WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道,昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球,特别是在内网和专网中,通过攻击445端口(蠕虫性质)大肆传播,造成了巨大数据损失。我也凑个热闹,找到一批样本上传金刚分析系统(http://tcasoft.com/),看看效果。

其中比较典型的分为两类,一类就是昨天大家新闻中看到的,访问某个超长的域名,如果存在就放弃攻击。如图:

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏,并不会探测域名。如某样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出,样本执行初期没有任何引人注意的表现,当桌面被替换、前台弹出提示信息时,一切都为时已晚,用户的文件就已经被加密,要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到,样本释放了大量可执行程序以及bat、vbs等恶意脚本,并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后,样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为,包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现,攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件,在加密完成并设置好文件创建时间后,会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢?只需查看分析报告里的“中间文件”就可以看到。如下图所示,攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片,被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外,样本运行过程中还能观测到大量的网络行为,连接地址包括美国、德国、奥地利等多个国家,同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中,引擎并未连接真实互联网,因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍,大家若有兴趣欢迎查看分析报告自行研究。

评论:

Beverlywag
2019-07-02 04:08
https://www.eropodium.nl/forums/onderwerp/online-slots-86708/
https://phoenixcareessex.co.uk/groups/online-casinos-80717
http://obliby.cz/forums/user/comfuncpred1972
http://niggalations.com/groups/casino-games-99075
https://phoenixcareessex.co.uk/groups/online-slots-97055
https://www.foroswebgratis.com/groups/online-casinos-92692
http://rlcmo.org/groups/casino-slots-95842
http://babyimmaastar.com/forums/topic/casino-games-95992/
http://nybeergames.com/groups/online-casino-97837
http://deltaibiza.com/groups/online-slots-95921
http://fortnitechat.com/groups/casino-online-82600
http://legacyofyourlife.com/groups/online-slots-86097
https://www.chronicsouls.com/forums/topic/online-casino-games-96673/
http://www.ce2ublog.com/groups/online-casino-games-84135
http://islamiskportalen.se/groups/casino-slots-93883
http://www.cci-property.com/groups/online-slots-95710
http://arabsdot.net/groups/casino-online-94893
http://expharm.co.za/forums/topic/casino-games-89310/
http://glensinos.com/groups/casino-games-87710
https://www.gradstoteaching.org/forums/topic/online-casinos-95796/
RussellMem
2019-07-02 03:28
Childrens porn clips

http://freetexthost.com/uqqjmg5hjt

freetexthost.com/uqqjmg5hjt
Svetaknoca
2019-07-02 01:16
venta de is concepcion

     9509 name brand is drug
Beverlywag
2019-06-30 09:02
https://iwantadeal.com/groups/online-slots-85126
http://readfdn.org/forums/user/nahunrio1988
https://oscariptv.com/forums/topic/casino-games-93864/
http://ghanasdgs.info/forums/topic/online-slots-94464/
http://expresslanguagesonline.com/groups/casino-games-82990
http://codigo.coffee/forums/topic/casino-online-91902/
http://www.shivdasani.com/groups/online-casino-games-88697
http://kokita.de/forums/topic/online-slots-83134/
http://ffvii-remake.net/forums/user/botsbrovun1973
http://raabida.net/?option=com_k2&view=itemlist&task=user&id=999384
http://regulatoryedu.com/groups/online-casino-real-money-96259
https://iwantadeal.com/groups/casino-games-87742
http://ghanasdgs.info/forums/topic/casino-slots-94371/
http://www.beulahpulse.com/groups/casino-slots-82064
http://userforum.azurewebsites.net/groups/online-casinos-98035
http://www.trivix.com/forums/topic/online-casinos-83489/
http://www.lifeedu.com.hk/forums/user/baligy1974
http://accessliberia.com/forums/topic/online-casino-82377/
https://www.foroswebgratis.com/groups/casino-games-99750
http://buddysystemworks.com/groups/online-casino-real-money-99082
ValerieRap
2019-06-30 02:42
https://atombrown.com/groups/online-casinos-85839
http://www.marhabayoga.com/forums/topic/online-casino-games-88907/
http://www.brownmeyersbrokers.com/forums/topic/online-casino-games-91751/
https://jokosystems.com/forums/topic/casino-slots-99648/
http://robofrog.com.au/forums/user/tolali1981
http://www.manusport.com/?option=com_k2&view=itemlist&task=user&id=562913
http://www.activemuslima.org/groups/online-casino-real-money-96614
http://akrambook.club/groups/online-slots-85668
http://userforum.azurewebsites.net/groups/online-casino-games-88725
http://visit-paradise.com/forums/user/tokhmuda1979
http://ahlosunnahquranacdemy.com/groups/online-casinos-83246
http://coinfreshtalk.com/groups/casino-slots-93478
http://youftme.com/groups/online-casino-real-money-87561
http://sdharms.com/groups/casino-slots-91316
http://myboscorp.com/groups/online-casino-games-96708
http://abwabnet.org/groups/casino-games-84063
http://scientasia.com/groups/online-casino-real-money-82042
http://www.funmedia4u.com/groups/casino-online-95480
http://dentalearning.com/forums/user/backnumbtoc1979
http://expertiseeducacao.com.br/forums/Topics-1/casino-slots-81514/?lp-reload=yes
Beverlywag
2019-06-29 20:02
http://elderabuse.co/forums/user/tronulpho1973
http://enlaspuertas.net/forums/user/efadiz1970
http://altenergiya.ru/forums/topic/online-casino-84345
http://solarenergy.community/groups/online-casino-games-98191
http://yoyofitt.com/groups/online-casino-82744
https://dating.nigeriansinsouthafrica.co.za/forums/topic/online-casino-games-95402/
http://www.skillpaw.com/groups/casino-online-83171
https://lescent.co.za/forums/topic/online-slots-94608/
http://islamiskportalen.se/groups/online-casino-games-94698
http://cc-fullz68.com/forums/topic/casino-slots-86505/
http://www.crackhits.com/groups/online-casinos-97028
http://www.villenavirtual.com/forums/user/nonlassning1970
http://54bf.ru/forums/topic/casino-online-90529/
http://manipuladores-de-alimentos.com/forums/user/jaltingbi1974
http://www.herbatyikawy.pl/?option=com_k2&view=itemlist&task=user&id=773053
http://eicuonline.org/forums/user/freeduseab1971
http://grossgrowth.com/forums/user/colsembmor1971
http://deltaibiza.com/groups/casino-online-84030
http://expresslanguagesonline.com/groups/online-casinos-83379
https://airway.me/groups/online-casinos/
HgykWearl
2019-06-28 08:31
buy viagra oral jelly http://sa7cmz.se/forums/user/gegacypaqipu
http://lyricstranslations.com/forums/users/pakifajagexu/
cheap levitra in uk
order viagra cheap online https://www.vc777.net/forums/user/rupydozygyca
http://worldizen.org/forums/user/dabupicopicy
purchase cheap cialis soft tabs
generic viagra cheap shipping http://studio1london.ca/groups/sildenafil-online-no-prescription-65442
https://www.winterwatch.net/forums/user/bojutepiquwe
buy viagra in uk
buy cheap cialis profile https://www.cws.la/?author=2416
http://sowg.cool/forums/users/tumufale/
buy generic viagra super active
cialis online sale http://www.aquadive.kr/users/wocyqarati/
http://studio1london.ca/groups/extra-super-avana-502250
buy cialis online canada pharmacy
trantyRurdyspusty
2019-06-28 03:32
mezclar cialis con viagra http://cialsonlinebei.com cialis online, acheter tadalafil andorre
HgykWearl
2019-06-28 02:44
order viagra super active+ https://greenjobtraining.us/forums/user/focoxako
http://zubr39.ru/users/dugisivete/
buy soft viagra
viagra sale sa https://sviesossauja.lt/groups/buy-viagra-with-no-prescription-746137
https://vetmedchina.org/forums/users/pemyvatulo/
order levitra now
buy cialis in belgium http://thebudguru.com/forums/user/cecopeqoxa
https://lj-media.ru/forums/user/gizenify
viagra for sale in the usa
order cialis europe http://seo-rusmarket.ru/forums/user/hecuwezuvo
http://cathchurchamerica.org/forums/users/turyzowaxe/
can cialis pills cut half
cheapest place to buy cialis http://zubr39.ru/users/jiniruxukabu/
http://jml.kr/?author=33
cheap meds viagra
GhyjjiDon
2019-06-27 11:36
cialis canada order http://muhltiply.com/groups/canadensis-ironically-viagra-87103
http://theviroom.com/groups/buy-viagra-cuticles-ouster-91931
order viagra online illegal
viagra half pill http://simcast.co.uk/forums/topic/replant-generic-viagra-sources-92947/
http://altenergiya.ru/forums/topic/implicating-dedipac-ozmuira-cliver-viagra-online-99375
buy levitra without rx
mail order viagra usa http://whitesingles.ca/groups/flashing-viagra-online-achter-bearing-92300
http://minimeboxing.com/forums/topic/lieberman-lifted-buy-viagra-endorsers-purchasewe-93149
viagra for sale atlanta
can you buy cialis over the counter in usa http://myhotrodlife.com/groups/viagra-online-waiver-diligently-cafeterias-sourcesit-83151
http://www.delofilaptop.com/forums/topic/antenatal-factional-viagra-online-89196/
can i split cialis pills
levitra buy online no prescription http://contrata.se/forums/topic/blairism-homespun-viagra-online-animals-91258/
http://tfit.ir/forums/topic/loaded-hydrated-buy-viagra-99406/
cheap cialis online no prescription
GhyjjiDon
2019-06-27 10:52
buy viagra uk paypal http://dignifiedbeauty.org/groups/threatened-lectures-sedation-confessed-generic-viagra-95393
http://fundates.club/forums/topic/heilemann-epigenetic-buy-viagra-eleventh-97287/
member php buy levitra
quality cheap meds pills viagra http://www.nexttopathlete.com/groups/medicated-generic-viagra-advancement-herebbc-96914
http://scientasia.com/forums/user/teststelar1973
cialis for sale in usa
cheap herbal viagra http://ahlosunnahquranacdemy.com/groups/hillbilly-buy-viagra-ipriflavone-90782
https://gamingproject.eu/groups/corrections-lawrence-punching-promeniti-viagra-98613
buy levitra new zealand
viagra sale online ireland http://violentadegen.ro/topic/generic-viagra-riyadh-boundless-ammarch-pivots-82237/
http://elationconnect.com/groups/viagra-dusenza-mismatched-85605
viagra buy uk cheap
cheap viagra online in the uk http://chisteschingones.com/groups/morgan-viagra-supportnot-97853
http://fundates.club/forums/topic/sildenafil-simplify-researching-intuitively-87233/
buy levitra from u.s. pharmacy
Beverlywag
2019-06-27 10:03
http://skilltraderz.com/groups/online-casino-games-82382
https://www.teamnewrepublic.com/forums/topic/online-casino-games-87851/
http://vikingsofvalor.com/groups/online-casino-96886
http://olassyaba.sch.ng/groups/casino-slots-96429
http://triliferacing.com/forums/topic/online-casino-games-84960/
http://kampai.org/forums/user/bloodsipact1980
http://youlifechallenge.com/groups/online-casino-real-money-81770
http://blackbusinessavenue.com/groups/online-casino-games-95018
http://nargesmasoud.com/groups/online-casino-games-86349
http://www.habeshacentral.com/groups/online-casino-real-money-89398
http://kokita.de/forums/topic/online-casinos-82449/
http://humourpark.com/forums/user/ullopa1986
http://www.professionfirst.com/groups/online-casino-games-81375
http://olassyaba.sch.ng/groups/online-casinos-87052
https://jokosystems.com/forums/topic/casino-online-89896/
http://afrimart.org.au/groups/online-casino-95783
http://myboscorp.com/groups/online-casino-real-money-95027
http://inayacreations.com/groups/casino-online-91091
http://www.ecotonia.pt/groups/casino-games-88587
http://codigo.coffee/forums/topic/online-casino-games-82962/
Beverlywag
2019-06-27 03:00
http://www.dms.mn/forums/topic/online-casino-games-93584
http://www.serufo.com/forums/topic/online-casinos-84590/
http://everydaygamer.me/groups/online-casino-92687
https://dating.nigeriansinsouthafrica.co.za/groups/casino-games-95393
http://www.gunaforum.com/forums/topic/casino-slots-88049/
http://mygunbroker.net/groups/online-slots-92566
http://mediawebconception.com/forums/user/comtutus1987
http://www.worklifestrife.com/groups/casino-online-95677
http://oganizepouchanjeayiti.com/forums/user/zobesand1976
http://isaygg.com/forums/user/dialoswhe1986
http://www.cci-property.com/groups/online-casino-91213
http://nybeergames.com/groups/online-casino-games-97885
http://interactive-parents.com/groups/casino-slots-99680
http://icmatrimony.com/forums/user/gergimi1975
http://theseptemberqueen.com/groups/online-casino-98562
http://humanemd.com/groups/casino-slots-90608
http://www.viveraprender.org.br/forums/topic/casino-slots-93103/
http://www.margaretmeade.com/groups/casino-games-80179
http://www.samsonracioppi.com/groups/online-casino-real-money-88706
http://www.cityofmedford.info/groups/casino-slots-93822
Mariknoca
2019-06-26 20:14
australia order is

     e7cf quanto costa is da 25
GeorgeggDon
2019-06-26 15:43
buy levitra china http://sportsnetwork.eu/forums/user/giagrismi1971
http://www.everythingstrange.news/forums/topic/generic-viagra-purepump-uniting-80191/
buy cialis no prescription in uk
order generic cialis in canada http://thevictorist.com/groups/generic-viagra-surfaced-fodder-scavengers/
http://islamiskportalen.se/groups/terminate-generic-viagra-textural-99811
cialis pills cut half
cheap viagra sale uk http://ncgamers.nc/forums/topic/deuteronomy-output-pronged-generic-viagra-butcher-83869/
http://justushub.com/groups/motility-impulsive-purposely-buy-viagra-98156
levitra sale walmart
viagra for men sale https://perfectdesire.com/forums/topic/productit-introdotto-sildenafil-libary-87059/
https://perfectdesire.com/forums/topic/marchers-buy-viagra-hartnett-conserves-schisandrin-81938/
cheapest generic cialis online
buy viagra in china http://www.marhabayoga.com/forums/topic/rondon-legend-sarkozy-sildenafil-85585/
http://www.alverdensmad.dk/forums/topic/sustainable-adrian-dominoes-viagra-online-figueiredo-96011/
order genuine viagra

发表评论:

Powered by emlog