{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nNov\u00fd typ malware triedy ransomwaru \u0161ifruje s\u00fabory a prid\u00e1va k nim pr\u00edponu \".SaveTheQueen\", \u0161\u00edriac sa cez syst\u00e9mov\u00fa sie\u0165ov\u00fa zlo\u017eku SYSVOL na dom\u00e9nov\u00fdch kontrol\u00e9roch Active Directory.<\/p>\n<p>Na\u0161i z\u00e1kazn\u00edci sa s touto hrozbou stretli ned\u00e1vno. Prin\u00e1\u0161ame n\u00e1\u0161 \u00fapln\u00fd anal\u00fdzu, jeho v\u00fdsledky a z\u00e1very ni\u017e\u0161ie.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Zistenie<\/h2>\n<\/h2>\n<p>\nJeden z na\u0161ich z\u00e1kazn\u00edkov n\u00e1s kontaktoval po tom, \u010do sa stretli s nov\u00fdm typom \u0161ifrova\u010da-ransomwaru, ktor\u00fd prid\u00e1val pr\u00edponu \".SaveTheQueen\" k nov\u00fdm za\u0161ifrovan\u00fdm s\u00faborom vo svojej prostred\u00ed.<\/p>\n<p>Po\u010das na\u0161ej vy\u0161etrovania, a presnej\u0161ie na etape vyh\u013ead\u00e1vania zdrojov n\u00e1kazy, sme zistili, \u017ee \u0161\u00edrenie a sledovanie infikovan\u00fdch obet\u00ed prebiehalo pomocou <strong>sie\u0165ovej zlo\u017eky SYSVOL <\/strong> na dom\u00e9novom kontrol\u00f3re z\u00e1kazn\u00edka.<\/p>\n<p>SYSVOL je k\u013e\u00fa\u010dov\u00e1 zlo\u017eka pre ka\u017ed\u00fd dom\u00e9nov\u00fd kontrol\u00f3r, pou\u017e\u00edvan\u00e1 na poskytovanie objektov skupinov\u00fdch polit\u00edk (GPO) a skriptov pre prihl\u00e1senie a odhl\u00e1senie na po\u010d\u00edta\u010doch v dom\u00e9ne. Obsah tejto zlo\u017eky sa replikovate\u013e medzi dom\u00e9nov\u00fdmi kontrol\u00f3rmi na synchroniz\u00e1ciu t\u00fdchto \u00fadajov na str\u00e1nkach organiz\u00e1cie. Z\u00e1pis do SYSVOL vy\u017eaduje vysok\u00e9 dom\u00e9nov\u00e9 privil\u00e9gi\u00e1, av\u0161ak po kompromit\u00e1cii sa tento akt\u00edv st\u00e1va mocn\u00fdm n\u00e1strojom pre \u00fato\u010dn\u00edkov, ktor\u00ed ho m\u00f4\u017eu vyu\u017ei\u0165 na r\u00fdchle a efekt\u00edvne roz\u0161irovanie \u0161kodlivej z\u00e1\u0165a\u017ee v celej dom\u00e9ne.<\/p>\n<p>Re\u0165azec auditu Varonis pomohol r\u00fdchlo identifikova\u0165 nasleduj\u00face:<\/p>\n<ul>\n<li> Infikovan\u00fd pou\u017e\u00edvate\u013e vytvoril s\u00fabor s n\u00e1zvom \u201ehourly\u201c v SYSVOL<\/li>\n<li> Ve\u013ea s\u00faborov protokolu sa vytvorilo v SYSVOL \u2013 ka\u017ed\u00fd nazvan\u00fd menom dom\u00e9nov\u00e9ho zariadenia<\/li>\n<li>Viacero r\u00f4znych IP adries z\u00edskalo pr\u00edstup k s\u00faboru \u201ehourly\u201c<\/li>\n<\/ul>\n<p>\nDosiahli sme, \u017ee s\u00fabory protokolu sa pou\u017e\u00edvali na sledovanie procesu infikovania na nov\u00fdch zariadeniach a \u017ee \u201ehourly\u201c je pl\u00e1novan\u00e1 \u00faloha, ktor\u00e1 vykon\u00e1vala \u0161kodliv\u00fa z\u00e1\u0165a\u017e na nov\u00fdch zariadeniach, pomocou skriptu Powershell \u2013 vzor \u201ev3\u201c a \u201ev4\u201c.<\/p>\n<p>Je pravdepodobn\u00e9, \u017ee \u00fato\u010dn\u00edk z\u00edskal a pou\u017eil pr\u00e1va spr\u00e1vcu dom\u00e9ny na z\u00e1pis s\u00faborov do SYSVOL. Na infikovan\u00fdch uzloch spustil \u00fato\u010dn\u00edk k\u00f3d PowerShell, ktor\u00fd vytvoril pl\u00e1novan\u00fa \u00falohu na to, aby otvoril, de\u0161ifroval a spustil \u0161kodliv\u00fd softv\u00e9r.<\/p>\n<h2>\n<h2>De\u0161ifrovanie \u0161kodliv\u00e9ho softv\u00e9ru<\/h2>\n<\/h2>\n<p>\nBezv\u00fdsledne sme vysk\u00fa\u0161ali nieko\u013eko sp\u00f4sobov na de\u0161ifrovanie vzoriek:<\/p>\n<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nU\u017e sme sa takmer chystali vzda\u0165, ke\u010f sme sa rozhodli vysk\u00fa\u0161a\u0165 \u00bbMagic\u00ab skvel\u00e9ho<br \/>\nn\u00e1stroja <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> od GCHQ. \u00bbMagic\u00ab sa pok\u00fa\u0161a uh\u00e1dnu\u0165 \u0161ifrovanie s\u00faboru pomocou preh\u013ead\u00e1vania hesiel pre r\u00f4zne typy \u0161ifrovania a merania entropie. <\/p>\n<p><b class=\"spoiler_title\">Pozn\u00e1mka prekladate\u013ea<\/b> Pozri.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Diferen\u010dn\u00e1 entropia<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entropia v te\u00f3rii inform\u00e1ci\u00ed<\/a><\/noindex>. Tento \u010dl\u00e1nok a koment\u00e1re nepredpokladaj\u00fa diskusiu zo strany autorov o detailoch met\u00f3d pou\u017eit\u00fdch ako v prostredn\u00edctve tak aj v propriet\u00e1rnom softv\u00e9ri. <br \/>\n<img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00bbMagic\u00ab zistil, \u017ee bol pou\u017eit\u00fd kompresor GZip s k\u00f3dovan\u00edm base64, \u010do n\u00e1m umo\u017enilo rozbali\u0165 s\u00fabor a objavi\u0165 k\u00f3d na implantovanie \u2013 \u00bbinjector\u00ab.<\/p>\n<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Dropper: \u00bbV oblasti epid\u00e9mia! Hromadn\u00e9 o\u010dkovanie. Mor\u00ab<\/h2>\n<p>\nDropper bol oby\u010dajn\u00fd .NET s\u00fabor bez akejko\u013evek ochrany. Po pre\u0161tudovan\u00ed zdrojov\u00e9ho k\u00f3du pomocou <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> sme si uvedomili, \u017ee jeho jedin\u00fdm cie\u013eom bolo implantovanie shell k\u00f3du do procesu winlogon.exe.<\/p>\n<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Shell k\u00f3d alebo jednoduch\u00e9 zlo\u017eitosti<\/h2>\n<p>\nPou\u017eili sme n\u00e1stroj vytvoren\u00fd Hexacorn \u2013 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> aby sme \u00bbskompilovali\u00ab shell k\u00f3d do spustite\u013en\u00e9ho s\u00faboru na ladenie a anal\u00fdzu. Potom sme zistili, \u017ee fungoval na 32- aj 64-bitov\u00fdch strojoch.<\/p>\n<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNap\u00edsa\u0165 aj jednoduch\u00fd shell k\u00f3d v nat\u00edvnej transl\u00e1cii z assembleru m\u00f4\u017ee by\u0165 zlo\u017eit\u00fdm, nap\u00edsanie pln\u00e9ho shell k\u00f3du funguj\u00faceho na oboch typoch syst\u00e9mov si vy\u017eaduje elitn\u00e9 zru\u010dnosti, preto sme za\u010dali \u017easn\u00fa\u0165 nad zlo\u017eitosti \u00fato\u010dn\u00edka.<\/p>\n<p>Ke\u010f sme rozobrali skompilovan\u00fd shell k\u00f3d pomocou <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>, v\u0161imli sme si, \u017ee na\u010d\u00edtaval <strong> dynamick\u00e9 kni\u017enice .NET <\/strong>, ako clr.dll a mscoreei.dll. Toto sa n\u00e1m zdalo podozriv\u00e9 \u2013 zvy\u010dajne sa zlomyse\u013en\u00edci sna\u017eia, aby bol shell k\u00f3d \u010do najmen\u0161\u00ed, volaj\u00fac nat\u00edvne funkcie OS namiesto ich na\u010d\u00edtavania. <em>Pre\u010do by niekto potreboval integrova\u0165 do shell k\u00f3du funkcionalitu Windows miesto priameho volania na po\u017eiadanie? <\/em><\/p>\n<p>Ako sa uk\u00e1zalo, autor \u0161kodliv\u00e9ho softv\u00e9ru tento zlo\u017eit\u00fd shell k\u00f3d v\u00f4bec nenap\u00edsal \u2013 bolo pou\u017eit\u00e9 charakteristick\u00e9 softv\u00e9rov\u00e9 vybavenie na prevod spustite\u013en\u00fdch s\u00faborov a skriptov do shell k\u00f3du. <\/p>\n<p>Na\u0161li sme n\u00e1stroj <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, ktor\u00fd, ako sme sa domnievali, mohol skompilova\u0165 podobn\u00fd shell k\u00f3d. Tu je jeho popis z GitHub:<\/p>\n<p><em>Donut generuje shell k\u00f3d x86 alebo x64 z VBScript, JScript, EXE, DLL (vr\u00e1tane .NET zost\u00e1v). Tento shell k\u00f3d m\u00f4\u017ee by\u0165 vlo\u017een\u00fd do ak\u00e9hoko\u013evek procesu Windows, aby sa vykonal v<br \/>\nRAM.<\/em><\/p>\n<p>Na potvrdenie na\u0161ej te\u00f3rie sme skompilovali n\u00e1\u0161 vlastn\u00fd k\u00f3d pomocou Donut a porovnali ho s vzorom \u2013 a... \u00e1no, objavili sme e\u0161te jeden komponent pou\u017eit\u00fdch n\u00e1strojov. Po tom sme u\u017e mohli extrahova\u0165 a analyzova\u0165 p\u00f4vodn\u00fd spustite\u013en\u00fd s\u00fabor na .NET.<\/p>\n<h2> Ochrana k\u00f3du <\/h2>\n<p>\nTento s\u00fabor bol obfuskovan\u00fd pomocou <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx\u00a0\u2014 je open-source .NET projekt na ochranu k\u00f3du od in\u00fdch v\u00fdvoj\u00e1rov. Softv\u00e9r tohto druhu umo\u017e\u0148uje v\u00fdvoj\u00e1rom chr\u00e1ni\u0165 svoj k\u00f3d pred reverzn\u00fdm in\u017einierstvom pomocou r\u00f4znych met\u00f3d, ako s\u00fa: z\u00e1mena symbolov, maskovanie toku riadiacich pr\u00edkazov a skr\u00fdvanie odkazov\u00e9ho met\u00f3dy. Autori malv\u00e9ru pou\u017e\u00edvaj\u00fa obfuska\u010dn\u00e9 n\u00e1stroje s cie\u013eom vyhn\u00fa\u0165 sa detekcii a s\u0165a\u017ei\u0165 \u00falohu reverzn\u00e9ho in\u017einierstva.<\/p>\n<p>V\u010faka <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> rozbalili sme k\u00f3d:<\/p>\n<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> V\u00fdsledok \u2013 u\u017eito\u010dn\u00e9 za\u0165a\u017eenie<\/h2>\n<p>\nZ\u00edskan\u00e1 transform\u00e1ciou u\u017eito\u010dn\u00e1 z\u00e1\u0165a\u017e je ve\u013emi jednoduch\u00fd ransomv\u00e9r. \u017diadny mechanizmus zabezpe\u010denia pr\u00edtomnosti v syst\u00e9me, \u017eiadne spojenia s vel\u00ednom \u2013 len star\u00e9 dobr\u00e9 asymetrick\u00e9 \u0161ifrovanie, aby sa \u00fadaje obete stali ne\u010ditate\u013en\u00fdmi.<\/p>\n<p>Hlavn\u00e1 funkcia si vyber\u00e1 ako parametre nasleduj\u00face re\u0165azce:<\/p>\n<ul>\n<li> Pr\u00edpona s\u00faboru na pou\u017eitie po za\u0161ifrovan\u00ed (SaveTheQueen) <\/li>\n<li> Email autora, ktor\u00fd sa m\u00e1 umiestni\u0165 do s\u00faboru s po\u017eiadavkou na v\u00fdkupn\u00e9<\/li>\n<li> Verejn\u00fd k\u013e\u00fa\u010d pou\u017e\u00edvan\u00fd na \u0161ifrovanie s\u00faborov <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Cel\u00fd proces vyzer\u00e1 nasledovne:<\/strong><\/p>\n<ol>\n<li> Malv\u00e9r sk\u00fama miestne a pripojen\u00e9 disky na zariaden\u00ed obete\n<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> H\u013ead\u00e1 s\u00fabory na \u0161ifrovanie\n<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Sna\u017e\u00ed sa ukon\u010di\u0165 proces, ktor\u00fd pou\u017e\u00edva s\u00fabor, ktor\u00fd chce za\u0161ifrova\u0165<\/li>\n<li> Premenov\u00e1va s\u00fabor na \u201eP\u00f4vodn\u00e9_meno_s\u00faboru.SaveTheQueenING\u201c pomocou funkcie MoveFile a za\u0161ifruje ho <\/li>\n<li>Po tom, \u010do je s\u00fabor za\u0161ifrovan\u00fd verejn\u00fdm k\u013e\u00fa\u010dom autora, malware ho znova premenov\u00e1va, tentoraz na \"P\u00f4vodn\u00e9_meno_s\u00faboru.SaveTheQueen\"<\/li>\n<li>Prebieha z\u00e1pis s\u00faboru s po\u017eiadavkou na v\u00fdkupn\u00e9 do tej istej zlo\u017eky\n<p><img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nNa z\u00e1klade pou\u017eitia nat\u00edvnej funkcie \u201eCreateDecryptor\u201c sa zd\u00e1, \u017ee jedna z funkci\u00ed malv\u00e9ru obsahuje ako parameter mechanizmus de\u0161ifrovania vy\u017eaduj\u00faci s\u00fakromn\u00fd k\u013e\u00fa\u010d.<\/p>\n<p>Ransomv\u00e9r <strong>NE \u0161ifruje s\u00fabory<\/strong>, ktor\u00e9 s\u00fa ulo\u017een\u00e9 v adres\u00e1roch:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>Tie\u017e ne <strong>NE \u0161ifruje nasleduj\u00face typy s\u00faborov:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> Zhrnutia a z\u00e1very<\/h2>\n<\/h2>\n<p>\nNapriek tomu, \u017ee s\u00e1m ransomv\u00e9r nemal \u017eiadne nezvy\u010dajn\u00e9 funkcie, \u00fato\u010dn\u00edk kreat\u00edvne vyu\u017eil Active Directory na \u0161\u00edrenie droppers, pri\u010dom samotn\u00fd malv\u00e9r n\u00e1m poskytol zauj\u00edmav\u00e9, i ke\u010f nakoniec nie zlo\u017eitosti po\u010das anal\u00fdzy. <\/p>\n<p>Mysl\u00edme si, \u017ee autor malv\u00e9ru:<\/p>\n<ol>\n<li>Nap\u00edsal ransomv\u00e9r so zabudovan\u00fdm zasaden\u00edm do procesu winlogon.exe, ako aj<br \/>\nfunkcionalitou \u0161ifrovania a de\u0161ifrovania s\u00faborov<\/li>\n<li>Maskoval malv\u00e9r pomocou ConfuserEx, transformoval v\u00fdsledok pomocou Donut a dodato\u010dne skryl dropper base64 Gzip<\/li>\n<li>Z\u00edskal zv\u00fd\u0161en\u00e9 opr\u00e1vnenia v dom\u00e9ne obete a pou\u017eil ich na kop\u00edrovanie<br \/>\nza\u0161ifrovan\u00e9ho malv\u00e9ru a \u00faloh napl\u00e1novan\u00fdch v sieti SYSVOL dom\u00e9nov\u00fdch kontrolerov<\/li>\n<li>Spustil skript PowerShell na zariadeniach v dom\u00e9ne na \u0161\u00edrenie malv\u00e9ru a zaznamen\u00e1vanie progresu \u00fatoku do z\u00e1znamov v SYSVOL<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"K\u00fap si kr\u00e1\u013eovn\u00fa: Varonis vy\u0161etril r\u00fdchlo sa \u0161\u00edriaci ransomv\u00e9r \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAk m\u00e1te ot\u00e1zky k tomuto variantu ransomv\u00e9ru alebo k ak\u00fdmko\u013evek in\u00fdm \u010din\u00edkom, ktor\u00e9 na\u0161e t\u00edmy vykonali pri forenznej anal\u00fdze a vy\u0161etren\u00ed incidentov v oblasti kybernetickej bezpe\u010dnosti, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">kontaktujte n\u00e1s <\/a><\/noindex> alebo si vy\u017eiadajte <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">\u017eiv\u00fa demon\u0161tr\u00e1ciu reakcie na \u00fatoky<\/a><\/noindex>, kde v\u017edy odpoved\u00e1me na ot\u00e1zky v r\u00e1mci sekcie ot\u00e1zok a odpoved\u00ed.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 V\u00fdkupn\u00e9 \u2014 ako kr\u00e1\u013eovn\u00e1: Varonis vy\u0161etruje r\u00fdchlo sa \u0161\u00edriaci \u0161ifrovate\u013e \u201eSaveTheQueen\u201c | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}