wesamhub/MalwareAnalysis-HandsOnLab

# 恶意软件分析报告：WannaCry 勒索软件 ## 执行摘要 我对勒索软件进行了静态和动态恶意软件分析，该软件会加密机器上的重要文件（包括文档、照片、视频和数据库），且威胁行为者要求支付比特币以发送解密密钥，并限定在 3 天内支付，此后价格将翻倍；如果 7 天未付款，您将无法恢复文件。[cite: 2] ## 安全防护措施 在解压文件之前，我下载了带有已知密码的样本 zip 文件，并将机器与互联网断开连接，以防止恶意软件在网络中传播，并确保机器的隔离级别达到 100%。[cite: 2] ## 静态分析 在静态分析中，首先获取恶意软件样本后，我使用 '7z x' 命令解压压缩文件，然后使用 'sha256sum' 命令生成文件的哈希值，以便稍后将其添加到 IoCs 列表中。[cite: 2] ``` remnux@remnux:~/Downloads$ ls 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.zip Manalyze remnux@remnux:~/Downloads$ 7z x 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.zip 7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20 64-bit locale=C.UTF-8 Threads:128 OPEN_MAX:1024 Scanning the drive for archives: 1 file, 195343 bytes (191 KiB) Extracting archive: 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.zip -- Path = 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.zip Type = zip Physical Size = 195343 Enter password (will not be echoed): Everything is Ok Size: 229386 Compressed: 195343 remnux@remnux:~/Downloads$ ls 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe Manalyze 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.zip remnux@remnux:~/Downloads$ sha256sum 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe Then I use 'strings' command to extract the readable strings in the malware file to look for IPs, URLs, libraries and DLLs files, first I use 'vi' command to look inside the output.txt file to found anything help, I found 'WANNACRY' string that tell us we are working on WannaCry ransomware, and I found that the malware use Microsoft's built-in cryptographic engine to encrypt the files of the machine with Windows Cryptography APIs and we found a 'wcry@2016' string and this used as a password to encrypt the Zip files embedded in the WannaCry as mentioned in the blog for Symantec researchers Go to The Blog, more findings as 'c.wry and t.wry' the ransomware use it for change the extension of dropped file to 'wry', the I use 'grep' command to search easier in the file I didn't found any Ips or URLs as strings but I found some DLLs that the ransomware use it, when we looking in the DLLs we notice there is a DLLS (WS2_32.dll and iphlpapi.dll) help the ransomware to spread automatically across the network that mean its not normal ransomware, it's a worm trying to reach all machines in the network ```bash remnux@remnux:~/Downloads$ strings 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe > output.txt remnux@remnux:~/Downloads$ vi output.txt WANNACRY Microsoft Enhanced RSA and AES Cryptographic Provider %08X p.wry StartTask .wry wcry@2016 GetNativeSystemInfo CryptAcquireContextA CryptImportKey CryptReleaseContext CryptDestroyKey CryptDecrypt remnux@remnux:~/Downloads$ grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' output.txt 6.0.0.0 remnux@remnux:~/Downloads$ grep -oE 'https?://[^ ]+' output.txt remnux@remnux:~/Downloads$ remnux@remnux:~/Downloads$ grep '.dll' output.txt KERNEL32.dll USER32.dll ADVAPI32.dll SHELL32.dll OLEAUT32.dll WS2_32.dll iphlpapi.dll NETAPI32.dll MPR.dll MSVCRT.dll MSVCP60.dll kernel32.dll ``` 我使用了 manalyze 开源工具，它返回了一些数据，例如编译日期 '2009-Jul-14 00:03:18' 以及文件的原始名称 'dvdplay'。在这里，勒索软件试图伪装成合法程序（以确保我们可以获取文件的哈希值并提交至 virustotal）。 ``` remnux@remnux:~/Manalyze/bin$ ./manalyze /home/remnux/Downloads/01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe * Manalyze 0.9 * ------------------------------------------------------------------------------- /home/remnux/Downloads/01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe ------------------------------------------------------------------------------- Summary: -------- Architecture: IMAGE_FILE_MACHINE_I386 Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI Compilation Date: 2009-Jul-14 00:03:18 Detected languages: English - United States CompanyName: Microsoft Corporation FileDescription: dvdplay placeholder Application FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) InternalName: dvdplay LegalCopyright: © Microsoft Corporation. All rights reserved. OriginalFilename: dvdplay ProductName: Microsoft® Windows® Operating System ProductVersion: 6.1.7600.16385 ``` ## 动态分析 在动态分析中，我使用 any.run 作为沙箱来运行勒索软件，并在不损害我个人机器的安全环境下观察其行为。执行勒索软件后，我们可以看到 GUI 提示我的文件已被加密，并且我应该向威胁行为者支付价值 300 美元的比特币，这令人遗憾。 我将从执行到文件加密的过程编写为执行链： **1. 执行阶段** 执行是通过手动点击并启动可执行文件完成的，随后主要的勒索软件二进制文件衍生出 cmd.exe 以执行恶意的批处理脚本（255351784564028.bat），以及衍生出 cscript.exe 以执行 VBScript（c.vbs）。 **2. 抑制系统恢复 (T1490)** 为了防止受害者简单地将计算机恢复到之前的状态，恶意软件立即通过 bcdedit.exe 运行命令以禁用 Windows 系统恢复选项，并删除了卷影副本（系统备份）。 **3. 持久化机制 (T1547, T1137, T1176)** * 修改 Windows 注册表 autorun 值。 * 将恶意文件写入 Microsoft Word 启动文件夹。 * 修改 Google Chrome 扩展文件夹内的配置文件。 ## IoCs **文件路径与归档：** * `01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.zip` * `c:\users\admin\desktop\255351784564028.bat` * `c:\users\admin\desktop\c.vbs` * `c:\users\admin\desktop\01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe` * `c:\users\admin\desktop\!wannadecryptor!.exe` * `c:\programdata\microsoft\clicktorun\productreleases\5b9936b4-3789-47cd-a7e1-a479148e7d7f\x-none.16\stream.x64.x-none.db.wcryt` * `c:\programdata\microsoft\clicktorun\productreleases\5b9936b4-3789-47cd-a7e1-a479148e7d7f\x-none.16\stream.x64.x-none.db.wcry` * `c:\programdata\microsoft\clicktorun\productreleases\5b9936b4-3789-47cd-a7e1-a479148e7d7f\tr-tr.16\stream.x64.tr-tr.db.wcryt` * `c:\programdata\microsoft\clicktorun\productreleases\5b9936b4-3789-47cd-a7e1-a479148e7d7f\tr-tr.16\stream.x64.tr-tr.db.wcry` * `c:\programdata\microsoft\clicktorun\productreleases\5b9936b4-3789-47cd-a7e1-a479148e7d7f\ru-ru.16\stream.x64.ru-ru.db.wcryt` * `c:\programdata\microsoft\clicktorun\productreleases\5b9936b4-3789-47cd-a7e1-a479148e7d7f\ru-ru.16\stream.x64.ru-ru.db.wcry` **字符串：** * `wcry@2016` * `WANNACRY` * `c.wry` * `t.wry` **哈希值：** * `01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4` ``` ```

标签：DAST, 云安全监控, 云资产清单, 勒索软件, 恶意软件分析, 逆向工程, 静态分析