Malware: Conficker

Description

[Conficker](https://attack.mitre.org/software/S0608) is a computer worm first detected in October 2008 that targeted Microsoft Windows using the MS08-067 Windows vulnerability to spread.(Citation: SANS Conficker) In 2016, a variant of [Conficker](https://attack.mitre.org/software/S0608) made its way on computers and removable disk drives belonging to a nuclear power plant.(Citation: Conficker Nuclear Power Plant)

External References

• mitre-attack
• SANS Conficker
• Conficker Nuclear Power Plant

Techniques Used by This Malware

• T1021.002 — SMB/Windows Admin Shares
• T1027 — Obfuscated Files or Information
• T1046 — Network Service Discovery
• T1091 — Replication Through Removable Media
• T1105 — Ingress Tool Transfer
• T1112 — Modify Registry
• T1124 — System Time Discovery
• T1210 — Exploitation of Remote Services
• T1490 — Inhibit System Recovery
• T1543.003 — Windows Service
• T1547.001 — Registry Run Keys / Startup Folder
• T1562.001 — Disable or Modify Tools
• T1568.002 — Domain Generation Algorithms