Ryuk ืืื ืืืื ืขืจ ืคืื ืื ืืขืจืกื ืืึทืจืืื ืจืึทื ืกืึธืืืืึทืจืข ืึธืคึผืฆืืขืก ืืื ืื ืืขืฆืืข ืืึธืจื. ืืื ื ืขืก ืขืจืฉืืขืจ ืืจืืืก ืืื ืื ืืืืขืจ ืคืื 2018, ืขืก ืืื ืืขืืืืื , ืกืคึผืขืฆืืขื ืืื ืื ืืขืฉืขืคื ืกืืืืืืข, ืืืึธืก ืืื ืืขืจ ืืืืคึผื ืฆืื ืคืื ืืืึทื ืื ืคืืื.
1. ืึทืืืขืืืื ืข ืืื ืคึฟืึธืจืืึทืฆืืข
ืืขืจ ืืึธืงืืืขื ื ืึผืืื ืึทื ืึทื ืึทืืืกืืก ืคืื ืื Ryuk ืจืึทื ืกืึธืืืืึทืจืข ืืืึทืจืืึทื ื, ืืื ืืขืืื ื ืืื ืื ืืึธืืืขืจ ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืืึธืืืื ื ืื ืืึทืืืืึทืจืข ืืื ืื ืกืืกืืขื.
ืื Ryuk ืจืึทื ืกืึธืืืืึทืจืข ืขืจืฉืืขืจ ืืจืืืก ืืื ืื ืืืืขืจ ืคืื 2018. ืืืื ืขืจ ืคืื ืื ืืืคืขืจืึทื ืกืื ืฆืืืืฉื Ryuk ืืื ืื ืืขืจืข ืจืึทื ืกืึธืืืืึทืจืข ืืื ืึทื ืขืก ืืื ืึทืืืขื ืฆื ืืึทืคืึทืื ืคึฟืืจืืข ืื ืืืืืจืึทื ืืึทื ืฅ.
ืืื ืืืื 2019, ืกืืืืขืจ ืงืจืืืื ืึทื ืืจืืคึผืขืก ืึทืืึทืงืืจื ืึท ืจืืืืง ื ืืืขืจ ืคืื ืฉืคึผืึทื ืืฉ ืงืึธืืคึผืึทื ืืขืก ื ืืฆื ืืขื ืจืึทื ืกืึธืืืืึทืจืข.
ืจืืืก. 1: ืืืืกืฆืื ืคืื El Confidencial ืืืขืื ืื Ryuk ืจืึทื ืกืึธืืืืึทืจืข ืืึทืคืึทืื [1]
ืจืืืก. 2: ืืืืกืฆืื ืคืื El Paรญs ืืืขืื ืึทื ืืึทืคืึทืื ืืขืคืืจื ืืื ืื Ryuk ืจืึทื ืกืึธืืืืึทืจืข [2]
ืืขื ืืึธืจ, ืจืืืง ืืื ืึทืืึทืงืืจื ืึท ืืจืืืก ื ืืืขืจ ืคืื ืงืึธืืคึผืึทื ืืขืก ืืื ืคืึทืจืฉืืื ืืขื ืืขืจ. ืืื ืืืจ ืงืขื ืขื ืืขื ืืื ืื ืคืืืืขืจื ืืื ืื, ืืืึทืืฉืืึทื ื, ืืฉืืื ืึท, ืึทืืืืฉืืจืืึท ืืื ืื ืืืึท ืืขื ืขื ืื ืืึทืจืืึทืกื ืฉืืึธืื.
ืืืจื ืงืึทืืคึผืขืจืื ื ืื ื ืืืขืจ ืคืื ืกืืืืขืจ ืึทืืึทืงืก, ืืืจ ืงืขื ืขื ืืขื ืึทื Ryuk ืืื ืึทืคืขืงืืึทื ืืืืืึทื ื ืคืื ื ืืฆืขืจืก ืืื ืงืึทืืคึผืจืึทืืืืื ืึท ืจืืืืง ืกืืืข ืคืื โโืืึทืื, ืจืืืึทืืืื ื ืืื ืฉืืจืขื ื ืขืงืึธื ืึธืืืฉ ืึธื ืืืขืจ.
ืจืืืก. 3: ืืืืืกืืจืืฆืืข ืคืื โโืจืืืง ืก ืืืืืืืข ืืขืืืงืืื.
ืจืืืก. 4: 16 ืืขื ืืขืจ ืืขืจืกื ืึทืคืขืงืืึทื ืืืจื Ryuk
ืจืืืก. 5: ื ืืืขืจ ืคืื ืืืืขืจื ืึทืืึทืงืืจื ืืืจื Ryuk ืจืึทื ืกืึธืืืืึทืจืข (ืืื ืืืืืึทื ื)
ืืืื ืื ืืขืืืืื ืืืขื ืึธืคึผืขืจืืืืื ื ืคึผืจืื ืฆืืคึผ ืคืื ืึทืืึท ืืจืขืฅ, ืืขื ืจืึทื ืกืึธืืืืึทืจืข, ื ืึธื ืขื ืงืจืืคึผืฉืึทื ืืื ืืึทื ืฅ, ืืืืืื ืื ืงืึธืจืื ืึท ืืืกืืืืืืขืื ืึธื ืืึธื ืืืึธืก ืืืื ืืืื ืืึทืฆืึธืื ืืื ืืืืงืึธืื ืก ืฆื ืื ืกืคึผืขืกืืคืืขื ืึทืืจืขืก ืฆื ืืืงืขืจื ืึทืงืกืขืก ืฆื ืื ืื ืงืจืืคึผืืื ืืขืงืขืก.
ืืขื ืืึทืืืืึทืจืข ืืื ืืขืืืื ืืื ื ืขืก ืืื ืืขืืืขื ืขืจืฉืืขืจ ืืึทืงืขื ืขื .
ืื ืืืึทืจืืึทื ื ืคืื ืืขื ืกืึทืงืึธื ืข ืึทื ืึทืืืืื ืืื ืืขื ืืึธืงืืืขื ื ืืื ืืืกืงืึทืืืขืจื ืืขืฉืึทืก ืึทื ืืึทืคืึทืื ืคึผืจืืืื ืืื ืืื ืืืจ 2020.
ืจืขืื ืฆื ืืืื ืงืึทืืคึผืืขืงืกืืื, ืืขื ืืึทืืืืึทืจืข ืืื ืึธืคื ืึทืืจืืืืึทืืึทื ืฆื ืึธืจืืึทื ืืืืจื ืกืืืืขืจืงืจืืืื ืึทื ืืจืืคึผืขืก, ืืืื ืืืงืื ื ืืื APT ืืจืืคึผืขืก.
ืืืื ืคืื ืื Ryuk ืงืึธื ืืื ืึท ืืืืขืจืงื ืขื ืืขืืงืืื ืฆื ืื ืงืึธื ืืื ืกืืจืืงืืืจ ืคืื ืื ืื ืืขืจ ืืึทืืืืกื ืจืึทื ืกืึธืืืืึทืจืข, ืืขืจืืขืก, ืืื ืืืึธืก ืืื ืืืืื ืึท ื ืืืขืจ ืคืื ืืืืขื ืืงืึทื ืคืึทื ืืงืฉืึทื ื. ืืึธืก ืืื ืืืึธืก ืจืืืง ืืื ืืขืืืขื ืืืืืขืก ืืื ืืงื ืฆื ืื ืฆืคืื ืงืึธืจืขืึดืฉ ืืจืืคึผืข Lazarus, ืืืึธืก ืืื ืืขืจ ืฆืืื ืืื ืืขืืืขื ืกืึทืกืคึผืขืงืืื ืคืื ืืืื ืืื ืืขืจ ืื ืืขืจืืขืก ืจืึทื ืกืึธืืืืึทืจืข.
CrowdStrike's Falcon X ืกืขืจืืืืก ืืขืจื ืึธื ืืืืขืจืงื ืึทื Ryuk ืืื ืืื ืคืึทืงื ืืืฉืืคื ืืืจื ืื WIZARD SPIDER ืืจืืคึผืข [4].
ืขืก ืืื ืขืืืขืืข ืืึธืื ืฆื ืฉืืืฆื ืืขื ืืึทืฉืึธืจืข. ืขืจืฉืืขืจ, ืืขื ืจืึทื ืกืึธืืืืึทืจืข ืืื ืืขืืืขื ืึทืืืืขืจืืืืื ืืืืฃ ืื ืืืขืืืืืื exploit.in, ืืืึธืก ืืื ืึท ืืึทืืืืกื ืจืืกืืฉ ืืึทืืืืึทืจืข ืืึทืจืง ืืื ืืื ืืื ืึทืืขืจ ืืขืืืขื ืคึฟืึทืจืืื ืื ืืื ืขืืืขืืข ืจืืกืืฉืข APT ืืจืืคึผืขืก.
ืืขืจ ืคืึทืงื ืจืืืึทืืฅ ืืืืก ืื ืืขืึธืจืืข ืึทื Ryuk ืงืขื ืืืื ืืขืืืขืืึธืคึผืขื ืืืจื ืื Lazarus APT ืืจืืคึผืข, ืืืืึทื ืขืก ืืื ื ืืฉื ืคึผืึทืกืืง ืืื ืื ืืืขื ืื ืืจืืคึผืข ืึทืคึผืขืจืืืฅ.
ืืื ืึทืืืฉืึทื, ืจืืืง ืืื ืืขืืืขื ืึทืืืืขืจืืืืื ืืื ืึท ืจืึทื ืกืึธืืืืึทืจืข ืืืึธืก ืืืขื ื ืืฉื ืึทืจืืขืื ืืืืฃ ืจืืกืืฉ, ืืืงืจืืื ืืฉ ืืื ืืขืืึธืจืืกืืฉ ืกืืกืืขืืขื. ืืขืจ ืึธืคึผืคืืจืื ื ืืื ืืืฉืืืกื ืืืจื ืึท ืฉืืจืื ืืขืคึฟืื ืขื ืืื ืขืืืขืืข ืืืขืจืกืืขืก ืคืื Ryuk, ืืื ืขืก ืืฉืขืงืก ืื ืฉืคึผืจืึทื ืคืื ืื ืกืืกืืขื ืืืืฃ ืืืึธืก ืื ืจืึทื ืกืึธืืืืึทืจืข ืืื ืคืืืกื ืืืง ืืื ืกืืึทืคึผืก ืขืก ืคืื ืคืืืกื ืืืง ืืืื ืื ืกืืกืืขื ืืื ืึท ืจืืกืืฉ, ืืืงืจืืื ืืฉ ืึธืืขืจ ืืขืืึธืจืืกืืฉ ืฉืคึผืจืึทื. ืฆืื ืกืืฃ, ืึทื ืขืงืกืคึผืขืจื ืึทื ืึทืืืกืืก ืคืื ืื ืืึทืฉืื ืืืึธืก ืืื ืืขืืืขื ืืึทืงื ืืืจื ืื WIZARD SPIDER ืืึทื ืฉืึทืคึฟื ืื ืืคืืขืงื ืขืืืขืืข "ืึทืจืืึทืคืึทืงืฅ" ืืืึธืก ืืขื ืขื ืึทืืขืืืฉืึทืืื ืืขื ืืฆื ืืื ืืขืจ ืึทื ืืืืืงืืื ื ืคืื Ryuk ืืื ืึท ืืืึทืจืืึทื ื ืคืื ืื ืืขืจืืขืก ืจืึทื ืกืึธืืืืึทืจืข.
ืืืืฃ ืื ืื ืืขืจืข ืืึทื ื, ืขืงืกืคึผืขืจืฅ Gabriela Nicolao ืืื Luciano Martins ืกืึทืืืืฉืขืกืืื ืึทื ืื ืจืึทื ืกืึธืืืืึทืจืข ืงืขื ืืืื ืืขืืืขืืึธืคึผืขื ืืืจื ืื APT ืืจืืคึผืข CryptoTech [5].
ืืึธืก ืงืืื ืคึฟืื ืืขื ืคืึทืงื ืึทื ืขืืืขืืข ืืืฉืื ืืืืืขืจ ืื ืืืืกืืขื ืคืื Ryuk, ืื ืืจืืคึผืข ืืึธื ืึทืจืืึทื ืืขืฉืืงื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืืฃ ืืขื ืคืึธืจืื ืคืื ืืขืจ ืืขืืืืงืขืจ ืคึผืืึทืฅ ืึทื ืืื ืืึธืื ืืขืืืขืืึธืคึผืขื ืึท ื ืืึทืข ืืืขืจืกืืข ืคืื โโโโืืขืจ ืืขืจืืขืก ืจืึทื ืกืึธืืืืึทืจืข.
ืขืืืขืืข ืคืึธืจืื ืืืืขืจื ืืขืคืจืขืื ืฆื CryptoTech ืึทืงืฉืื ืืืฉืืคื Ryuk. ืื ืืจืืคืข ืืื ืืื ืืขืืืื ืคืืจืืืืืืงื ืืื ืืขืจืงืืขืจื ืื ืื ืืื ืืืืืืืื ืื ืืื ืืืื ืื ืืืืืงืื 100% ืคืื ืื ืจืึทื ืกืึธืืืืึทืจืข.
2. ืงืขืจืึทืงืืขืจืืกืืืงืก
ืืืจ ืึธื ืืืืื ืืื ืื ืืึธืึธืืืึธืึทืืขืจ, ืืืขืืขื ืก ืึทืจืืขื ืืื ืฆื ืืืขื ืืืคืืฆืืจื ืื ืกืืกืืขื ืขืก ืืื ืืืืฃ ืึทืืื ืึทื ืื "ืจืืืืืง" ืืืขืจืกืืข ืคืื โโืื Ryuk ืจืึทื ืกืึธืืืืึทืจืข ืงืขื ืขื ืืืื ืืึธื ืืฉื.
ืื ืืึธืึธืืืึธืึทืืขืจ ืืึทืฉ ืืื ืืื ืืืื:
MD5 A73130B0E379A989CBA3D695A157A495
SHA256 EF231EE1A2481B7E627921468E79BB4369CCFAEB19A575748DD2B664ABC4F469
ืืืื ืขืจ ืคืื ืื ืคึฟืขืึดืงืืืื ืคืื ืืขื ืืึธืืื ืืึธืึทืืขืจ ืืื ืึทื ืขืก ืึผืืื ืงืืื ืืขืืึทืืึทืืึท, ื.ื. ืื ืงืจืืืืืขืจื ืคืื ืืขื ืืึทืืืืึทืจืข ืืึธืื ื ืืฉื ืึทืจืืึทื ืืขืจืขืื ื ืงืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืขืก.
ืืื ืืื ืึทืจืืึทื ื ืขืืขื ืขืจืึธืื ืืึทืก ืืึทืื ืฆื ืืจืืง ืื ืืึทื ืืฆืขืจ ืฆื ืืจืึทืืื ืืื ืืืืคื ืึท ืืึทืืืฉืืืึทืืึทื ืึทืคึผืืึทืงืืืฉืึทื. ืึธืืขืจ, ืืื ืืืจ ืืืขืื ืืขื ืฉืคึผืขืืขืจ, ืืืื ืื ืื ืคืขืงืฆืืข ืืื ื ืืฉื ืึทืจืืึทื ืฆืืขื ืืึทื ืืฆืขืจ ืื ืืขืจืึทืงืฉืึทื (ืืื ืืื ืืขืจ ืคืึทื ืืื ืืขื ืจืึทื ืกืึธืืืืึทืจืข), ืึทืืึทืงืขืจื ืืึธื ื ืื ืืึทืืจืึทืืื ืขืก ื ืืืืืง ืฆื ื ืืฆื ืืขืืึทืืึทืืึท.
ืจืืืก. 6: ืืืกืืขืจ ืืขืืึท ืืึทืืึท
ืืขืจ ืืืกืืขืจ ืืื ืืขืืืขื ืงืึทืืคึผืืืื ืืื 32-ืืืกื ืคึฟืึธืจืืึทื ืึทืืื ืึทื ืขืก ืงืขื ืขื ืืืืคื ืืืืฃ ืืืืืข 32-ืืืกื ืืื 64-ืืืกื ืกืืกืืขืืขื.
3. ืืืจืืืจืื ื ืืืขืงืืึธืจ
ืืขืจ ืืืกืืขืจ ืืืึธืก ืืึทืื ืืึธืืื ืืื ืืืืคื Ryuk ืืื ืืจืืื ืืื ืืื ืืืขืจ ืกืืกืืขื ืืืจื ืึท ืืืืึทื ืงืฉืจ, ืืื ืื ืึทืงืกืขืก ืคึผืึทืจืึทืืขืืขืจืก ืืขื ืขื ืืืงืืืขื ืืืจื ืึท ืคึผืจืืืืืึทื ืขืจื RDP ืืึทืคืึทืื.
ืจืืืก. 7: ืึทืืึทืง ืจืขืืืกืืจืืจื
ืืขืจ ืึทืืึทืงืขืจ ืืขืจืืื ืฆื ืึทืจืืึทื ืืึธืืืจื ืื ืกืืกืืขื ืจืืืึธืืืื. ื ืึธื ืืขื, ืขืจ ืืืฉืืคื ืึท ืขืงืกืขืงืืืึทืืืข ืืขืงืข ืืื ืืื ืืืขืจ ืืืกืืขืจ.
ืืขื ืขืงืกืขืงืืืึทืืืข ืืขืงืข ืืื ืืคืืขืฉืืขืื ืืืจื ืึทื ืึทื ืืืืืืจืืก ืืืืืื ื ืืืืืขืจ ืคืืืกื ืืืง.
ืจืืืก. 8: ืืืกืืขืจ ืฉืืึธืก
ืจืืืก. 9: ืืืกืืขืจ ืฉืืึธืก
ืืืขื ืื ืืืืืข ืืขืงืข ืืื ืืคืืขืฉืืขืื, ืืขืจ ืึทืืึทืงืขืจ ืืขืคืจืืืื ืฆื ืึธืคึผืืึธืืืจื ืึท ืื ืงืจืืคึผืืื ืืืขืจืกืืข ืคืื โโืื ืขืงืกืขืงืืืึทืืืข ืืขืงืข, ืืืึธืก ืืื ืืืื ืืคืืขืฉืืขืื.
ืจืืืก. 10: ืกืืื ืคืื ืกืึทืืคึผืึทืื ืึทื ืื ืึทืืึทืงืขืจ ืืขืคืจืืืื ืฆื ืืืืคื
ืฆืื ืกืืฃ, ืขืจ ืืขืคืจืืืื ืฆื ืึธืคึผืืึธืืืจื ืื ืื ืืขืจ ืืืืืข ืืขืงืข ืืืจื ืื ืื ืงืจืืคึผืืื ืงืึทื ืกืึธืื
PowerShell ืฆื ืืืืคึผืึทืก ืึทื ืืืืืืจืืก ืฉืืฅ. ืืืขืจ ืขืจ ืืื ืืืื ืืืืงืืจื ืืขืืืืจื.
ืจืืืก. 11: PowerShell ืืื ืืืืืข ืืื ืืึทืื ืืคืืขืฉืืขืื
ืจืืืก. 12: PowerShell ืืื ืืืืืข ืืื ืืึทืื ืืคืืขืฉืืขืื
4. ืืึธืืืขืจ
ืืืขื ืขืก ืขืงืกืึทืงืืืฅ, ืขืก ืฉืจืืืื ืึท ืจืขืึทืืืข ืืขืงืข ืฆื ืืขืจ ืืขืงืข % temp%, ืืืึธืก ืืื ืืืคึผืืฉ ืคึฟืึทืจ ืจืืืง. ืืขืจ ืืขืงืข ืืื ืึท ืืืกืืืืืืขืื ืืื ืึทื E- ืืจืืื ืึทืืจืขืก ืืื ืื ืคึผืจืึธืืึธืืืึทืื ืคืขืื, ืืืึธืก ืืื ืืึทื ืฅ ืคึผืจืึธืกื ืืื ืืขื ืืึทืืืืึทืจืข ืืฉืคึผืื: [ืืืืขืื ืืืฉืืฆื]
ืจืืืก. 13: ืจืึทื ืกืึธื ืคืึธืืขืจืื ื
ืืฉืขืช ืื ืืึธืึธืืืึธืึทืืขืจ ืืื ืคืืืกื ืืืง, ืืืจ ืงืขื ืขื ืืขื ืึทื ืขืก ืืึธื ืืฉืื ืขืืืขืืข ืขืงืกืขืงืืืึทืืืข ืืขืงืขืก ืืื ืืจืึทืค - ื ืขืืขื. ืืื ืืขื ืขื ืกืืึธืจื ืืื ืึท ืคืึทืจืืึธืจืื ืืขืงืข ืขืคื ืืืขื, ืึธืืขืจ ืืืื ืื ืึธืคึผืฆืืข ืืื ื ืืฉื ืึทืงืืืื ืืื ืื ืึธืคึผืขืจืืืืื ื ืกืืกืืขื "ืืืืึทืื ืคืึทืจืืึธืจืื ืืขืงืขืก ืืื ืคืึธืืืขืจืก", ืืขืืื ื ืฐืขื ื ื ืฒ ืืืฒื ื ืืืืืื ื . ืืขืจืฆื, ืื ืืขืงืขืก ืืขื ืขื 64-ืืืกื, ื ืื ืขื ืืขื ืื ืคืึธืืขืจ ืืขืงืข, ืืืึธืก ืืื 32-ืืืกื.
ืจืืืก. 14: ืขืงืกืขืงืืืึทืืืข ืืขืงืขืก ืืึธื ืืฉื ืืืจื ืื ืืืกืืขืจ
ืืื ืืืจ ืงืขื ืขื ืืขื ืืื ืื ืืืื ืืืืื, Ryuk ืืึธื ืืฉืื icacls.exe, ืืืึธืก ืืืขื ืืืื ืืขืืืืื ื ืฆื ืืึธืืืคืืฆืืจื ืึทืืข ืึทืงืืก (ืึทืงืกืขืก ืงืึธื ืืจืึธื ืจืฉืืืืช), ืึทืืื ืื ืฉืืจืื ื ืึทืงืกืขืก ืืื ืืึธืืืคืืงืึทืืืึธื ืคืื ืคืืึทืืก.
ืขืก ืืขืฅ ืคืื ืึทืงืกืขืก ืืื ืืขืจ ืึทืืข ืืืืขืจื ืฆื ืึทืืข ืืขืงืขืก ืืืืฃ ืื ืืืื (/ ื) ืจืึทืืึทืจืืืึทืก ืคืื ืขืจืจืึธืจืก (/ C) ืืื ืึธื ืืืืืืื ื ืงืืื ืึทืจืืืงืืขื (/ ืง).
ืจืืืก. 15: ืืืจืืคืืจืื ื ืคึผืึทืจืึทืืขืืขืจืก ืคืื icacls.exe ืืึธื ืืฉื ืืืจื ืื ืืืกืืขืจ
ืขืก ืืื ืืืืืืืง ืฆื ืืึธื ืึทื Ryuk ืืฉืขืงืก ืืืึธืก ืืืขืจืกืืข ืคืื โโโโWindows ืืืจ ืืืืคื. ืคึฟืึทืจ ืืขื ืขืจ
ืคึผืขืจืคืึธืจืื ืึท ืืืขืจืกืืข ืืฉืขืง ื ืืฆื GetVersionExW, ืืื ืืืึธืก ืขืก ืืฉืขืงืก ืื ืืืขืจื ืคืื ืื ืคืึธื lpVersionInformationืืืึธืก ืื ืืืงืืืฅ ืฆื ืื ืงืจืึทื ื ืืืขืจืกืืข ืคืื โโWindows ืืื ื ืืึทืขืจ ืืื ืคึฟืขื ืฆืืขืจ ืงืกืคึผ.
ืืขืคึผืขื ืืื ื ืืืืฃ ืฆื ืืืจ ืืืืคื ืึท ืืืขืจืกืืข ืฉืคึผืขืืขืจ ืืื Windows XP, ืื ืฉืืืืื ืืึธืืืขืจ ืืืขื ืฉืจืืึทืื ืฆื ืื ืืืืข ืืึทื ืืฆืขืจ ืืขืงืข - ืืื ืืขื ืคืึทื ืฆื ืืขืจ ืืขืงืข %ืขืคื ืืืขื%.
ืจืืืก. 17: ืงืึธื ืืจืึธืืืจืื ื ืื ืึธืคึผืขืจืืืืื ื ืกืืกืืขื ืืืขืจืกืืข
ืืขืจ ืืขืงืข ืืืึธืก ืืื ืืขืฉืจืืื ืืื Ryuk. ืขืก ืืขืืึธืื ืืืืคื ืขืก, ืืืื ืคืืจืืื ืืืื ืืืืืขื ืข ืึทืืจืขืก ืืื ืึท ืคึผืึทืจืึทืืขืืขืจ.
ืจืืืก. 18: ืืืกืคืืจื Ryuk ืืืจื ShellExecute
ืืขืจ ืขืจืฉืืขืจ ืืึทื ืืืึธืก Ryuk ืืื ืืื ืฆื ืืึทืงืืืขื ืื ืึทืจืืึทื ืฉืจืืึทื ืคึผืึทืจืึทืืขืืขืจืก. ืืึธืก ืืึธื ืขืก ืืขื ืขื ืฆืืืื ืึทืจืืึทื ืฉืจืืึทื ืคึผืึทืจืึทืืขืืขืจืก (ืื ืขืงืกืขืงืืืึทืืืข ืืื ืืื ืื ืืจืึทืคึผืขืจ ืึทืืจืขืก) ืืืึธืก ืืขื ืขื ืืขื ืืฆื ืฆื ืืึทืืืึทืืืงื ืืืื ืืืืืขื ืข ืืจืึทืกืขืก.
ืจืืืก. 19: ืงืจืืืืืื ื ืึท ืคึผืจืึธืฆืขืก
ืืืจ ืงืขื ื ืืืื ืืขื ืึทื ืึทืืึธื ืขืก ืืื ืืืืคื ืืืื ืขืงืกืขืงืืืึทืืืขืก, ืขืก ืืืกืืขืงื ืืื, ืึทืืื ืืึธืื ืงืืื ืฉืคึผืืจ ืคืื ืืืื ืืืืืขื ืข ืืืึทืืืึทื ืืื ืืขืจ ืืขืงืข ืืื ืขืก ืืื ืืขืืืขื ืขืงืกืึทืงืืืืึทื.
ืจืืืก. 20: ืืืืืืื ื ืึท ืืขืงืข
5. RYUK
5.1 ืืืึทืืืึทื
Ryuk, ืืื ืื ืืขืจืข ืืึทืืืืึทืจืข, ืคืจืืืื ืฆื ืืืืืื ืืืืฃ ืื ืกืืกืืขื ืืื ืืึทื ื ืืื ืืขืืืขื. ืืื ืืขืืืืื ืืืืื, ืืืื ืืืขื ืฆื ืืขืจืืจืืืื ืืขื ืฆืื ืืื ืฆื ืืขืกืึธื ืฉืึทืคึฟื ืืื ืืืืคื ืขืงืกืขืงืืืึทืืืข ืืขืงืขืก. ืฆื ืืึธื ืืึธืก, ืื ืืขืจืกื ืคึผืจืึธืกื ืคืืจ ืืื ืฆื ืืืืฉื ืื ืจืขืืืกืืจื ืฉืืืกื CurrentVersionRun.
ืืื ืืขื ืคืึทื, ืืืจ ืงืขื ืขื ืืขื ืึทื ืคึฟืึทืจ ืืขื ืฆืืืขืง ืืขืจ ืขืจืฉืืขืจ ืืขืงืข ืฆื ืืืื ืืึธื ืืฉื VWjRF.exe
(ืืขืงืข ื ืึธืืขื ืืื ืจืึทื ืืึทืืื ืืืฉืขื ืขืจืืืืึทื) ืืึธื ืืฉืื ืงืื.ืขืงืกืข.
ืจืืืก. 21: ืขืงืกืึทืงืืืืื ื VWjRF.exe
ืืขืจื ืึธื ืึทืจืืึทื ืื ืืึทืคึฟืขื RUN ืืื ื ืึธืืขื "svchos". ืืืื, ืืืื ืืืจ ืืืืื ืฆื ืงืึธื ืืจืึธืืืจื ืื ืจืขืืืกืืจื ืฉืืืกืืขื ืืื ืงืืื ืฆืืึทื, ืืืจ ืงืขื ืขื ืืืืื ืคืึทืจืคืืจื ืืขื ืขื ืืขืจืื ื, ืืขืืขืื ืื ืขื ืืขืืงืืื ืคืื ืืขื ื ืึธืืขื ืืื ืกืืืืฉืึธืกื. ืืึทื ืง ืฆื ืืขื ืฉืืืกื, Ryuk ืื ืฉืืจื ืืืึทื ืืืึทืืืึทื ืืื ืื ืกืืกืืขื. ืืืื ืื ืกืืกืืขื ืืื ื ืืฉื. ื ืึธื ืื ืคืขืงืืึทื, ืืืขื ืืืจ ืจืขืืึธืึธื ืื ืกืืกืืขื, ืื ืขืงืกืขืงืืืึทืืืข ืืืขื ืคึผืจืืืืจื ืืืืืขืจ.
ืจืืืก. 22: ืืขืจ ืืืกืืขืจ ืื ืฉืืจื ืืืึทืืืึทื ืืื ืื ืจืขืืืกืืจื ืฉืืืกื
ืืืจ ืงืขื ืขื ืืืื ืืขื ืึทื ืื ืขืงืกืขืงืืืึทืืืข ืกืืึทืคึผืก ืฆืืืื ืืึทืืื ืื ืืก:
"ืึทืืืืึธืขื ืืคึผืึธืื ืืืืืืืขืจ", ืืืึธืก, ืืื ืืืื ื ืึธืืขื ืกืึทืืืืฉืขืก, ืงืึธืจืึทืกืคึผืึทื ืื ืฆื ืกืืกืืขื ืึทืืืืึธ,
ืจืืืก. 23: ืืืกืืขืจ ืกืืึทืคึผืก ืื ืกืืกืืขื ืึทืืืืึธ ืืื ืกื
ะธ Samss, ืืืึธืก ืืื ืึท ืืฉืืื ืคืึทืจืืืึทืืืื ื ืืื ืกื. ืกืืึธืคึผืคึผืื ื ืื ืฆืืืื ืืึทืืื ืื ืืก ืืื ืึท ืืึทืจืึทืงืืขืจืืกืืืฉ ืคืื Ryuk. ืืื ืืขื ืคืึทื, ืืืื ืื ืกืืกืืขื ืืื ืงืึธื ื ืขืงืืขื ืฆื ืึท SIEM ืกืืกืืขื, ืื ืจืึทื ืกืึธืืืืึทืจืข ืคืจืืืื ืฆื ืืึทืืื ืฉืืงื ืฆื ืงืืื ืืืึธืจื ืื ืื. ืืื ืืขื ืืืขื, ืขืจ ืคึผืจืึทืืขืงืฅ ืืืื ืืืืึทืืขืจ ืกืืขืคึผืก ืืื ื ืขืืืขืืข SAM ืืึทืืื ืื ืืก ืืืขืื ื ืืฉื ืงืขื ืขื ืฆื ืึธื ืืืืื ืืืืขืจ ืึทืจืืขื ืจืืืืืง ื ืึธื ืขืงืกืึทืงืืืืื ื Ryuk.
ืจืืืก. 24: ืืืกืืขืจ ืกืืึทืคึผืก ืกืึทืืกืก ืืื ืกื
5.2 ืคึผืจืืืืืืึทืืืฉืึทื
ืืื ืึทืืืขืืืื, Ryuk ืกืืึทืจืฅ ืืืจื ืืึธืืืื ื ืืึทืืขืจืึทื ืืื ืื ื ืขืฅ ืึธืืขืจ ืขืก ืืื ืืึธื ืืฉื ืืืจื ืื ืื ืืขืจ ืืึทืืืืึทืจืข ืึทืืึท ืืื ืึธืืขืจ , ืืืึธืก, ืืื ืื ืืขืฉืขืขื ืืฉ ืคืื ืคึผืจืืืืืืขืืืข ืขืกืงืึทืืืจืื ื, ืึทืจืืืขืจืคืืจื ืื ืขืืขืืืึทืืขื ืจืขืื ืฆื ืื ืจืึทื ืกืึธืืืืึทืจืข.
ืคืจืืขืจ, ืืื ืึท ืืงืืื ืฆื ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคึผืจืึธืฆืขืก, ืืืจ ืืขื ืืื ืืืจืืคืืจื ืืขื ืคึผืจืึธืฆืขืก ืืืคึผืขืจืกืึธื ืึทืืขืกืขืืฃ, ืืืึธืก ืืืื ืึทื ืื ืืืืขืจืืืื ืืื ืืึทืื ืคืื ืื ืึทืงืกืขืก ืกืืืขื ืืืขื ืืืื ืืืจืืืขืืื ืืขื ืฆื ืื ืืืึทื, ืืื ืขืก ืืืขื ืืืื ืืื ืจืืืจืืืื ืืื GetCurrentThread.
ืจืืืก. 25: ืจืืคื ืืืคึผืขืจืกืึธื ืึทืืขืกืขืืฃ
ืืขืจื ืึธื ืืืจ ืืขื ืึทื ืขืก ืืืขื ืคืึทืจืืื ืื ืึท ืึทืงืกืขืก ืกืืืขื ืืื ืึท ืคืึธืืขื. ืืืจ ืืืื ืืขื ืึทื ืืืื ืขืจ ืคืื ืื ืคืืึทืืก ืืื ืืขืืืืื ืึทืงืกืขืก, ืืืึธืก ืงืขื ืขื ืืืื ืืขืืืืื ื ืฆื ืงืึธื ืืจืึธืืืจื ืื ืึทืงืกืขืก ืืืึธืก ืื ืคืึธืืขื ืืืขื ืืึธืื. ืืื ืืขื ืคืึทื ืื ืืืขืจื ืึทื ืขืืงืก ืืืขื ืืึทืงืืืขื ืืึธื ืืืื TOKEN_ALL_ACCESS ืึธืืขืจ ืึทื ืืขืจืฉ - TOKEN_WRITE.
ืจืืืก. 26: ืงืจืืืืืื ื ืึท ืคืืึธื ืืึธืงืขื
ืืขืืึธืื ืขืจ ืืืขื ื ืืฆื SeDebugPrivilege ืืื ืืืขื ืืึทืื ืึท ืจืืฃ ืฆื ืืึทืงืืืขื ืืขืืื ืคึผืขืจืืืฉืึทื ื ืืืืฃ ืืขื ืคืึธืืขื, ืจืืืึทืืืื ื ืืื PROCESS_ALL_ACCESS, ืขืจ ืืืขื ืงืขื ืขื ืฆื ืฆืืืจืื ืงืืื ืคืืจืืื ืื ืคึผืจืึธืฆืขืก. ืืืฆื, ืืืืึทื ืื ืขื ืงืจืืคึผืืขืจ ืืื ืฉืืื ืึท ืฆืืืขืืจืืื ืืืึทื, ืึทืืข ืืืึธืก ืืืืืื ืืื ืฆื ืืืื ืืืืึทืืขืจ ืฆื ืื ืืขืฆื ืืื ืข.
ืจืืืก. 27: ืจืืคื SeDebugPrivilege ืืื ืคึผืจืืืืืืขืืืข ืขืกืงืึทืืึทืืืึธื ืคึฟืื ืงืฆืืข
ืืืืฃ ืื ืืืื ืืึทื ื, ืืืจ ืืึธืื LookupPrivilegeValueW, ืืืึธืก ืืื ืืื ืื ืื ื ืืืืืง ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืคึผืจืืืืืืึทืืืฉืึทื ืืืึธืก ืืืจ ืืืืื ืฆื ืคืึทืจืืจืขืกืขืจื.
ืจืืืก. 28: ืืขืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืคึผืจืืืืืืึทืืืฉืึทื ืคึฟืึทืจ ืคึผืจืืืืืืขืืืข ืขืกืงืึทืืืจืื ื
ืืืืฃ ืื ืื ืืขืจืข ืืึทื ื, ืืืจ ืืึธืื AdjustTokenPrivileges, ืฐื ืก ืืขืจืืืื ื ืืื ื ื ืืืงืืืข ื ื ื ื ืืืืืง ืข ืจืขืื ื ืฆ ื ืืื ืืืข ืจ ืฉืืจืื . ืืื ืืขื ืคืึทื, ืื ืืขืจืกื ืืืืืืืง ืืึทื ืืื ื ืื ืฉืืึทื, ืฐืขืืขื ืก ืคื ื ืฐืข ื ืฉืขื ืง ื ืคืจืืฐืืืขืืืขืก .
ืจืืืก. 29: ืืึทืฉืืขืืืงื ืคึผืขืจืืืฉืึทื ื ืคึฟืึทืจ ืึท ืกืืืขื
5.3 ืืืคึผืืึทืืขื ืืืืฉืึทื
ืืื ืืขื ืึธืคึผืืืืืื ื, ืืืจ ืืืขืื ืืืืึทืื ืืื ืืขืจ ืืืกืืขืจ ืคึผืขืจืคืึธืจืื ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคึผืจืึธืฆืขืก ืคืจืืขืจ ืืขืจืืื ื ืืื ืืขื ืืึทืจืืื.
ืืขืจ ืืืืคึผื ืฆืื ืคืื ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคึผืจืึธืฆืขืก, ืืื ืืขืืื ื ืืื ืขืกืงืึทืืืจืื ื, ืืื ืฆื ืืึทืงืืืขื ืึทืงืกืขืก ืฆื ืฉืึธืื ืงืืคืืขืก. ืฆื ืืึธื ืืึธืก, ืขืจ ืืึทืจืฃ ืฆื ืึทืจืืขืื ืืื ืึท ืคืึธืืขื ืืื ืจืขืื ืืขืืขืจ ืืื ืื ืคืื ืื ืืืืข ืืึทื ืืฆืขืจ. ืึทืืึธื ืขืก ืืืื ื ืึทืืึท ืขืืขืืืึทืืขื ืจืขืื, ืขืก ืืืขื ืืืกืืขืงื ืงืืคืืขืก ืืื ืืึทืื ืขื ืืขืจืื ืืขื ืฆื ืื ืืขืจืข ืคึผืจืึทืกืขืกืึทื ืืื ืกืืจ ืฆื ืืึทืื ืขืก ืืืืืขืืืขื ืฆื ืฆืืจืืงืงืืืขื ืฆื ืึท ืคืจืืขืจ ืืืงืขืจื ืคืื ื ืืื ืื ืึธืคึผืขืจืืืืื ื ืกืืกืืขื.
ืืื ืืืคึผืืฉ ืืื ืืขื ืืืคึผ ืคืื ืืึทืืืืึทืจืข, ืขืก ื ืืฆื CreateToolHelp32Snapshotืึทืืื ืขืก ื ืขืื ืึท ืืึธืืขื ืืืืื ืคืื ืื ืืืฆื ืคืืืกื ืืืง ืคึผืจืึทืกืขืกืึทื ืืื ืคืจืืืื ืฆื ืึทืงืกืขืก ืื ืคึผืจืึทืกืขืกืึทื ื ืืฆื OpenProcess. ืึทืืึธื ืขืก ืืืื ื ืึทืงืกืขืก ืฆื ืืขื ืคึผืจืึธืฆืขืก, ืขืก ืืืื ืึธืคึผืขื ืก ืึท ืกืืืขื ืืื ืืืึทื ืืื ืคึฟืึธืจืืึทืฆืืข ืฆื ืืึทืงืืืขื ืื ืคึผืจืึธืฆืขืก ืคึผืึทืจืึทืืขืืขืจืก.
ืจืืืก. 30: ืจืืืจืืืืื ื ืคึผืจืึทืกืขืกืึทื ืคืื ืึท ืงืึธืืคึผืืืืขืจ
ืืืจ ืงืขื ืขื ืืื ืึทืืืงืึทืืื ืืขื ืืื ืขืก ืืขืฅ ืื ืจืฉืืื ืคืื ืคืืืกื ืืืง ืคึผืจืึทืกืขืกืึทื ืืื ืจืืืื 140002D9C ื ืืฆื CreateToolhelp32Snapshot. ื ืึธื ืืืงืืืขื ืืื, ืขืจ ืืืื ืืืจื ืื ืจืฉืืื, ืืจืืื ื ืฆื ืขืคืขื ืขื ืคึผืจืึทืกืขืกืึทื ืืืื ืขืจ ืืืจื ืืืื ืขืจ ื ืืฆื OpenProcess ืืื ืขืจ ืกืึทืงืกืืืึทื. ืืื ืืขื ืคืึทื, ืืขืจ ืขืจืฉืืขืจ ืคึผืจืึธืฆืขืก ืขืจ ืืื ืืืืืืช ืฆื ืขืคืขื ืขื ืืื ืืขืืืขื "taskhost.exe".
ืจืืืก. 31: ืืื ืึทืืืฉ ืืืกืคืืจื ืึท ืคึผืจืึธืฆืขืืืจ ืฆื ืืึทืงืืืขื ืึท ืคึผืจืึธืฆืขืก
ืืืจ ืงืขื ืขื ืืขื ืึทื ืขืก ืืขืจื ืึธื ืืืืขื ื ืื ืคึผืจืึธืฆืขืก ืกืืืขื ืืื ืคึฟืึธืจืืึทืฆืืข, ืึทืืื ืขืก ืจืืคื OpenProcessToken ืืื ืคึผืึทืจืึทืืขืืขืจ "20008"
ืจืืืก. 32: ืืืืขื ืขื ืคึผืจืึธืฆืขืก ืกืืืขื ืืื ืคึฟืึธืจืืึทืฆืืข
ืขืก ืืืื ืืฉืขืงืก ืึทื ืืขืจ ืคึผืจืึธืฆืขืก ืขืก ืืืขื ืืืื ืื ืืืฉืขืงืืื ืืื ืืื ื ืืฉื ืงืกืจืกืก.ืขืงืกืข, explorer.exe, lsaas.exe ืึธืืขืจ ืึทื ืขืจ ืืื ืึท ืกืืื ืคืื ืจืขืื ื ื ืืืืืึธืจืืืขื.
ืจืืืก. 33: ืืงืกืงืืืืื ืคึผืจืึทืกืขืกืึทื
ืืืจ ืงืขื ืขื ืืื ืึทืืืงืึทืืื ืืขื ืืื ืขืก ืขืจืฉืืขืจ ืคึผืขืจืคืึธืจืื ืื ืืฉืขืง ื ืืฆื ืื ืคึผืจืึธืฆืขืก ืกืืืขื ืืื ืคึฟืึธืจืืึทืฆืืข ืืื 140002D9C ืืื ืกืืจ ืฆื ืืขืคึฟืื ืขื ืืืืก ืฆื ืืขืจ ืืฉืืื ืืืขืืขื ืก ืจืขืื ืืขื ืขื ืืขื ืืฆื ืฆื ืืืกืคืืจื ืึท ืคึผืจืึธืฆืขืก ืืื ืึท ืืฉืืื NT ืืืืืึธืจืืืขื.
ืจืืืก. 34: NT ืืืืืึธืจืืืขื ืืฉืขืง
ืืื ืฉืคึผืขืืขืจ, ืึทืจืืืก ืื ืคึผืจืึธืฆืขืืืจ, ืขืจ ืืฉืขืงืก ืึทื ืืึธืก ืืื ื ืืฉื csrss.exe, explorer.exe ืึธืืขืจ lsaas.exe.
ืจืืืก. 35: NT ืืืืืึธืจืืืขื ืืฉืขืง
ืืืื ืืื ืขืจ ืืื ืืขื ืืืขื ื ืืืืขื ื ืคืื ืื ืคืจืืฆืขืกืขื, ืืขืขืคื ื ืื ืคืจืืฆืขืกืขื, ืืื ืืืฉืืขืืืื ืื ืงืืื ืขืจ ืคืื ืืื ืืื ื ืืฉื ืืืืกืืขืฉืืืกื, ืืื ืขืจ ืืจืืื ืฆื ืฉืจืืืื ืฆืื ืืืจืื ืื ืคืจืืฆืขืกืขื ืืืืก ืืืขืื ืืจืืื ืืขืฉืืขืคื ืืืขืจื.
ืฆื ืืึธื ืืึธืก, ืขืก ืขืจืฉืืขืจ ืจืืืขืจืืื ืึท ืฉืื ืืื ืืึผืจืื (VirtualAllocEx), ืฉืจืืืื ืืื ืขืก (ืฉืจืืืืคึผืจืึธืกืขืกืกืืขืืึธืจื) ืืื ืงืจืืืืฅ ืึท ืคืึธืืขื (CreateRemoteThread). ืฆื ืึทืจืืขืื ืืื ืื ืคืึทื ืืงืฉืึทื ื, ืขืก ื ืืฆื ืื PIDs ืคืื ืื ืืืืกืืขืงืืืื ืคึผืจืึทืกืขืกืึทื, ืืืึธืก ืขืก ืืื ืึทืืขืจ ืืืงืืืขื CreateToolhelp32Snapshot.
ืจืืืก. 36: ืืืืขื ืงืึธื
ืืึธ ืืืจ ืงืขื ืขื ืืื ืึทืืืงืึทืืื ืึธืืกืขืจืืืืจื ืืื ืขืก ื ืืฆื ืืขื ืคึผืจืึธืฆืขืก PID ืฆื ืจืืคื ืื ืคึฟืื ืงืฆืืข VirtualAllocEx.
ืจืืืก. 37: ืจืืคื VirtualAllocEx
5.4 ืขื ืงืจืืคึผืฉืึทื
ืืื ืืขื ืึธืคึผืืืืืื ื, ืืืจ ืืืขืื ืงืืงื ืืื ืื ืขื ืงืจืืคึผืฉืึทื ืืืื ืคืื ืืขื ืืืกืืขืจ. ืืื ืื ืคืืืืขื ืืข ืืืื ืืืจ ืงืขื ืขื ืืขื ืฆืืืื ืกืืืจืึธืืืื ื ืืขืจืืคื "LoadLibrary_EncodeString"ะธ"Encode_Func", ืืืึธืก ืืขื ืขื ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืืืจืืคืืจื ืื ืขื ืงืจืืคึผืฉืึทื ืคึผืจืึธืฆืขืืืจ.
ืจืืืก. 38: ืขื ืงืจืืคึผืฉืึทื ืคึผืจืึธืืกืืืืฉืขืจื
ืืื ืื ืึธื ืืืื ืืืจ ืงืขื ืขื ืืขื ืืื ืขืก ืืึธืืื ืึท ืฉืืจืืงื ืืืึธืก ืืืขื ืฉืคึผืขืืขืจ ืืืขืจื ืืขื ืืฆื ืฆื ืืขืึธืืคืืกืงืืื ืึทืืฅ ืืืึธืก ืืื ืืืจืฃ: ืืืคึผืึธืจืฅ, ืืืืก, ืงืึทืืึทื ืื, ืืขืงืขืก ืืื CSPs.
ืจืืืก. 39: ืืขืึธืืคืืกืงืึทืืืึธื ืงืจืืึทื
ืื ืคืืืืขื ืืข ืคืืืืจ ืืืืืื ืืขืจ ืขืจืฉืืขืจ ืึทืจืืึทื ืคืืจ ืขืก ืืขืึธืืคืืกืงืึทืืขืก ืืื ืจืขืืืกืืจืืจื ืจ 4. LoadLibrary. ืืึธืก ืืืขื ืืืื ืืขืืืืื ื ืฉืคึผืขืืขืจ ืฆื ืืึธืื ืื ืคืืจืืื ืื ืืืืก. ืืืจ ืงืขื ืขื ืืืื ืืขื ืื ืื ืืขืจ ืฉืืจื ืืื ืจืขืืืกืืจืืจื R12, ืืืึธืก ืืื ืืขื ืืฆื ืฆืืืืืขื ืืื ืื ืคืจืืขืจืืืงืข ืฉืืจื ืฆื ืืืจืืคืืจื ืืขืึธืืคืืกืงืึทืืืึธื.
ืจืืืก. 40: ืืื ืึทืืืฉ ืืขืึธืืคืืกืงืึทืืืึธื
ืขืก ืืืื ืฆื ืึธืคึผืืึธืืืจื ืงืึทืืึทื ืื ืึทื ืขืก ืืืขื ืืืืคื ืฉืคึผืขืืขืจ ืฆื ืืืกืืืืึทื ืืึทืงืึทืคึผืก, ืืืงืขืจื ืคืื ืงืื ืืื ืืืืขืจ ืฉืืืืื ืืึธืืขืก.
ืจืืืก. 41: ืืึธืืืื ื ืงืึทืืึทื ืื
ืืขืจื ืึธื ืขืก ืืึธืืื ืื ืึธืจื ืืื ืขืก ืืืขื ืคืึทืื 3 ืืขืงืขืก: Windows.bat, run.sct ะธ ืึธื ืืืื.ืคืืขืืขืจืืืื.
ืจืืืก. 42: ืืขืงืข ืืึธืืงืืืฉืึทื ื
ืื 3 ืืขืงืขืก ืืขื ืขื ืืขื ืืฆื ืฆื ืงืึธื ืืจืึธืืืจื ืื ืคึผืจืืืืืืึทืืืฉืึทื ืืืึธืก ืืขืืขืจ ืึธืจื ืืื. ืืืื ืื ืคืืจืืื ืื ืคึผืจืืืืืืึทืืืฉืึทื ืืขื ืขื ื ืืฉื ืื ืืืฆื, Ryuk ืกืืึทืคึผืก ืืืจืืคืืจืื ื.
ืขืก ืืืื ืฆื ืืึทืกืข ืื ืฉืืจืืช ืงืึธืจืึทืกืคึผืึทื ืืื ื ืฆื ืื ืืจืื ืืขืงืขืก. ืงืืื, DECRYPT_INFORMATION.html, ืึผืืื ืืื ืคึฟืึธืจืืึทืฆืืข ื ืืืืืง ืฆื ืฆืืจืืงืงืจืืื ืืขืงืขืก. ืกืขืงืื ืืข, ืขืคื ืืืขื, ืึผืืื ืื RSA ืขืคื ืืืขื ืฉืืืกื.
ืจืืืก. 43: ืฉืืจื ืืขืงืจืืคึผื ืืื ืคึฟืึธืจืืึทืฆืืข.html
ืืจืืืขืจ, UNIQUE_ID_DO_NOT_REMOVE, ืึผืืื ืื ืื ืงืจืืคึผืืื ืฉืืืกื ืืืึธืก ืืืขื ืืืื ืืขื ืืฆื ืืื ืืขืจ ืืืืึทืืขืจ ืจืืืื ืฆื ืืืจืืคืืจื ืื ืขื ืงืจืืคึผืฉืึทื.
ืจืืืก. 44: ืฉืืจื ืืื ืฆืืง ืฉืืึทื ืืึธื ื ืื ืืึทืืืึทืืืงื
ืฆืื ืกืืฃ, ืขืก ืืึทืื ืืึธืืื ืื ืคืืจืืื ืื ืืืืืจืขืจืื ืฆืืืืืขื ืืื ืื ืคืืจืืื ืื ืืืคึผืึธืจืฅ ืืื CSPs (Microsoft Enhanced RSA ะธ AES ืงืจืืคึผืืึธืืจืึทืคืืง ืคึผืจืึทืืืืืืขืจื).
ืจืืืก. 45: ืืึธืืืื ื ืืืืืจืขืจืื
ื ืึธื ืึทืืข ืืขืึธืืคืืกืงืึทืืืึธื ืืื ืืืจืืืขืงืึธืื, ืขืก ืคึผืจืึทืกืขืกื ืฆื ืืืจืืคืืจื ืื ืึทืงืฉืึทื ื ืคืืจืืื ืื ืคึฟืึทืจ ืขื ืงืจืืคึผืฉืึทื: ืื ืืืขืจืืืืื ื ืึทืืข ืืึทืืืฉืืงืึทื ืืจืืืืื, ืขืงืกืึทืงืืืืื ื ืืืึธืก ืืื ืืขืืืขื ืืึธืืืื ืืื ืื ืคืจืืขืจืืืงืข ืจืืืื, ืคึฟืึทืจืฉืืึทืจืงืื ื ืื ืืืึทืืืึทื ืืื ืื ืกืืกืืขื, ืคืืจืืืืจืคื ืื RyukReadMe.html ืืขืงืข, ืขื ืงืจืืคึผืฉืึทื, ืื ืืืขืจืืืืื ื ืึทืืข ื ืขืฅ ืืจืืืืื , ืืืขืจืืึทื ื ืฆื ืืืืขืงืืึทื ืืขืืืืกืขืก ืืื ืืืืขืจ ืขื ืงืจืืคึผืฉืึทื.
ืขืก ืึทืืข ืกืืึทืจืฅ ืืื ืืึธืืืื ื"ืงืื.ืขืงืกืข" ืืื RSA ืขืคื ืืืขื ืฉืืืกื ืจืขืงืึธืจืืก.
ืจืืืก. 46: ืคึผืจืืคึผืขืจืื ื ืคึฟืึทืจ ืขื ืงืจืืคึผืฉืึทื
ืืขืจื ืึธื ืขืก ืืขืฅ ืึทืืข ืืึทืืืฉืืงืึทื ืืจืืืืื ื ืืฆื GetLogicalDrives ืืื ืืืกืืืืึทืื ืึทืืข ืืึทืงืึทืคึผืก, ืืืงืขืจื ืืืืืื ืืื ืืืืขืจ ืฉืืืืื ืืึธืืขืก.
ืจืืืก. 47: ืืืึทืงืืืืืืืืื ื ืึธืคึผืืื ืืืฉืืจืื
ื ืึธื ืืขื, ืขืก ืกืืจืขื ืืืึทื ื ืืืึทื ืืืึทืืืึทื ืืื ืื ืกืืกืืขื, ืืื ืืืจ ืืขืืขื ืืืืื, ืืื ืฉืจืืืื ืืขืจ ืขืจืฉืืขืจ ืืขืงืข RyukReadMe.html ะฒ ืืขืืคึผ.
ืจืืืก. 48: ืืจืืืกืืขืื ืึท ืืืกืืืืืืขืื ืืขืืืื ื
ืืื ืื ืคืืืืขื ืืข ืืืื ืืืจ ืงืขื ืขื ืืขื ืืื ืขืก ืงืจืืืืฅ ืึท ืืขืงืข, ืืึทืื ืืึธืืื ืื ืืื ืืึทืื ืืื ืฉืจืืืื ืขืก:
ืจืืืก. 49: ืืึธืืืื ื ืืื ืฉืจืืืื ืืขืงืข ืืื ืืึทืื
ืฆื ืงืขื ืขื ืืืจืืคืืจื ืื ืืขืืืข ืึทืงืฉืึทื ื ืืืืฃ ืึทืืข ืืขืืืืกืขืก, ืขืจ ื ืืฆื
"icacls.exe", ืืื ืืืจ ืืขืืืืื ืืืืื.
ืจืืืก. 50: ื ืืฆื icalcls.exe
ืืื ืืขืกืึธืฃ, ืขืก ืกืืึทืจืฅ ืขื ืงืจืืคึผืืื ื ืืขืงืขืก ืึทืืืฅ ืคึฟืึทืจ "*. ืขืงืกืข", "*. ืืื" ืืขืงืขืก, ืกืืกืืขื ืืขืงืขืก ืืื ืื ืืขืจืข ืืึธืืงืืืฉืึทื ื ืกืคึผืขืกืืคืืขื ืืื ืื ืคืึธืจืขื ืคืื ืึท ืื ืงืจืืคึผืืื ืืืืึทืก ืจืฉืืื. ืฆื ืืึธื ืืึธืก, ืขืก ื ืืฆื ืืืคึผืึธืจืฅ: CryptAcquireContextW (ืืื ืื ื ืืฆื ืคืื AES ืืื RSA ืืื ืกืคึผืขืกืืคืืขื), CryptDeriveKey, CryptGenKey, ืงืจืืคึผืืืขืกืืจืืืงืื ืืื"ื ื ืขืก ืืืื ืคืจืืืื ืฆื ืคืึทืจืืจืืืืขืจื ืื ืืขืจืืจืืืื ืฆื ืืืกืงืึทืืืขืจื ื ืขืฅ ืืขืืืืกืขืก ืืื WNetEnumResourceW ืืื ืืขืจื ืึธื ืขื ืงืจืืคึผื ืืื.
ืจืืืก. 51: ืขื ืงืจืืคึผืืื ื ืกืืกืืขื ืืขืงืขืก
6. ืืืคึผืึธืจืฅ ืืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืคืืึทืืก
ืื ืืขืจ ืืื ืึท ืืืฉ ืืื ืื ืืขืจืกื ืืึทืืืึทืืืง ืืืคึผืึธืจืฅ ืืื ืคืืึทืืก ืืขื ืืฆื ืืืจื ืื ืืืกืืขืจ:
7. IOC
ืจืขืคึฟืขืจืขื ืฆื
- usersPublicrun.sct
- ืึธื ืืืื MenuProgramsStartupstart.bat ืึทืคึผืืึทืืึท ืจืึธืืืื ื ืืืืงืจืึธืกืึธืคึฟื ืืืื ืืึธืืืกืกืืึทืจื
- MenuProgramsStartupstart.bat
ื ืืขืื ืืฉ ืืึทืจืืื ืืืืฃ ืื Ryuk ืจืึทื ืกืึธืืืืึทืจืข ืืื ืืขืืืขื ืฆืื ืืืคืืขืฉืืขืื ืืืจื ืขืงืกืคึผืขืจืฅ ืคืื ืื ืึทื ืืืืืืจืืก ืืึทืืึธืจืึทืืึธืจืืข PandaLabs.
8. ืืื ืงืก
1. "Everis y Prisa Radio sufren un grave ciberataque que secuestra sus sistemas." ืืืืคึผืก: // ืืืืืื. elconfidencial.com/tecnologia/2019-11-04/everis-la-ser-ciberataque-ransomware-15_2312019/, ืืจืืืก ืืืืฃ 04/11/2019.
2. "ืืื ืื ืึธืจืืืื ืืืืจืืก ืืื ืื ืืืืืืืงืืื ืคืื ืื ืืืืคืขืจืืข ืคืื โโืกืคึผืึทืื." https: //elpais.com/tecnologia/2019/11/04/actualidad/1572897654_ 251312.html, ืืจืืืก ืืืืฃ 04/11/2019.
3. "VB2019 ืคึผืึทืคึผืืจ: ืฉืื ืืืึทืื ืก ื ืขืงืึธืืข: ืื ืืึทื ื ืขืง ืคืื ืื Ryuk ืืึทืืืืึทืจืข." https://securelist.com/story-of-the-year-2019-cities-under-ransomware-siege/95456/, Publicada el 11 /12/2019
4. "ืืจืืืก ืฉืคึผืื ืืืืขื ืืื Ryuk: ืื ืื ืืขืจ ืืืงืจืึทืืืืื ืืึทืจืืขืืขื ืจืึทื ืกืึธืืืืึทืจืข." ืืืืคึผืก: // ืืืืืื. crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/, ืืจืืืก ืืืืฃ 10/01/2019.
5. "VB2019 ืคึผืึทืคึผืืจ: ืฉืื ืืืึทืื ืก ื ืขืงืึธืืข: ืื ืืึทื ื ืขืง ืคืื ืื Ryuk ืืึทืืืืึทืจืข." https://www. virusbulletin.com/virusbulletin/2019/10/ vb2019-paper-shinigamis-revenge-long-tail-r
ืืงืืจ: www.habr.com