Malware.View on attack.mitre.org
| Technique | Procedure example |
|---|---|
| T1007 System Service Discovery |
Babuk can enumerate all services running on a compromised host. |
| T1027.002 Software Packing |
Versions of Babuk have been packed. |
| T1049 System Network Connections Discovery |
Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption. |
| T1057 Process Discovery |
Babuk has the ability to check running processes on a targeted system. |
| T1059.003 Windows Command Shell |
Babuk has the ability to use the command line to control execution on compromised hosts. |
| T1083 File and Directory Discovery |
Babuk has the ability to enumerate files on a targeted system. |
| T1106 Native API |
Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution. |
| T1135 Network Share Discovery |
Babuk has the ability to enumerate network shares. |
| T1140 Deobfuscate/Decode Files or Information |
Babuk has the ability to unpack itself into memory using XOR. |
| T1486 Data Encrypted for Impact |
Babuk can use ChaCha8 and ECDH to encrypt data. |
| T1489 Service Stop |
Babuk can stop specific services related to backups. |
| T1490 Inhibit System Recovery |
Babuk has the ability to delete shadow volumes using |
| T1680 Local Storage Discovery |
Babuk can enumerate disk volumes, get disk information, and query service status. |
| T1685 Disable or Modify Tools |
Babuk can stop anti-virus services on a compromised host. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
