WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道,昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球,特别是在内网和专网中,通过攻击445端口(蠕虫性质)大肆传播,造成了巨大数据损失。我也凑个热闹,找到一批样本上传金刚分析系统(http://tcasoft.com/),看看效果。

其中比较典型的分为两类,一类就是昨天大家新闻中看到的,访问某个超长的域名,如果存在就放弃攻击。如图:

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏,并不会探测域名。如某样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出,样本执行初期没有任何引人注意的表现,当桌面被替换、前台弹出提示信息时,一切都为时已晚,用户的文件就已经被加密,要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到,样本释放了大量可执行程序以及bat、vbs等恶意脚本,并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后,样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为,包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现,攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件,在加密完成并设置好文件创建时间后,会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢?只需查看分析报告里的“中间文件”就可以看到。如下图所示,攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片,被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外,样本运行过程中还能观测到大量的网络行为,连接地址包括美国、德国、奥地利等多个国家,同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中,引擎并未连接真实互联网,因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍,大家若有兴趣欢迎查看分析报告自行研究。

评论:

sallypf2
2019-11-20 06:22
Scandal porn galleries, daily updated lists
http://theshemalevideo.sexjanet.com/?molly

you porn no black sweet pussy mobile oprn you tube jennifer love hewitt porn porn actors site miley cyrus porn film
LeonelWAYNC
2019-11-17 14:23
娛樂城介紹


https://forum.tw-sportslottery.com/thread-119-1-1.html
HenryImads
2019-11-16 00:26
Pthc cp lolita child porn site
Hangman Anal Series Animation Art
Siberian Mouse Collection Asian Set Viola Set

https://qil.su/WgxoqM

https://lst.to/k5vck

http://childporno.site
briannadw1
2019-11-14 23:38
Hot galleries, thousands new daily.
http://teeshirtbleu.instakink.com/?delilah

big athletic girl porn porn max gang bang best college lesbian porn free gay porn moves college is awesome porn
autumnoc4
2019-11-14 08:47
Hot photo galleries blogs and pictures
http://pornblackgay.instakink.com/?madyson

free porn previews orgies chili movies porn toilet swirlie porn heather macarthy porn photos home drunk pron
DannyFrema
2019-11-12 00:42
第一借錢網


https://168cash.com.tw/adv/area
tuclice
2019-11-11 12:01
Доброго времени суток
Самое время получать 5096 $ ежедневно!
https://cloud.mail.ru/public/3T5x/4B7Dav9kV
MichaelMiz
2019-11-09 23:06
【揚歌-教學麥克風直營店】官方線上購物網站─JM-180B有線麥克風擴音器│無線麥克風擴音器│揚歌小蜜蜂│專營教學麥克風及教學擴音器

https://mic-shop.com/
nikkiza3
2019-11-04 15:35
Hot galleries, thousands new daily.
http://tanyataylorporn.topanasex.com/?malia

vitage porn clips ashley madison porn alice in wonderland 1976 porn streaming adults sending self porn text legal young teeen porn
berthalp4
2019-10-30 18:36
Teen Girls Pussy Pics. Hot galleries
http://ebonylesbians.allproblog.com/?abbie

kristy love porn niche flix porn free monster and aliens cartoon porn ebony ocean porn hentai porn katara avatar free videos
bernardnc1
2019-10-27 21:24
Sexy teen photo galleries
http://bobbistarporn.kanakox.com/?kiersten

youtube porn clone spongebob porn sex porn suffer goht porn video porn tyubes
knoca
2019-10-23 17:46
link for you low cost is

     61a8 is capsules
Deborahrah
2019-10-20 19:33
https://tunesick.com/forums/topic/9093/
http://vetfutursfrance.fr/users/imincesgoods/edit/?updated=true
http://www.morganfit.cl/forums/user/zioraispecse/edit/?updated=true
https://winterthur.frei-denken.ch/foren/topic/6959
http://skilltraderz.com/groups/3784
http://fantasyanddesires.com/forums/topic/7435/
https://thinkwriteacademy.com/forums/topic/4050/
https://mummyclinicc.com/forums/topic/4238/
http://behelps.com/forums/topic/6708/
http://www.eunibikes.com/forums/topic/8741/
http://www.la-cambuse.fr/index.php/Sujet/7823/
http://pndworks.com/forums/topic/1661/
https://pcnapoveda.cz/users/dapgarate/edit/?updated=true
http://www.ericjunjiehuang.com/forums/users/downsparexuk/edit/?updated=true
http://herpessupportgroup.org/forums/users/deistanomtos/edit/?updated=true
http://www.droneforum.no/forums/users/anderdebtsoft/edit/?updated=true
http://cslpesas.org/forums/topic/4203/
https://diysmartdesk.com/forums/users/czechtyobideads/edit/?updated=true
http://localplus.co.uk/forums/topic/561/
http://www.healthworldbook.com/forums/topic/8454/
Deborahrah
2019-10-18 08:21
http://smac-ky.org/forums/topic/5639/
https://www.haasfan.co.il/all-forums/users/niesandgahi/edit/?updated=true
https://thealphamentor.com/forums/user/vlikemosam/edit/?updated=true
https://joshuaparker.blog/forums/users/inabprovdud/edit/?updated=true
http://www.capsutd.com/groups/6851
http://www.controltec.ind.br/forums/user/coibeauholti/edit/?updated=true
http://myhelpdesk.club/forums/users/checafifpva/edit/?updated=true
https://hairprincess.nl/forums/topic/5872/
https://mulesoft-developers.com/forums/user/huemewantgrad/edit/?updated=true
https://apfelkurse.de/forums/topic/8264/
http://lcc.edu.pk/?topic=6264
http://www.mybaazar.in/forums/topic/5613/
http://ashermansyndrome.com/forums/topic/4481/
http://lightningsfm.com/users/afenpagloo/edit/?updated=true
https://liverpoolfcdublin.com/forums/topic/9690/
https://myschoolchat.com/forums/topic/1886/
https://www.youthwinconnect.com/forums/topic/3163/
https://ilmulquran.org/forums/topic/casino-games6035/
http://ccmasite.com/users/cripbarclingper/edit/?updated=true
http://athar-school.ir/forums/topic/7800/
Deborahrah
2019-10-17 09:36
http://www.bukashka.org/forum.html/users/membtudekop/edit/?updated=true
http://www.marhabapilates.com/forums/topic/casino-games9945/
https://dartsplanet.tv/groups/459
https://www.loganslocker702.com/groups/7091
http://www.pixelpiraterne.dk/forums/topic/5521/
http://gloryhammergaming.com/forums/user/waydifbaver/edit/?updated=true
https://adorebikes.com/forums/users/lacmaesiozen/edit/?updated=true
http://theelitesthall.com/forums/topic/114/
https://plantaoveterinario.com.br/forums/user/stocgasgforpo/edit/?updated=true
http://www.africaengineer.co.za/forums/topic/8416/
https://lesboles.ca/forums/topic/3871/
http://lcc.edu.pk/?topic=6264
http://expertiseeducacao.com.br/forums/Topics-1/2138/
http://wara-diaspora-guyane.com/forums/topic/5554/
https://caelumlore.com/forums/topic/3658/
https://guialonline.com/forums/topic/3473/
http://www.study4topper.com/forums/topic/5622/
http://www.institutovimam.com.br/forums/topic/444/
https://www.ieltspracticezone.com/forums/topic/2420/
http://avader.org/forums/topic/8965/

发表评论:

Powered by emlog