https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
If you affected by the current Ransomware attacks’ then its best to follow this advice and patch your systems before similar attacks are launched.
In what has been big news over the past 24 hours. Especially here in the UK is that the NHS has been hit with a large ransomware attack.
http://www.bbc.co.uk/news/technology-39901382
http://blog.talosintelligence.com/2017/05/wannacry.html?m=1
This is a pretty good write up of what was known at the time.
There have been easy fixes for this available for the past 2 months and it was just a matter of time until the tools that were developed by our American Friends, that they would be used against the general public.
Hopefully this is lessons learned for many organisations, and they realise that patching and running fairly up to date operating systems is important and not just something to achieve compliance.
Few more articles that contain good information about these events.
https://www.troyhunt.com/everything-you-need-to-know-about-the-wannacrypt-ransomware/
https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html
Also of note.
wannadecrypt
If you use intitle:”index of” “@WanaDecryptor@.exe” as a search on google, at the time of this update there are 67 results.
Not a good weekend for the world of IT admins.
The github link referenced below is being kept up today and contains some very good and useful information.
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).update: A minor variant of the virus has been found, it looks to have had the killswitch hexedited out. Not done by recompile so probably not done by the original malware author. On the other hand that is the only change: the encryption keys are the same, the bitcoin addresses are the same. On the other hand it is corrupt so the ransomware aspect of it doesn’t work – it only propagates.
SECURITY BULLETIN AND UPDATES HERE: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
Microsoft first patch for XP since 2014: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
Killswitch source: https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/ https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html
Exploit details: https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html
To be infected requires the SMB port (445) to be open, or the machine already infected with DOUBLEPULSAR (and killswitch not registered or somehow blocked, or the network accessing it through a proxy).
The MS17-010 patch fixes the vulnerability.
The RSA public key used to encrypt the infection specific RSA private key is embedded inside the DLL and owned by the ransomware authors.
https://pastebin.com/aaW2Rfb6 even more in depth RE information by cyg_x1!!
3 addresses hard coded into the malware.
gx7ekbenv2riucmf.onion57g7spgrzlojinas.onionxxlvbrloxvriy2c5.onion76jdd2ir2embyv47.onioncwwnhwhlz52maqm7.onionAll language ransom messages available here: https://transfer.sh/y6qco/WANNACRYDECRYPTOR-Ransomware-Messages-all-langs.zip
m_bulgarian, m_chinese (simplified), m_chinese (traditional), m_croatian, m_czech, m_danish, m_dutch, m_english, m_filipino, m_finnish, m_french, m_german, m_greek, m_indonesian, m_italian, m_japanese, m_korean, m_latvian, m_norwegian, m_polish, m_portuguese, m_romanian, m_russian, m_slovak, m_spanish, m_swedish, m_turkish, m_vietnamese
There are a number of files and folders wannacrypt will avoid. Some because it’s entirely pointless and others because it might destabilize the system. During scans, it will search the path for the following strings and skip over if present:
The filetypes it looks for to encrypt are:
.doc, .docx, .xls, .xlsx, .ppt, .pptx, .pst, .ost, .msg, .eml, .vsd, .vsdx, .txt, .csv, .rtf, .123, .wks, .wk1, .pdf, .dwg, .onetoc2, .snt, .jpeg, .jpg, .docb, .docm, .dot, .dotm, .dotx, .xlsm, .xlsb, .xlw, .xlt, .xlm, .xlc, .xltx, .xltm, .pptm, .pot, .pps, .ppsm, .ppsx, .ppam, .potx, .potm, .edb, .hwp, .602, .sxi, .sti, .sldx, .sldm, .sldm, .vdi, .vmdk, .vmx, .gpg, .aes, .ARC, .PAQ, .bz2, .tbk, .bak, .tar, .tgz, .gz, .7z, .rar, .zip, .backup, .iso, .vcd, .bmp, .png, .gif, .raw, .cgm, .tif, .tiff, .nef, .psd, .ai, .svg, .djvu, .m4u, .m3u, .mid, .wma, .flv, .3g2, .mkv, .3gp, .mp4, .mov, .avi, .asf, .mpeg, .vob, .mpg, .wmv, .fla, .swf, .wav, .mp3, .sh, .class, .jar, .java, .rb, .asp, .php, .jsp, .brd, .sch, .dch, .dip, .pl, .vb, .vbs, .ps1, .bat, .cmd, .js, .asm, .h, .pas, .cpp, .c, .cs, .suo, .sln, .ldf, .mdf, .ibd, .myi, .myd, .frm, .odb, .dbf, .db, .mdb, .accdb, .sql, .sqlitedb, .sqlite3, .asc, .lay6, .lay, .mml, .sxm, .otg, .odg, .uop, .std, .sxd, .otp, .odp, .wb2, .slk, .dif, .stc, .sxc, .ots, .ods, .3dm, .max, .3ds, .uot, .stw, .sxw, .ott, .odt, .pem, .p12, .csr, .crt, .key, .pfx, .der
credit herulume, thanks for extracting this list from the binary.
more details came from https://pastebin.com/xZKU7Ph1 thanks to cyg_x11
credit: nulldot https://pastebin.com/0LrH05y2
typedef struct _wc_file_t {
char sig[WC_SIG_LEN] // 64 bit signature WANACRY!
uint32_t keylen; // length of encrypted key
uint8_t key[WC_ENCKEY_LEN]; // AES key encrypted with RSA
uint32_t unknown; // usually 3 or 4, unknown
uint64_t datalen; // length of file before encryption, obtained from GetFileSizeEx
uint8_t *data; // Ciphertext Encrypted data using AES-128 in CBC mode
} wc_file_t;
credit for reversing this file format info: cyg_x11.
The specific vulnerability that it uses to propagate is ETERNALBLUE.
This was developed by “equation group” an exploit developer group associated with the NSA and leaked to the public by “the shadow brokers”. Microsoft fixed this vulnerability March 14, 2017. They were not 0 days at the time of release.
I’ve been on Sky news earlier today discussing #WannaCry with @myhackerhouse – hat tip @rurapenthe for the video! pic.twitter.com/QtheV4IIED
— Hacker Fantastic (@hackerfantastic) 13 May 2017
In what feels like perfect timing from Microsoft, it seems they had already released patches for some if not all of the exploits released these past few days by the file dump by the ShadowBrokers.
| Code Name | Solution |
| “EternalBlue” | Addressed by MS17-010 |
| “EmeraldThread” | Addressed by MS10-061 |
| “EternalChampion” | Addressed by CVE-2017-0146 & CVE-2017-0147 |
| “ErraticGopher” | Addressed prior to the release of Windows Vista |
| “EsikmoRoll” | Addressed by MS14-068 |
| “EternalRomance” | Addressed by MS17-010 |
| “EducatedScholar” | Addressed by MS09-050 |
| “EternalSynergy” | Addressed by MS17-010 |
| “EclipsedWing” | Addressed by MS08-067 |
This has been taken straight from the Microsoft Blog.
Regardless how this happens does not matter, it is just good to know that most if not all of these issues released are patched.
***On 17th April, we have a news article on the BBC that actually covers this story by Microsoft
http://www.bbc.co.uk/news/technology-39620534
It is good to see that we are getting better as an industry to fix and patch these exploits.
Further apparent NSA tools have been released and this time there is alot more information contained with the files. This tool in particular looks quite similar to metasploit.
@hackerfantastic have been investigating these tools and posting their findings, I believe there are going to be fun times in the next week or so!
Here is a video showing ETERNALBLUE being used to compromise a Windows 2008 R2 SP1 x64 host in under 120 seconds with FUZZBUNCH #0day 😉 pic.twitter.com/I9aUF530fU
— Hacker Fantastic (@hackerfantastic) 14 April 2017
hxxp://petroffpianostudio[.]com/ (This may now be cleaned up at the time of posting)
It looks like the the aforementioned webpage is infected with a redirect to download suspect files
Traffic observed after the infection suggests that it will attempt to download executable files from a few different locations.
hxxp://talk-of-the-tyne.co.uk/download1264/ hxxp://willy.pro.br/download3299/ hxxp://freight.eu.com/download3696/
The analysis of the files on hybrid analysis does confirm that these are malicious files
https://www.hybrid-analysis.com/sample/e8d2f149de58eb45b398a84d6d27d568ab1d239584edcb55531fe11da2f9c51b?environmentId=100
Once the executable file is on the host machine, it then attempts to call out to the following
173.230.137.155 206.214.220.79
Upon further analysis we have another file which has been downloaded from the following location
hxxp://matchpointpro.com/lDu52756eeJMW/
I revisited the links later in the day and have a bit more details, we can see they are still serving executable files. Chrome is now blocking and suggesting these files are malicious, and also so is internet explorer. I have not tried them on firefox at this time.
GET /download3299/ HTTP/1.1 Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */* Accept-Language: en-gb User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) Accept-Encoding: gzip, deflate Host: willy.pro.br Cache-Control: max-age=259200 Connection: keep-aliveHTTP/1.1 200 OK Date: Wed, 12 Apr 2017 18:16:51 GMT Content-Type: application/octet-stream Connection: keep-alive Keep-Alive: timeout=15 Server: Apache Cache-Control: no-cache, no-store, max-age=0, must-revalidate Expires: Tue, 08 Jan 1935 00:00:00 GMT Pragma: no-cache Content-Disposition: attachment; filename="6274.exe" Content-Transfer-Encoding: binaryGET /download1264/ HTTP/1.1 Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */* Accept-Language: en-GB User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) Accept-Encoding: gzip, deflate Host: talk-of-the-tyne.co.uk Cache-Control: max-age=259200 Connection: keep-aliveHTTP/1.1 200 OK Date: Wed, 12 Apr 2017 18:16:09 GMT Server: Apache Cache-Control: no-cache, no-store, max-age=0, must-revalidate Expires: Tue, 08 Jan 1935 00:00:00 GMT Pragma: no-cache Content-Disposition: attachment; filename="5198.exe" Content-Transfer-Encoding: binary Vary: User-Agent X-Powered-By: PleskLin MS-Author-Via: DAV Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: application/octet-streamGET /lDu52756eeJMW/ HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) Host: matchpointpro.com Cache-Control: max-age=259200 Connection: keep-aliveHTTP/1.1 200 OK Server: nginx Date: Wed, 12 Apr 2017 18:11:09 GMT Content-Type: application/octet-stream Connection: keep-alive Keep-Alive: timeout=15 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Expires: Tue, 08 Jan 1935 00:00:00 GMT Pragma: no-cache Content-Disposition: attachment; filename="5345.exe" Content-Transfer-Encoding: binary ngpass_ngall: 1
Still in the process of building my Analysis Lab, so this is not quite how I would like to post, but some information is better than none.
The ShadowBrokers have released the password for the EQGRP files.
There is a repository on github that has downloaded and starting to delve deeper into the contents of these files.
These list various exploits, I’ve not had the chance to look through much of these yet, but over the next few days, I will be having a read and a play around with these files to see what things can be learnt from them.
The password for the original file leak is – CrDj”(;Va.*NdlnzB9M?@K2)#>deB7mN
Currently you can download the files from here.
Now that these have been released, the patches for many of these exploits should follow – if not so already patched.
Saw this article today and its quite interesting.
https://blog.malwarebytes.com/cybercrime/2017/03/websites-compromised-decimal-ip-campaign/
A quick search of the string “1760468715” shows there are quite a few websites that have been compromised.
This is quite a clever but old technique that is referred to as Dotless IP’s. A google search will find quite a few results, with several posts from around 15 or so years ago.
In order to work out the IP address the value represents you can perform a fairly straight forward calculation.
If you had the IP address 172.16.4.8
You can calculate this as follows
172 * 16777216 = 2885681152
16 * 65536 = 1048576
4 * 256 = 1024
8 * 1 = 8
Add the bold figures up.
2886730760
So if you were to enter this address in your browser http://2886730760
It would attempt to take you to 172.16.4.8
Just another way of hiding in plain sight.