Kaspersky Threats — not-a-virus:AdWare.Win32.Ad2345.bmu

Kategorie: Adware

Adware umfasst Programme zur Anzeige von Werbung (normalerweise in Form von Bannern), Weiterleitung von Suchanfragen an Werbeseiten und Sammlung von Marketingdaten über den Nutzer (z. B. welche Arten von Websites er besucht), um personalisierte Werbung anzuzeigen der Computer.

Abgesehen von der Anzeige von Werbung und dem Sammeln von Daten sind diese Arten von Programmen im Allgemeinen nicht im System bekannt: Es gibt keine Anzeichen dafür, dass sich das Programm in der Taskleiste befindet, und im Programmmenü wird nicht angezeigt, dass Dateien installiert wurden. Oft haben Adware-Programme keine Deinstallationsverfahren und verwenden Technologien, die an die Virentechnologie grenzen, um das Programm heimlich in den Computer einzudringen und unbemerkt zu laufen. Penetration

Es gibt zwei Hauptwege, auf denen Adware auf den Computer eines Benutzers gelangt:

Es ist in einige Freeware- und Shareware-Programme integriert
nicht autorisierte Installation auf dem Computer eines Benutzers als Folge eines Besuchs auf einer infizierten Website.
Die meisten Freeware- und Shareware-Programme hören auf, Werbung anzuzeigen, sobald sie gekauft und / oder registriert wurden. Diese Programme verwenden jedoch häufig integrierte Adware-Dienstprogramme von Drittanbietern, und in einigen Fällen bleiben diese Dienstprogramme auch nach der Registrierung der Programme auf dem Computer des Benutzers installiert. Darüber hinaus könnte das Entfernen der Adware-Komponente, die immer noch von einem Programm zum Anzeigen von Werbung verwendet wird, zu Fehlfunktionen des Programms führen.

Der Hauptzweck von Adware, der über die erste Methode verbreitet wird, besteht darin, eine Art der Bezahlung für die Software zu extrahieren, indem dem Benutzer Anzeigen angezeigt werden (die Parteien, die die Werbung machen, zahlen die Werbeagentur und die Werbeagentur bezahlt den Adware-Entwickler). Adware hilft auch, die Ausgaben für Softwareentwickler zu senken (der Umsatz von Adware ermutigt sie, neue Programme zu schreiben und bestehende zu verbessern), und es hilft auch, die Kosten für die Benutzer zu senken.

Hackertechnologien werden häufig verwendet, wenn Werbekomponenten nach dem Besuch einer infizierten Website auf dem Computer eines Benutzers installiert werden. Zum Beispiel kann der Computer durch eine Browser-Schwachstelle durchdrungen werden, und es können Trojaner verwendet werden, die zur heimlichen Installation (Trojan-Downloader oder Trojan-Dropper) entwickelt wurden. Adware-Programme, die auf diese Weise funktionieren, werden oft Browser-Hijacker genannt.

Anzeigen anzeigen

Es gibt zwei Hauptarten, in denen Werbung dem Benutzer gezeigt wird:

durch Herunterladen von Werbetext und Bildern auf einen Computer von Web- oder FTP-Servern, die dem Werbetreibenden gehören
Weiterleiten von Suchanfragen für Internetbrowser an Werbeseiten.
In einigen Fällen werden Weiterleitungsanfragen nur ausgeführt, wenn die vom Benutzer angeforderte Webseite nicht verfügbar ist, dh wenn ein Fehler in der URL auftritt.

Daten sammeln

Viele Werbesysteme erfassen nicht nur Werbung, sondern auch Daten über den Computer und den Benutzer, wie zum Beispiel:

die IP-Adresse des Computers
das Betriebssystem und die Browserversion
eine Liste der am häufigsten besuchten Websites
Suchanfragen
andere Daten, die zur Durchführung nachfolgender Werbekampagnen verwendet werden können.
Hinweis: Es ist wichtig, Adware, die Daten sammelt, nicht mit Trojanern zu verwechseln. Der Unterschied besteht darin, dass Adware Daten mit Zustimmung des Nutzers sammelt.

Wenn Adware den Benutzer nicht benachrichtigt, dass es Informationen sammelt, wird es als bösartiges Programm (Malware) klassifiziert, das speziell durch das Verhalten von Trojan-Spy abgedeckt wird.

Mehr Informationen

Plattform: Win32

Win32 ist eine API auf Windows NT-basierten Betriebssystemen (Windows XP, Windows 7 usw.), die die Ausführung von 32-Bit-Anwendungen unterstützt. Eine der am weitesten verbreiteten Programmierplattformen der Welt.

Familie: AdWare.Win32.Ad2345

No family description

Examples

452E8E46572365C6358491C3008D46F7

Tactics and Techniques: Mitre*

TA0002

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.

T1129

Shared Modules

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

T1203

Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

T1204.002

Malicious File

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, and .reg.

T1559.001

Component Object Model

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE). Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM).

TA0003

Persistence

The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

T1543.003

Windows Service

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

TA0004

Privilege Escalation

The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.

T1055

Process Injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

T1134

Access Token Manipulation

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

T1543.003

Windows Service

TA0005

Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

T1055

Process Injection

T1070.006

Timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.

T1112

Modify Registry

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

T1134

Access Token Manipulation

T1497.001

System Checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

TA0006

Credential Access

The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.

T1003.001

LSASS Memory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

TA0007

Discovery

The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.

T1120

Peripheral Device Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

T1497.001

System Checks

T1518

Software Discovery

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

TA0009

Collection

The adversary is trying to gather data of interest to their goal. Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to steal (exfiltrate) the data. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.

T1560.001

Archive via Utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

TA0011

Command and Control

The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.

T1571

Non-Standard Port

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.