Classe: Worm
Les vers se propagent sur les réseaux informatiques via des ressources réseau. Contrairement à Net-Worms, un utilisateur doit lancer un ver afin qu'il soit activé. Ce type de ver recherche les réseaux informatiques distants et se copie dans les répertoires accessibles en lecture / écriture (s'il en trouve). En outre, ces vers utilisent les fonctions intégrées du système d'exploitation pour rechercher des répertoires réseau accessibles et / ou ils recherchent au hasard des ordinateurs sur Internet, s'y connectent et tentent d'accéder pleinement aux disques de ces ordinateurs. Cette catégorie couvre également les vers qui, pour une raison ou une autre, ne rentrent dans aucune des autres catégories définies ci-dessus (par exemple les vers pour les appareils mobiles).Plus d'informations
Plateforme: Win64
Win64 est une plate-forme sur les systèmes d'exploitation Windows pour l'exécution d'applications 32/64 bits. Les programmes Win64 ne peuvent pas être lancés sur des versions 32 bits de Windows.Famille: Worm.Win64.AutoRun
No family descriptionExamples
0AD18066110D9D9E3507AEBE9875A0F5Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1036.007
Double File Extension
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex:
File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies. TA0007
Discovery
The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
T1057
Process Discovery
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.