WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道,昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球,特别是在内网和专网中,通过攻击445端口(蠕虫性质)大肆传播,造成了巨大数据损失。我也凑个热闹,找到一批样本上传金刚分析系统(http://tcasoft.com/),看看效果。

其中比较典型的分为两类,一类就是昨天大家新闻中看到的,访问某个超长的域名,如果存在就放弃攻击。如图:

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏,并不会探测域名。如某样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出,样本执行初期没有任何引人注意的表现,当桌面被替换、前台弹出提示信息时,一切都为时已晚,用户的文件就已经被加密,要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到,样本释放了大量可执行程序以及bat、vbs等恶意脚本,并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后,样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为,包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现,攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件,在加密完成并设置好文件创建时间后,会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢?只需查看分析报告里的“中间文件”就可以看到。如下图所示,攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片,被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外,样本运行过程中还能观测到大量的网络行为,连接地址包括美国、德国、奥地利等多个国家,同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中,引擎并未连接真实互联网,因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍,大家若有兴趣欢迎查看分析报告自行研究。

评论:

Rannevknoca
2019-06-22 15:36
just try is lowest price
ValerieRap
2019-06-22 10:24
http://nybeergames.com/groups/online-slots-87837
http://fundates.club/forums/user/bajustli1979
http://cyberart.info/groups/casino-games-99648
http://www.ecotonia.pt/groups/online-slots-90808
http://gc.pknowledge.eu/forums/Thema/online-casino-87968/
http://www.trivix.com/forums/topic/online-casino-88578/
http://altenergiya.ru/forums/topic/online-casino-real-money-95167
http://comment-contacter.pro/forums/topic/online-casino-games-90701/
https://mundyacademy.com/groups/casino-online/
http://expertiseeducacao.com.br/forums/Topics-1/online-casino-real-money-91646/?lp-reload=yes
http://elderabuse.co/forums/user/zeabdorsging1988
https://jokosystems.com/forums/topic/online-casino-games-92010/
https://perfectdesire.com/forums/topic/online-casino-98816/
http://www.everythingstrange.news/groups/online-casinos-98802
http://deltaibiza.com/groups/online-casinos-91578
http://fanz4life.com/groups/online-casino-real-money-99310
http://triliferacing.com/forums/topic/casino-games-97815/
http://designsandpeople.com/forums/topic/casino-online-90544/
http://stylefinderacademy.com/groups/casino-slots-83307
http://kriptobalkan.net/groups/online-slots-89617
ShawnFup
2019-06-22 04:24
Представляем Вашему вниманию промышленные фрезерные станки с ЧПУ серий CNC-3030, CNC-4040 и CNC-6060. Промышленные фрезерные станки с ЧПУ данной серии предназначены для обработки дерева, пластмасс, органического стекла, акрила, камня, цветных металлов и даже стали. Управление промышленным фрезерным станком осуществляется системой числового программного управления. Промышленные фрезерные станки с ЧПУ по дереву и металлу нашего производства позволяют изготавливать художественные панно для отделки интерьеров и фасадов зданий, логотипы фирм, рекламную продукцию из дерева и металла.

Производимые на нашем заводе промышленные фрезерные станки с ЧПУ по дереву и металлу применяются для небольших высокоточных изделий, ювелирных задач, восковок, печатных плат, 2D и 3D фрезеровки небольших изделий, металлических форм, шильдов, приборных панелей, штампов и электродов, сувениров и многого другого.

Обращайтесь: https://stanki-chpu.ru/cnc-stanok/cnc304060-cena/
Rannevknoca
2019-06-22 02:34
how com is cost so much
Briangroto
2019-06-22 02:17
buy cialis by paypal http://www.silvanusinternational.org/groups/legendairy-neptune-viagra-84581
http://www.startuparewa.org/groups/enteritis-gilday-generic-viagra-trenton/
cheapest viagra
buy viagra online from canada http://ahlosunnahquranacdemy.com/groups/blissful-viagra-online-earthquake-household-95299
https://www.kigilove.com/groups/worldbaby-essentaial-generic-viagra-tewari-linger/
how to order viagra online
female viagra pink pill http://www.alverdensmad.dk/forums/user/critgieword1986
http://myhotrodlife.com/groups/bundled-viagra-cuticles-92355
can you buy cialis over counter mexico
buy viagra soft tabs http://muhltiply.com/groups/masthead-wenner-viagra-congressman-88380
http://mesibba.com/forums/topic/santolina-onsthe-bullying-buy-viagra-williamson-87356/
buy cialis delhi
cheap viagra jelly uk http://arabsdot.net/groups/terapanthi-uncool-generic-viagra-webinar-89003
http://coinfreshtalk.com/groups/loadingpost-poverty-aviation-sildenafil-komentari-98816
viagra super force for sale
viagra sale hyderabad http://112cats.com/groups/prosecutor-anthriscus-generic-viagra-vegetarian-lemony-90611
http://www.akuntansi.club/forums/topic/niacinamide-sildenafil-cheeping-menuhome-87208/
buy viagra priligy
buy cialis in canada http://volusiachurch.com/groups/helena-generic-viagra-threats-97845
http://userforum.azurewebsites.net/groups/drugged-germany-scientifici-generic-viagra-lifespan-84438
buy cialis daily
order viagra generic http://www.topnailartists.com/forums/topic/soreness-sildenafil-moreis-90886/
http://theviroom.com/groups/proportion-sildenafil-lebrew-87599
cheap viagra pills sale
buy viagra dubai http://comment-contacter.pro/forums/topic/sensitizer-generic-viagra-krijgen-invite-cutsee-97336/
http://nishathletics.com/groups/arsonist-campinas-avidin-demetria-viagra-online-90261
buy daily cialis
legal order viagra online http://nishathletics.com/groups/docxpress-hardier-generic-viagra-peptides-95426
http://www.prisonercompanion.com/groups/viagra-online-limited-equivale-87666
order brand viagra online
Rannevknoca
2019-06-21 08:44
buying viagra in macau
MariaCiz
2019-06-21 05:35
http://nybeergames.com/groups/online-casino-gambling-90757
http://sodalimedev.com/forums/forum/post-discussions/
http://muhltiply.com/groups/online-gambling-casino-92364
http://www.gdemhigher.co.uk/groups/3d-adult-games-93875
http://bettersightonline.com/groups/adult-games-80542
http://kampai.org/groups/casino-slots-92297
http://royalclasses.org/groups/online-casino-gambling-81850
http://fanz4life.com/groups/casino-online-93296
http://zfetch.com/groups/sexy-games-86904
http://solarenergy.community/groups/casino-news-80231
http://www.thesocialcapitalinstitute.org/forums/user/relema1982
http://pharaohbank.com/groups/online-gambling-casino-93790
http://www.akuntansi.club/forums/topic/online-casino-83137/
http://treerepo.com/forums/topic/online-slots-87687/
http://myopusdei.com/groups/casino-online-90767
http://indianotion.com/groups/adult-game-97683
http://designsandpeople.com/forums/topic/play-casino-95017/
http://www.prisonercompanion.com/groups/sexy-game-96781
http://gratefulreadyopenwilling.com/forums/topic/adult-games-97623/
http://www.aurapersonality.com/forums/user/hyptafor1985
MariaCiz
2019-06-21 01:47
http://rvitpros.org/groups/online-casino-bonus-92877
http://myboscorp.com/groups/online-casinos-88592
http://agentfactor.net/forums/user/quicricop1981
http://pharaohbank.com/groups/online-casino-bonus-95199
http://yoyofitt.com/groups/casino-news-84271
http://tutoreum.com/groups/real-money-casino-80482
https://www.gradstoteaching.org/forums/topic/casino-games-real-money-98464/
http://www.gdemhigher.co.uk/groups/mysexgames-98103
http://kiksexting.site/groups/online-casinos-80150
http://goconvo.org/groups/adult-flash-games-97730
http://fayven.com/groups/xxx-games-96956
http://www.englishemy.com/groups/casinos-online-92592
http://jonddesign.com/groups/slots-online-87658
http://propertyin28days.net/groups/real-money-casino-98085
http://vivelavida.net/groups/casino-news-92722
http://yoursurveyplus.com/forums/topic/online-casino-82208/
http://petzplanet.com/forums/user/restrocou1988
http://youftme.com/groups/adult-porn-games-91185
http://glensinos.com/groups/casino-games-93218
http://www.boazandruthpalace.org/forums/topic/casino-games-real-money-84391/
Underry
2019-06-20 16:25
<a href="http://paydayonlineexpress.com/#">payday loans<a>
faifimi
2019-06-20 16:22
<a href="http://paydayonlineexpress.com/#">payday loans<a>
Exteft
2019-06-20 13:46
<a href="http://paydayonlineexpress.com/#">payday loans online<a>
Payophy
2019-06-20 12:26
<a href="http://paydayonlineexpress.com/#">payday loans<a>
Refamava
2019-06-20 10:40
<a href="http://paydayonlineexpress.com/#">payday loans<a>
Mymnpymn
2019-06-20 08:51
<a href="http://paydayonlineexpress.com/#">payday loans<a>
prarrisp
2019-06-20 05:56
<a href="http://paydayonlineexpress.com/#">payday loans online<a>

发表评论:

Powered by emlog