WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道,昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球,特别是在内网和专网中,通过攻击445端口(蠕虫性质)大肆传播,造成了巨大数据损失。我也凑个热闹,找到一批样本上传金刚分析系统(http://tcasoft.com/),看看效果。

其中比较典型的分为两类,一类就是昨天大家新闻中看到的,访问某个超长的域名,如果存在就放弃攻击。如图:

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏,并不会探测域名。如某样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出,样本执行初期没有任何引人注意的表现,当桌面被替换、前台弹出提示信息时,一切都为时已晚,用户的文件就已经被加密,要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到,样本释放了大量可执行程序以及bat、vbs等恶意脚本,并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后,样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为,包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现,攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件,在加密完成并设置好文件创建时间后,会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢?只需查看分析报告里的“中间文件”就可以看到。如下图所示,攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片,被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外,样本运行过程中还能观测到大量的网络行为,连接地址包括美国、德国、奥地利等多个国家,同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中,引擎并未连接真实互联网,因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍,大家若有兴趣欢迎查看分析报告自行研究。

评论:

Rebeccapneuh
2019-06-19 21:01
http://gg.gg/kenia/ - http://skype.miss-bdsm.mcdir.ru/img/aaa.jpg
My hot cunt wants dick!
http://gg.gg/kenia/ - http://skype.miss-bdsm.mcdir.ru/img/21.jpg
Looking for a boyfriend!!!
Register and write me my nickname Xenia21
link to my free webcam
http://gg.gg/kenia/
Ladonnajoils
2019-06-18 10:32
http://www.gdemhigher.co.uk/groups/play-casino-online-91138
http://findabiker.com/groups/online-casino-gambling-80951
http://deltaibiza.com/groups/casino-games-96567
http://biztektoolbox.com/groups/adult-flash-games-88275
http://fayven.com/groups/slots-casino-games-97482
http://minimeboxing.com/forums/topic/online-gambling-casino-80184
http://www.akuntansi.club/forums/topic/online-casinos-84672/
http://beardedsquadron.com/groups/casino-news-90093
http://uop.sk/forums/topic/online-casino-92350/
http://nightryders.com/groups/sexgames-85009
http://bikersluv2.com/forums/topic/online-casinos-86357/
http://skilltraderz.com/groups/mysexgames-95109
https://www.eropodium.nl/forums/onderwerp/mysexgames-87504/
http://www.amecorn.com/groups/hentai-sex-games-86600
http://circleoasis.org/forums/topic/adultgames-80393
http://propertyin28days.net/groups/online-slots-88241
http://www.marhabapilates.com/forums/topic/casino-slots-86541/
http://evolvenevolve.com/groups/casino-bonus-86920
http://henkgeesink.com/groups/games-for-adults-94069
http://bordentech.com/groups/porn-game-85582
Rannevknoca
2019-06-18 04:43
billige viagra online apotheke
Miloslavaknoca
2019-06-17 19:04
is blue sale online india

     c61d is 10 mg mejor precio
Galyaknoca
2019-06-17 08:23
069c viagra quebec canada

  
    

viagra suomi
Galyaknoca
2019-06-17 07:50
069c how to use viagra capsule

  
    

anybody tried generic viagra
Rannevknoca
2019-06-17 06:30
viagra billig keine vorschrift
Galyaknoca
2019-06-17 02:38
069c cheap viagra online walmart

  
    

use of viagra
Galyaknoca
2019-06-17 00:49
069c counterfeit viagra australia

  
    

viagra femme prix
Rannevknoca
2019-06-16 17:30
google online viagra sales
Galyaknoca
2019-06-16 15:21
069c viagra suomi

  
    

counterfeit viagra australia
Ladonnajoils
2019-06-15 21:21
http://www.prisonercompanion.com/groups/best-adult-games-90600
http://abwabnet.org/groups/gambling-online-99008
http://www.marhabapilates.com/forums/topic/adult-flash-games-87867-2/
http://cc-fullz68.com/forums/topic/adultgames-88520/
https://malawiusfriends.com/groups/play-casino-online-86467
http://iafob.in/groups/online-slots-80741
http://www.hackz24.com/forums/topic/bonus-casino-89151/
http://creatingmykaleidoscope.com/forums/topic/sex-games-online-82066/
http://acencanal.org/forums/topic/casinos-online-87657/
https://www.foroswebgratis.com/groups/online-casino-84475
http://elsonwong.com/imforums/topic/play-casino-91450/
http://tfit.ir/forums/topic/casino-online-98789/
http://epictake.net/forums/user/exlonma1986
http://nopapertown.com/forums/user/astemar1972
http://teamwell.com.au/groups/online-gambling-casino-83974
http://fayven.com/groups/adult-games-87525
http://teamwell.com.au/groups/play-casino-online-96126
http://www.suprememandarinschool.com/groups/casino-online-95544
http://violentadegen.ro/topic/casinos-online-92084/
http://myhotrodlife.com/groups/online-casino-gambling-92814
Dennisbup
2019-06-14 13:28
Норвежский Ламинин  http://tkfl777.com дешевле Laminine LPGN в 4 раза. Единственный в мире комплект ВСЕХ протеиногенных аминокислот Животного ( зародышевого ) происхождения  для восстановления всего организма это Aminoboosters
KopylovAprel95knoca
2019-06-13 23:23
is at viagr

     efa3 is levitra barato
Ladonnajoils
2019-06-11 17:23
http://helpsindhi.org/groups/online-casino-87606
http://cc-fullz68.com/forums/topic/online-sex-games-93834/
http://xminutegameplay.com/groups/play-casino-online-83925
http://thefoundationsofhappiness.com/groups/adult-sex-games-87835
http://sweacarolina.com/groups/adult-sex-games-92743
http://www.socialshares.net/groups/best-sex-games-91568
http://infinitylearning.org.uk/forums/user/giticving1976
http://adviserpal.com/groups/online-casinos-92408
http://talksforever.com/groups/online-gambling-89765
http://www.schoolpigeon.uk/forums/topic/online-gambling-casino-85820/
https://adciosa.org/forums/topic/real-money-casino-93894/
http://icchoir.net/forums/topic/play-casino-88234/
http://fantasyanddesires.com/forums/topic/play-casino-online-85133/
http://mftpracticeexam.com/groups/online-gambling-casino-89176
http://www.nexttopathlete.com/groups/adult-flash-games-88123
http://infexxxiousgaming.com/groups/best-online-casino-94434
http://userforum.azurewebsites.net/groups/play-casino-online-96902
http://rastafari.org/groups/hentai-sex-games-84364
http://mumradar.info/groups/porn-game-93231
http://www.naoms.org/groups/casino-news-88972

发表评论:

Powered by emlog