support sa snažia poskytnúť ľudia z BleepingComputers12.5.2017 okolo 18:00 GMT začal nečakaný útok modifikovanej utility z balíku nástrojov NSA, ktorý zverejnila skupina The Shadow Brokers.
Bolo to pre väčšinu zasiahnutých neočakávané, keďže išlo o mimoriadne masívny útok v 99 krajinách sveta na zhruba 100 000 aktívnych uzloch (nie jednotlivých počítačoch).
Špeciálnou vecou je, že je komplet postavený na nástrojoch rodiny Eternal exploit z dielne NSA.
ERRATICGOPHER pre SMBv1 exploit na Windows XP a Server 2003
ETERNALBLUE pre SMBv2 exploit na Windows 7 SP1
ETERNALSYNERGY pre SMBv3 remote code execution flaw pre Windows 8 a Server 2012
ETERNALCHAMPION tiez na SMBv1 exploit
V súčasnosti sa za využitia zabudovaného killswitchu podarilo zastaviť šírenie. Zastavenie šírenia ale nerieši problém so šifrovaním súborov.
Akýsi support sa snažia poskytnúť ľudia z BleepingComputers.
Zaujímavosťou je, že killswitch je súčasťou pôvodných utilít.
Taktiež sa WanaCrypt0r lýši od ostatného ransomware tým, že má v sebe akýsi self decryptor (dokáže offline dekryptovať údaje) .
Obr. Stav 12.5.2017 o 23:00 screenshot z Malware Tech
Obr. Stav 13.5.2017 o 07:45 screenshot z Malware Tech
Online Wcrypt tracker od Malwaretech
Technický popis infekcie:
po napadnutí počítača s OS Windows sa spustí loader, ktorý vykoná úpravy nastavení a spúšťaných služieb.
Následne stiahne TOR klienta z https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip rozbalí ho do /TaskData.
následne priradí plné práva pre Everyone (icacls . /grant Everyone:F /T /C /Q) a zastaví databázové procesy:
taskkill.exe /f /im mysqld.exe
taskkill.exe /f /im sqlwriter.exe
taskkill.exe /f /im sqlserver.exe
taskkill.exe /f /im MSExchange*
taskkill.exe /f /im Microsoft.Exchange.*
Následne zakryptuje súbory na disku.
po ukončení vytvorí súbor @Please_Read_Me@.txt a spraví kopie @WanaDecryptor@.exe
Príkazom:
C:\Windows\SysWOW64\cmd.exe /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
vymaže Shadow Volume Copies, zastaví Windows startup recovery, a vyčistí Windows Server Backup history.
Následne vytvorí nový wallpaper a zobrazí obrazovku s tým, že žiada bitcoiny za decryptovanie.
Súbory spojené s WanaCrypt0r:
[Installed_Folder]\00000000.eky [Installed_Folder]\00000000.pky [Installed_Folder]\00000000.res [Installed_Folder]\@WanaDecryptor@.exe [Installed_Folder]\@WanaDecryptor@.exe.lnk [Installed_Folder]\b.wnry [Installed_Folder]\c.wnry [Installed_Folder]\f.wnry [Installed_Folder]\msg\ [Installed_Folder]\msg\m_bulgarian.wnry [Installed_Folder]\msg\m_chinese (simplified).wnry [Installed_Folder]\msg\m_chinese (traditional).wnry [Installed_Folder]\msg\m_croatian.wnry [Installed_Folder]\msg\m_czech.wnry [Installed_Folder]\msg\m_danish.wnry [Installed_Folder]\msg\m_dutch.wnry [Installed_Folder]\msg\m_english.wnry [Installed_Folder]\msg\m_filipino.wnry [Installed_Folder]\msg\m_finnish.wnry [Installed_Folder]\msg\m_french.wnry [Installed_Folder]\msg\m_german.wnry [Installed_Folder]\msg\m_greek.wnry [Installed_Folder]\msg\m_indonesian.wnry [Installed_Folder]\msg\m_italian.wnry [Installed_Folder]\msg\m_japanese.wnry [Installed_Folder]\msg\m_korean.wnry [Installed_Folder]\msg\m_latvian.wnry [Installed_Folder]\msg\m_norwegian.wnry [Installed_Folder]\msg\m_polish.wnry [Installed_Folder]\msg\m_portuguese.wnry [Installed_Folder]\msg\m_romanian.wnry [Installed_Folder]\msg\m_russian.wnry [Installed_Folder]\msg\m_slovak.wnry [Installed_Folder]\msg\m_spanish.wnry [Installed_Folder]\msg\m_swedish.wnry [Installed_Folder]\msg\m_turkish.wnry [Installed_Folder]\msg\m_vietnamese.wnry [Installed_Folder]\r.wnry [Installed_Folder]\s.wnry [Installed_Folder]\t.wnry [Installed_Folder]\TaskData\ [Installed_Folder]\TaskData\Data\ [Installed_Folder]\TaskData\Data\Tor\ [Installed_Folder]\TaskData\Tor\ [Installed_Folder]\TaskData\Tor\libeay32.dll [Installed_Folder]\TaskData\Tor\libevent-2-0-5.dll [Installed_Folder]\TaskData\Tor\libevent_core-2-0-5.dll [Installed_Folder]\TaskData\Tor\libevent_extra-2-0-5.dll [Installed_Folder]\TaskData\Tor\libgcc_s_sjlj-1.dll [Installed_Folder]\TaskData\Tor\libssp-0.dll [Installed_Folder]\TaskData\Tor\ssleay32.dll [Installed_Folder]\TaskData\Tor\taskhsvc.exe [Installed_Folder]\TaskData\Tor\tor.exe [Installed_Folder]\TaskData\Tor\zlib1.dll [Installed_Folder]\taskdl.exe [Installed_Folder]\taskse.exe [Installed_Folder]\u.wnry [Installed_Folder]\wcry.exe
Registre spojené s WanaCrypt0r:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\[random] "[Installed_Folder]\tasksche.exe" HKCU\Software\WanaCrypt0r\ HKCU\Software\WanaCrypt0r\wd [Installed_Folder] HKCU\Control Panel\Desktop\Wallpaper "[Installed_Folder]\Desktop\@WanaDecryptor@.bmp"
