SearchAwesome

SearchAwesome adware intercepts encrypted web traffic to inject ads.

ATT&CK Techniques

Name	Use
Defense Evasion::Subvert Trust Controls (T1553)	The malware uses certificates to gain access to HTTPS traffic. [1]
Collection::Browser Session Hijacking (T1185)	The malware can modify web traffic for the purpose of injecting Javascript. [1]
Command and Control::Proxy (T1090)	The malware uses mitmproxy to intercept and modify web traffic. [1]
Collection::Adversary-in-the-Middle (T1557)	After installing a certificate, the malware inserts inself into a chain of custody, typically within network packets. [1]

Name	Use
Execution::User Execution (E1204)	The user opens a disk image file which invisibly installs its components. [1]
Defense Evasion::Self Deletion (F0007)	The malware will monitor if a specific file gets deleted and then will delete itself. [1]
Privilege Escalation::Install Certificate (E1608)	The malware installs a certificate. [1]
Execution::Command and Scripting Interpreter (E1059)	The malware installs a script to inject a JavaScript script and modify web traffic. [1]

Name	Use
Command and Control::C2 Communication::Receive Data (B0030.002)	The malware receives data from the C2 server. [1]
Impact::Manipulate Network Traffic (B0019)	SearchAwesome intercepts encrypted web traffic to inject ads. [1]
Execution::Install Additional Program (B0023)	The malware installs an open-source program called mitmproxy. [1]

Attack flow for SearchAwesome based on [1].