Kaspersky Threats — not-a-virus:AdWare.Win32.Ad2345.bmu

Clase: Adware

Adware cubre programas diseñados para mostrar anuncios (generalmente en forma de pancartas), redirige las solicitudes de búsqueda a sitios web publicitarios y recopila datos de tipo marketing sobre el usuario (por ejemplo, qué tipos de sitios web visita) para mostrar publicidad personalizada en el ordenador. Además de mostrar anuncios y recopilar datos, estos tipos de programas generalmente no hacen que su presencia en el sistema sea conocida: no habrá señales del programa en la bandeja del sistema, y no habrá ninguna indicación en el menú del programa de que los archivos se hayan instalado. A menudo, los programas Adware no tienen ningún procedimiento de desinstalación y usan tecnologías que limitan con la tecnología de virus para ayudar al programa a penetrar sigilosamente en la computadora y pasar desapercibido. Penetración Hay dos formas principales en que Adware ingresa a la computadora de un usuario: está incorporada en algunos programas freeware y shareware de instalación no autorizada en la computadora de un usuario como resultado de una visita a un sitio web infectado. La mayoría de los programas freeware y shareware dejan de mostrar anuncios una vez que se han comprado y / o registrado. Pero estos programas a menudo usan utilidades incorporadas de Adware de terceros y, en algunos casos, estas utilidades permanecen instaladas en la computadora del usuario incluso una vez que se han registrado los programas. Además, la eliminación del componente Adware, que todavía está siendo utilizado por un programa para mostrar anuncios, podría causar un mal funcionamiento del programa. El principal objetivo de propagación de Adware a través del primer método es extraer un tipo de pago para el software mostrando anuncios al usuario (las partes que hacen los anuncios pagan a la agencia de publicidad, y la agencia de publicidad paga al desarrollador de Adware). Adware también ayuda a reducir los gastos para los desarrolladores de software (los ingresos de Adware los alienta a escribir nuevos programas y mejorar los ya existentes) y ayuda a reducir los costos para los usuarios también. Las tecnologías de hackers a menudo se usan cuando los componentes publicitarios se instalan en la computadora de un usuario después de visitar un sitio web infectado. Por ejemplo, se puede penetrar la computadora a través de una vulnerabilidad de navegador y se pueden usar troyanos diseñados para su instalación sigilosa (Trojan-Downloader o Trojan-Dropper). Los programas publicitarios que funcionan de esta manera a menudo se denominan secuestradores del navegador. Mostrar anuncios Hay dos formas principales en que se muestra la publicidad al usuario: mediante la descarga de texto e imágenes publicitarias a una computadora desde servidores web o FTP propiedad del anunciante que redirigen las solicitudes de búsqueda del navegador de Internet a sitios web publicitarios. En algunos casos, las solicitudes de redireccionamiento solo se realizan si la página web solicitada del usuario no está disponible, es decir, si hay un error en la URL. Recopilación de datos Además de mostrar anuncios, muchos sistemas publicitarios también recopilan datos sobre la computadora y el usuario, tales como: la dirección IP de la computadora, el sistema operativo y la versión del navegador una lista de los sitios más visitados, consultas de búsqueda, otros datos que pueden usarse para llevar a cabo campañas publicitarias posteriores. Nota: es importante no confundir el Adware que recopila datos con programas espía de troyanos. La diferencia es que Adware recopila datos con el consentimiento del usuario. Si Adware no notifica al usuario que está recopilando información, entonces se clasifica como un programa malicioso (Malware), específicamente cubierto por el comportamiento Trojan-Spy.

Más información

Plataforma: Win32

Win32 es una API en sistemas operativos basados en Windows NT (Windows XP, Windows 7, etc.) que admite la ejecución de aplicaciones de 32 bits. Una de las plataformas de programación más extendidas en el mundo.

Familia: AdWare.Win32.Ad2345

No family description

Examples

452E8E46572365C6358491C3008D46F7

Tactics and Techniques: Mitre*

TA0002

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.

T1129

Shared Modules

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

T1203

Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

T1204.002

Malicious File

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, and .reg.

T1559.001

Component Object Model

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE). Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM).

TA0003

Persistence

The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

T1543.003

Windows Service

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

TA0004

Privilege Escalation

The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.

T1055

Process Injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

T1134

Access Token Manipulation

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

T1543.003

Windows Service

TA0005

Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

T1055

Process Injection

T1070.006

Timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.

T1112

Modify Registry

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

T1134

Access Token Manipulation

T1497.001

System Checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

TA0006

Credential Access

The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.

T1003.001

LSASS Memory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

TA0007

Discovery

The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.

T1120

Peripheral Device Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

T1497.001

System Checks

T1518

Software Discovery

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

TA0009

Collection

The adversary is trying to gather data of interest to their goal. Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to steal (exfiltrate) the data. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.

T1560.001

Archive via Utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

TA0011

Command and Control

The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.

T1571

Non-Standard Port

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.