WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道，昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球，特别是在内网和专网中，通过攻击445端口（蠕虫性质）大肆传播，造成了巨大数据损失。我也凑个热闹，找到一批样本上传金刚分析系统（http://tcasoft.com/），看看效果。

其中比较典型的分为两类，一类就是昨天大家新闻中看到的，访问某个超长的域名，如果存在就放弃攻击。如图：

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏，并不会探测域名。如某样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出，样本执行初期没有任何引人注意的表现，当桌面被替换、前台弹出提示信息时，一切都为时已晚，用户的文件就已经被加密，要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到，样本释放了大量可执行程序以及bat、vbs等恶意脚本，并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后，样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为，包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现，攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件，在加密完成并设置好文件创建时间后，会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢？只需查看分析报告里的“中间文件”就可以看到。如下图所示，攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片，被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外，样本运行过程中还能观测到大量的网络行为，连接地址包括美国、德国、奥地利等多个国家，同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中，引擎并未连接真实互联网，因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍，大家若有兴趣欢迎查看分析报告自行研究。

[分析引擎开发笔记]64位系统支持»

评论：

MichaelSeala
2019-06-25 17:35
MOST SUCCESSFULLY CHILDREN'S PORN
http://freetexthost.com/x3l6rzn11m
freetexthost.com/x3l6rzn11m
回复
Frankbat
2019-06-25 11:56
http://03.vyborg.ru/about/forum/?PAGE_NAME=profile_view&UID=12258
http://vmkg.ru/about/forum/user/70734/
https://stal-evro-beton.io.ua
http://www.rostransport.com/forum/?PAGE_NAME=profile_view&UID=34832
http://optdetal.ru/forum/user/10578/
回复
Rannevknoca
2019-06-25 10:27
online at is sales
回复
Rannevknoca
2019-06-25 08:35
generisches online viagra
回复
Rannevknoca
2019-06-25 06:41
viagra svizzera prezzo
回复
Rannevknoca
2019-06-25 01:06
we use it original is
回复
RichardHoila
2019-06-24 11:02
herbal viagra sale uk http://fetish-finder.net/groups/inspector-buy-viagra-postponed-midwife-97350
https://www.radiuzz.com/forums/topic/republished-flavescens-singer-headache-viagra-88286/
cialis 20mg pills sale
cheap viagra buy uk http://contrata.se/forums/topic/aubrey-baghdad-viagra-ruhter-92566/
http://bristolguitar.com/groups/monument-longer-hearby-sildenafil-82558
buy viagra by paypal
how to buy cialis in canada https://collegemommies101.com/groups/polyether-marketed-generic-viagra-cheating/
http://volusiachurch.com/groups/sildenafil-applywhat-shutdown-99612
buy cialis generic
buy cialis safely http://coinfreshtalk.com/groups/generic-viagra-millers-mcneely-95220
http://com.brainwire-ng.com/groups/crafted-effetti-caffiene-kasich-generic-viagra-93828
buy viagra egypt
viagra for men sale http://petzplanet.com/groups/hateful-morning-tanzania-viagra-refunded-95358
http://propertyin28days.net/groups/benedict-viagra-online-focussed-97208
levitra sale online
buy cialis amazon https://perfectdesire.com/forums/topic/viagra-online-surgery-racial-97761/
http://www.lou-sifflaire.com/forums/topic/sildenafil-prolonged-recipients-80297/
cialis dapoxetine buy
buy cheap cialis line http://classiccarmarket.co.za/forums/topic/licenced-parsnips-literal-buy-viagra-millets-89587/
http://www.akuntansi.club/forums/topic/hookworm-sesame-viagra-online-mattis-99580/
cheap cialis usa
can you buy cialis over counter mexico https://www.eropodium.nl/forums/onderwerp/asperger-versatile-tomalty-ragland-viagra-97139/
http://deltaibiza.com/groups/progress-gallup-viagra-online-reconnects-tolerant-86821
viagra online cheap
good place buy cialis https://perfectdesire.com/forums/topic/aprint-protect-buy-viagra-grunting-97234/
http://zfetch.com/groups/generic-viagra-baritone-concepts-purityall-parathas-93773
order cialis canada
cialis viagra sale canada http://www.margaretmeade.com/groups/viagra-online-homogenized-floating-manuscripts-aboriginal-80107
http://www.spiritualtrade.com/groups/attraction-prospects-soluble-missteps-viagra-online-94178
viagra sale auckland
回复
Beverlywag
2019-06-24 06:14
http://betterpreparedtogether.org/groups/casino-online-81111
http://www.priyankasewhagjoshi.com/groups/casino-online-81840
http://stylefinderacademy.com/groups/online-casino-86893
http://muhltiply.com/groups/online-slots-81538
http://everydaygamer.me/groups/online-casinos-93358
http://ahlosunnahquranacdemy.com/forums/topic/casino-online-80367/
http://www.englishemy.com/groups/casino-slots-85810
http://stylefinderacademy.com/groups/casino-slots-99108
http://www.worklifestrife.com/groups/online-casino-games-99231
http://ichl.club/groups/online-casino-real-money-93565
http://www.funmedia4u.com/groups/casino-games-99219
http://ahlosunnahquranacdemy.com/groups/casino-slots-81582
http://xminutegameplay.com/groups/casino-online-84111
https://www.gradstoteaching.org/forums/topic/casino-slots-83872/
http://scientasia.com/groups/online-casino-real-money-99613
http://sportsnetwork.eu/forums/user/icnanca1981
http://www.biesadi.com/forums/topic/casino-online-84523/
https://www.chronicsouls.com/groups/online-casinos-90074
http://www.artnirvana.gallery/forums/topic/online-casino-87562/
http://altenergiya.ru/forums/topic/online-casino-games-85932
回复
Rannevknoca
2019-06-23 21:33
click here viagra one a day
回复
Beverlywag
2019-06-23 18:12
https://adciosa.org/forums/topic/casino-online-94389/
http://www.marhabayoga.com/forums/topic/online-casino-games-81856/
http://jyuku.kz/groups/online-slots-96399
http://nishathletics.com/groups/online-casino-games-86851
http://okkigo.com/groups/online-casino-89776
https://www.eropodium.nl/forums/onderwerp/casino-games-94376/
http://labinfo.org/groups/online-slots-85519
http://victor-wp-test.com/forums/user/keicormann1974
http://www.brownmeyersbrokers.com/forums/topic/online-casinos-87078/
http://www.priyankasewhagjoshi.com/groups/online-casinos-90180
http://scientasia.com/groups/online-casino-real-money-88244
https://www.gradstoteaching.org/forums/topic/online-slots-85643/
https://adciosa.org/forums/topic/online-casinos-97608/
http://literacyanywhere.com/groups/online-casino-games-89106
http://goconvo.org/groups/casino-online-90058
http://www.everythingstrange.news/forums/topic/casino-slots-88982/
http://coworkingrugby.co.uk/groups/online-slots-86941
https://oscariptv.com/forums/topic/online-casino-90824/
http://leadthevoice.com/groups/online-casino-games-91198
http://mybucketwishes.com/groups/casino-online-97187
回复
CharlesMib
2019-06-23 14:09
buy viagra greece http://altenergiya.ru/forums/topic/sildenafil-contenders-sandto-99681
http://volusiachurch.com/groups/sandwich-hakeem-byproducts-viagra-93496
buy levitra online prescription
viagra buy chennai http://fetish-finder.net/groups/farrokhyar-abounds-corriher-occurs-sildenafil-96483
http://myboscorp.com/groups/buy-viagra-preclude-anatomical-petulant-ribbon-87962
viagra buy in canada
buy viagra greece http://myhotrodlife.com/groups/nuneaton-concealer-viagra-lagoon-91588
http://bettersightonline.com/groups/viagra-online-papyrus-sinica-smoking-scenes-87354
cialis tablete srbija
buy cheap cialis in australia http://www.ccmining.org/groups/acceptable-finance-buy-viagra-whoops-vanuatu-91693
https://oscariptv.com/forums/topic/panchakarma-sildenafil-bribed-82352/
cheap cialis uk
buy viagra montreal http://accessliberia.com/forums/topic/sildenafil-applicants-ascophyllum-scrutinized-92602/
http://www.puppydates.co.uk/forums/topic/viagra-presses-earthaven-95687/
buy viagra uk tesco
cialis women sale http://violentadegen.ro/topic/analog-generic-viagra-racestate-93246/
http://nishathletics.com/groups/boneheart-fredrik-generic-viagra-96602
cheap viagra 50 mg
buy cialis no prescription uk http://obliby.cz/groups/probation-sildenafil-nicotine-94156
http://tfit.ir/forums/topic/milwaukee-veracity-viagra-online-underarms-greenland-91130/
viagra cheap paypal
mail order levitra http://www.lou-sifflaire.com/forums/topic/buy-viagra-roberta-hailemariam-churchill-forskohlii-92963/
http://elsonwong.com/imforums/topic/amseptember-understory-bundles-buy-viagra-85315/
cheap generic viagra australia
cheap-generic-viagra.com http://myhotrodlife.com/groups/sildenafil-areata-sourcing-97027
http://jyuku.kz/groups/viagra-medical-proposes-suggestions-99082
cialis cheap usa
where can i buy viagra in london http://triliferacing.com/forums/topic/buy-viagra-nasties-pronounced-brilliance-counts-94847/
http://jyuku.kz/groups/imbalances-buy-viagra-broker-updated-alternates-95923
generic cialis for sale in the u.k
回复
Beverlywag
2019-06-23 07:13
http://www.everydayinspiring.com/groups/online-slots-94901
http://yoursurveyplus.com/forums/topic/online-casino-real-money-90744/
http://minimeboxing.com/forums/topic/casino-games-99662
http://www.spiritualtrade.com/groups/online-casino-81864
http://fortnitechat.com/groups/casino-online-95140
http://www.salaser.org/groups/casino-games-91988
http://scientasia.com/groups/online-slots-91474
http://www.cityofmedford.info/groups/online-casinos-89033
http://www.everythingstrange.news/groups/casino-slots-95082
http://nargesmasoud.com/groups/casino-slots-96898
http://dealshappenhere.com/groups/online-casino-98444
http://e-learnforma.com/forums/user/stocerscar1983
http://islamiskportalen.se/groups/online-casino-83173
http://olassyaba.sch.ng/groups/online-casino-real-money-82401
https://www.gradstoteaching.org/forums/topic/online-casino-85467/
http://theviroom.com/groups/online-casino-games-86403
http://kampai.org/groups/online-casino-88081
http://interpretation-of-oral-radiology.ir/groups/online-casino-games-82181
http://www.allaboutmoms.net/forums/topic/casino-games-97290/
http://papones.es/forums/user/tichiso1983
回复
Beverlywag
2019-06-23 01:01
http://dellomorealtors.com/forums/user/myrtthermra1989
http://hfcircle.com/groups/online-casino-real-money-84609
http://ahlosunnahquranacdemy.com/groups/online-casino-games-80325
http://completediet.com/groups/online-casino-games-94464
http://coinfreshtalk.com/groups/online-casino-games-97646
http://mybucketwishes.com/groups/online-casino-games-94408
http://afrimart.org.au/groups/online-casinos-86835
http://web420.com/groups/casino-online-85286
http://indianotion.com/forums/user/ervepe1984
https://oscariptv.com/forums/user/reucalbi1989
http://goconvo.org/forums/user/imanga1976
http://creatingmykaleidoscope.com/forums/topic/casino-games-92097/
http://www.everydayinspiring.com/groups/casino-games-88718
http://primeupintl.com/forums/topic/online-casinos-99516/
http://expresslanguagesonline.com/groups/online-casino-real-money-94088
http://dignifiedbeauty.org/groups/online-casino-real-money-81643
http://kingudamu.net/forums/user/letficen1986
http://yoyofitt.com/groups/casino-games-94098
http://www.ccmining.org/groups/online-casinos-82891
http://deliberatecreativeteams.com/groups/casino-games-85881
回复
Rannevknoca
2019-06-22 23:01
iscom prices
回复
ValerieRap
2019-06-22 16:45
https://perfectdesire.com/forums/topic/casino-games-83613/
http://sniffers.co/forums/user/fahnechev1970
http://warriorsphere.com/groups/online-casinos-88872
http://icmatrimony.com/forums/topic/online-casino-games-90526/
http://kampai.org/groups/online-casinos-87332
http://www.surg.tech/groups/casino-slots/
http://haitianmobile.com/forums/topic/online-casino-real-money-96987/
https://oscariptv.com/forums/topic/online-casino-99240/
http://studio1london.ca/groups/casino-games-91600
http://smartsthetics.com/forums/user/derstranenar1988/
https://gamingproject.eu/groups/casino-online-97180
http://altenergiya.ru/forums/topic/casino-games-98326
https://vitalprojex.com/forums/user/saddrassynch1988
http://yoursurveyplus.com/forums/user/predconte1973
http://prod.club/forums/user/contbudhpi1983
https://adciosa.org/forums/topic/casino-slots-92929/
http://yoursurveyplus.com/forums/topic/online-casino-80757/
http://www.beulahpulse.com/groups/online-casino-89916
http://tfit.ir/forums/user/skyritef1979
http://solarenergy.community/groups/casino-online-80125
回复

发表评论：

Powered by emlog