Kaspersky Threats — not-a-virus:HEUR:AdWare.Win32.SpeedBit.vho

クラス: Adware

アドウェアは、（通常はバナーの形で）広告を表示し、検索要求を広告ウェブサイトにリダイレクトし、カスタマイズされた広告を表示するためにユーザーに関するマーケティングタイプのデータを収集するように設計されたプログラム（例えば、コンピュータ。広告を表示してデータを収集する以外に、これらのタイプのプログラムは一般に、システムトレイにプログラムの兆候はなく、プログラムメニューにはファイルがインストールされていることを知らされません。多くの場合、アドウェアプログラムにはアンインストール手順がなく、プログラムがコンピュータに密かに浸透して気づかれないようにするために、ウイルス技術に接するテクノロジを使用します。侵入Adwareがユーザーのコンピュータに侵入する主な2つの方法があります。感染したWebサイトを訪問した結果、ユーザーのコンピュータに不正なソフトウェアやプログラムが不正にインストールされることがあります。ほとんどのフリーウェアおよびシェアウェアプログラムは、一度購入および/または登録された広告の表示を停止する。しかし、これらのプログラムでは、サードパーティのAdwareユーティリティが組み込まれていることが多く、プログラムが登録されていてもこれらのユーティリティはユーザーのコンピュータにインストールされていることがあります。さらに、プログラムによってまだ広告を表示するために使用されているAdwareコンポーネントを削除すると、プログラムが誤動作する可能性があります。第1の方法で広がるアドウェアの主な目的は、ユーザに広告を表示することによってソフトウェアの支払いのタイプを抽出することである（広告代理店に広告を支払う当事者、広告代理店はAdware開発者に支払う）。アドウェアは、ソフトウェア開発者の経費を削減するのにも役立ちます（Adwareの収益は、新しいプログラムを作成し、既存のプログラムを改善することを奨励します）。また、ユーザーのコスト削減にも役立ちます。ハッカー技術は、感染したWebサイトにアクセスした後、ユーザーのコンピュータに広告コンポーネントをインストールするときによく使用されます。例えば、コンピュータはブラウザの脆弱性を介して侵入され、巧妙にインストールするよう設計されたトロイの木馬（Trojan-DownloaderまたはTrojan-Dropper）を使用することができます。このように動作するアドウェアプログラムは、多くの場合、ブラウザハイジャッカーと呼ばれます。広告を表示する広告主が所有するウェブまたはFTPサーバから広告テキストおよび画像をコンピュータにダウンロードし、インターネットブラウザの検索要求を広告ウェブサイトにリダイレクトすることにより、広告がユーザに表示される主な2つの方法があります。場合によっては、ユーザーの要求されたWebページが利用できない場合、つまりURLにエラーがある場合にのみ、リダイレクト要求が行われます。データの収集多くの広告システムは、広告を表示するだけでなく、次のようなコンピュータとユーザーに関するデータも収集します。コンピュータのIPアドレスオペレーティングシステムとブラウザのバージョン最も頻繁にアクセスされるサイトの一覧では、その後の広告キャンペーンを実施する。注意：データを収集するアドウェアとトロイの木馬のスパイウェアプログラムを混同しないことが重要です。違いは、Adwareがユーザーの同意を得てデータを収集することです。 Adwareが情報を収集していることをユーザーに通知しない場合は、トロイの木馬 - スパイの動作に特化したマルウェア（マルウェア）として分類されます。

プラットフォーム: Win32

Win32は、32ビットアプリケーションの実行をサポートするWindows NTベースのオペレーティングシステム（Windows XP、Windows 7など）上のAPIです。世界で最も広く普及しているプログラミングプラットフォームの1つです。

ファミリー: AdWare.Win32.SpeedBit

No family description

Examples

06D807391E25158F8FBED7D658AF20D6

Tactics and Techniques: Mitre*

TA0002

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.

T1053.005

Scheduled Task

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

T1059.003

Windows Command Shell

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

T1106

Native API

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

T1203

Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

T1204.002

Malicious File

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.

TA0003

Persistence

The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

T1053.005

Scheduled Task

T1547.001

Registry Run Keys / Startup Folder

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

TA0004

Privilege Escalation

The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.

T1053.005

Scheduled Task

T1134

Access Token Manipulation

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

T1547.001

Registry Run Keys / Startup Folder

TA0005

Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

T1070.006

Timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.

T1112

Modify Registry

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

T1134

Access Token Manipulation

T1140

Deobfuscate/Decode Files or Information

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

T1497.001

System Checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

T1622

Debugger Evasion

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

TA0007

Discovery

The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.

T1010

Application Window Discovery

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used. For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.

T1012

Query Registry

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

T1497.001

System Checks

T1518

Software Discovery

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

T1518.001

Security Software Discovery

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

T1622

Debugger Evasion

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

TA0009

Collection

The adversary is trying to gather data of interest to their goal. Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to steal (exfiltrate) the data. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.

T1560.001

Archive via Utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

TA0011

Command and Control

The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.

T1071.001

Web Protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.