WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道,昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球,特别是在内网和专网中,通过攻击445端口(蠕虫性质)大肆传播,造成了巨大数据损失。我也凑个热闹,找到一批样本上传金刚分析系统(http://tcasoft.com/),看看效果。

其中比较典型的分为两类,一类就是昨天大家新闻中看到的,访问某个超长的域名,如果存在就放弃攻击。如图:

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏,并不会探测域名。如某样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出,样本执行初期没有任何引人注意的表现,当桌面被替换、前台弹出提示信息时,一切都为时已晚,用户的文件就已经被加密,要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到,样本释放了大量可执行程序以及bat、vbs等恶意脚本,并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后,样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为,包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现,攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件,在加密完成并设置好文件创建时间后,会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢?只需查看分析报告里的“中间文件”就可以看到。如下图所示,攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片,被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外,样本运行过程中还能观测到大量的网络行为,连接地址包括美国、德国、奥地利等多个国家,同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中,引擎并未连接真实互联网,因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍,大家若有兴趣欢迎查看分析报告自行研究。

评论:

Henrynib
2020-10-17 09:06
Check out the automatic Bot, which works for you 24/7.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%66%56%6b%77%53%68%57%4d%4a%41%54%42%59%71%6d%58%59&sa=D&sntz=1&usg=AFQjCNGqfzYo21rUaHfLcBbM8qx_66AhSg
homework
2020-10-13 00:22
Truly a lot of useful facts. buy essay paper https://freeessayfinder.com finding a ghostwriter
Henrynib
2020-10-11 17:46
Earning $1000 a day is easy if you use this financial Robot.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%66%49%6b%73%6e%42%68%58%6d%51%51%61%62%67%4d%63%5a&sa=D&sntz=1&usg=AFQjCNGKwC2ayYDD2c_S0GMeznTjHjKY4Q
Henrynib
2020-10-11 13:02
Launch the financial Robot and do your business.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%71%51%52%6d%6a%47%75%47%72%54%57%50%65%44%48%77%79&sa=D&sntz=1&usg=AFQjCNF_Lvz18OudlraWx_tfEMzwLpv6Sw
Henrynib
2020-10-10 19:52
Lanciare il miglior strumento di investimento per iniziare a fare soldi oggi.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%46%73%63%79%42%6d%49%59%6a%5a%58%42%6e%7a%61%75%71&sa=D&sntz=1&usg=AFQjCNE3Kqk3kholKkaTYh7vOK_XyK-Fxg
Henrynib
2020-10-10 10:43
Fare soldi può essere estremamente facile se si utilizza questo Robot.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%63%79%62%49%53%54%6a%7a%52%47%53%69%77%41%51%47%6b&sa=D&sntz=1&usg=AFQjCNFrDoCXau5Tfkw4B2JtZTVEt-ecGQ
Henrynib
2020-10-10 10:02
Fare soldi, non la guerra! Robot finanziario è quello che ti serve.
Link - - https://moneylinks.page.link/6SuK
Henrynib
2020-10-09 17:15
Basta un clic può trasformare dollaro in $ 1000.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%56%41%41%46%72%4c%51%79%52%55%56%77%67%43%58%58%6f&sa=D&sntz=1&usg=AFQjCNH55eHpvfUWPnoFoiRAzcmGTlTlXA
paper writing
2020-10-08 05:11
Cheers. Awesome stuff.  https://definitionessays.com/
the internet
2020-10-07 22:16
cheap custom essay  cheap custom essay  http://buyessayhelpvwe.com/ the internet
Henrynib
2020-10-06 08:42
Robot finanziario garantisce a tutti stabilità e reddito.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%53%64%68%6b%74%43%62%51%7a%45%52%4a%74%77%57%53%59&sa=D&sntz=1&usg=AFQjCNGafoCO5zbQmOeDGEEoU0RJM-2O3w
Henrynib
2020-10-06 08:30
Fidati del Bot finanziario per diventare ricco.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%42%69%63%6f%6f%73%50%77%6f%63%62%47%45%6b%45%46%66&sa=D&sntz=1&usg=AFQjCNEK5ufVJ1SAOty_sOgc-uIo5t-kYQ
dfhbsfFap
2020-10-05 07:46
<a href=https://informed.top/>
путин последние новости о выплатах до 16    
</a>
Henrynib
2020-10-05 03:10
Tutti possono guadagnare quanto vuole citare in giudizio questo Bot.
Link - - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%53%56%77%51%64%42%4a%64%4d%4c%46%6b%47%77%72%5a%59&sa=D&sntz=1&usg=AFQjCNE0wKaztReNOODA9pdkcaBs7vX9pg
Henrynib
2020-10-03 17:30
Trust the financial Bot to become rich.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%77%7a%63%5a%55%73%42%41%47%64%5a%44%7a%69%49%7a%4d&sa=D&sntz=1&usg=AFQjCNEOamusMvyb_gpn_5twr7-F5jADPg

发表评论:

Powered by emlog