{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware \"SaveTheQueen\"","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nNov\u00fd typ \u0161kodliv\u00e9ho softwaru kategorie ransomwaru \u0161ifruje soubory a p\u0159id\u00e1v\u00e1 k nim p\u0159\u00edponu \".SaveTheQueen\", \u0161\u00ed\u0159\u00ed se p\u0159es syst\u00e9movou s\u00ed\u0165ovou slo\u017eku SYSVOL na \u0159adi\u010d\u00edch dom\u00e9n Active Directory.<\/p>\n<p>Na\u0161i z\u00e1kazn\u00edci se s t\u00edmto \u0161kodliv\u00fdm softwarem setkali ned\u00e1vno. P\u0159in\u00e1\u0161\u00edme na\u0161i kompletn\u00ed anal\u00fdzu, jej\u00ed v\u00fdsledky a z\u00e1v\u011bry n\u00ed\u017ee.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Detekce<\/h2>\n<\/h2>\n<p>\nJeden z na\u0161ich klient\u016f se s n\u00e1mi spojil pot\u00e9, co se setkal s nov\u00fdm typem ransomware, kter\u00fd p\u0159id\u00e1val p\u0159\u00edponu \".SaveTheQueen\" k nov\u011b za\u0161ifrovan\u00fdm soubor\u016fm v jejich prost\u0159ed\u00ed.<\/p>\n<p>B\u011bhem na\u0161eho vy\u0161et\u0159ov\u00e1n\u00ed, p\u0159esn\u011bji v etap\u011b hled\u00e1n\u00ed zdroj\u016f infekce, jsme zjistili, \u017ee \u0161\u00ed\u0159en\u00ed a sledov\u00e1n\u00ed naka\u017een\u00fdch ob\u011bt\u00ed prob\u00edhalo s vyu\u017eit\u00edm <strong>s\u00ed\u0165ov\u00e9 slo\u017eky SYSVOL <\/strong> na \u0159adi\u010di dom\u00e9ny z\u00e1kazn\u00edka.<\/p>\n<p>SYSVOL je kl\u00ed\u010dov\u00e1 slo\u017eka pro ka\u017ed\u00fd \u0159adi\u010d dom\u00e9ny, pou\u017e\u00edvan\u00e1 k distribuci objekt\u016f skupinov\u00e9 politiky (GPO) a p\u0159ihla\u0161ovac\u00edch a odhla\u0161ovac\u00edch skript\u016f na po\u010d\u00edta\u010de dom\u00e9ny. Obsah t\u00e9to slo\u017eky se replikuj\u00ed mezi \u0159adi\u010di dom\u00e9ny pro synchronizaci t\u011bchto dat na lokalit\u00e1ch organizace. Z\u00e1pis do SYSVOL vy\u017eaduje vysok\u00e1 dom\u00e9nov\u00e1 opr\u00e1vn\u011bn\u00ed, av\u0161ak po kompromitaci se tento aktiv st\u00e1v\u00e1 mocn\u00fdm n\u00e1strojem pro \u00fato\u010dn\u00edky, kte\u0159\u00ed ho mohou pou\u017e\u00edt k rychl\u00e9mu a efektivn\u00edmu \u0161\u00ed\u0159en\u00ed \u0161kodliv\u00e9 z\u00e1t\u011b\u017ee po dom\u00e9n\u011b.<\/p>\n<p>Auditn\u00ed \u0159et\u011bzec Varonis pomohl rychle odhalit n\u00e1sleduj\u00edc\u00ed:<\/p>\n<ul>\n<li> Infikovan\u00fd u\u017eivatelsk\u00fd \u00fa\u010det vytv\u00e1\u0159el soubor s n\u00e1zvem \u201ehourly\u201c ve SYSVOL<\/li>\n<li> Spousta soubor\u016f protokolu byla vytv\u00e1\u0159ena ve SYSVOL \u2014 ka\u017ed\u00fd pojmenov\u00e1n podle dom\u00e9nov\u00e9ho za\u0159\u00edzen\u00ed<\/li>\n<li>Mnoho r\u016fzn\u00fdch IP adres m\u011blo p\u0159\u00edstup k souboru \u201ehourly\u201c<\/li>\n<\/ul>\n<p>\nDosp\u011bli jsme k z\u00e1v\u011bru, \u017ee soubory protokolu byly pou\u017e\u00edv\u00e1ny k sledov\u00e1n\u00ed procesu infekce na nov\u00fdch za\u0159\u00edzen\u00edch a \u017ee \u201ehourly\u201c je napl\u00e1novan\u00e1 \u00faloha, kter\u00e1 spou\u0161t\u00ed \u0161kodlivou z\u00e1t\u011b\u017e na nov\u00fdch za\u0159\u00edzen\u00edch pomoc\u00ed skriptu PowerShell \u2014 vzorky \u201ev3\u201c a \u201ev4\u201c.<\/p>\n<p>Je pravd\u011bpodobn\u00e9, \u017ee \u00fato\u010dn\u00edk z\u00edskal a pou\u017eil opr\u00e1vn\u011bn\u00ed dom\u00e9nov\u00e9ho administr\u00e1tora k z\u00e1pisu soubor\u016f do SYSVOL. Na infikovan\u00fdch uzlech \u00fato\u010dn\u00edk spou\u0161t\u011bl k\u00f3d PowerShell, kter\u00fd vytv\u00e1\u0159el napl\u00e1novanou \u00falohu k otev\u0159en\u00ed, de\u0161ifrov\u00e1n\u00ed a spu\u0161t\u011bn\u00ed \u0161kodliv\u00e9ho software.<\/p>\n<h2>\n<h2>De\u0161ifrov\u00e1n\u00ed \u0161kodliv\u00e9ho software<\/h2>\n<\/h2>\n<p>\nBez \u00fasp\u011bchu jsme vyzkou\u0161eli n\u011bkolik metod de\u0161ifrov\u00e1n\u00ed vzork\u016f:<\/p>\n<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00e9m\u011b\u0159 jsme byli p\u0159ipraveni se vzd\u00e1t, kdy\u017e jsme se rozhodli vyzkou\u0161et zp\u016fsob \u201eMagic\u201c od<br \/>\nn\u00e1stroje <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> GCHQ. \u201eMagic\u201c se sna\u017e\u00ed uhodnout \u0161ifrov\u00e1n\u00ed souboru pomoc\u00ed hrub\u00e9 s\u00edly na z\u00e1klad\u011b r\u016fzn\u00fdch typ\u016f \u0161ifrov\u00e1n\u00ed a m\u011b\u0159en\u00edm entropie. <\/p>\n<p><b class=\"spoiler_title\">Pozn\u00e1mka p\u0159ekladatele<\/b> Viz.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Diferen\u010dn\u00ed entropie<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entropie v informa\u010dn\u00ed teorii<\/a><\/noindex>. Tento \u010dl\u00e1nek a koment\u00e1\u0159e nezahrnuj\u00ed diskusi ze strany autor\u016f o podrobnostech metod pou\u017eit\u00fdch jak v otev\u0159en\u00e9m, tak v propriet\u00e1rn\u00edm softwaru. <br \/>\n<img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u201eMagic\u201c zjistil, \u017ee byl pou\u017eit kompresor GZip s k\u00f3dov\u00e1n\u00edm base64, d\u00edky \u010demu\u017e jsme byli schopni extrahovat soubor a odhalit k\u00f3d pro implantaci \u2013 \u201einjektor\u201c.<\/p>\n<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Drobber: \u201eV oblasti epidemie! Hromadn\u00e9 o\u010dkov\u00e1n\u00ed. Mor\u201c<\/h2>\n<p>\nDrobber byl b\u011b\u017en\u00fd .NET soubor bez jak\u00e9koli ochrany. Po p\u0159e\u010dten\u00ed zdrojov\u00e9ho k\u00f3du pomoc\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> jsme pochopili, \u017ee jeho jedin\u00fdm c\u00edlem bylo implantovat shell k\u00f3d do procesu winlogon.exe.<\/p>\n<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Shell k\u00f3d nebo jednoduch\u00e9 obt\u00ed\u017ee<\/h2>\n<p>\nPou\u017eili jsme n\u00e1stroj od Hexacorn \u2013 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> abychom \u201ezkop\u00edrovali\u201c shell k\u00f3d do spustiteln\u00e9ho souboru pro lad\u011bn\u00ed a anal\u00fdzu. Pak jsme zjistili, \u017ee funguje jak na 32-, tak na 64bitov\u00fdch stroj\u00edch.<\/p>\n<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNaps\u00e1n\u00ed i jednoduch\u00e9ho shell k\u00f3du v nativn\u00edm p\u0159ekladu z assembleru m\u016f\u017ee b\u00fdt slo\u017eit\u00e9, naps\u00e1n\u00ed cel\u00e9ho shell k\u00f3du, kter\u00fd funguje na obou syst\u00e9mech, vy\u017eaduje \u0161pi\u010dkov\u00e9 dovednosti, tak\u017ee jsme za\u010dali b\u00fdt ohromeni rafinovanost\u00ed \u00fato\u010dn\u00edka.<\/p>\n<p>Kdy\u017e jsme rozebrali zkompilovan\u00fd shell k\u00f3d pomoc\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>, v\u0161imli jsme si, \u017ee na\u010d\u00edtal <strong> dynamick\u00e9 knihovny .NET <\/strong>, jako jsou clr.dll a mscoreei.dll. To n\u00e1m p\u0159i\u0161lo podivn\u00e9 \u2013 \u00fato\u010dn\u00edci obvykle usiluj\u00ed o to, aby byl shell k\u00f3d co nejmen\u0161\u00ed, volaj\u00edc\u00ed nativn\u00ed funkce OS m\u00edsto jejich na\u010d\u00edt\u00e1n\u00ed. <em>Pro\u010d by m\u011bl n\u011bkdo integrovat funkce Windows do shell k\u00f3du m\u00edsto jejich p\u0159\u00edm\u00e9ho vol\u00e1n\u00ed? <\/em><\/p>\n<p>Jak se uk\u00e1zalo, autor malware v\u016fbec nenapsal tento slo\u017eit\u00fd shell k\u00f3d \u2013 pou\u017eil se k tomu specializovan\u00fd software ur\u010den\u00fd k p\u0159ekladu spustiteln\u00fdch soubor\u016f a skript\u016f na shell k\u00f3d. <\/p>\n<p>Na\u0161li jsme n\u00e1stroj <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, kter\u00fd, jak se n\u00e1m zd\u00e1lo, mohl zkompilovat podobn\u00fd shell k\u00f3d. Tady je jeho popis z GitHubu:<\/p>\n<p><em>Donut generuje shell k\u00f3d x86 nebo x64 z VBScript, JScript, EXE, DLL (v\u010detn\u011b .NET sestaven\u00ed). Ten shell k\u00f3d m\u016f\u017ee b\u00fdt implantov\u00e1n do jak\u00e9hokoli procesu Windows k vykon\u00e1n\u00ed v<br \/>\nopera\u010dn\u00ed pam\u011bti.<\/em><\/p>\n<p>Pro potvrzen\u00ed na\u0161\u00ed teorie jsme zkompilovali n\u00e1\u0161 vlastn\u00ed k\u00f3d pomoc\u00ed Donut a porovnali ho se vzorem \u2013 a... ano, objevili jsme dal\u0161\u00ed komponentu pou\u017eit\u00fdch n\u00e1stroj\u016f. Pot\u00e9 jsme ji\u017e mohli extrahovat a analyzovat p\u016fvodn\u00ed spustiteln\u00fd soubor na .NET.<\/p>\n<h2> Ochrana k\u00f3du <\/h2>\n<p>\nTento soubor byl obfuskovan\u00fd pomoc\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx je open-source .NET projekt pro ochranu k\u00f3du ostatn\u00edch v\u00fdvoj\u00e1\u0159\u016f. Software tohoto typu umo\u017e\u0148uje v\u00fdvoj\u00e1\u0159\u016fm chr\u00e1nit sv\u016fj k\u00f3d p\u0159ed reverzn\u00edm in\u017een\u00fdrstv\u00edm pomoc\u00ed takov\u00fdch metod, jako je: nahrazov\u00e1n\u00ed znak\u016f, maskov\u00e1n\u00ed toku \u0159\u00edd\u00edc\u00edch povel\u016f a skr\u00fdv\u00e1n\u00ed volaj\u00edc\u00ed metody. Auto\u0159i \u0161kodliv\u00e9ho softwaru pou\u017e\u00edvaj\u00ed obfuskatory s c\u00edlem vyhnout se detekci a zt\u00ed\u017eit \u00fakol reverzn\u00edho in\u017een\u00fdrstv\u00ed.<\/p>\n<p>D\u00edky <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> jsme rozbalili k\u00f3d:<\/p>\n<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> V\u00fdsledek \u2013 payload<\/h2>\n<p>\nPayload z\u00edskan\u00fd po transformac\u00edch je velmi jednoduch\u00fd ransomware. \u017d\u00e1dn\u00fd mechanismus zaji\u0161\u0165ov\u00e1n\u00ed p\u0159\u00edtomnosti v syst\u00e9mu, \u017e\u00e1dn\u00e1 spojen\u00ed s \u0159\u00edd\u00edc\u00edm centrem \u2013 pouze star\u00e9 dobr\u00e9 asymetrick\u00e9 \u0161ifrov\u00e1n\u00ed, aby data ob\u011bti byla ne\u010diteln\u00e1.<\/p>\n<p>Hlavn\u00ed funkce jako parametry vy\u017eaduje n\u00e1sleduj\u00edc\u00ed \u0159et\u011bzce:<\/p>\n<ul>\n<li> P\u0159\u00edpona souboru pro pou\u017eit\u00ed po \u0161ifrov\u00e1n\u00ed (SaveTheQueen) <\/li>\n<li> Email autora, aby byl zahrnut do souboru s v\u00fdkupn\u00fdm<\/li>\n<li> Ve\u0159ejn\u00fd kl\u00ed\u010d pou\u017e\u00edvan\u00fd pro \u0161ifrov\u00e1n\u00ed soubor\u016f <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Samotn\u00fd proces vypad\u00e1 n\u00e1sledovn\u011b:<\/strong><\/p>\n<ol>\n<li> \u0160kodliv\u00fd software zkoum\u00e1 m\u00edstn\u00ed a p\u0159ipojen\u00e9 disky na za\u0159\u00edzen\u00ed ob\u011bti\n<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Hled\u00e1 soubory k \u0161ifrov\u00e1n\u00ed\n<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Sna\u017e\u00ed se ukon\u010dit proces, kter\u00fd pou\u017e\u00edv\u00e1 soubor, kter\u00fd m\u00e1 za\u0161ifrovat<\/li>\n<li> P\u0159ejmenov\u00e1v\u00e1 soubor na \"P\u016fvodn\u00ed_n\u00e1zev_souboru.SaveTheQueenING\" pomoc\u00ed funkce MoveFile a za\u0161ifruje jej <\/li>\n<li>Po za\u0161ifrov\u00e1n\u00ed souboru ve\u0159ejn\u00fdm kl\u00ed\u010dem autora, malware soubor znovu p\u0159ejmenuje, tentokr\u00e1t na \" P\u016fvodn\u00ed_n\u00e1zev_souboru.SaveTheQueen\"<\/li>\n<li>Prob\u00edh\u00e1 z\u00e1pis souboru s v\u00fdkupn\u00fdm do stejn\u00e9 slo\u017eky\n<p><img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nNa z\u00e1klad\u011b pou\u017eit\u00ed nativn\u00ed funkce \u201eCreateDecryptor\u201c jedna z funkc\u00ed malwaru pravd\u011bpodobn\u011b obsahuje jako parametr mechanismus de\u0161ifrov\u00e1n\u00ed vy\u017eaduj\u00edc\u00ed soukrom\u00fd kl\u00ed\u010d.<\/p>\n<p>Ransomware <strong>NE\u0161ifruje soubory<\/strong>, kter\u00e9 se nach\u00e1zej\u00ed v adres\u00e1\u0159\u00edch:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>Takt\u00e9\u017e <strong>NE\u0161ifruje n\u00e1sleduj\u00edc\u00ed typy soubor\u016f:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> Z\u00e1v\u011bry a shrnut\u00ed<\/h2>\n<\/h2>\n<p>\nI kdy\u017e samotn\u00fd ransomware nem\u011bl \u017e\u00e1dn\u00e9 neobvykl\u00e9 funkce, \u00fato\u010dn\u00edk kreativn\u011b pou\u017eil Active Directory k \u0161\u00ed\u0159en\u00ed dropera, p\u0159i\u010dem\u017e samotn\u00fd malware n\u00e1m poskytl zaj\u00edmav\u00e9, i kdy\u017e nakonec ne slo\u017eit\u00e9, p\u0159ek\u00e1\u017eky b\u011bhem anal\u00fdzy. <\/p>\n<p>Domn\u00edv\u00e1me se, \u017ee autor malwaru:<\/p>\n<ol>\n<li>Napsal ransomware se zabudovanou injekc\u00ed do procesu winlogon.exe, a tak\u00e9<br \/>\nfunkcionalitou pro \u0161ifrov\u00e1n\u00ed a de\u0161ifrov\u00e1n\u00ed soubor\u016f<\/li>\n<li>Maskoval \u0161kodliv\u00fd k\u00f3d pomoc\u00ed ConfuserEx, transformoval v\u00fdsledek s pomoc\u00ed Donut a d\u00e1le skryl dropera base64 Gzip<\/li>\n<li>Z\u00edskal zv\u00fd\u0161en\u00e1 opr\u00e1vn\u011bn\u00ed v dom\u00e9n\u011b ob\u011bti a vyu\u017eil je k kop\u00edrov\u00e1n\u00ed<br \/>\nza\u0161ifrovan\u00e9ho malwaru a \u00faloh napl\u00e1novan\u00fdch v s\u00ed\u0165ov\u00e9 slo\u017ece SYSVOL dom\u00e9nov\u00fdch \u0159adi\u010d\u016f<\/li>\n<li>Spustil skript PowerShell na za\u0159\u00edzen\u00edch dom\u00e9ny pro \u0161\u00ed\u0159en\u00ed malwaru a zaznamen\u00e1v\u00e1n\u00ed pokroku \u00fatoku do protokol\u016f v SYSVOL<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Vykoupit \u2014 jako kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed ransomware &quot;SaveTheQueen&quot;\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPokud m\u00e1te dotazy ohledn\u011b t\u00e9to varianty ransomwaru nebo jak\u00e9koli jin\u00e9 pr\u00e1ce, kterou na\u0161e t\u00fdmy provedly v r\u00e1mci forenzn\u00ed anal\u00fdzy a vy\u0161et\u0159ov\u00e1n\u00ed bezpe\u010dnostn\u00edch incident\u016f, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">n\u00e1s kontaktujte <\/a><\/noindex> nebo si vy\u017e\u00e1dejte <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">\u017eivou uk\u00e1zku reakce na \u00fatoky<\/a><\/noindex>, kde v\u017edy odpov\u00edd\u00e1me na ot\u00e1zky v r\u00e1mci sezen\u00ed ot\u00e1zek a odpov\u011bd\u00ed.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Odkupovat \u2014 tak kr\u00e1lovnu: Varonis vy\u0161et\u0159uje rychle se \u0161\u00ed\u0159\u00edc\u00ed \u0161ifrovac\u00ed ransomware \u201cSaveTheQueen\u201d | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}