ID	E1082
Objective(s)	Discovery
Related ATT&CK Techniques	System Information Discovery (T1082)
Version	2.0
Created	2 August 2022
Last Modified	21 November 2022

System Information Discovery

Malware may attempt to get detailed information about the system.

See ATT&CK: System Information Discovery (T1082).

Methods

Name	ID	Description
Generate Windows Exception	E1082.m01	Malware may trigger an exception as a way of gathering system details.

Use in Malware

Name	Date	Method	Description
TrickBot	2016	--	Trojan spyware program that has mainly been used for targeting banking sites. [7]
WebCobra	2018	--	Learns about the system so it can drop compatible miner software. [8]
Ursnif	2016	--	Uses windows command prompt commands to gather system info, task list, installed drivers, and installed programs [1]
BlackEnergy	2007	--	Uses Systeminfo to gather OS version, system configuration, BIOS, the motherboard, and processor [ [2]
Emotet	2018	--	Collects information related to OS, processes, and sometimes mail client information and sends it to c2 [4]
Stuxnet	2010	--	Gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the net to spread itself [5]
CHOPSTICK	2015	--	CHOPSTICK collects information from the host including Windows version, CPU architecture, and UAC settings [6]
Dark Comet	2008	--	Can collect information about the compter, resources, and operating system version [3]
CryptoLocker	2013	--	Query environment variable (This capa rule had 1 match) [9]
Gamut	2014	--	Query environment variable (This capa rule had 1 match) [9]
GoBotKR	2019	--	GoBotKR uses wmic, systeminfo and ver commands to collect information about the system and the installed software. [10]query environment variable (This capa rule had 2 matches) [9]
Hupigon	2013	--	Query environment variable (This capa rule had 1 match) [9]
Kovter	2016	--	Get disk information (This capa rule had 1 match) [9]
Mebromi	2011	--	Check OS version (This capa rule had 1 match) [9]
Redhip	2011	--	Check OS version (This capa rule had 1 match) [9]
Rombertik	2015	--	Get disk size (This capa rule had 1 match) [9]
Shamoon	2012	--	Get hostname (This capa rule had 1 match) [9]
UP007 Malware Family	2016	--	Query environment variable (This capa rule had 1 match) [9]