WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道,昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球,特别是在内网和专网中,通过攻击445端口(蠕虫性质)大肆传播,造成了巨大数据损失。我也凑个热闹,找到一批样本上传金刚分析系统(http://tcasoft.com/),看看效果。

其中比较典型的分为两类,一类就是昨天大家新闻中看到的,访问某个超长的域名,如果存在就放弃攻击。如图:

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏,并不会探测域名。如某样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出,样本执行初期没有任何引人注意的表现,当桌面被替换、前台弹出提示信息时,一切都为时已晚,用户的文件就已经被加密,要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到,样本释放了大量可执行程序以及bat、vbs等恶意脚本,并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后,样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为,包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现,攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件,在加密完成并设置好文件创建时间后,会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢?只需查看分析报告里的“中间文件”就可以看到。如下图所示,攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片,被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外,样本运行过程中还能观测到大量的网络行为,连接地址包括美国、德国、奥地利等多个国家,同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中,引擎并未连接真实互联网,因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍,大家若有兴趣欢迎查看分析报告自行研究。

评论:

StevenKeNcy
2019-07-10 06:33
ООО «Ангарский Завод Полимеров» http://www.azp-plenka.ru/ крупнейший в Сибири производитель полимерных материалов предлагает Полиэтиленовую пленку: хозяйственного назначения, тепличную, парниковую, строительную, термоусадочную, армированную, цветную, черную, светостабилизированную, стрейч-пленку паллетную, для ручной упаковки, пищевую стрейч пленку. Изделия из полиэтилена: мешки полиэтиленовые любых размеров, толщины, цвета, вида и назначения; мешки для строительного и бытового мусора; пакеты полиэтиленовые шириной до 1200 мм., пакеты фасовочные ПВД 250х350мм, 280х350мм, 200х400мм и т.д., пакеты фасовочные ПНД 250х350мм и т.д. в рулоне, пачках, пластах, с фальцем и без; пакеты майка с рисунком, с Вашим логотипом на заказ; вкладыши в бочку, коробку, биг-беги; крышки полиэтиленовые на стекло банку, трубы и т.д. Полимеры производства ПАО НК Роснефть: полиэтилен ПВД 10803-020, полистирол ПСВ-СВ-НМ-Р-О марка 2,4,6, полистирол ПСВ-СВ-НМ марка 15. Отдел сбыта +7(3955)508-864, 573-555, 573-554, +79501440042(Теле2), +79140107278(МТС). Работаем по всей России
Stukovninaknoca
2019-07-09 23:53
is 5 mg se necesita receta

     3570 vente is generique ligne
Beverlywag
2019-07-09 12:30
http://mesibba.com/forums/user/nisynfors1988
http://www.rojukiss.co.th/forums/user/kowlowink1974
http://fantasyanddesires.com/forums/user/genana1982
http://tfit.ir/forums/topic/online-casino-games-87040/
https://gamingproject.eu/groups/casino-online-92451
https://jokosystems.com/forums/topic/online-casinos-84188/
http://swipeycat.com/groups/casino-online-92945
http://expharm.co.za/forums/topic/casino-online-85566/
http://www.cci-property.com/groups/online-slots-96058
http://imbf.info/forums/user/soulsroda1977
http://acencanal.org/forums/topic/online-casino-84534/
http://www.southjerseywriters.com/groups/casino-online-96018
https://www.gradstoteaching.org/forums/topic/casino-slots-81309/
http://www.artsyfact.com/forums/topic/online-casino-80222/
http://genesisos.co.uk/groups/online-casino-games-87134
http://www.skillpaw.com/groups/casino-games-83453
http://nishathletics.com/groups/online-casino-games-92761
https://atombrown.com/groups/online-casinos-88991
http://alternathistory.com/groups/online-casinos-92770
https://loongchinese.com/groups/casino-slots-85182
trantyRurdyspusty
2019-07-09 11:47
sildenafil and sleeplessness http://cialisrol.com buy cialis online, can i drink alcohol when taking sildenafil
DouglasGably
2019-07-09 05:09
Imposing childrens porn clips PTHC CP

freetexthost.com/x3l6rzn11m

http://freetexthost.com/x3l6rzn11m
BrendanIncob
2019-07-09 02:47
cialis discount code http://www.shentao.it/groups/moretwo-costar-buycialisonlinewithoutprescriptionincanada-88833
http://www.myrealtortrends.com/forums/topic/pearson-buy-cheap-generic-cialis-online-debtors-trainster-warehousing-93349/
buy viagra in canada
cheap cialis online india https://playrsclub.com/groups/measurement-where-can-i-buy-real-cialis-wilfordii-95096
http://predmestiepnz.ru/forums/topic/baicalin-consign-turner-motions-cialis-for-sale-in-australia-83645/
cheap viagra adelaide
buy viagra professional online http://ffaworldofrunning.com/forums/topic/buy-cheap-viagra-cialis-crudity-martinis-advisors-91402/
https://www.nijatvgermany.com/groups/cimicifuga-weblog-buy-cialis-in-india-hawaiians-switching-89546
buy cialis johannesburg
can cialis pills cut half https://crowdcoast.com/forums/topic/original-cialis-pills-japonica-thomson-96986/
https://mezeos.de/groups/cialis-pills-color-aplenty-insect-92366
safe buy generic viagra online
viagra on sale https://www.lootidea.com/forums/user/sisnales1977
https://nooreyabiogas.com/forums/user/ryperspen1972
mail order viagra online
Beverlywag
2019-07-06 02:28
http://expresslanguagesonline.com/groups/casino-games-85743
http://accessliberia.com/forums/topic/casino-games-88416/
http://youlifechallenge.com/groups/online-slots-97894
http://www.cityofmedford.info/groups/online-casino-97274
http://thepuzzledparents.com/forums/user/knocapentan1983
http://fev.moscow/groups/casino-online-89361
http://mybucketwishes.com/groups/online-casino-80575
http://carouse.life/groups/casino-games-82612
http://being-russia.ru/forums/topic/online-slots-90618
http://crackmeup.site/forums/topic/online-casino-games-80751/
http://acencanal.org/forums/topic/online-casino-real-money-87246/
http://www.beulahpulse.com/groups/casino-online-98487
http://genesisos.co.uk/forums/user/subctersy1979
http://auctusgrad.com/forums/user/rayfafer1978
http://genesisos.co.uk/groups/online-casino-real-money-84330
http://genesisos.co.uk/groups/casino-online-82210
http://afroconsciousness.com/forums/user/basubsre1977
http://mesibba.com/forums/topic/casino-online-94643/
http://dignifiedbeauty.org/groups/casino-slots-88798
https://www.shareapin.com/groups/online-casinos-93458
Galyaknoca
2019-07-05 05:17
is toronto sale

     10c8 informacion sobre la is
Galyaknoca
2019-07-05 04:55
is sales in spain

     10c8 prix du is role
Galyaknoca
2019-07-04 22:14
is 50mg hinta

     10c8 can a 20 year old take is
Galyaknoca
2019-07-04 21:01
being is prescription

     10c8 is ordine online
Beverlywag
2019-07-04 06:09
http://allstarcomicsandcards.com/forums/user/anfippa1983
http://www.silvanusinternational.org/groups/online-slots-83605
http://topparry.com/groups/casino-games-83234
http://vikingsofvalor.com/groups/online-casino-games-91049
https://www.chronicsouls.com/groups/online-casinos-89395
http://hueseek.com/forums/user/twinouvre1971
http://www.biesadi.com/forums/topic/online-casino-real-money-81871/
http://blackbusinessavenue.com/groups/online-casino-88834
http://akrambook.club/groups/casino-slots-89275
http://www.scooterstore.ph/forums/user/lujourchant1985
http://altenergiya.ru/forums/user/tudito1978
http://toolbudd.com/forums/topic/casino-games-91576/
http://yoursurveyplus.com/forums/user/ryonaha1981
https://www.foroswebgratis.com/groups/online-casino-86769
http://theviroom.com/groups/casino-games-90692
http://henkgeesink.com/groups/casino-games-99929
http://acencanal.org/forums/topic/online-slots-85933/
http://www.marhabayoga.com/forums/topic/casino-online-82164/
http://fanz4life.com/groups/online-casino-real-money-90089
http://ilearnmedical.co.za/groups/online-casino-games-93350
Terryimade
2019-07-03 15:59
Childrens porn clips PTHC
Siberian Mouse Valya Tara Vicky
NewSugar Goldberg Deadpixel
HMM Series (Gracel and Friend)

http://freetexthost.com/uqqjmg5hjt

freetexthost.com/uqqjmg5hjt
Beverlywag
2019-07-03 12:10
http://cc-fullz68.com/forums/topic/casino-games-97089/
http://sniffers.co/forums/user/tinasenf1974
http://stylefinderacademy.com/groups/casino-online-96461
https://gamingproject.eu/groups/casino-slots-99348
http://restaurantsintraversecity.com/forums/topic/online-casino-95387/
http://www.scooterstore.ph/forums/topic/online-casino-real-money-97664/
http://readfdn.org/forums/user/legbestsag1975
http://hotbhabhiji.com/groups/online-casino-real-money-85511
http://schulzentrum-am-alex.org/forums/user/tempkincu1981
https://malawiusfriends.com/groups/online-casino-games-94344
http://myboscorp.com/groups/online-casinos-87988
http://gc.pknowledge.eu/forums/Thema/casino-games-81887/
http://hausvergleich.ch/forums/topic/casino-games-89723/
http://warriorsphere.com/groups/online-casino-real-money-84900
http://studio1london.ca/groups/casino-online-86766
http://islamiskportalen.se/groups/casino-slots-83743
http://swipeycat.com/groups/casino-online-87393
https://www.biomimetics-connect.com/forums/topic/online-casinos-88377/
http://coworkingrugby.co.uk/groups/casino-slots-93198
http://fanz4life.com/groups/online-slots-83961
trantyRurdyspusty
2019-07-03 05:16
can you buy sildenafil at walmart http://viagrraver.com cheap generic viagra, cialis precio farmacia andorra

发表评论:

Powered by emlog