| ID |
C0021 |
| Objective(s) |
Cryptography |
| Related ATT&CK Techniques |
None |
| Version |
2.1 |
| Created |
14 August 2020 |
| Last Modified |
30 April 2024 |
The Generate Pseudo-random Sequence micro-behavior can be used for a number of purposes. The methods below include specific functions, as well as pseudo-random number generators (PRNG).
| Name | ID | Description |
|---|
| GetTickCount | C0021.001 | Malware generates a pseudo-random sequence using GetTickCount. |
| Use API | C0021.003 | Malware generates a pseudo-random sequence using a Windows API. |
| rand | C0021.002 | Malware generates a pseudo-random sequence using rand. |
| RC4 PRGA | C0021.004 | Malware generates a pseudo-random sequence using the RC4 Pseudo Random (Byte) Generation Algorithm (PRGA). |
| Name | Date | Method | Description |
|---|
| BlackEnergy | 2007 | C0021.003 | BlackEnergy generates random numbers via WinAPI. [1] |
| Locky Bart | 2017 | C0021.003 | Generate random numbers via WinAPI [1] |
Cryptography::Generate Pseudo-random Sequence
SHA256: 192cdcbdec8bdebb7cae89037d6004b4aff2b8264c35a3875fa2d6db104437ca
Location: 0x40B120
mov eax, [DAT_00423174] ; set up the array of values used for the twister
mov ecx, dword ptr [eax*0x4 + DAT_004227b0]
mov dword ptr [EBP + local_8], ecx
mov edx, dword ptr [DAT_00423174]
add edx, 0x1
mov dword ptr [DAT_OO423174], edx
mov eax, dword ptr [ebp + local_8] ; set up by taking x (value in series to start the transform, stored at the memory address [ebp + local_8] in this case
shr eax, 0xb ; shift x right by 11
xor eax, dword ptr [ebp + local_8] ; xor the result of the previous operation with the old value of x. The eax register now contains intermediate value y
mov dword ptr [ebp + local_8], eax ; store the value of y
mov ecx, dword ptr [ebp + local_8] ; ecx now contains y
shl ecx, 0x7 ; shift y left by 7
and ecx, 0x9d2c5680 ; perform a bitwise and against a known constant bitmask (this value is specified in the transform equation)
xor ecx, dword ptr [ebp + local_8] ; xor the output of the previous two instructions with the old value of y to produce y1 (still an intermediate value)
mov dword ptr [ebp + local_8], ecx ; store y1
mov edx, dword ptr [ebp + local_8] ; load y1 into edx to start the third part of the transform
shl edx, 0xf ; shift y1 left by 15
and edx, 0xefc60000 ; take y1 and perform a bitwise and operation with another constant
xor edx, dword ptr [ebp + local_8] ; xor the output from the previous two instructions with the value of y1 stored earlier
mov dword ptr [ebp + local_8], edx ; save this new intermediate y-value (y2)
mov eax, dword ptr [ebp + local_8] ; load y2 into eax to start the final portion of the transform and produce the output
shr eax, 0x12 ; shift y2 right by 18
xor eax, dword ptr [ebp + local_8] ; xor the output from the previous instruction with the value of y2 stored earlier
mov dword ptr [ebp + local_8], eax ; store the z-value (final output)
mov eax, dword ptr [ebp + local_8] ; load the z-value into eax to return it
mov esp, ebp ; move the stack pointer to the frame pointer
pop ebp ; pop the current frame off the stack
ret ; return from the function
[1] capa v4.0, analyzed at MITRE on 10/12/2022