SHIPSHAPE
ID: S0028
ⓘ
Type: MALWARE
Version: 1.0
Created: 31 May 2017
Last Modified: 17 October 2018
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.[1] |
| .009 | 启动或登录自动启动执行: Shortcut Modification |
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.[1] |
||
| Enterprise | T1091 | 通过可移动媒体复制 |
APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.[1] |
|