WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道,昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球,特别是在内网和专网中,通过攻击445端口(蠕虫性质)大肆传播,造成了巨大数据损失。我也凑个热闹,找到一批样本上传金刚分析系统(http://tcasoft.com/),看看效果。

其中比较典型的分为两类,一类就是昨天大家新闻中看到的,访问某个超长的域名,如果存在就放弃攻击。如图:

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏,并不会探测域名。如某样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出,样本执行初期没有任何引人注意的表现,当桌面被替换、前台弹出提示信息时,一切都为时已晚,用户的文件就已经被加密,要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到,样本释放了大量可执行程序以及bat、vbs等恶意脚本,并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后,样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为,包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现,攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件,在加密完成并设置好文件创建时间后,会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢?只需查看分析报告里的“中间文件”就可以看到。如下图所示,攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片,被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外,样本运行过程中还能观测到大量的网络行为,连接地址包括美国、德国、奥地利等多个国家,同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中,引擎并未连接真实互联网,因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍,大家若有兴趣欢迎查看分析报告自行研究。

评论:

Henrynib
2020-11-04 02:16
Imparare a fare centinaia di spalle ogni giorno.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%4f%58%66%4f%48%47%75%72%53%54%42%6f%61%70%71%69%51&sa=D&sntz=1&usg=AFQjCNH8ATZBKguJCKA73J1nFeZTWy9xSA
Henrynib
2020-11-02 17:06
Fai migliaia di dollari. Robot finanziario vi aiuterà a farlo!
Link - - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%4f%45%47%64%58%63%54%63%6e%73%51%54%45%70%49%42%4f&sa=D&sntz=1&usg=AFQjCNGGhj9czQC0t01Oih4O6m6lNGnBcA
Henrynib
2020-11-01 10:30
Let the Robot bring you money while you rest.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%70%53%55%43%57%6b%4e%57%69%7a%44%63%53%6f%47%54%4d&sa=D&sntz=1&usg=AFQjCNHPFo5NQpTwh2v9dEoew9NQxmJ_sw
Henrynib
2020-11-01 08:25
Si trova la formula del successo. Scopri di più su di esso.
Link - - https://moneylinks.page.link/6SuK
Henrynib
2020-11-01 04:02
Guadagnare $ 1000 al giorno è facile se si utilizza questo Robot finanziario.
Link - - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%59%42%58%49%78%6d%5a%72%45%6c%61%59%64%4d%42%42%70&sa=D&sntz=1&usg=AFQjCNGmO0rfMHNSb3SMDfbXf2XyOujzyA
SuzanHig
2020-10-31 13:42
Zubař Praha 10
Henrynib
2020-10-29 07:26
Si trova il modo più veloce per rendere il tuo portafoglio spesso.
Link - - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%6e%6f%6e%7a%67%65%6a%52%45%68%56%76%66%64%72%53%4e&sa=D&sntz=1&usg=AFQjCNG_T-k69KdwrxlPH5Dl88isgyq1yg
Sofiyaknoca
2020-10-28 18:30
244821 viagra poland price

https://viagrahere20.com/ - viagra

site achat viagra

http://viagraoier.com/ - viagra online

wow look it viagra to order

https://viagraonline20up.com/ - viagra generic
Leonhardknoca
2020-10-28 09:48
244821 online viagra canada

http://viagraoier.com/ - buy viagra

how to use pfizer viagra

https://viagraonline20up.com/ - buy generic viagra

comprar viagra en farmacia

https://viagraonlinegfsd.com/ - online viagra
Yaheliknoca
2020-10-28 09:33
a6ac21 cialis kosten 10 mg

https://cialisactivesupers.com/ - generic cialis online

cialis generique pas che

https://cialisdoitnow.com/ - buy generic cialis

cialis auf rechnung

http://cialishhqoeur.com/ - cialis online

cialis canada wholesale

https://cialishowmuch.com/ - cheap cialis
Abiyaknoca
2020-10-28 09:18
5f7521 pfizer viagra daily

https://viagraonline20up.com/ - viagra

la viagra causa sordera

https://viagraonlinegfsd.com/ - buy viagra

viagra cialis donne

https://viagrasupertreat.com/ - online viagra
Henrynib
2020-10-28 09:08
Avvia il robot e lascia che ti porti soldi.
Link - http://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%68%64%72%65%64%74%75%62%65%33%2e%6d%6f%62%69%2F%62%74%73%6d%61%72%74%23%6b%71%46%47%4c%5a%6b%43%56%43%46%54%77%67%64%72%64&sa=D&sntz=1&usg=AFQjCNEI6hGjWREUVugrU-ZXuJXZRKTIbg
Henrynib
2020-10-25 21:50
This robot will help you to make hundreds of dollars each day.
Link - http://www.google.com/url?q=%68%74%74%70%3A%2F%2F%74%65%73%74%77%6f%72%6b%73%2e%77%65%62%73%69%74%65%23%77%4d%57%4f%6a%43%58%50%42%71%43%69%79%62%66%77&sa=D&sntz=1&usg=AFQjCNEu-6eJ96jivy5mH4rMXaUSslhSIA
Henrynib
2020-10-25 15:39
Prova il robot automatico per continuare a guadagnare tutto il giorno.
Link - - http://www.google.com/url?q=%68%74%74%70%3A%2F%2F%74%65%73%74%77%6f%72%6b%73%2e%77%65%62%73%69%74%65%23%69%71%51%5a%55%61%4f%71%49%76%7a%5a%76%59%4f%59&sa=D&sntz=1&usg=AFQjCNGJ3__ObQHZV_krAQaT5zwNRgUwjA
Henrynib
2020-10-25 10:34
Fare Dollari stare a casa e ha lanciato questo Bot.
Link - - http://www.google.com/url?q=%68%74%74%70%3A%2F%2F%74%65%73%74%77%6f%72%6b%73%2e%77%65%62%73%69%74%65%23%4b%62%57%78%4d%48%54%56%69%77%7a%45%6d%79%48%56&sa=D&sntz=1&usg=AFQjCNGzOTR-6OOhqWzleki2jg_JMnewWA

发表评论:

Powered by emlog