2c78c-286f-448e-b999-6484fa5a55fa" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--800171b8-5b84-43f4-8606-66e9fda278be", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Hide Artifacts: Hidden Window as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Goofy Guineapig contains the functionality to perform process hollowing on dllhost.exe, when this is performed the process is created hidden." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0b4760da-ef07-43c0-8910-b1b94d3df21a", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--800171b8-5b84-43f4-8606-66e9fda278be", "target_ref": "attack-pattern--cbb66055-0325-4111-aca0-40547b6ad5b0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--158025fe-3cba-43bd-a328-9377668edc27", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--800171b8-5b84-43f4-8606-66e9fda278be" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a4468d56-71fd-462f-b1f3-5f5498c40e9b", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Indicator Removal on Host: File Deletion as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Goofy Guineapig initially runs in the location to which it is downloaded, the files are moved to a legitimate looking directory and deleted from the initial download location." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3899e4ea-83d9-4e7c-91b3-b42a51bc60a4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--a4468d56-71fd-462f-b1f3-5f5498c40e9b", "target_ref": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--689b14ef-7d9f-4972-ab78-bd8fa531076e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--a4468d56-71fd-462f-b1f3-5f5498c40e9b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9d013b75-c2bb-4cb7-9d81-f52d454d7111", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Hijack Execution Flow: DLL Side-Loading as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "A legitimate executable is installed by the Goofy Guineapig loader, alongside a malicious DLL which will be loaded by the legitimate executable." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc90755c-fe1f-42c7-98b0-7c0b50ba6681", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--9d013b75-c2bb-4cb7-9d81-f52d454d7111", "target_ref": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e549fb0-3723-455b-aa08-34a99f3c4c52", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--9d013b75-c2bb-4cb7-9d81-f52d454d7111" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ed4b5f69-b8bc-4745-bb9f-11051a0d924f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Process Injection: Process Hollowing as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Goofy Guineapig can perform process hollowing on the dllhost.exe binary, injecting content downloaded by the C2." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9569403d-bb8b-46d2-beea-bf686c391c16", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--ed4b5f69-b8bc-4745-bb9f-11051a0d924f", "target_ref": "attack-pattern--b200542e-e877-4395-875b-cf1a44537ca4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--612e0bac-509f-44be-a16b-0455683bfaf7", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--ed4b5f69-b8bc-4745-bb9f-11051a0d924f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--644ba292-d166-4de4-9dd3-acd39ec7770c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Signed Binary Proxy Execution: Rundll32 as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "The Goofy Guineapig persistence mechanism utilises rundll32.exe and url.dll to execute the legitimate binary which will load the malicious DLL." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--21d70434-6c8e-4134-a90b-f6ac0cfc29e2", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--644ba292-d166-4de4-9dd3-acd39ec7770c", "target_ref": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--94e7bea7-7e0e-4e2b-820a-d188c7d89d18", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--644ba292-d166-4de4-9dd3-acd39ec7770c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7486a77e-e0f5-497d-a654-d0922bb253d6", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "System Information Discovery as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "description": "Goofy Guineapig sends information \nabout the infected machine in each C2 \npacket, as an obfuscated ‘Authorization’ \nstring in the HTTP header." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb80325d-a640-45de-8da6-474a3a8cac34", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--7486a77e-e0f5-497d-a654-d0922bb253d6", "target_ref": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5e070586-452b-4708-9e4b-90445390a58e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--7486a77e-e0f5-497d-a654-d0922bb253d6" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--170107f3-85fc-4cd3-a943-f55231aec985", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Application Layer Protocol: Web Protocols as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Goofy Guineapig uses HTTPS for its C2 \ncommunications." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fa9d3965-4268-47f1-a37d-a4f5eddb78fc", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--170107f3-85fc-4cd3-a943-f55231aec985", "target_ref": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--693acb82-dfd3-4840-9630-40c95c34b8f4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--170107f3-85fc-4cd3-a943-f55231aec985" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9b1489db-1a03-4d18-a09a-8d1beae494d8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Fallback Channels as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Goofy Guineapig contains the \nfunctionality to communicate using UDP \nand the KCP protocol, or direct socket \ncommunications, dependant on an \nembedded configuration string." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b4be223-7a8b-4cb5-bb64-af8833eb3d4b", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--9b1489db-1a03-4d18-a09a-8d1beae494d8", "target_ref": "attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--685947c9-c98c-49e1-b15e-2728fe7f559c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--9b1489db-1a03-4d18-a09a-8d1beae494d8" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--669bda02-167a-44e4-80be-491e43243063", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Non-Standard Port as used by Goofy Guineapig", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Goofy Guineapig communicates over \nthe non-standard HTTPS port 4443." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c1ab0809-8d07-4469-bd6b-1da50a01792c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--669bda02-167a-44e4-80be-491e43243063", "target_ref": "attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ebf0745e-13c0-4e45-ad39-bb50036a2f67", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "target_ref": "attack-pattern--669bda02-167a-44e4-80be-491e43243063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dd8d92e6-10b5-4080-8113-b00012f948f1", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d4f87c8c-0524-4d34-a86e-dd598ae2cbfb", "target_ref": "indicator--cb99bae3-6e90-4f97-998b-6f352fa7c709" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7cee95b1-e3a1-4970-8c18-3c4519cec208", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d4f87c8c-0524-4d34-a86e-dd598ae2cbfb", "target_ref": "indicator--30125d06-6e30-40e6-8316-5d8a4439d882" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e739fb03-30fd-404b-92d6-7c1648f76dff", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--cb99bae3-6e90-4f97-998b-6f352fa7c709", "target_ref": "indicator--d4f87c8c-0524-4d34-a86e-dd598ae2cbfb" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60293fe0-9d72-4547-bd62-929d4b6e1459", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--cb99bae3-6e90-4f97-998b-6f352fa7c709", "target_ref": "indicator--30125d06-6e30-40e6-8316-5d8a4439d882" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0b7653a2-1992-4b7a-9451-f18b7bfcbc3f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--30125d06-6e30-40e6-8316-5d8a4439d882", "target_ref": "indicator--d4f87c8c-0524-4d34-a86e-dd598ae2cbfb" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--35e7f647-1458-40d9-a027-87ca14836009", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--30125d06-6e30-40e6-8316-5d8a4439d882", "target_ref": "indicator--cb99bae3-6e90-4f97-998b-6f352fa7c709" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5330ba08-5dee-44e3-985a-88b121ca934f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f", "target_ref": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad8ae70a-ce7f-44f9-baa4-716b8b1214a6", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f", "target_ref": "indicator--462b0379-4384-4ca4-87ac-d258656001d5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f2c3252a-3c81-402c-8ec5-0860f90df9ad", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f", "target_ref": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--243ec7d1-40e2-4c07-95cc-9827a8bcbea1", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f", "target_ref": "indicator--462b0379-4384-4ca4-87ac-d258656001d5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c8d76607-77f5-476b-84d1-35c818eb9294", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--462b0379-4384-4ca4-87ac-d258656001d5", "target_ref": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a163b937-0d7a-4868-90e5-3d76753bba18", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--462b0379-4384-4ca4-87ac-d258656001d5", "target_ref": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5447e229-38f6-486a-8c7b-2447a17d4532", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd", "target_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf16ae1d-bed6-43d5-82dc-cf98da0647aa", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd", "target_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5517b1f8-bd39-4cc7-b87b-51029a79b0be", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd", "target_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bb68a30a-2bdf-4a08-9507-98a4dec5cded", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd", "target_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b6c69abb-0315-4cac-827d-6d4973187c80", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890", "target_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6f1633e7-ab1f-4608-96d6-e221634e4490", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890", "target_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1167a594-3c48-45e7-9199-0472aeb3e6eb", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--60be8dfe-55e4-4c44-8afe-32ecfb47f253", "target_ref": "indicator--6109f0fe-c396-441d-b51d-366593c9d405" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7db96ab6-59ad-442a-87b8-a02e5a73d5d2", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--60be8dfe-55e4-4c44-8afe-32ecfb47f253", "target_ref": "indicator--2f78c408-1e45-49ca-bc3e-52386e3c34d2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b7de5b4d-bfc9-4d91-938b-a937033feaf2", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--6109f0fe-c396-441d-b51d-366593c9d405", "target_ref": "indicator--60be8dfe-55e4-4c44-8afe-32ecfb47f253" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--322e322f-d753-4620-8ae7-0e9280cff8b1", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--6109f0fe-c396-441d-b51d-366593c9d405", "target_ref": "indicator--2f78c408-1e45-49ca-bc3e-52386e3c34d2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--650a52dc-001d-4c5c-8697-49671e7de732", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--2f78c408-1e45-49ca-bc3e-52386e3c34d2", "target_ref": "indicator--60be8dfe-55e4-4c44-8afe-32ecfb47f253" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6acb1a41-ab63-4d3e-8065-52ad55d3fda8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--2f78c408-1e45-49ca-bc3e-52386e3c34d2", "target_ref": "indicator--6109f0fe-c396-441d-b51d-366593c9d405" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e62190c1-5c50-4ba9-b644-a27410d1840c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ac594c10-f711-479f-8727-f6cbf6016f9f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf530edd-83be-4543-b64d-e40848750e79", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb812069-0b48-4ac5-9521-d88413a18bc7", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--533327de-b293-40b6-9d77-af3b34f5c552", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--78d9ee30-85f4-4d48-907e-e82218411ef6", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bdc2a9ac-ba0e-459b-972e-db2369a65144", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--cff4fd4f-85ee-42ed-8d86-c1d7e8194bd8", "target_ref": "indicator--61fa1160-3786-418a-8761-ad5f2f8bd0d4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f6ef7b47-9461-414b-8d5f-c9da527aea29", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--cff4fd4f-85ee-42ed-8d86-c1d7e8194bd8", "target_ref": "indicator--092fc851-a7e1-446d-ae93-bb02e2bd58e4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4f802613-2a76-4ffe-934b-c7b3a98ba7a7", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--61fa1160-3786-418a-8761-ad5f2f8bd0d4", "target_ref": "indicator--cff4fd4f-85ee-42ed-8d86-c1d7e8194bd8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a9bd9d20-f454-4ecc-aa27-577274d16311", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--61fa1160-3786-418a-8761-ad5f2f8bd0d4", "target_ref": "indicator--092fc851-a7e1-446d-ae93-bb02e2bd58e4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--45780c7d-1056-40f1-b6d1-6594a6e07b69", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--092fc851-a7e1-446d-ae93-bb02e2bd58e4", "target_ref": "indicator--cff4fd4f-85ee-42ed-8d86-c1d7e8194bd8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--098ace62-5946-4785-b713-ab13009a19f4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--092fc851-a7e1-446d-ae93-bb02e2bd58e4", "target_ref": "indicator--61fa1160-3786-418a-8761-ad5f2f8bd0d4" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d4f87c8c-0524-4d34-a86e-dd598ae2cbfb", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'a21dec89611368313e138480b3c94835']", "description": "UPX packed setup-stub.exe", "valid_from": "2022-12-14T13:39:06.599Z", "name": "Goofy Guineapig sample (MD5: a21dec89611368313e138480b3c94835 Filename: 'Firefox-latest.exe ')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--74bfc9d7-beab-402b-b38e-ff70c12810b2", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--d4f87c8c-0524-4d34-a86e-dd598ae2cbfb", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cb99bae3-6e90-4f97-998b-6f352fa7c709", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '2b8aab068ef15cb05789da320b7099932a0a4166']", "description": "UPX packed setup-stub.exe", "valid_from": "2022-12-14T13:39:06.599Z", "name": "Goofy Guineapig sample (SHA-1: a21dec89611368313e138480b3c94835 Filename: 'Firefox-latest.exe ')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--43d7aa52-f426-4e94-92ad-0aa7da072be5", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--cb99bae3-6e90-4f97-998b-6f352fa7c709", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--30125d06-6e30-40e6-8316-5d8a4439d882", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '19cef7f32e42cc674f7c76be3a5c691c543f4e018486c29153e7dde1a48af34c']", "description": "UPX packed setup-stub.exe", "valid_from": "2022-12-14T13:39:06.599Z", "name": "Goofy Guineapig sample (SHA-256: a21dec89611368313e138480b3c94835 Filename: 'Firefox-latest.exe ')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c5fe962e-4488-4045-9aa5-b43586dfab71", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--30125d06-6e30-40e6-8316-5d8a4439d882", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '180e0bb4b570c215bfe7abdf209402aa']", "description": "Trojanised NSIS FireFox installer ", "valid_from": "2022-12-14T13:39:06.599Z", "name": "Goofy Guineapig sample (MD5: 180e0bb4b570c215bfe7abdf209402aa Filename: 'setup-stub.exe')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36c148b5-cce0-48c6-8915-b767683f740e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '6f5c07c50ce4976ddb3879ce65d3b2f96693dc4c']", "description": "Trojanised NSIS FireFox installer ", "valid_from": "2022-12-14T13:39:06.599Z", "name": "Goofy Guineapig sample (SHA-1: 180e0bb4b570c215bfe7abdf209402aa Filename: 'setup-stub.exe')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f2d60b8-dc18-4999-a834-c06e3cd41649", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--462b0379-4384-4ca4-87ac-d258656001d5", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '97f66bcdd73917a8b59d9a1dcac21a58936bcaf91e757a9dfb8e5c320af40f56']", "description": "Trojanised NSIS FireFox installer ", "valid_from": "2022-12-14T13:39:06.599Z", "name": "Goofy Guineapig sample (SHA-256: 180e0bb4b570c215bfe7abdf209402aa Filename: 'setup-stub.exe')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03aad537-ab4b-4b30-9dec-9a4afba516f9", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--462b0379-4384-4ca4-87ac-d258656001d5", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'f98537517212068d0c57968876fc8204']", "description": "Malicious DLL masquerading as Google update - extracted from setup-stub", "valid_from": "2022-12-14T13:39:06.600Z", "name": "Goofy Guineapig sample (MD5: f98537517212068d0c57968876fc8204 Filename: 'Goopdate.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5c3d16ed-d387-4903-8d09-8cf23dec1f7f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '7961930d13cb8d5056db64b6749356915fb4c272']", "description": "Malicious DLL masquerading as Google update - extracted from setup-stub", "valid_from": "2022-12-14T13:39:06.600Z", "name": "Goofy Guineapig sample (SHA-1: f98537517212068d0c57968876fc8204 Filename: 'Goopdate.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--25cad179-7567-4491-93e7-8b83d9652d89", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '12a29373c1f493f7757b755099bde4770c310af3fde376176b6d792cd1c5e150']", "description": "Malicious DLL masquerading as Google update - extracted from setup-stub", "valid_from": "2022-12-14T13:39:06.600Z", "name": "Goofy Guineapig sample (SHA-256: f98537517212068d0c57968876fc8204 Filename: 'Goopdate.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c162c8f4-92e4-4235-a0fc-057c1ae740b1", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--60be8dfe-55e4-4c44-8afe-32ecfb47f253", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '06e1992e6c52af33117d142bdbeef74d']", "description": "Decoded shellcode extracted from config.dat", "valid_from": "2022-12-14T13:39:06.601Z", "name": "Goofy Guineapig sample (MD5: 06e1992e6c52af33117d142bdbeef74d)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0deb6aab-a2d5-4d72-bf6e-72eee22c5c0c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--60be8dfe-55e4-4c44-8afe-32ecfb47f253", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6109f0fe-c396-441d-b51d-366593c9d405", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '231ac2c5f3c9a833836be65f7443e3525eb1e7a3']", "description": "Decoded shellcode extracted from config.dat", "valid_from": "2022-12-14T13:39:06.601Z", "name": "Goofy Guineapig sample (SHA-1: 06e1992e6c52af33117d142bdbeef74d)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c329231d-eff9-46b9-9734-f2d8f403b11e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--6109f0fe-c396-441d-b51d-366593c9d405", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2f78c408-1e45-49ca-bc3e-52386e3c34d2", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '13c27a686f863a388cbc40661e6fda602ab14af9454421b08229cadb54d7b000']", "description": "Decoded shellcode extracted from config.dat", "valid_from": "2022-12-14T13:39:06.601Z", "name": "Goofy Guineapig sample (SHA-256: 06e1992e6c52af33117d142bdbeef74d)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c3a9808b-3d13-42d1-a88a-d585189aec15", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2f78c408-1e45-49ca-bc3e-52386e3c34d2", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--27632564-82dc-46fe-9729-61f6f8560103", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'abbe7d13b13ea4315543bdad187f14b3']", "description": "Decoded binary extracted from the shellcode extracted from config.dat", "valid_from": "2022-12-14T13:39:06.602Z", "name": "Goofy Guineapig sample (MD5: abbe7d13b13ea4315543bdad187f14b3)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--641474ee-b69e-4f31-adc5-02bbc10bb40a", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '11b82826ec01aeec44e5e2504935b6aaccf51cac']", "description": "Decoded binary extracted from the shellcode extracted from config.dat", "valid_from": "2022-12-14T13:39:06.602Z", "name": "Goofy Guineapig sample (SHA-1: abbe7d13b13ea4315543bdad187f14b3)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--504284fc-0807-4b3f-9fec-2c8e78c50daa", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '4ffc7f65e16ce59ff9e6a504f88e0cf56b225c0eb2cf8ec578b3e9d40d9bd898']", "description": "Decoded binary extracted from the shellcode extracted from config.dat", "valid_from": "2022-12-14T13:39:06.602Z", "name": "Goofy Guineapig sample (SHA-256: abbe7d13b13ea4315543bdad187f14b3)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--949e8d78-ab7c-4b75-9511-231f83ed8c81", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cff4fd4f-85ee-42ed-8d86-c1d7e8194bd8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '3dc1096e73db4886fb66ed9413ca994c']", "description": "Encoded shellcode file - extracted from setup-stub", "valid_from": "2022-12-14T13:39:06.602Z", "name": "Goofy Guineapig sample (MD5: 3dc1096e73db4886fb66ed9413ca994c Filename: 'config.dat')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9593011c-c563-4856-9833-64bb72fb066f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--cff4fd4f-85ee-42ed-8d86-c1d7e8194bd8", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--61fa1160-3786-418a-8761-ad5f2f8bd0d4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '628ce6721b97fa12590356712fbfc5ae030781ce']", "description": "Encoded shellcode file - extracted from setup-stub", "valid_from": "2022-12-14T13:39:06.602Z", "name": "Goofy Guineapig sample (SHA-1: 3dc1096e73db4886fb66ed9413ca994c Filename: 'config.dat')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--02cea3ee-0490-424d-b8f7-5d5cfbee7e72", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--61fa1160-3786-418a-8761-ad5f2f8bd0d4", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--092fc851-a7e1-446d-ae93-bb02e2bd58e4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '3a1af09a0250c602569d458e79db90a45e305b76d8423b81eeca14c69847b81c']", "description": "Encoded shellcode file - extracted from setup-stub", "valid_from": "2022-12-14T13:39:06.602Z", "name": "Goofy Guineapig sample (SHA-256: 3dc1096e73db4886fb66ed9413ca994c Filename: 'config.dat')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--657bd17b-8295-4da4-92c8-38e8ef4dd4d7", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--092fc851-a7e1-446d-ae93-bb02e2bd58e4", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d3c48941-6a7f-4979-820a-886357069322", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_sessionstate\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects session state stack string setup in Goofy Guineapig.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {66 C7 45 E8 44 69 66 C7 45 F2 65 64 C6 45 F1 74 66 C7 45 EB 63 6F C6 45 F4 00 C6 45 EA 73 C7 45 ED 6E 6E 65 63}\r\n $2 = {66 C7 45 ED 65 00 C7 45 E8 41 63 74 69 C6 45 EC 76 EB 2A}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects session state stack string setup in Goofy Guineapig.", "valid_from": "2022-12-14T13:39:06.604Z", "name": "YARA: GoofyGuineapig_sessionstate", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1cf3366f-9c65-4587-9fca-b67b6fd0bb20", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--d3c48941-6a7f-4979-820a-886357069322", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--80123318-bec6-4f4d-afc1-e22526d694bc", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d3c48941-6a7f-4979-820a-886357069322", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f4673f5e-0733-4009-b27f-38e48bb2241b", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d3c48941-6a7f-4979-820a-886357069322", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f5597608-d9de-4e58-a1ad-5d6425ca29d4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d3c48941-6a7f-4979-820a-886357069322", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bc017b31-2e1d-472d-97cf-8bf040f87eb4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_shellcodeheader\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig shellcode header.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"231ac2c5f3c9a833836be65f7443e3525eb1e7a3\"\r\n\r\n strings:\r\n $1 = {10 00 00 00 00 FA 01 00 EA 06 00 00 51 36 25 07 31 25 53 55 08 3A 15 2A 3B 34 2C 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00}\r\n\r\n condition:\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig shellcode header.", "valid_from": "2022-12-14T13:39:06.604Z", "name": "YARA: GoofyGuineapig_shellcodeheader", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1fd30b3a-9551-48f6-909f-eefecd6570dc", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--bc017b31-2e1d-472d-97cf-8bf040f87eb4", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cde478cf-e25b-4b72-aa00-b9fa5bd2c272", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bc017b31-2e1d-472d-97cf-8bf040f87eb4", "target_ref": "indicator--60be8dfe-55e4-4c44-8afe-32ecfb47f253" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--40a26c27-64fd-40e1-98c7-ecdc7cbd9cf5", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bc017b31-2e1d-472d-97cf-8bf040f87eb4", "target_ref": "indicator--6109f0fe-c396-441d-b51d-366593c9d405" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a96d598-38fb-4de3-9ed5-61a27bf2619b", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bc017b31-2e1d-472d-97cf-8bf040f87eb4", "target_ref": "indicator--2f78c408-1e45-49ca-bc3e-52386e3c34d2" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a724f4c3-a799-4b01-98a4-8833d6c0f887", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_querysessionargs\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects query session information API call arguments in Goofy Guineapig.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {6A 05 52 33 DB 53 FF D7}\r\n $2 = {50 6A 10 51 53 FF D7}\r\n $3 = {51 6A 0E 52 53 FF D7}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects query session information API call arguments in Goofy Guineapig.", "valid_from": "2022-12-14T13:39:06.605Z", "name": "YARA: GoofyGuineapig_querysessionargs", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cbeb5373-9711-4198-b02d-cd3e99c17cbd", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a724f4c3-a799-4b01-98a4-8833d6c0f887", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aef8a0d7-c339-4ac2-9df3-fee981e9a7c0", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a724f4c3-a799-4b01-98a4-8833d6c0f887", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03e536f6-540e-4eda-94b9-5a44e79f9c79", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a724f4c3-a799-4b01-98a4-8833d6c0f887", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fcae62df-7e93-435e-8ee1-8cbeefcda5be", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a724f4c3-a799-4b01-98a4-8833d6c0f887", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--060ccc1c-2465-4281-bd8b-a16655b09dc8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_internetsetoptionargs\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects internet set option API call arguments in Goofy Guineapig.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {6A 04 8D 55 ?? 52 6A 06 57 C7 45 ?? 20 BF 02 00 FF 15 ?? ?? ?? ??}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects internet set option API call arguments in Goofy Guineapig.", "valid_from": "2022-12-14T13:39:06.605Z", "name": "YARA: GoofyGuineapig_internetsetoptionargs", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c17856c-858a-4c48-9684-57eaace4d546", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--060ccc1c-2465-4281-bd8b-a16655b09dc8", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--75521d33-f21e-4cec-9d1b-7af6fb8a3338", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--060ccc1c-2465-4281-bd8b-a16655b09dc8", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4be6dd0f-a9ee-43c0-a421-52c4098cca8e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--060ccc1c-2465-4281-bd8b-a16655b09dc8", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--56d8b9e9-af42-438d-9f6e-3d152da0f532", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--060ccc1c-2465-4281-bd8b-a16655b09dc8", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--99ee1288-0750-454e-9972-9ecba66928e1", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_sleepargs\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects sleep API call argument setup in Goofy Guineapig.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {33 D2 8D 4E 01 F7 F1 8B C6 8B CA 99 2B C2 D1 F8 8D 94 01 D0 07 00 00 52 FF 15 ?? ?? ?? ??}\t\t\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects sleep API call argument setup in Goofy Guineapig.", "valid_from": "2022-12-14T13:39:06.605Z", "name": "YARA: GoofyGuineapig_sleepargs", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8c72801e-6b14-4b3e-a0a5-476b62f94e94", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--99ee1288-0750-454e-9972-9ecba66928e1", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2607cf86-f5df-44d8-a6c9-aba29ef0a8a8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--99ee1288-0750-454e-9972-9ecba66928e1", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b4bb811-900c-484f-8e59-d130c201c742", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--99ee1288-0750-454e-9972-9ecba66928e1", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9dabe46b-f33e-4080-a551-8dd3e67fc384", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--99ee1288-0750-454e-9972-9ecba66928e1", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cb79fbbb-f882-4aa3-bee4-085d24ffc218", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_internetqueryoptionargs\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects internet query option API call arguments in Goofy Guineapig.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {52 6A 1F 57 C7 85 ?? ?? ?? ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 04 00 00 00 FF 15 ?? ?? ?? ?? 81 8D ?? ?? ?? ?? 80 03 00 00 6A 04 8D 85 ?? ?? ?? ?? 50 6A 1F 57 FF 15 ?? ?? ?? ??}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects internet query option API call arguments in Goofy Guineapig.", "valid_from": "2022-12-14T13:39:06.606Z", "name": "YARA: GoofyGuineapig_internetqueryoptionargs", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee40e580-2593-4222-b72c-a6e1996dab3c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--cb79fbbb-f882-4aa3-bee4-085d24ffc218", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aeb152ac-6f46-4f89-a2f0-1a74374a1458", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cb79fbbb-f882-4aa3-bee4-085d24ffc218", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a1b6ad52-1c75-4988-9181-fd1871b6a04e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cb79fbbb-f882-4aa3-bee4-085d24ffc218", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--73571faf-be99-4932-af2d-7c7424f936a8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cb79fbbb-f882-4aa3-bee4-085d24ffc218", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cfb042f3-952b-4de8-a044-c1508ff8f57c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_httpstack\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects http/HTTP stack string setup in Goofy Guineapig.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {3C 68 75 ?? 80 7F 01 74 75 ?? 80 7F 02 74 75 ?? 80 7F 03 70 74 ??}\r\n $2 = {3C 48 75 ?? 80 7F 01 54 75 ?? 80 7F 02 54 75 ?? 80 7F 03 50 74 ??}\t\t\t\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects http/HTTP stack string setup in Goofy Guineapig.", "valid_from": "2022-12-14T13:39:06.606Z", "name": "YARA: GoofyGuineapig_httpstack", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c1a052e-83d9-410b-b70b-6cde40af7a98", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--cfb042f3-952b-4de8-a044-c1508ff8f57c", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1f813d86-ddc4-42e0-bb1c-47796fe7870e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cfb042f3-952b-4de8-a044-c1508ff8f57c", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3fafa82c-c9d1-4b59-80b6-7bdb4939f41e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cfb042f3-952b-4de8-a044-c1508ff8f57c", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23f40a1b-71fc-45b4-8ef9-295fb25e9a91", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cfb042f3-952b-4de8-a044-c1508ff8f57c", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--65a70bee-65d3-4e1a-bf98-440327c6480c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_httpfunc\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects GET string setup in Goofy Guineapig.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {C7 45 ?? FF FF FF FF BE 00 01 00 80 C7 45 ?? 47 45 54 00 C7 45 ?? 00 02 00 00 E8 ?? ?? ?? ??}\t\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects GET string setup in Goofy Guineapig.", "valid_from": "2022-12-14T13:39:06.606Z", "name": "YARA: GoofyGuineapig_httpfunc", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--96e944a3-79c4-4969-90a6-9b0275ea1d6f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--65a70bee-65d3-4e1a-bf98-440327c6480c", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c778aa0a-7479-49f8-b66a-48c7bf66247f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--65a70bee-65d3-4e1a-bf98-440327c6480c", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c11e7467-ba06-4a6e-9988-413448f2218d", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--65a70bee-65d3-4e1a-bf98-440327c6480c", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4c37e3ef-bc7b-4710-8b34-a5c3db088408", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--65a70bee-65d3-4e1a-bf98-440327c6480c", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b6687197-72ce-4d40-b3ac-127cb89c7ee4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_encodedurl\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig encoded URL config.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {11 0D 0D 09 0A 63 76 76 2A 2D 38 2D 30 3A 77 2D 3A 29 35 36 3E 77 3A 36 34 63 6D 6D 6D 6A 25 11 0D 0D 09 0A 63 76 76 2A 2D 38 2D 30 3A 77 2D 3A 29 35 36 3E 77 3A 36 34 63 6D 6D 6D 6A 25 68 6B 25 6C 25 68 59}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig encoded URL config.", "valid_from": "2022-12-14T13:39:06.606Z", "name": "YARA: GoofyGuineapig_encodedurl", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--53cb2da5-692b-4a6d-b81a-a7af069af1f0", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--b6687197-72ce-4d40-b3ac-127cb89c7ee4", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--40cb71ad-dc64-442c-bd0c-a9adb47b6005", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b6687197-72ce-4d40-b3ac-127cb89c7ee4", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--39a66116-a652-4ddb-bb6f-82cebcd1c4a0", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b6687197-72ce-4d40-b3ac-127cb89c7ee4", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0eb2147f-0fb3-491c-944a-2a51f0ca8056", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b6687197-72ce-4d40-b3ac-127cb89c7ee4", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b23a4ebe-0274-4cbc-a3f4-9874e1381fae", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_errorcompare\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig error comparison.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {81 FE FF 2E 00 00 0F ?? ?? ?? ?? ?? 81 FE F3 2E 00 00 74 ?? 81 FE 0D 2F 00 00 74 ?? 81 FE 8A 2F 00 00 74 ?? 81 FE 89 2F 00 00 74 ?? 81 FE 06 2F 00 00 74 ?? 81 FE 05 2F 00 00 0F}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig error comparison.", "valid_from": "2022-12-14T13:39:06.607Z", "name": "YARA: GoofyGuineapig_errorcompare", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f85b24a1-00b0-4ca1-8e39-713e88ac463e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--b23a4ebe-0274-4cbc-a3f4-9874e1381fae", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--99d2efec-eb9e-4a02-a158-8718298115d4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b23a4ebe-0274-4cbc-a3f4-9874e1381fae", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--99f7ce77-6332-48fd-a7fb-6f7d5df9f1ab", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b23a4ebe-0274-4cbc-a3f4-9874e1381fae", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--55509492-15f4-4e79-832c-bdc04349bf51", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b23a4ebe-0274-4cbc-a3f4-9874e1381fae", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c0927b8e-faee-4de3-8272-8e6584c2ec71", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_processstart\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig process hollowing process start-up.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {50 51 51 68 34 00 08 00 51 51 51 66 89 4D CC 8B 4D 08 51 6A 00 52 C7 45 9C 48 00 00 00 C7 45 A4 ?? ?? ?? ?? C7 45 C8 01 00 08 00 FF 15 ?? ?? ?? ??}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig process hollowing process start-up.", "valid_from": "2022-12-14T13:39:06.607Z", "name": "YARA: GoofyGuineapig_processstart", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--19bb98a5-4d75-4dfd-bd73-105b5aff1793", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--c0927b8e-faee-4de3-8272-8e6584c2ec71", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86644818-f712-4371-856b-ecf9ab334319", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c0927b8e-faee-4de3-8272-8e6584c2ec71", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db261c06-242d-4700-bcb5-d32614b37895", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c0927b8e-faee-4de3-8272-8e6584c2ec71", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--82968acf-ab7a-4f6b-b73d-a21f68c7989e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c0927b8e-faee-4de3-8272-8e6584c2ec71", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2e16e9d1-614a-4006-b8c8-2777a41bfbdd", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_threadcontext\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig process hollowing thread context.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {8D 95 ?? ?? ?? ?? 52 BB 02 00 01 00 57 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 57 89 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ??}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig process hollowing thread context.", "valid_from": "2022-12-14T13:39:06.607Z", "name": "YARA: GoofyGuineapig_threadcontext", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5688eb59-d0e2-4f55-a265-3a9dccffd8f9", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2e16e9d1-614a-4006-b8c8-2777a41bfbdd", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--438b546f-c0c2-44ce-9b1f-fd1f9a42c5f5", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2e16e9d1-614a-4006-b8c8-2777a41bfbdd", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--314f7205-74bf-4c7a-8275-1c8b6f2d5a98", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2e16e9d1-614a-4006-b8c8-2777a41bfbdd", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9cb04271-3d8f-4c6d-af60-6887b1a1e4f9", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2e16e9d1-614a-4006-b8c8-2777a41bfbdd", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2a0396f9-a6e0-4543-ba29-c2905bc69cca", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_rc4keystackstring_NZTsIkAC6FUDY7FyN\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig RC4 key stack string setup.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {66 C7 45 DF 79 4E C6 45 E1 00 C7 45 D0 4E 5A 54 73 66 C7 45 DC 59 37 66 C7 45 D9 46 55 C6 45 DB 44 C7 45 D4 49 6B 41 43 C6 45 D8 36}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig RC4 key stack string setup.", "valid_from": "2022-12-14T13:39:06.607Z", "name": "YARA: GoofyGuineapig_rc4keystackstring_NZTsIkAC6FUDY7FyN", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6414beaa-5bb1-4031-96b2-f3a00450b0b4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2a0396f9-a6e0-4543-ba29-c2905bc69cca", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf3e6c8e-802b-4a9a-8bca-f1ce4d7943e7", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2a0396f9-a6e0-4543-ba29-c2905bc69cca", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5d27c02f-fca3-4043-9630-661bcae9c343", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2a0396f9-a6e0-4543-ba29-c2905bc69cca", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c381c73c-4f49-4dea-9eb7-8b301d7b6dac", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2a0396f9-a6e0-4543-ba29-c2905bc69cca", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_servicestring\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig loader service string.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"7961930d13cb8d5056db64b6749356915fb4c272\"\r\n hash2 = \"6f5c07c50ce4976ddb3879ce65d3b2f96693dc4c\"\r\n\r\n strings:\r\n $service_string = \"C:\\\\windows\\\\system32\\\\cmd.exe /c C:\\\\windows\\\\system32\\\\rundll32.exe url.dll,FileProtocolHandler C:\\\\ProgramData\\\\GoogleUpdate\\\\GoogleUpdate.exe\"\t\t\t\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig loader service string.", "valid_from": "2022-12-14T13:39:06.607Z", "name": "YARA: GoofyGuineapig_servicestring", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d76a4759-11a4-46be-9ba6-bbf8fcb7e0f1", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--237afb95-72b2-4d0e-86be-0eefc4a68168", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "target_ref": "attack-pattern--b24615d1-ed34-43f1-9a0b-ecef5b1ec143" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8b3b8862-bb72-48a7-84a6-f341578b06b8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "target_ref": "attack-pattern--644ba292-d166-4de4-9dd3-acd39ec7770c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9d1d4ebe-d7a5-400f-8719-16a8f8af8125", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "target_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dd4ad024-39a8-44d4-a73b-7eb4d9cee99e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "target_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--da322285-1e07-4bf8-ad80-d4e774a44d14", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "target_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--caa3275b-b786-4b52-a60b-c33fcfdf3e3f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "target_ref": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--219f4a1c-6ebb-48c8-99ee-423838ae7258", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "target_ref": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--466a35f2-6d1c-40c4-8dcf-923e14485ac4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "target_ref": "indicator--462b0379-4384-4ca4-87ac-d258656001d5" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ef0c3fc0-343e-4ad0-be7f-087f378f1eaa", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_rc4keystackstring_DNPl8CS20U5SvtpT5PE13\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig RC4 key stack string setup.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"11b82826ec01aeec44e5e2504935b6aaccf51cac\"\r\n\r\n strings:\r\n $1 = {C7 45 ?? 44 4E 50 6C C7 45 ?? 38 43 53 32 C7 45 ?? 30 55 35 53 C7 45 ?? 76 74 70 54 C7 45 ?? 35 50 45 31 66 C7 45 ?? 33 00}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig RC4 key stack string setup.", "valid_from": "2022-12-14T13:39:06.607Z", "name": "YARA: GoofyGuineapig_rc4keystackstring_DNPl8CS20U5SvtpT5PE13", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77238cb2-821c-413d-895c-c54184396857", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--ef0c3fc0-343e-4ad0-be7f-087f378f1eaa", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86f14eb7-6836-414b-8bcf-5120fb251291", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ef0c3fc0-343e-4ad0-be7f-087f378f1eaa", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e0b9b3e2-7c51-44c2-bfd1-822a1e1f2488", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ef0c3fc0-343e-4ad0-be7f-087f378f1eaa", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bdd43754-6903-45bc-8add-3f6da55de96c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ef0c3fc0-343e-4ad0-be7f-087f378f1eaa", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--81a944e6-3690-4750-97f4-77378ac769e5", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_decodeshellcode\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig loader shellcode decoding.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"7961930d13cb8d5056db64b6749356915fb4c272\"\r\n hash2 = \"6f5c07c50ce4976ddb3879ce65d3b2f96693dc4c\"\r\n\r\n strings:\r\n $1 = {8A 0C 18 80 E9 73 80 F1 6D 88 0C 18 40 3B C7}\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig loader shellcode decoding.", "valid_from": "2022-12-14T13:39:06.607Z", "name": "YARA: GoofyGuineapig_decodeshellcode", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aa8a5b21-8060-4135-89b8-4274cc25cbf2", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--81a944e6-3690-4750-97f4-77378ac769e5", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77f67a40-0cce-4fe3-85ff-1c9c7f59f9e2", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--81a944e6-3690-4750-97f4-77378ac769e5", "target_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1bb8e648-7df9-45ea-b395-95cc70880726", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--81a944e6-3690-4750-97f4-77378ac769e5", "target_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad53f9e4-90b6-4bdb-a924-dffcd1a19d75", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--81a944e6-3690-4750-97f4-77378ac769e5", "target_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1d366236-8bce-491c-961d-b90fa01b9c18", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--81a944e6-3690-4750-97f4-77378ac769e5", "target_ref": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b2a3a652-67f0-44e2-ae76-e153a7184755", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--81a944e6-3690-4750-97f4-77378ac769e5", "target_ref": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6325b555-7b22-4cda-b189-2c750b2272ef", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--81a944e6-3690-4750-97f4-77378ac769e5", "target_ref": "indicator--462b0379-4384-4ca4-87ac-d258656001d5" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--125bc87a-9ee3-4d33-b8f9-4fc89f28235c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_stackstrings\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig loader stack strings.\"\r\n date = \"2022-12-13\"\r\n hash1 = \"6f5c07c50ce4976ddb3879ce65d3b2f96693dc4c\"\r\n hash2 = \"7961930d13cb8d5056db64b6749356915fb4c272\"\r\n\r\n strings:\r\n $TempBat = {C6 85 ?? F5 FF FF 2A C6 85 ?? F5 FF FF 78 C6 85 ?? F5 FF FF 61 C6 85 ?? F5 FF FF 79 C6 85 ?? F5 FF FF 6A C6 85 ?? F5 FF FF 72 C6 85 ?? F5 FF FF 75 C6 85 ?? F5 FF FF 33 C6 85 ?? F5 FF FF 67 C6 85 ?? F5 FF FF 66 C6 85 ?? F5 FF FF 79}\r\n $nStart = {C6 85 ?? F5 FF FF 4C C6 85 ?? F5 FF FF 35 C6 85 ?? F5 FF FF 32 C6 85 ?? F5 FF FF 27 C6 85 ?? F5 FF FF 34 C6 85 ?? F5 FF FF 32 C6 85 ?? F5 FF FF 66}\r\n $Goopdate = {C6 85 ?? F6 FF FF 49 33 C9 C6 85 ?? F6 FF FF 71 C6 85 ?? F6 FF FF 71 C6 85 ?? F6 FF FF 69 C6 85 ?? F6 FF FF 6E C6 85 ?? F6 FF FF 67 C6 85 ?? F6 FF FF 57 C6 85 ?? F6 FF FF 72 C6 85 ?? F6 FF FF 66 C6 85 ?? F6 FF FF 63 C6 85 ?? F6 FF FF 76 C6 85 ?? F6 FF FF 67}\r\n\t\t$GoogleUpdateExe = {C6 85 ?? F5 FF FF 75 C6 85 ?? F5 FF FF 5D C6 85 ?? F5 FF FF 5D C6 85 ?? F5 FF FF 55 C6 85 ?? F5 FF FF 5E C6 85 ?? F5 FF FF 57 C6 85 ?? F5 FF FF 67 C6 85 ?? F5 FF FF 42 C6 85 ?? F5 FF FF 56 C6 85 ?? F5 FF FF 53 C6 85 ?? F5 FF FF 46 C6 85 ?? F5 FF FF 57 C6 85 ?? F5 FF FF 1C C6 85 ?? F5 FF FF 57 C6 85 ?? F5 FF FF 4A C6 85 ?? F5 FF FF 57}\r\n $GoogleUpdate = {C6 85 ?? F5 FF FF 4E C6 85 ?? F5 FF FF 55 C6 85 ?? F5 FF FF 7D C6 85 ?? F5 FF FF 7D C6 85 ?? F5 FF FF 75 C6 85 ?? F5 FF FF 7E C6 85 ?? F5 FF FF 77 C6 85 ?? F5 FF FF 47 C6 85 ?? F5 FF FF 62 C6 85 ?? F5 FF FF 76 C6 85 ?? F5 FF FF 73 C6 85 ?? F5 FF FF 66 C6 85 ?? F5 FF FF 77 C6 85 ?? F5 FF FF 3C C6 85 ?? F5 FF FF 77 C6 85 ?? F5 FF FF 6A C6 85 ?? F5 FF FF 77}\r\n $ProgramDataGoogleUpdate = {C6 85 ?? F5 FF FF 4F C6 85 ?? F5 FF FF 46 C6 85 ?? F5 FF FF 68 C6 85 ?? F5 FF FF 5C C6 85 ?? F5 FF FF 7E C6 85 ?? F5 FF FF 7B 33 C9 C6 85 ?? F5 FF FF 73 C6 85 ?? F5 FF FF 7E C6 85 ?? F5 FF FF 6D C6 85 ?? F5 FF FF 79 C6 85 ?? F5 FF FF 50 C6 85 ?? F5 FF FF 6D C6 85 ?? F5 FF FF 80 C6 85 ?? F5 FF FF 6D C6 85 ?? F5 FF FF 68 C6 85 ?? F5 FF FF 53 C6 85 ?? F5 FF FF 7B C6 85 ?? F5 FF FF 7B C6 85 ?? F5 FF FF 73 C6 85 ?? F5 FF FF 78 C6 85 ?? F5 FF FF 71 C6 85 ?? F5 FF FF 61 C6 85 ?? F5 FF FF 7C C6 85 ?? F5 FF FF 70 C6 85 ?? F5 FF FF 6D C6 85 ?? F5 FF FF 80 C6 85 ?? F5 FF FF 71}\r\n $Del = {C6 85 ?? F5 FF FF 79 C6 85 ?? F5 FF FF 17 C6 85 ?? F5 FF FF 16 C6 85 ?? F5 FF FF 1F C6 85 ?? F5 FF FF 53 C6 85 ?? F5 FF FF 56 C6 85 ?? F5 FF FF 43 C6 85 ?? F5 FF FF 79}\r\n $DEBUG = {C6 85 ?? FD FF FF 4A 33 C9 C6 85 ?? FD FF FF 4B C6 85 ?? FD FF FF 48 C6 85 ?? FD FF FF 5B C6 85 ?? FD FF FF 4D}\r\n $Debug = {C6 85 ?? FD FF FF 34 C6 85 ?? FD FF FF 35 C6 85 ?? FD FF FF 32 C6 85 ?? FD FF FF 25 C6 85 ?? FD FF FF 37}\r\n $Debug2 = {C6 44 24 ?? 5B C6 44 24 ?? 5A C6 44 24 ?? 5D C6 44 24 ?? 4A 88 44 24 ?? C6 44 24 ?? 58}\r\n $ConfigDat = {C6 85 ?? F6 FF FF 16 C6 85 ?? F6 FF FF 29 C6 85 ?? F6 FF FF 25 C6 85 ?? F6 FF FF 24 C6 85 ?? F6 FF FF 2C C6 85 ?? F6 FF FF 23 C6 85 ?? F6 FF FF 2D C6 85 ?? F6 FF FF 64 C6 85 ?? F6 FF FF 2E C6 85 ?? F6 FF FF 2B C6 85 ?? F6 FF FF 3E}\r\n $ConfigDatSubC = {C6 85 ?? F6 FF FF 68 C6 85 ?? F6 FF FF 6F C6 85 ?? F6 FF FF 7B C6 85 ?? F6 FF FF 7A C6 85 ?? F6 FF FF 72 C6 85 ?? F6 FF FF 75 C6 85 ?? F6 FF FF 73 C6 85 ?? F6 FF FF 3A C6 85 ?? F6 FF FF 70 C6 85 ?? F6 FF FF 6D}\r\n $EchoCommand = {C6 85 ?? F5 FF FF 43 C6 85 ?? F5 FF FF 68 C6 85 ?? F5 FF FF 66 C6 85 ?? F5 FF FF 6B C6 85 ?? F5 FF FF 72 C6 85 ?? F5 FF FF 23 C6 85 ?? F5 FF FF 72 C6 85 ?? F5 FF FF 69 C6 85 ?? F5 FF FF 69 C6 85 ?? F5 FF FF 0D C6 85 ?? F5 FF FF 66 C6 85 ?? F5 FF FF 6B C6 85 ?? F5 FF FF 72 C6 85 ?? F5 FF FF 6C C6 85 ?? F5 FF FF 66 C6 85 ?? F5 FF FF 68 C6 85 ?? F5 FF FF 23 C6 85 ?? F5 FF FF 32 C6 85 ?? F5 FF FF 77 C6 85 ?? F5 FF FF 23 C6 85 ?? F5 FF FF 28 C6 85 ?? F5 FF FF 67 C6 85 ?? F5 FF FF 23 C6 85 ?? F5 FF FF 32 C6 85 ?? F5 FF FF 67 33 C9 C6 85 ?? F5 FF FF 23 C6 85 ?? F5 FF FF 7C C6 85 ?? F5 FF FF 23 C6 85 ?? F5 FF FF 32 C6 85 ?? F5 FF FF 71 C6 85 ?? F5 FF FF 23 C6 85 ?? F5 FF FF 41 C6 85 ?? F5 FF FF 71 C6 85 ?? F5 FF FF 78 C6 85 ?? F5 FF FF 6F C6 85 ?? F5 FF FF 0D C6 85 ?? F5 FF FF 67 C6 85 ?? F5 FF FF 68 C6 85 ?? F5 FF FF 6F C6 85 ?? F5 FF FF 23} \t\t\t\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig loader stack strings.", "valid_from": "2022-12-14T13:39:06.607Z", "name": "YARA: GoofyGuineapig_stackstrings", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--54928612-727f-4ea6-af68-45d0e686ce2c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--125bc87a-9ee3-4d33-b8f9-4fc89f28235c", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--afea410d-bf9b-4610-9978-ea8e694b62e6", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--125bc87a-9ee3-4d33-b8f9-4fc89f28235c", "target_ref": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e3c54084-a1dd-4d33-8c7b-64011eff33fa", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--125bc87a-9ee3-4d33-b8f9-4fc89f28235c", "target_ref": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--25e7366d-d9ac-4ec8-80ae-95ac3029a0ca", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--125bc87a-9ee3-4d33-b8f9-4fc89f28235c", "target_ref": "indicator--462b0379-4384-4ca4-87ac-d258656001d5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--41106140-3a46-4830-a4b6-e5997bd3e905", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--125bc87a-9ee3-4d33-b8f9-4fc89f28235c", "target_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f08613af-046e-441a-b772-a3c35f77bd34", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--125bc87a-9ee3-4d33-b8f9-4fc89f28235c", "target_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--edcb5251-94e9-4c38-a6cb-945ed314db91", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--125bc87a-9ee3-4d33-b8f9-4fc89f28235c", "target_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--880d0075-5af8-4135-9714-b6cc1fe2c01b", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule GoofyGuineapig_pdbpath\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Goofy Guineapig debug path\"\r\n date = \"2022-12-13\"\r\n hash1 = \"7961930d13cb8d5056db64b6749356915fb4c272\"\r\n hash2 = \"6f5c07c50ce4976ddb3879ce65d3b2f96693dc4c\"\r\n\r\n strings:\r\n $pdb_path = \"C:\\\\Users\\\\Benjamin\\\\source\\\\repos\\\\Dll1\\\\Release\\\\Dll1.pdb\"\t\t\t\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Goofy Guineapig debug path", "valid_from": "2022-12-14T13:39:06.608Z", "name": "YARA: GoofyGuineapig_pdbpath", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9d9e3b63-12a7-4006-9323-99dcadf9fb0b", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--880d0075-5af8-4135-9714-b6cc1fe2c01b", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ec610a6b-920c-4b15-923b-b3803b3048e8", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--880d0075-5af8-4135-9714-b6cc1fe2c01b", "target_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0cfd5f12-7a1f-4571-8642-6077e4e2d513", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--880d0075-5af8-4135-9714-b6cc1fe2c01b", "target_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a52dfadf-ecac-4813-a5af-2f43af150335", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--880d0075-5af8-4135-9714-b6cc1fe2c01b", "target_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4dc0678f-ca58-42b8-8f24-bb634f7c51b3", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--880d0075-5af8-4135-9714-b6cc1fe2c01b", "target_ref": "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5693c037-36bb-4f05-b4dc-7eb42a0ecdfb", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--880d0075-5af8-4135-9714-b6cc1fe2c01b", "target_ref": "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--486c2d8d-4979-46ac-9617-215fa07f77dd", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--880d0075-5af8-4135-9714-b6cc1fe2c01b", "target_ref": "indicator--462b0379-4384-4ca4-87ac-d258656001d5" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0bd15ef5-5ce7-40fa-b5c3-7a7c1216addd", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[url:value = 'HTTPS://static.tcplog.com']", "description": "Goofy Guineapig C2 infrastructure", "valid_from": "2022-12-14T13:39:06.608Z", "name": "URL: HTTPS://static.tcplog.com", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9b9b3581-d15c-45e0-9794-19cd9eec4f2f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0bd15ef5-5ce7-40fa-b5c3-7a7c1216addd", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2a124cd8-b799-4df9-990a-ca9d5330f9ea", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0bd15ef5-5ce7-40fa-b5c3-7a7c1216addd", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--35bad436-2273-4686-8209-a8bfc3431e37", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0bd15ef5-5ce7-40fa-b5c3-7a7c1216addd", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9ae20986-0609-4beb-9358-556e3bf4e61c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0bd15ef5-5ce7-40fa-b5c3-7a7c1216addd", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--750b4bb2-a9dc-4c22-b179-dc3e93b5d5ea", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'tmp.bat' AND file:parent_directory_ref.path = 'C:\\\\ProgramData\\\\GoogleUpdate\\\\GoogleUpdate']", "description": "Malicious batch file created and executed by Goofy Guineapig", "valid_from": "2022-12-14T13:39:06.608Z", "name": "Path: C:\\ProgramData\\GoogleUpdate\\GoogleUpdate\\tmp.bat", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4929ea32-444d-42d9-a2aa-fed359d011d3", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--750b4bb2-a9dc-4c22-b179-dc3e93b5d5ea", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1740ef5a-c387-4484-ae98-2c98138e02dd", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--750b4bb2-a9dc-4c22-b179-dc3e93b5d5ea", "target_ref": "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--55250afc-91c3-4ba6-93a9-894badf42cd1", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--750b4bb2-a9dc-4c22-b179-dc3e93b5d5ea", "target_ref": "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f7b463e9-05d5-41a0-9303-2cdf0edf95bc", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--750b4bb2-a9dc-4c22-b179-dc3e93b5d5ea", "target_ref": "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6eed5332-e808-45b1-bd1c-0e2f61941adf", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[network-traffic:extensions.'http-request-ext'.request_header.'User-Agent' = 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36']", "description": "Hard coded Goofy Guineapig User Agent string", "valid_from": "2022-12-14T13:39:06.608Z", "name": "User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--07d4a870-4894-4298-adc2-17ec481c7c54", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--6eed5332-e808-45b1-bd1c-0e2f61941adf", "target_ref": "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--02ecb815-75be-4ec4-b5d0-dce230ed7751", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--6eed5332-e808-45b1-bd1c-0e2f61941adf", "target_ref": "indicator--27632564-82dc-46fe-9729-61f6f8560103" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--edc60df0-6c71-443d-92eb-76117d915c1e", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--6eed5332-e808-45b1-bd1c-0e2f61941adf", "target_ref": "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f32af5ce-4956-4b0d-a306-6cf4ecf56d2d", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--6eed5332-e808-45b1-bd1c-0e2f61941adf", "target_ref": "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", "created": "2022-10-01T00:00:00.000Z", "modified": "2022-10-01T00:00:00.000Z", "name": "TLP:CLEAR", "extensions": { "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": { "extension_type": "property-extension", "tlp_2_0" : "clear" } } }, { "type": "identity", "spec_version": "2.1", "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "created": "2021-05-20T12:00:00.000Z", "modified": "2021-05-20T12:00:00.000Z", "name": "NCSC", "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2959d63f-73fd-46a1-abd2-109d7dcede32", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "name": "Windows Service", "x_mitre_data_sources": [ "Service: Service Creation", "Service: Service Modification", "Process: Process Creation", "Process: OS API Execution", "Command: Command Execution", "Windows Registry: Windows Registry Key Creation", "Windows Registry: Windows Registry Key Modification" ], "x_mitre_version": "1.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" }, { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ], "x_mitre_platforms": [ "Windows" ], "x_mitre_is_subtechnique": true, "description": "Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075). \n\nAdversaries may install a new service or modify an existing service by using system utilities to interact with services, by directly modifying the Registry, or by using custom tools to interact with the Windows API. Adversaries may configure services to execute at startup in order to persist on a system.\n\nAn adversary may also incorporate [Masquerading](https://attack.mitre.org/techniques/T1036) by using a service name from a related operating system or benign software, or by modifying existing services to make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used. \n\nServices may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). ", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_contributors": [ "Matthew Demaske, Adaptforward", "Travis Smith, Tripwire", "Pedro Harrison" ], "x_mitre_effective_permissions": [ "Administrator", "SYSTEM" ], "x_mitre_detection": "Monitor processes and command-line arguments for actions that could create or modify services. Command-line invocation of tools capable of adding or modifying services may be unusual, depending on how systems are typically used in a particular environment. Services may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data. Remote access tools with built-in features may also interact directly with the Windows API to perform these functions outside of typical system utilities. Collect service utility execution and service binary path arguments used for analysis. Service binary paths may even be changed to execute commands or scripts. \n\nLook for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at HKLM\\SYSTEM\\CurrentControlSet\\Services. Changes to the binary path and the service startup type changed from manual or disabled to automatic, if it does not typically do so, may be suspicious. Tools such as Sysinternals Autoruns may also be used to detect system service changes that could be attempts at persistence.(Citation: TechNet Autoruns) \n\nCreation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017)(Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software.\n\nSuspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1543/003", "external_id": "T1543.003", "source_name": "mitre-attack" }, { "url": "https://capec.mitre.org/data/definitions/478.html", "external_id": "CAPEC-478", "source_name": "capec" }, { "url": "https://capec.mitre.org/data/definitions/550.html", "external_id": "CAPEC-550", "source_name": "capec" }, { "url": "https://capec.mitre.org/data/definitions/551.html", "external_id": "CAPEC-551", "source_name": "capec" }, { "source_name": "TechNet Services", "description": "Microsoft. (n.d.). Services. Retrieved June 7, 2016.", "url": "https://technet.microsoft.com/en-us/library/cc772408.aspx" }, { "source_name": "TechNet Autoruns", "description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.", "url": "https://technet.microsoft.com/en-us/sysinternals/bb963902" }, { "source_name": "Microsoft 4697 APR 2017", "description": "Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service was installed in the system. Retrieved August 7, 2018.", "url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697" }, { "source_name": "Microsoft Windows Event Forwarding FEB 2018", "description": "Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding to help with intrusion detection. Retrieved August 7, 2018.", "url": "https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "name": "Match Legitimate Name or Location", "x_mitre_data_sources": [ "Image: Image Metadata", "File: File Metadata", "Process: Process Metadata" ], "x_mitre_version": "1.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_defense_bypassed": [ "Application control by file name or path" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows", "Containers" ], "x_mitre_is_subtechnique": true, "description": "Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.\n\nAdversaries may also use the same icon of the file they are trying to mimic.", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_contributors": [ "Yossi Weizman, Azure Defender Research Team", "Vishwas Manral, McAfee" ], "x_mitre_detection": "Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.\n\nIf file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)\n\nIn containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1036/005", "external_id": "T1036.005", "source_name": "mitre-attack" }, { "url": "https://capec.mitre.org/data/definitions/177.html", "external_id": "CAPEC-177", "source_name": "capec" }, { "url": "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf", "description": "Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.", "source_name": "Elastic Masquerade Ball" }, { "url": "https://twitter.com/ItsReallyNick/status/1055321652777619457", "description": "Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019.", "source_name": "Twitter ItsReallyNick Masquerading Update" }, { "url": "https://docs.docker.com/engine/reference/commandline/images/", "description": "Docker. (n.d.). Docker Images. Retrieved April 6, 2021.", "source_name": "Docker Images" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Time Based Evasion", "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "1.2", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" }, { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_defense_bypassed": [ "Host forensic analysis", "Signature-based detection", "Static File Analysis", "Anti-virus" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": true, "description": "Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.\n\nAdversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.(Citation: Deloitte Environment Awareness)\n\nBenign commands or other operations may also be used to delay malware execution. Loops or otherwise needless repetitions of commands, such as [Ping](https://attack.mitre.org/software/S0097)s, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol) Another variation, commonly referred to as API hammering, involves making various calls to [Native API](https://attack.mitre.org/techniques/T1106) functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation: Joe Sec Nymaim)(Citation: Joe Sec Trickbot)\n\nAdversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)", "x_mitre_contributors": [ "Jorge Orchilles, SCYTHE", "Ruben Dodge, @shotgunner101", "Jeff Felling, Red Canary", "Deloitte Threat Library Team" ], "x_mitre_detection": "Time-based evasion will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection. ", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1497/003", "external_id": "T1497.003", "source_name": "mitre-attack" }, { "url": "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc", "description": "Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021.", "source_name": "Deloitte Environment Awareness" }, { "url": "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/", "description": "Loman, M. et al. (2021, July 4). Independence Day: REvil uses supply chain exploit to attack hundreds of businesses. Retrieved September 30, 2021.", "source_name": "Revil Independence Day" }, { "url": "https://www.netskope.com/blog/nitol-botnet-makes-resurgence-evasive-sandbox-analysis-technique", "description": "Malik, A. (2016, October 14). Nitol Botnet makes a resurgence with evasive sandbox analysis technique. Retrieved September 30, 2021.", "source_name": "Netskope Nitol" }, { "url": "https://www.joesecurity.org/blog/3660886847485093803", "description": "Joe Security. (2016, April 21). Nymaim - evading Sandboxes with API hammering. Retrieved September 30, 2021.", "source_name": "Joe Sec Nymaim" }, { "url": "https://www.joesecurity.org/blog/498839998833561473", "description": "Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021.", "source_name": "Joe Sec Trickbot" }, { "url": "https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/evasive-malware-tricks-how-malware-evades-detection-by-sandboxes", "description": "Kolbitsch, C. (2017, November 1). Evasive Malware Tricks: How Malware Evades Detection by Sandboxes. Retrieved March 30, 2021.", "source_name": "ISACA Malware Tricks" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "name": "System Checks", "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "2.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" }, { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_defense_bypassed": [ "Static File Analysis", "Signature-based detection", "Host forensic analysis", "Anti-virus" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": true, "description": "Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)\n\nSpecific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. \n\nChecks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. \n\nOther common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. \n \nHardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_contributors": [ "Deloitte Threat Library Team" ], "x_mitre_detection": "Virtualization/sandbox related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1497/001", "external_id": "T1497.001", "source_name": "mitre-attack" }, { "url": "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc", "description": "Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021.", "source_name": "Deloitte Environment Awareness" }, { "url": "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/", "description": "Roccia, T. (2017, January 19). Stopping Malware With a Fake Virtual Machine. Retrieved April 17, 2019.", "source_name": "McAfee Virtual Jan 2017" }, { "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/", "description": "Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.", "source_name": "Unit 42 OilRig Sept 2018" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--91541e7e-b969-40c6-bbd8-1b5352ec2938", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "User Activity Based Checks", "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "1.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" }, { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_defense_bypassed": [ "Anti-virus", "Static File Analysis", "Signature-based detection", "Host forensic analysis" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": true, "description": "Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)\n\nAdversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017) ", "x_mitre_contributors": [ "Deloitte Threat Library Team" ], "x_mitre_detection": "User activity-based checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection. ", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1497/002", "external_id": "T1497.002", "source_name": "mitre-attack" }, { "url": "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc", "description": "Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021.", "source_name": "Deloitte Environment Awareness" }, { "url": "https://www.sans.org/reading-room/whitepapers/forensics/detecting-malware-sandbox-evasion-techniques-36667", "description": "Keragala, D. (2016, January 16). Detecting Malware and Sandbox Evasion Techniques. Retrieved April 17, 2019.", "source_name": "Sans Virtual Jan 2016" }, { "url": "https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/", "description": "Falcone, R., Lee, B.. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved April 23, 2019.", "source_name": "Unit 42 Sofacy Nov 2018" }, { "source_name": "FireEye FIN7 April 2017", "description": "Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.", "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Software Packing", "x_mitre_data_sources": [ "File: File Metadata" ], "x_mitre_version": "1.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_defense_bypassed": [ "Anti-virus", "Heuristic detection", "Signature-based detection" ], "x_mitre_platforms": [ "macOS", "Windows" ], "x_mitre_is_subtechnique": true, "description": "Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) \n\nUtilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses. ", "x_mitre_contributors": [ "Filip Kafka, ESET" ], "x_mitre_detection": "Use file scanning to look for known software packers or artifacts of packing techniques. Packing is not a definitive indicator of malicious activity, because legitimate software may use packing techniques to reduce binary size or to protect proprietary code.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1027/002", "external_id": "T1027.002", "source_name": "mitre-attack" }, { "url": "https://capec.mitre.org/data/definitions/570.html", "external_id": "CAPEC-570", "source_name": "capec" }, { "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf", "description": "Kafka, F. (2018, January). ESET's Guide to Deobfuscating and Devirtualizing FinFisher. Retrieved August 12, 2019.", "source_name": "ESET FinFisher Jan 2018" }, { "source_name": "Wikipedia Exe Compression", "description": "Executable compression. (n.d.). Retrieved December 4, 2014.", "url": "http://en.wikipedia.org/wiki/Executable_compression" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Deobfuscate/Decode Files or Information", "x_mitre_data_sources": [ "Process: Process Creation", "File: File Modification", "Script: Script Execution" ], "x_mitre_version": "1.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_defense_bypassed": [ "Anti-virus", "Host intrusion prevention systems", "Signature-based detection", "Network intrusion detection system" ], "x_mitre_platforms": [ "Windows", "Linux", "macOS" ], "x_mitre_is_subtechnique": false, "x_mitre_permissions_required": [ "User" ], "description": "Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.\n\nOne such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)\n\nSometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)", "x_mitre_contributors": [ "Matthew Demaske, Adaptforward", "Red Canary" ], "x_mitre_detection": "Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as [certutil](https://attack.mitre.org/software/S0160).\n\nMonitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1140", "external_id": "T1140", "source_name": "mitre-attack" }, { "source_name": "Malwarebytes Targeted Attack against Saudi Arabia", "description": "Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017.", "url": "https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/" }, { "source_name": "Carbon Black Obfuscation Sept 2016", "description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.", "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/" }, { "source_name": "Volexity PowerDuke November 2016", "description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.", "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cbb66055-0325-4111-aca0-40547b6ad5b0", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Hidden Window", "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution", "Script: Script Execution", "File: File Modification" ], "x_mitre_version": "1.0", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_platforms": [ "macOS", "Windows" ], "x_mitre_is_subtechnique": true, "x_mitre_permissions_required": [ "User" ], "description": "Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. \n\nOn Windows, there are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden. (Citation: PowerShell About 2019)\n\nSimilarly, on macOS the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.\n\nAdversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware)", "x_mitre_contributors": [ "Travis Smith, Tripwire" ], "x_mitre_detection": "Monitor processes and command-line arguments for actions indicative of hidden windows. In Windows, enable and configure event logging and PowerShell logging to check for the hidden window style. In MacOS, plist files are ASCII text files with a specific format, so they're relatively easy to parse. File monitoring can check for the apple.awt.UIElement or any other suspicious plist tag in plist files and flag them.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1564/003", "external_id": "T1564.003", "source_name": "mitre-attack" }, { "url": "https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Core/About/about_PowerShell_exe?view=powershell-5.1", "description": "Wheeler, S. et al.. (2019, May 1). About PowerShell.exe. Retrieved October 11, 2019.", "source_name": "PowerShell About 2019" }, { "source_name": "Antiquated Mac Malware", "description": "Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.", "url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "File Deletion", "x_mitre_data_sources": [ "File: File Deletion", "Command: Command Execution" ], "x_mitre_version": "1.0", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_defense_bypassed": [ "Host forensic analysis" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": true, "x_mitre_permissions_required": [ "User" ], "description": "Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.\n\nThere are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)", "x_mitre_contributors": [ "Walker Johnson" ], "x_mitre_detection": "It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1070/004", "external_id": "T1070.004", "source_name": "mitre-attack" }, { "source_name": "Trend Micro APT Attack Tools", "description": "Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.", "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "name": "DLL Side-Loading", "x_mitre_data_sources": [ "File: File Creation", "File: File Modification", "Module: Module Load", "Process: Process Creation" ], "x_mitre_version": "2.0", "x_mitre_defense_bypassed": [ "Anti-virus", "Application control" ], "x_mitre_platforms": [ "Windows" ], "x_mitre_is_subtechnique": true, "description": "Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).\n\nSide-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.(Citation: FireEye DLL Side-Loading)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" }, { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" }, { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_detection": "Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so) as well as the introduction of new files/programs. Track DLL metadata, such as a hash, and compare DLLs that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1574/002", "external_id": "T1574.002", "source_name": "mitre-attack" }, { "url": "https://capec.mitre.org/data/definitions/641.html", "external_id": "CAPEC-641", "source_name": "capec" }, { "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf", "description": "Amanda Steward. (2014). FireEye DLL Side-Loading: A Thorn in the Side of the Anti-Virus Industry. Retrieved March 13, 2020.", "source_name": "FireEye DLL Side-Loading" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b200542e-e877-4395-875b-cf1a44537ca4", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Process Hollowing", "x_mitre_data_sources": [ "Process: Process Modification", "Process: OS API Execution", "Process: Process Access" ], "x_mitre_version": "1.1", "x_mitre_defense_bypassed": [ "Application control", "Anti-virus" ], "x_mitre_platforms": [ "Windows" ], "x_mitre_is_subtechnique": true, "x_mitre_permissions_required": [ "User" ], "description": "Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. \n\nProcess hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as CreateProcess, which includes a flag to suspend the processes primary thread. At this point the process can be unmapped using APIs calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection before being written to, realigned to the injected code, and resumed via VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.(Citation: Leitch Hollowing)(Citation: Elastic Process Injection July 2017)\n\nThis is very similar to [Thread Local Storage](https://attack.mitre.org/techniques/T1055/005) but creates a new process rather than targeting an existing process. This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process. ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" }, { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ], "x_mitre_detection": "Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as CreateRemoteThread, SuspendThread/SetThreadContext/ResumeThread, and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be used for this technique.(Citation: Elastic Process Injection July 2017)\n\nAnalyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. ", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1055/012", "external_id": "T1055.012", "source_name": "mitre-attack" }, { "source_name": "Leitch Hollowing", "description": "Leitch, J. (n.d.). Process Hollowing. Retrieved November 12, 2014.", "url": "http://www.autosectools.com/process-hollowing.pdf" }, { "source_name": "Elastic Process Injection July 2017", "description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.", "url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Rundll32", "x_mitre_data_sources": [ "File: File Metadata", "Process: Process Creation", "Command: Command Execution", "Module: Module Load" ], "x_mitre_version": "1.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_defense_bypassed": [ "Digital Certificate Validation", "Application control", "Anti-virus" ], "x_mitre_platforms": [ "Windows" ], "x_mitre_is_subtechnique": true, "x_mitre_permissions_required": [ "User" ], "description": "Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).\n\nRundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)\n\nRundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write();GetObject(\"script:https[:]//www[.]example[.]com/malicious.sct\")\" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)\n\nAdversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll)", "x_mitre_contributors": [ "Gareth Phillips, Seek Ltd.", "Casey Smith", "Ricardo Dias" ], "x_mitre_detection": "Use process monitoring to monitor the execution and arguments of rundll32.exe. Compare recent invocations of rundll32.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity.\n\nCommand arguments used with the rundll32.exe invocation may also be useful in determining the origin and purpose of the DLL being loaded. Analyzing DLL exports and comparing to runtime arguments may be useful in uncovering obfuscated function calls.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1218/011", "external_id": "T1218.011", "source_name": "mitre-attack" }, { "url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf", "description": "Merces, F. (2014). CPL Malware Malicious Control Panel Items. Retrieved November 1, 2017.", "source_name": "Trend Micro CPL" }, { "url": "https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/", "description": "B. Ancel. (2014, August 20). Poweliks – Command Line Confusion. Retrieved March 5, 2018.", "source_name": "This is Security Command Line Confusion" }, { "url": "https://www.attackify.com/blog/rundll32_execution_order/", "description": "Attackify. (n.d.). Rundll32.exe Obscurity. Retrieved August 23, 2021.", "source_name": "Attackify Rundll32.exe Obscurity" }, { "url": "https://github.com/gtworek/PSBits/tree/master/NoRunDll", "description": "gtworek. (2019, December 17). NoRunDll. Retrieved August 23, 2021.", "source_name": "Github NoRunDll" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "System Information Discovery", "x_mitre_data_sources": [ "Instance: Instance Metadata", "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "2.3", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_platforms": [ "Windows", "IaaS", "Linux", "macOS" ], "x_mitre_is_subtechnique": false, "x_mitre_permissions_required": [ "User" ], "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nTools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)\n\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)", "x_mitre_contributors": [ "Maril Vernon @shewhohacks", "Praetorian" ], "x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nIn cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be useful due to benign use during normal operations.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1082", "external_id": "T1082", "source_name": "mitre-attack" }, { "url": "https://capec.mitre.org/data/definitions/312.html", "external_id": "CAPEC-312", "source_name": "capec" }, { "url": "https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/", "description": "Phile Stokes. (2018, September 20). On the Trail of OSX.FairyTale | Adware Playing at Malware. Retrieved August 24, 2021.", "source_name": "OSX.FairyTale" }, { "url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/", "description": "Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.", "source_name": "20 macOS Common Tools and Techniques" }, { "url": "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html", "description": "Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.", "source_name": "Amazon Describe Instance" }, { "url": "https://cloud.google.com/compute/docs/reference/rest/v1/instances", "description": "Google. (n.d.). Rest Resource: instance. Retrieved March 3, 2020.", "source_name": "Google Instances Resource" }, { "source_name": "Microsoft Virutal Machine API", "description": "Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved October 8, 2019.", "url": "https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "name": "Web Protocols", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Traffic Content" ], "x_mitre_version": "1.0", "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": true, "description": "Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as HTTP and HTTPS that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)\n\nMonitor for web traffic to/from known-bad or suspicious domains. ", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1071/001", "external_id": "T1071.001", "source_name": "mitre-attack" }, { "source_name": "University of Birmingham C2", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "name": "Fallback Channels", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1008", "external_id": "T1008", "source_name": "mitre-attack" }, { "source_name": "University of Birmingham C2", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" } ], "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Connection Creation" ], "x_mitre_version": "1.0", "x_mitre_network_requirements": true, "x_mitre_is_subtechnique": false, "description": "Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)", "x_mitre_platforms": [ "Linux", "Windows", "macOS" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "name": "Non-Standard Port", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Connection Creation", "Network Traffic: Network Traffic Content" ], "x_mitre_version": "1.0", "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": false, "description": "Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "x_mitre_detection": "Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.(Citation: University of Birmingham C2)", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1571", "external_id": "T1571", "source_name": "mitre-attack" }, { "url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage", "description": "Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.", "source_name": "Symantec Elfin Mar 2019" }, { "url": "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html", "description": "Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.", "source_name": "Fortinet Agent Tesla April 2018" }, { "source_name": "University of Birmingham C2", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" } ], "x_killchain": "mitre-attack" }, { "type": "report", "spec_version": "2.1", "id": "report--8e6e99a9-6860-4891-9519-3315ce253c4f", "created": "2022-12-13T00:00:00.000Z", "modified": "2022-12-13T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Malware Analysis Report: Goofy Guineapig", "description": "Persistent Windows backdoor with HTTPS C2 communications. The Goofy Guineapig loader is a UPX packed, trojanised NSIS Firefox installer. Once extracted, it masquerades as a Google update component. Goofy Guineapig maintains persistence as a Windows service. Goofy Guineapig provides a framework into which additional plugins may be loaded. The backdoor supports multiple communications methods, including HTTP, HTTPS and KCP. The configuration is embedded in the binary, and the configuration for the binary analysed results in command and control communications occurring over HTTPS. Many defence evasion techniques are implemented throughout execution.", "published": "2022-12-13T00:00:00Z", "external_references": [ { "source_name": "NCSC", "external_id": "NCSC/MAR/Goofy-Guineapig" } ], "report_types": [ "malware" ], "object_refs": [ "malware--f871e8b8-1ad7-4e6f-a877-9af75ba40a3b", "attack-pattern--b24615d1-ed34-43f1-9a0b-ecef5b1ec143", "relationship--26ca8e76-80e3-4969-807f-74b2d099c098", "relationship--12bbf144-ce0e-44f8-a907-98db7698b5bf", "attack-pattern--6b3afa7e-8249-4e2e-adb1-333b02f38b47", "relationship--a19f4907-289d-4a85-811b-bc8890754462", "relationship--014f3c8e-5c23-42b3-a909-582a08e1ac2a", "attack-pattern--68e3f3f1-a84e-468b-b854-4bf6f77a81b9", "relationship--9158d7a2-f1ec-4a09-8fca-fa4cf6a437a8", "relationship--c8f26dbb-993a-4811-bcd5-710f04e732a5", "attack-pattern--0cbe52aa-8761-4bf2-ad91-738e52f37877", "relationship--4284619b-68d5-43ab-9974-9af1e2f88ddb", "relationship--cc62516f-463c-4535-a6ce-9d7236a69d4a", "attack-pattern--66ee351b-79d6-43d7-8596-e99f38f7cd13", "relationship--76fb5773-bb84-4c77-8b5e-6d5e59f156df", "relationship--d106bc1f-2c87-4efa-af97-9f0ef37975b4", "attack-pattern--7b69046e-e7a3-4278-b2bf-4f8e687ffe63", "relationship--ea775d27-0bac-4b44-9d51-4ab843823d94", "relationship--b3c0feed-4505-488d-8427-2e169c2cd724", "attack-pattern--02e2c78c-286f-448e-b999-6484fa5a55fa", "relationship--308d5784-0f7c-42f4-9039-1a30e2c5253c", "relationship--243bbff9-9dfc-421c-8a90-91e028c6f517", "attack-pattern--800171b8-5b84-43f4-8606-66e9fda278be", "relationship--0b4760da-ef07-43c0-8910-b1b94d3df21a", "relationship--158025fe-3cba-43bd-a328-9377668edc27", "attack-pattern--a4468d56-71fd-462f-b1f3-5f5498c40e9b", "relationship--3899e4ea-83d9-4e7c-91b3-b42a51bc60a4", "relationship--689b14ef-7d9f-4972-ab78-bd8fa531076e", "attack-pattern--9d013b75-c2bb-4cb7-9d81-f52d454d7111", "relationship--fc90755c-fe1f-42c7-98b0-7c0b50ba6681", "relationship--6e549fb0-3723-455b-aa08-34a99f3c4c52", "attack-pattern--ed4b5f69-b8bc-4745-bb9f-11051a0d924f", "relationship--9569403d-bb8b-46d2-beea-bf686c391c16", "relationship--612e0bac-509f-44be-a16b-0455683bfaf7", "attack-pattern--644ba292-d166-4de4-9dd3-acd39ec7770c", "relationship--21d70434-6c8e-4134-a90b-f6ac0cfc29e2", "relationship--94e7bea7-7e0e-4e2b-820a-d188c7d89d18", "attack-pattern--7486a77e-e0f5-497d-a654-d0922bb253d6", "relationship--eb80325d-a640-45de-8da6-474a3a8cac34", "relationship--5e070586-452b-4708-9e4b-90445390a58e", "attack-pattern--170107f3-85fc-4cd3-a943-f55231aec985", "relationship--fa9d3965-4268-47f1-a37d-a4f5eddb78fc", "relationship--693acb82-dfd3-4840-9630-40c95c34b8f4", "attack-pattern--9b1489db-1a03-4d18-a09a-8d1beae494d8", "relationship--5b4be223-7a8b-4cb5-bb64-af8833eb3d4b", "relationship--685947c9-c98c-49e1-b15e-2728fe7f559c", "attack-pattern--669bda02-167a-44e4-80be-491e43243063", "relationship--c1ab0809-8d07-4469-bd6b-1da50a01792c", "relationship--ebf0745e-13c0-4e45-ad39-bb50036a2f67", "relationship--dd8d92e6-10b5-4080-8113-b00012f948f1", "relationship--7cee95b1-e3a1-4970-8c18-3c4519cec208", "relationship--e739fb03-30fd-404b-92d6-7c1648f76dff", "relationship--60293fe0-9d72-4547-bd62-929d4b6e1459", "relationship--0b7653a2-1992-4b7a-9451-f18b7bfcbc3f", "relationship--35e7f647-1458-40d9-a027-87ca14836009", "relationship--5330ba08-5dee-44e3-985a-88b121ca934f", "relationship--ad8ae70a-ce7f-44f9-baa4-716b8b1214a6", "relationship--f2c3252a-3c81-402c-8ec5-0860f90df9ad", "relationship--243ec7d1-40e2-4c07-95cc-9827a8bcbea1", "relationship--c8d76607-77f5-476b-84d1-35c818eb9294", "relationship--a163b937-0d7a-4868-90e5-3d76753bba18", "relationship--5447e229-38f6-486a-8c7b-2447a17d4532", "relationship--bf16ae1d-bed6-43d5-82dc-cf98da0647aa", "relationship--5517b1f8-bd39-4cc7-b87b-51029a79b0be", "relationship--bb68a30a-2bdf-4a08-9507-98a4dec5cded", "relationship--b6c69abb-0315-4cac-827d-6d4973187c80", "relationship--6f1633e7-ab1f-4608-96d6-e221634e4490", "relationship--1167a594-3c48-45e7-9199-0472aeb3e6eb", "relationship--7db96ab6-59ad-442a-87b8-a02e5a73d5d2", "relationship--b7de5b4d-bfc9-4d91-938b-a937033feaf2", "relationship--322e322f-d753-4620-8ae7-0e9280cff8b1", "relationship--650a52dc-001d-4c5c-8697-49671e7de732", "relationship--6acb1a41-ab63-4d3e-8065-52ad55d3fda8", "relationship--e62190c1-5c50-4ba9-b644-a27410d1840c", "relationship--ac594c10-f711-479f-8727-f6cbf6016f9f", "relationship--bf530edd-83be-4543-b64d-e40848750e79", "relationship--fb812069-0b48-4ac5-9521-d88413a18bc7", "relationship--533327de-b293-40b6-9d77-af3b34f5c552", "relationship--78d9ee30-85f4-4d48-907e-e82218411ef6", "relationship--bdc2a9ac-ba0e-459b-972e-db2369a65144", "relationship--f6ef7b47-9461-414b-8d5f-c9da527aea29", "relationship--4f802613-2a76-4ffe-934b-c7b3a98ba7a7", "relationship--a9bd9d20-f454-4ecc-aa27-577274d16311", "relationship--45780c7d-1056-40f1-b6d1-6594a6e07b69", "relationship--098ace62-5946-4785-b713-ab13009a19f4", "indicator--d4f87c8c-0524-4d34-a86e-dd598ae2cbfb", "relationship--74bfc9d7-beab-402b-b38e-ff70c12810b2", "indicator--cb99bae3-6e90-4f97-998b-6f352fa7c709", "relationship--43d7aa52-f426-4e94-92ad-0aa7da072be5", "indicator--30125d06-6e30-40e6-8316-5d8a4439d882", "relationship--c5fe962e-4488-4045-9aa5-b43586dfab71", "indicator--9d16edbf-f4b5-48d8-bf77-0e1d72665d0f", "relationship--36c148b5-cce0-48c6-8915-b767683f740e", "indicator--abd72a79-1b6b-4885-9928-bb7eefd0f55f", "relationship--0f2d60b8-dc18-4999-a834-c06e3cd41649", "indicator--462b0379-4384-4ca4-87ac-d258656001d5", "relationship--03aad537-ab4b-4b30-9dec-9a4afba516f9", "indicator--29ec0f9f-8e98-44a8-8b4f-e4c1494718bd", "relationship--5c3d16ed-d387-4903-8d09-8cf23dec1f7f", "indicator--dc8a599d-1540-47a1-ad4d-da91fd1a04cd", "relationship--25cad179-7567-4491-93e7-8b83d9652d89", "indicator--a24d24e2-e94f-4652-ae42-d4b3dac1c890", "relationship--c162c8f4-92e4-4235-a0fc-057c1ae740b1", "indicator--60be8dfe-55e4-4c44-8afe-32ecfb47f253", "relationship--0deb6aab-a2d5-4d72-bf6e-72eee22c5c0c", "indicator--6109f0fe-c396-441d-b51d-366593c9d405", "relationship--c329231d-eff9-46b9-9734-f2d8f403b11e", "indicator--2f78c408-1e45-49ca-bc3e-52386e3c34d2", "relationship--c3a9808b-3d13-42d1-a88a-d585189aec15", "indicator--27632564-82dc-46fe-9729-61f6f8560103", "relationship--641474ee-b69e-4f31-adc5-02bbc10bb40a", "indicator--8f99ff75-0201-4e73-80e0-9dc4f00024c5", "relationship--504284fc-0807-4b3f-9fec-2c8e78c50daa", "indicator--dc42f5b4-28ab-4654-9560-275916bd57c8", "relationship--949e8d78-ab7c-4b75-9511-231f83ed8c81", "indicator--cff4fd4f-85ee-42ed-8d86-c1d7e8194bd8", "relationship--9593011c-c563-4856-9833-64bb72fb066f", "indicator--61fa1160-3786-418a-8761-ad5f2f8bd0d4", "relationship--02cea3ee-0490-424d-b8f7-5d5cfbee7e72", "indicator--092fc851-a7e1-446d-ae93-bb02e2bd58e4", "relationship--657bd17b-8295-4da4-92c8-38e8ef4dd4d7", "indicator--d3c48941-6a7f-4979-820a-886357069322", "relationship--1cf3366f-9c65-4587-9fca-b67b6fd0bb20", "relationship--80123318-bec6-4f4d-afc1-e22526d694bc", "relationship--f4673f5e-0733-4009-b27f-38e48bb2241b", "relationship--f5597608-d9de-4e58-a1ad-5d6425ca29d4", "indicator--bc017b31-2e1d-472d-97cf-8bf040f87eb4", "relationship--1fd30b3a-9551-48f6-909f-eefecd6570dc", "relationship--cde478cf-e25b-4b72-aa00-b9fa5bd2c272", "relationship--40a26c27-64fd-40e1-98c7-ecdc7cbd9cf5", "relationship--6a96d598-38fb-4de3-9ed5-61a27bf2619b", "indicator--a724f4c3-a799-4b01-98a4-8833d6c0f887", "relationship--cbeb5373-9711-4198-b02d-cd3e99c17cbd", "relationship--aef8a0d7-c339-4ac2-9df3-fee981e9a7c0", "relationship--03e536f6-540e-4eda-94b9-5a44e79f9c79", "relationship--fcae62df-7e93-435e-8ee1-8cbeefcda5be", "indicator--060ccc1c-2465-4281-bd8b-a16655b09dc8", "relationship--9c17856c-858a-4c48-9684-57eaace4d546", "relationship--75521d33-f21e-4cec-9d1b-7af6fb8a3338", "relationship--4be6dd0f-a9ee-43c0-a421-52c4098cca8e", "relationship--56d8b9e9-af42-438d-9f6e-3d152da0f532", "indicator--99ee1288-0750-454e-9972-9ecba66928e1", "relationship--8c72801e-6b14-4b3e-a0a5-476b62f94e94", "relationship--2607cf86-f5df-44d8-a6c9-aba29ef0a8a8", "relationship--5b4bb811-900c-484f-8e59-d130c201c742", "relationship--9dabe46b-f33e-4080-a551-8dd3e67fc384", "indicator--cb79fbbb-f882-4aa3-bee4-085d24ffc218", "relationship--ee40e580-2593-4222-b72c-a6e1996dab3c", "relationship--aeb152ac-6f46-4f89-a2f0-1a74374a1458", "relationship--a1b6ad52-1c75-4988-9181-fd1871b6a04e", "relationship--73571faf-be99-4932-af2d-7c7424f936a8", "indicator--cfb042f3-952b-4de8-a044-c1508ff8f57c", "relationship--0c1a052e-83d9-410b-b70b-6cde40af7a98", "relationship--1f813d86-ddc4-42e0-bb1c-47796fe7870e", "relationship--3fafa82c-c9d1-4b59-80b6-7bdb4939f41e", "relationship--23f40a1b-71fc-45b4-8ef9-295fb25e9a91", "indicator--65a70bee-65d3-4e1a-bf98-440327c6480c", "relationship--96e944a3-79c4-4969-90a6-9b0275ea1d6f", "relationship--c778aa0a-7479-49f8-b66a-48c7bf66247f", "relationship--c11e7467-ba06-4a6e-9988-413448f2218d", "relationship--4c37e3ef-bc7b-4710-8b34-a5c3db088408", "indicator--b6687197-72ce-4d40-b3ac-127cb89c7ee4", "relationship--53cb2da5-692b-4a6d-b81a-a7af069af1f0", "relationship--40cb71ad-dc64-442c-bd0c-a9adb47b6005", "relationship--39a66116-a652-4ddb-bb6f-82cebcd1c4a0", "relationship--0eb2147f-0fb3-491c-944a-2a51f0ca8056", "indicator--b23a4ebe-0274-4cbc-a3f4-9874e1381fae", "relationship--f85b24a1-00b0-4ca1-8e39-713e88ac463e", "relationship--99d2efec-eb9e-4a02-a158-8718298115d4", "relationship--99f7ce77-6332-48fd-a7fb-6f7d5df9f1ab", "relationship--55509492-15f4-4e79-832c-bdc04349bf51", "indicator--c0927b8e-faee-4de3-8272-8e6584c2ec71", "relationship--19bb98a5-4d75-4dfd-bd73-105b5aff1793", "relationship--86644818-f712-4371-856b-ecf9ab334319", "relationship--db261c06-242d-4700-bcb5-d32614b37895", "relationship--82968acf-ab7a-4f6b-b73d-a21f68c7989e", "indicator--2e16e9d1-614a-4006-b8c8-2777a41bfbdd", "relationship--5688eb59-d0e2-4f55-a265-3a9dccffd8f9", "relationship--438b546f-c0c2-44ce-9b1f-fd1f9a42c5f5", "relationship--314f7205-74bf-4c7a-8275-1c8b6f2d5a98", "relationship--9cb04271-3d8f-4c6d-af60-6887b1a1e4f9", "indicator--2a0396f9-a6e0-4543-ba29-c2905bc69cca", "relationship--6414beaa-5bb1-4031-96b2-f3a00450b0b4", "relationship--bf3e6c8e-802b-4a9a-8bca-f1ce4d7943e7", "relationship--5d27c02f-fca3-4043-9630-661bcae9c343", "relationship--c381c73c-4f49-4dea-9eb7-8b301d7b6dac", "indicator--99cfac77-8957-4610-aec7-2af57fc96596", "relationship--d76a4759-11a4-46be-9ba6-bbf8fcb7e0f1", "relationship--237afb95-72b2-4d0e-86be-0eefc4a68168", "relationship--8b3b8862-bb72-48a7-84a6-f341578b06b8", "relationship--9d1d4ebe-d7a5-400f-8719-16a8f8af8125", "relationship--dd4ad024-39a8-44d4-a73b-7eb4d9cee99e", "relationship--da322285-1e07-4bf8-ad80-d4e774a44d14", "relationship--caa3275b-b786-4b52-a60b-c33fcfdf3e3f", "relationship--219f4a1c-6ebb-48c8-99ee-423838ae7258", "relationship--466a35f2-6d1c-40c4-8dcf-923e14485ac4", "indicator--ef0c3fc0-343e-4ad0-be7f-087f378f1eaa", "relationship--77238cb2-821c-413d-895c-c54184396857", "relationship--86f14eb7-6836-414b-8bcf-5120fb251291", "relationship--e0b9b3e2-7c51-44c2-bfd1-822a1e1f2488", "relationship--bdd43754-6903-45bc-8add-3f6da55de96c", "indicator--81a944e6-3690-4750-97f4-77378ac769e5", "relationship--aa8a5b21-8060-4135-89b8-4274cc25cbf2", "relationship--77f67a40-0cce-4fe3-85ff-1c9c7f59f9e2", "relationship--1bb8e648-7df9-45ea-b395-95cc70880726", "relationship--ad53f9e4-90b6-4bdb-a924-dffcd1a19d75", "relationship--1d366236-8bce-491c-961d-b90fa01b9c18", "relationship--b2a3a652-67f0-44e2-ae76-e153a7184755", "relationship--6325b555-7b22-4cda-b189-2c750b2272ef", "indicator--125bc87a-9ee3-4d33-b8f9-4fc89f28235c", "relationship--54928612-727f-4ea6-af68-45d0e686ce2c", "relationship--afea410d-bf9b-4610-9978-ea8e694b62e6", "relationship--e3c54084-a1dd-4d33-8c7b-64011eff33fa", "relationship--25e7366d-d9ac-4ec8-80ae-95ac3029a0ca", "relationship--41106140-3a46-4830-a4b6-e5997bd3e905", "relationship--f08613af-046e-441a-b772-a3c35f77bd34", "relationship--edcb5251-94e9-4c38-a6cb-945ed314db91", "indicator--880d0075-5af8-4135-9714-b6cc1fe2c01b", "relationship--9d9e3b63-12a7-4006-9323-99dcadf9fb0b", "relationship--ec610a6b-920c-4b15-923b-b3803b3048e8", "relationship--0cfd5f12-7a1f-4571-8642-6077e4e2d513", "relationship--a52dfadf-ecac-4813-a5af-2f43af150335", "relationship--4dc0678f-ca58-42b8-8f24-bb634f7c51b3", "relationship--5693c037-36bb-4f05-b4dc-7eb42a0ecdfb", "relationship--486c2d8d-4979-46ac-9617-215fa07f77dd", "indicator--0bd15ef5-5ce7-40fa-b5c3-7a7c1216addd", "relationship--9b9b3581-d15c-45e0-9794-19cd9eec4f2f", "relationship--2a124cd8-b799-4df9-990a-ca9d5330f9ea", "relationship--35bad436-2273-4686-8209-a8bfc3431e37", "relationship--9ae20986-0609-4beb-9358-556e3bf4e61c", "indicator--750b4bb2-a9dc-4c22-b179-dc3e93b5d5ea", "relationship--4929ea32-444d-42d9-a2aa-fed359d011d3", "relationship--1740ef5a-c387-4484-ae98-2c98138e02dd", "relationship--55250afc-91c3-4ba6-93a9-894badf42cd1", "relationship--f7b463e9-05d5-41a0-9303-2cdf0edf95bc", "indicator--6eed5332-e808-45b1-bd1c-0e2f61941adf", "relationship--07d4a870-4894-4298-adc2-17ec481c7c54", "relationship--02ecb815-75be-4ec4-b5d0-dce230ed7751", "relationship--edc60df0-6c71-443d-92eb-76117d915c1e", "relationship--f32af5ce-4956-4b0d-a306-6cf4ecf56d2d" ], "x_version": "1.1" } ] }