Kaspersky Threats — not-a-virus:HEUR:AdWare.Win32.SpeedBit.vho

Sınıf: Adware

Reklam yazılımı, reklamları (genellikle afiş biçiminde) görüntülemek, arama isteklerini reklam web sitelerine yönlendirmek ve kullanıcıyla ilgili pazarlama türündeki verileri toplamak (örneğin hangi web sitelerini ziyaret ettikleri) için özelleştirilmiş programlar görüntülemek üzere tasarlanmış programları kapsar. bilgisayar. Reklamların görüntülenmesi ve veri toplanması dışında, bu tür programlar genellikle sistemde varlığını ortaya çıkarmazlar: sistem tepsisinde programın hiçbir işareti olmayacak ve dosyaların yüklendiği program menüsünde hiçbir belirti olmayacaktır. Çoğu zaman, Adware programlarının herhangi bir kaldırma prosedürü yoktur ve programın gizlice bilgisayara girmesine ve fark edilmeden çalıştırılmasına yardımcı olmak için virüs teknolojisiyle sınırlanan teknolojileri kullanır. Penetrasyon Adware'in bir kullanıcının bilgisayarına girmesinin iki ana yolu vardır: virüslü bir web sitesine yapılan ziyaretin bir sonucu olarak, bir kullanıcının bilgisayarına yetkisiz bir şekilde yüklenen bazı ücretsiz ve shareware programlarına yerleştirilmiştir. Çoğu ücretsiz yazılım ve shareware programı, satın alındıktan ve / veya kayıt olduktan sonra reklam göstermeyi durdurur. Ancak bu programlar genellikle yerleşik üçüncü taraf Adware yardımcı programlarını kullanır ve bazı durumlarda, programlar kaydedildikten sonra bile bu yardımcı programlar kullanıcının bilgisayarında yüklü kalır. Ayrıca, reklamları görüntülemek için bir program tarafından hala kullanılmakta olan Adware bileşeninin kaldırılması, programın arızalanmasına neden olabilir. Adware'in temel amacı, ilk yöntemle yayının, kullanıcıya reklam göstererek (reklam ajansını reklam ajansını ödeyen taraflar ve reklam ajansı Adware geliştiricisine ödeme yapması) yazılım için bir ödeme şekli çıkarmasıdır. Adware ayrıca yazılım geliştiricilerinin (Adware gelirleri yeni programlar yazmaya ve mevcut olanları iyileştirmeye teşvik eder) masraflarını azaltmaya yardımcı olur ve ayrıca kullanıcılar için maliyetleri azaltmaya yardımcı olur. Hacker teknolojileri, genellikle, bir kullanıcının web sitesinde, bir web sitesinin ziyaret edilmesini takiben, reklam bileşenleri yüklü olduğunda kullanılır. Örneğin, bir tarayıcıda bir güvenlik açığı ile bilgisayara girilebilir ve gizlice kurulacak şekilde tasarlanmış Truva atları (Trojan-Downloader veya Trojan-Dropper) kullanılabilir. Bu şekilde çalışan adware programları genellikle Tarayıcı Korsanları olarak adlandırılır. Reklamların gösterilmesi Reklamın kullanıcıya gösterilmesinin iki ana yolu vardır: reklam metinlerini ve görüntüleri bir web sitesine veya İnternet tarayıcı arama isteklerini reklam web sitelerine yönlendiren reklamverenin sahip olduğu FTP veya sunuculardan indirerek. Bazı durumlarda, yönlendirme istekleri yalnızca kullanıcının istediği web sayfası kullanılamıyorsa, yani URL'de bir hata varsa gerçekleşir. Veri toplama Reklamları görüntülemenin yanı sıra, birçok reklamcılık sistemi de bilgisayar ve kullanıcı ile ilgili verileri toplar; örneğin: bilgisayarın IP adresi işletim sistemi ve tarayıcı sürümü en çok ziyaret edilen sitelerin listesini arar. sonraki reklam kampanyalarını yürütmek. Not: Trojan casus yazılım programlarıyla veri toplayan Adware'i karıştırmamak önemlidir. Aradaki fark, Adware'in verileri kullanıcının izni ile toplamasıdır. Adware, kullanıcıyı bilgi topladığına bildirmezse, özellikle Trojan-Spy davranışı kapsamında olan kötü amaçlı bir program (Malware) olarak sınıflandırılır.

Platform: Win32

Win32, 32-bit uygulamaların yürütülmesini destekleyen Windows NT tabanlı işletim sistemlerinde (Windows XP, Windows 7, vb.) Bir API'dir. Dünyanın en yaygın programlama platformlarından biri.

Aile: AdWare.Win32.SpeedBit

No family description

Examples

06D807391E25158F8FBED7D658AF20D6

Tactics and Techniques: Mitre*

TA0002

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.

T1053.005

Scheduled Task

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

T1059.003

Windows Command Shell

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

T1106

Native API

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

T1203

Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

T1204.002

Malicious File

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.

TA0003

Persistence

The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

T1053.005

Scheduled Task

T1547.001

Registry Run Keys / Startup Folder

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

TA0004

Privilege Escalation

The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.

T1053.005

Scheduled Task

T1134

Access Token Manipulation

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

T1547.001

Registry Run Keys / Startup Folder

TA0005

Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

T1070.006

Timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.

T1112

Modify Registry

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

T1134

Access Token Manipulation

T1140

Deobfuscate/Decode Files or Information

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

T1497.001

System Checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

T1622

Debugger Evasion

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

TA0007

Discovery

The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.

T1010

Application Window Discovery

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used. For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.

T1012

Query Registry

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

T1497.001

System Checks

T1518

Software Discovery

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

T1518.001

Security Software Discovery

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

T1622

Debugger Evasion

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

TA0009

Collection

The adversary is trying to gather data of interest to their goal. Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to steal (exfiltrate) the data. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.

T1560.001

Archive via Utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

TA0011

Command and Control

The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.

T1071.001

Web Protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.