WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道,昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球,特别是在内网和专网中,通过攻击445端口(蠕虫性质)大肆传播,造成了巨大数据损失。我也凑个热闹,找到一批样本上传金刚分析系统(http://tcasoft.com/),看看效果。

其中比较典型的分为两类,一类就是昨天大家新闻中看到的,访问某个超长的域名,如果存在就放弃攻击。如图:

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏,并不会探测域名。如某样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出,样本执行初期没有任何引人注意的表现,当桌面被替换、前台弹出提示信息时,一切都为时已晚,用户的文件就已经被加密,要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到,样本释放了大量可执行程序以及bat、vbs等恶意脚本,并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后,样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为,包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现,攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件,在加密完成并设置好文件创建时间后,会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢?只需查看分析报告里的“中间文件”就可以看到。如下图所示,攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片,被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外,样本运行过程中还能观测到大量的网络行为,连接地址包括美国、德国、奥地利等多个国家,同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中,引擎并未连接真实互联网,因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍,大家若有兴趣欢迎查看分析报告自行研究。

评论:

Kyeonknoca
2020-08-15 12:30
business plan writing services south africa

aa64 payday loans pinole ca

aa64 is in hyderabad price

aa64 is fermo posta

aa64
Gliemknoca
2020-08-15 01:46
is prescriptions canada

6ff1 only now cheap is 100mg

6ff1 is and order online

6ff1
Zixuanknoca
2020-08-09 01:53
238931 peak time of cialis 20mg



http://cialisuqwc.com/
Hargunknoca
2020-08-06 11:02
get is avoid prescription

f10a is achat en belgiqu

f10a watermelon better than is

f10a
Reickknoca
2020-08-06 10:28
is nrnberg

d937 only best offers is 5 mg

d937
Lolly
2020-08-06 03:27
Yes!  Interested!  Also I'm loving the first dress, hope it is the winner!  Seems like the second is a lot like one you've made before, just different di#3nsions&m82e0;
Skip
2020-08-06 03:27
This is so lovely! Thanks also for sharing the music link!My weekly Say G’day Saturday Linky Party is on now and I would be so thrilled if you could join in and link up this great post! I also host a Sunday Song link up on Sundays so maybe you could pop by and check it out!Best wishes for a fabulous weadenk!Netasha in Oz
Zalvinjew
2020-08-04 22:35
viagra coupon free trial search titles
  viagra tadalafil cheapest
<a href="https://nwlionstore.com">viagra without a doctor prescription canada
</a> - viagra super active 20mg pills
https://nwlionstore.com - viagra no prescription
buy silagra viagra
Joelysknoca
2020-08-01 17:35
a75621 viagra hur lnge stnd

http://viagraaqwe.com/ - viagra

street viagra 100mg

http://viagrabytwfa.com/ - online viagra

female viagra echeck

http://viagraeuw.com/ - generic viagra

best viagra in bangalore

https://viagrahere20.com/ - buy viagra
Widowaknoca
2020-08-01 12:44
be is jelly online uk

f8f0
moldy_zaria
2020-07-31 04:34
Read Ava Addams new post https://weshansfordschool.com/dbla/primary/wes/CookiePolicy.action?backto=https://avaaddams.fun/ava-addams-official-facebook-channel-my-nails-match-batman-freshmani/ - Here
Read Elsa Jean new post http://www.silvercrestmetals.com/outurl.php?url=https://elsajean.fun/elsa-jean-reddit-channel-delicious-holes/ - Here
Read Lena Paul new post https://boyscoutsamerica.asureforce.net/redirect.aspx?redirecturl=https://lenapaul.fun/lena-paul-facebook-channel-%f0%9f%98%ba/ - Here
Read Romi Rain new post http://maps.google.mk/url?q=https://romirain.fun/romi-rain-adult-video-in-the-mood-for-romi-rain/ - Here
Read Nicolette Shea new post http://snoekpie.com/gallery/main.php?g2_return=https://nicoletteshea.fun/nicolette-shea-official-instagram-channel-dust-em-off%f0%9f%92%8b-llnkinblo/&g2_returnName=album%2Ftrends%2Faloha-indian-porn%2F1%2F&g2_subView=core.UserLogin&g2_view=core.UserAdmin - Here
Read Lena Paul new post http://images.google.com.do/url?q=https://lenapaul.fun/lena-paul-official-reddit-channel-hot/ - Here
Read Gianna Michaels new post https://www.google.es/url?cad=rja&cd=1&esrc=s&q=factor+quema+grasa&rct=j&sa=t&source=web&url=https://giannamichaels.fun/gianna-michaels-facebook-channel-hola-a-todos-ciao-a-tutti/&ved=0ahUKEwjbt9zAlKbPAhUHJR4KHW1LD9IQFggnMAE - Here
Read Hitomi Tanaka new post http://space.sosot.net/link.php?url=https://hitomitanaka.fun/hitomi-tanaka-official-instagram-channel-%e7%b4%844%e3%83%b6%e6%9c%88%e3%81%b6%e3%82%8a%e3%81%ae%e7%be%8e%e5%ae%b9%e5%ae%a4%f0%9f%a5%ba%e3%82%84%e3%81%a3%e3%81%a8%e3%81%93%e3%82%8c%e3%81%a6/ - Here
Radijknoca
2020-07-30 14:20
is 50mg vs levitra 20mg

bd65 prix is tunis

bd65
Ingaknoca
2020-07-30 11:11
is fr frauen

b4ba comprar is bueno

b4ba cheapest 5 mg is

b4ba
spars_rebecca
2020-07-29 17:50
Read Nikita Bellucci new post http://forumok.com/redirect.php?url=https://nikitabellucci.fun/nikita-bellucci-adult-video-magma-film-francais-anal-nikita-bellucci/ - Here
Read Abella Danger new post http://mcclureandsons.com/Projects/FishHatcheries/Baker_Lake_Spawning_Beach_Hatchery.aspx?Returnurl=https://abelladanger.fun/abella-danger-adult-video-big-ass-abella-danger-takes-bbc-anal-big-ass-abella-danger-takes-bbc-anal/ - Here
Read Ava Addams new post http://www.google.com.ng/url?q=https://avaaddams.fun/ava-addams-official-facebook-channel-avaaaddamss-on-set-for-digital-playground-today/ - Here
Read Anissa Kate new post http://www.google.com.bo/url?q=https://anissakate.fun/anissa-kate-adult-video-bombe-aux-cheveux-noir-anissa-kate-avec-des-seins-enormes-sur-primecups/ - Here
Read Sasha Grey new post http://sc.devb.gov.hk/TuniS/https://sashagrey.fun/sasha-grey-official-youtube-channel-sashas-april-top-clips//bd/nepali-12sal-ki-ladki-ki-chudai-xxx-video.html - Here
Read Apolonia Lapiedra new post http://www.google.co.in/url?q=https://apolonialapiedra.fun/apolonia-lapiedra-official-twitter-channel-se-que-echabais-mucho-de-menos-que-compartiesemos-alguna-escena-de-apoloniaporn-os-dejo-un-trocito-de-una-escena-para-metartnetwork-publicada-en/ - Here
Read Eva Lovia new post http://images.google.se/url?q=https://evalovia.fun/eva-lovia-adult-video-sexy-eva-lovia-fingering-herself-outdoor/ - Here
Read Leah Gotti new post http://sc.hkeaa.edu.hk/TuniS/www.https://leahgotti.fun/leah-gotti-official-instagram-channel-in-shade-of-nature%f0%9f%8c%b4// - Here
bette_corey
2020-07-28 12:15
Read Romi Rain new post http://www.strongmaturetube.com/cgi-bin/crtr/out.cgi?id=308&l=topmain&u=https://romirain.fun/romi-rain-official-youtube-channel-a-mouthful-from-contract-girl-to-boss-ft-stoya/ - Here
Read Lela Star new post https://maps.google.lv/url?q=https://lelastar.fun/lela-star-official-instagram-channel-my-life-has-been-such-an-adventure-throw-back-to-last-summer-in-greece/ - Here
Read Claire Castel new post http://tandem-impex.derevo.ua/redirect?goto=https://clairecastel.fun/claire-castel-official-twitter-channel-jadoreeeeee-%f0%9f%98%8a/ - Here
Read Eva Lovia new post https://maps.google.ro/url?q=https://evalovia.fun/eva-lovia-reddit-channel-that-looks-tasty/ - Here
Read Riley Reid new post http://sftrack.searchforce.net/SFConversionTracking/redir?jadid=12956858527&jaid=33186&jk=trading&jmt=1_p_&jr=https://rileyreid.fun/riley-reid-adult-video-blasting-riley-reid-with-cum/&js=1&jsid=24742&jt=3 - Here
Read Nikki Benz new post http://maps.google.co.nz/url?q=https://nikkibenz.fun/nikki-benz-official-twitter-channel-my-new-hobbie-blocking-ppl-on-social-media/ - Here
Read Alexis Texas new post https://www.sozmart.com/tc/click.php?id=17207&url=https://alexistexas.fun/alexis-texas-official-instagram-channel-happy-saturday-teamtexass-%f0%9f%98%bb/ - Here
Read Leah Gotti new post http://www.onlyams.com/te3/out.php?l=post&purl=https://leahgotti.fun/leah-gotti-facebook-channel-whoooorrrrreeeeeeeee%e2%9b%b3%ef%b8%8f-instagram-com-teamgotti/ - Here

发表评论:

Powered by emlog