{"id":49830,"date":"2017-05-18T21:22:05","date_gmt":"2017-05-18T13:22:05","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=49830"},"modified":"2017-05-19T15:37:40","modified_gmt":"2017-05-19T07:37:40","slug":"wannacry-%e5%8b%92%e7%b4%a2%e7%97%85%e6%af%92%e5%b0%9a%e6%9c%aa%e5%b9%b3%e6%81%af%e5%88%a9%e7%94%a8%e7%9b%b8%e5%90%8c%e6%bc%8f%e6%b4%9e%e6%94%bb%e6%93%8a%e7%9a%84-uiwix-%e6%8e%a5%e8%b8%b5%e8%80%8c","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=49830","title":{"rendered":"WannaCry \u52d2\u7d22\u75c5\u6bd2\u5c1a\u672a\u5e73\u606f,\u5229\u7528\u76f8\u540c\u6f0f\u6d1e\u653b\u64ca\u7684 UIWIX \u63a5\u8e35\u800c\u4f86"},"content":{"rendered":"

\u00a0WannaCry \u54ed\u8072\u672a\u6b62,\u5176\u4ed6\u7db2\u8def\u72af\u7f6a\u96c6\u5718\u7d1b\u7d1b\u5229\u7528\u76f8\u540c\u7684\u6f0f\u6d1e\u4f86\u653b\u64ca<\/h3>\n

\u4e00\u6ce2\u672a\u5e73\u4e00\u6ce2\u53c8\u8d77,\u4e0a\u5468\u672bWannaCry(\u60f3\u54ed)\u52d2\u7d22\u75c5\u6bd2\/\u52d2\u7d22\u8815\u87f2<\/a>\u525b\u7206\u767c,\u53e6\u4e00\u96bb\u4e5f\u662f\u5229\u7528 Server Message Block (SMB) \u6f0f\u6d1e\u7684UIWIX\u52d2\u7d22\u75c5\u6bd2\u7dca\u63a5\u8457\u767c\u52d5\u7db2\u8def\u653b\u64ca\uff0c\u9664\u4e86 UIWIX \u52d2\u7d22\u75c5\u6bd2 (\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba RANSOM_UIWIX.A<\/a>) \u9084\u6709\u53e6\u4e00\u500b\u5c08\u9580\u958b\u63a1\u58a8\u5167\u7f85 (Monero) \u8ca8\u5e63\u7684\u6728\u99ac\u7a0b\u5f0f\u3002<\/p>\n

UIWIX \u4e26\u975e WannaCry,\u4f46\u66f4\u96e3\u5075\u6e2c<\/strong><\/em><\/p>\n

\u6700\u8fd1\u6709\u4e9b\u65b0\u805e\u5831\u5c0e\u8868\u793a UIWIX \u662f WannaCry \u65b0\u6f14\u5316\u7684\u7248\u672c\uff0c\u4f46\u6839\u64da\u6211\u5011\u6301\u7e8c\u4e0d\u65b7\u7684\u5206\u6790\u767c\u73fe\uff0c\u9019\u662f\u4e00\u500b\u5168\u65b0\u7684\u52d2\u7d22\u75c5\u6bd2 Ransomware<\/a> (\u52d2\u7d22\u8edf\u9ad4\/\u7d81\u67b6\u75c5\u6bd2)\u5bb6\u65cf\uff0c\u53ea\u4e0d\u904e\u548c WannaCry \u4e00\u6a23\u662f\u5229\u7528 Server Message Block (SMB) \u6f0f\u6d1e (MS17-010<\/a>\uff0c\u4ee3\u865f EternalBlue\uff0c\u7531 Shadow Brokers \u6240\u516c\u958b\u63ed\u9732<\/a>) \u4f86\u611f\u67d3\u7cfb\u7d71\u4e26\u5728\u7db2\u8def\u5167\u6563\u5e03\uff0c\u540c\u6642\u9084\u6703\u6383\u7784\u7db2\u969b\u7db2\u8def\u4e0a\u7684\u96fb\u8166\u4ee5\u5c0b\u627e\u66f4\u591a\u53d7\u5bb3\u8005\u3002<\/p>\n

UIWIX \u6709\u4f55\u4e0d\u540c\uff1f\u9996\u5148\uff0c\u5b83\u662f\u6240\u8b02\u7684\u7121\u6a94\u6848\u578b\u614b\u75c5\u6bd2\uff0cUIWIX \u662f\u7d93\u7531 EternalBlue \u6f0f\u6d1e\u76f4\u63a5\u9032\u5165\u8a18\u61b6\u9ad4\u4e2d\u57f7\u884c\u3002\u7121\u6a94\u6848\u7684\u611f\u67d3\u65b9\u5f0f\u4e0d\u6703\u5728\u96fb\u8166\u786c\u789f\u5beb\u5165\u6a94\u6848\u6216\u5143\u4ef6\uff0c\u56e0\u6b64\u4e0d\u6703\u7559\u4e0b\u4ec0\u9ebc\u75d5\u8de1\uff0c\u6240\u4ee5\u66f4\u96e3\u5075\u6e2c\u3002<\/p>\n

\u6b64\u5916\uff0cUIWIX \u7684\u884c\u70ba\u66f4\u52a0\u8b39\u614e\uff0c\u53ea\u8981\u5b83\u5075\u6e2c\u5230\u865b\u64ec\u6a5f\u5668 (VM) \u6216\u6c99\u76d2\u6a21\u64ec\u74b0\u5883\u5b58\u5728\uff0c\u5c31\u6703\u81ea\u884c\u7d42\u6b62\u3002\u6839\u64da UIWIX \u7a0b\u5f0f\u5167\u7684\u5b57\u4e32\u986f\u793a\uff0c\u5b83\u4f3c\u4e4e\u53ef\u4ee5\u8490\u96c6\u611f\u67d3\u7cfb\u7d71\u4e0a\u6240\u5132\u5b58\u7684\u700f\u89bd\u5668\u3001FTP\u3001\u96fb\u5b50\u90f5\u4ef6\u4ee5\u53ca\u5373\u6642\u901a\u8a0a\u8edf\u9ad4\u5e33\u865f\u767b\u5165\u8cc7\u8a0a\u3002<\/p>\n

\u4ee5\u4e0b\u662f WannaCry \u548c UIWIX \u4e3b\u8981\u7279\u9ede\uff1a<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
<\/td>\nWannaCry<\/strong><\/td>\nUIWIX<\/strong><\/td>\n<\/tr>\n
\u653b\u64ca\u9014\u5f91<\/td>\nSMB \u6f0f\u6d1e (MS17-010<\/a>)\uff0cTCP \u9023\u63a5\u57e0 445<\/td>\nSMB \u6f0f\u6d1e (MS17-010<\/a>)\uff0cTCP \u9023\u63a5\u57e0 445<\/td>\n<\/tr>\n
\u6a94\u6848\u985e\u578b<\/td>\n\u57f7\u884c\u6a94 (EXE)<\/td>\n\u52d5\u614b\u9023\u7d50\u7a0b\u5f0f\u5eab (DLL)<\/td>\n<\/tr>\n
\u52a0\u5bc6\u5f8c\u6a94\u6848\u7684\u526f\u6a94\u540d<\/td>\n{\u539f\u59cb\u6a94\u540d}.WNCRY<\/td>\n._{\u7368\u7279\u8b58\u5225\u78bc}.UIWIX<\/td>\n<\/tr>\n
\u958b\u6a5f\u81ea\u52d5\u555f\u52d5\u8207\u6f5b\u4f0f\u6a5f\u5236<\/td>\n\u7cfb\u7d71\u767b\u9304<\/td>\n\u7121<\/td>\n<\/tr>\n
\u865b\u64ec\u6a5f\u5668\u53cd\u5236\u3001\u865b\u64ec\u6a5f\u5668\u6aa2\u67e5\u6216\u6c99\u76d2\u6a21\u64ec\u5206\u6790\u53cd\u5236\u80fd\u529b<\/td>\n\u7121<\/td>\n\u6703\u6aa2\u67e5\u865b\u64ec\u6a5f\u5668\u548c\u6c99\u76d2\u6a21\u64ec\u5206\u6790\u74b0\u5883\u76f8\u95dc\u6a94\u6848\u8207\u8cc7\u6599\u593e\u662f\u5426\u5b58\u5728\u3002<\/td>\n<\/tr>\n
\u7db2\u8def\u6d3b\u52d5<\/td>\n\u5728\u7db2\u969b\u7db2\u8def\u4e0a\uff0c\u5b83\u6703\u6383\u7784\u96a8\u6a5f\u6311\u9078\u7684 IP \u4f4d\u5740\u770b\u770b\u662f\u5426\u958b\u653e TCP 445 \u9023\u63a5\u57e0\uff1b\u7d93\u7531 Tor \u700f\u89bd\u5668\u9023\u4e0a\u300c.onion\u300d\u7db2\u7ad9\u3002<\/td>\n\u00a0\u63a1\u7528 mini-tor.dll<\/em>\u00a0\u7a0b\u5f0f\u5eab\u4f86\u9023\u7dda\u81f3\u300c.onion\u300d\u7db2\u7ad9\u3002<\/td>\n<\/tr>\n
\u4f8b\u5916\u60c5\u6cc1 (\u82e5\u5075\u6e2c\u5230\u67d0\u4e9b\u7cfb\u7d71\u5143\u4ef6\u5c31\u4e0d\u6703\u57f7\u884c)<\/td>\n\u7121<\/td>\n\u82e5\u767c\u73fe\u81ea\u5df1\u5728\u4fc4\u7f85\u65af\u3001\u54c8\u85a9\u514b\u548c\u767d\u4fc4\u7f85\u65af\u5883\u5167\u57f7\u884c\u5c31\u6703\u81ea\u884c\u7d42\u6b62\u3002<\/td>\n<\/tr>\n
\u6392\u9664\u7684\u6a94\u6848\u53ca\u8cc7\u6599\u593e (\u4e5f\u5c31\u662f\u4e0d\u6703\u52a0\u5bc6\u7684\u6a94\u6848\u548c\u8cc7\u6599\u593e)<\/td>\n\u6703\u907f\u958b\u67d0\u4e9b\u8cc7\u6599\u593e\u4e2d\u7684\u6a94\u6848\u3002<\/td>\n\u6703\u907f\u958b\u67d0\u5169\u500b\u8cc7\u6599\u593e\u4e2d\u7684\u6a94\u6848\u4ee5\u53ca\u6a94\u540d\u6709\u67d0\u4e9b\u5b57\u4e32\u7684\u6a94\u6848\u3002<\/td>\n<\/tr>\n
\u6383\u7784\u7db2\u8def\u4f86\u8a66\u5716\u6563\u5e03<\/td>\n\u662f (\u5982\u540c\u8815\u87f2\u7684\u6563\u5e03\u65b9\u5f0f)<\/td>\n\u5426<\/td>\n<\/tr>\n
\u95dc\u9589\u958b\u95dc<\/td>\n\u662f<\/td>\n\u5426<\/td>\n<\/tr>\n
\u52d2\u8d16\u91d1\u984d<\/td>\n\u76f8\u7576\u65bc 300 \u7f8e\u5143\u7684\u6bd4\u7279\u5e63<\/td>\n\u76f8\u7576\u65bc 200 \u7f8e\u5143\u7684\u6bd4\u7279\u5e63<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

\u5716 1\uff1a\u88ab UIWIX \u52a0\u5bc6\u7684\u6e2c\u8a66\u6a94\u6848 (\u5de6) \u4ee5\u53ca\u4e00\u5c01\u52d2\u7d22\u8a0a\u606f(\u53f3)\u3002<\/em><\/p>\n

UIWIX \u6703\u91dd\u5c0d\u6bcf\u4e00\u4f4d\u53d7\u5bb3\u8005\u7522\u751f\u4e0d\u4e00\u6a23\u7684\u6bd4\u7279\u5e63\uff08Bitcoin\uff09<\/a>\u9322\u5305\u3002\u5982\u679c\u53d7\u5bb3\u8005\u9ede\u9078\u52d2\u7d22\u8a0a\u606f\u4e2d\u7684\u7db2\u5740\uff0c\u5c31\u6703\u88ab\u8981\u6c42\u8f38\u5165\u4e00\u500b\u300c\u500b\u4eba\u4ee3\u78bc\u300d(\u6b64\u4ee3\u78bc\u5c31\u5728\u52d2\u7d22\u8a0a\u606f\u7576\u4e2d)\uff0c\u63a5\u8457\u6703\u770b\u5230\u4e00\u500b\u53eb\u60a8\u8a3b\u518a\u6bd4\u7279\u5e63\u9322\u5305\u7684\u8a0a\u606f\u3002<\/p>\n


\n\u5716 2\uff1aUIWIX \u7684\u4ed8\u6b3e\u7db2\u7ad9\u3002<\/em><\/p>\n

\u5176\u4ed6\u60e1\u610f\u7a0b\u5f0f\u4e5f\u8d81\u6a5f\u5229\u7528 EternalBlue \u6f0f\u6d1e<\/strong><\/em><\/p>\n

WannaCry \u4e5f\u5f15\u4f86\u5176\u4ed6\u7db2\u8def\u72af\u7f6a\u96c6\u5718\u7684\u6548\u6cd5\uff0c\u7d1b\u7d1b\u5229\u7528\u76f8\u540c\u7684\u6f0f\u6d1e\u4f86\u653b\u64ca\u96fb\u8166\u7cfb\u7d71\u8207\u7db2\u8def\u3002\u9664\u4e86 WannaCry \u548c UIWIX\uff0c\u6211\u5011\u7684\u60c5\u5831\u7db2\u5df2\u767c\u73fe\u53e6\u4e00\u500b\u540c\u6a23\u85c9\u7531 EternalBlue \u6563\u5e03\u7684\u6728\u99ac\u7a0b\u5f0f\uff1aAdylkuzz<\/a> (TROJ_COINMINER.WN)\u3002\u6b64\u60e1\u610f\u7a0b\u5f0f\u6703\u5c07\u88ab\u611f\u67d3\u7684\u7cfb\u7d71\u8b8a\u6210\u6bad\u5c4d\u96fb\u8166\uff0c\u4e26\u5229\u7528\u5176\u904b\u7b97\u8cc7\u6e90\u4f86\u958b\u63a1\u58a8\u5167\u7f85 (Monero) \u6578\u4f4d\u8ca8\u5e63\u3002<\/p>\n

\u4f01\u696d\u9632\u7bc4 UIWIX\u516d\u5927\u5b88\u5247<\/strong><\/em><\/p>\n

\u5982\u540c\u5176\u4ed6\u5c08\u9580\u653b\u64ca\u8cc7\u5b89\u6f0f\u6d1e\u7684\u5a01\u8105\u4e00\u6a23\uff0cUIWIX \u8b93\u6211\u5011\u518d\u6b21\u5b78\u5230\u5b9a\u671f\u4fee\u88dc\u7cfb\u7d71\u7684\u91cd\u8981\u6027<\/a>\u3002\u4f01\u696d\u5fc5\u9808\u5728\u7dad\u6301\u4f01\u696d\u71df\u904b\u6548\u7387\u8207\u7dad\u8b77\u5b89\u5168\u4e4b\u9593\u6c42\u53d6\u5e73\u8861\u3002IT \u7cfb\u7d71\u7ba1\u7406\u54e1\u548c\u8cc7\u5b89\u4eba\u54e1\uff0c\u61c9\u5f37\u5236\u5be6\u65bd\u4e00\u5957\u57fa\u672c\u898f\u7bc4\u4f86\u964d\u4f4e\u653b\u64ca\u7684\u5a01\u8105\uff0c\u7dad\u8b77\u7cfb\u7d71\u548c\u7db2\u8def\u7684\u5b8c\u6574\u8207\u5b89\u5168\u3002<\/p>\n

\u6709\u9451\u65bc UIWIX \u548c WannaCry \u90fd\u4f7f\u7528\u76f8\u540c\u7684\u653b\u64ca\u7ba1\u9053\uff0c\u56e0\u6b64\u4f01\u696d\u61c9\u8a72\u719f\u6089\u9632\u7bc4 UIWIX \u53ca\u5176\u4ed6\u985e\u4f3c\u653b\u64ca\u7684\u6700\u4f73\u5be6\u52d9\u539f\u5247<\/a>\uff1a<\/p>\n

    \n
  1. \u4fee\u88dc\u53ca\u66f4\u65b0\u7cfb\u7d71\uff0c\u4e26\u8003\u616e\u63a1\u7528\u865b\u64ec\u4fee\u88dc\u6280\u8853\u3002<\/a><\/li>\n
  2. \u78ba\u5be6\u555f\u7528\u9632\u706b\u7246\u8207\u5165\u4fb5\u9632\u8b77\u7cfb\u7d71\u3002<\/li>\n
  3. \u4e3b\u52d5\u76e3\u63a7\u4e26\u6aa2\u67e5\u9032\u51fa\u4f01\u696d\u7684\u7db2\u8def\u6d41\u91cf\u3002<\/li>\n
  4. \u5efa\u7acb\u5b89\u5168\u63aa\u65bd\u4f86\u9632\u7bc4\u5176\u4ed6\u99ed\u5ba2\u53ef\u80fd\u5165\u4fb5\u7684\u7ba1\u9053\uff0c\u4f8b\u5982\u96fb\u5b50\u90f5\u4ef6<\/a>\u548c\u7db2\u7ad9\u3002<\/li>\n
  5. \u90e8\u7f72\u61c9\u7528\u7a0b\u5f0f\u63a7\u7ba1<\/a>\u6a5f\u5236\u4f86\u9632\u6b62\u53ef\u7591\u7684\u6a94\u6848\u57f7\u884c\uff0c\u4e26\u4e14\u914d\u5408\u884c\u70ba\u76e3\u63a7\u4f86\u9632\u6b62\u7cfb\u7d71\u906d\u5230\u975e\u7d93\u5141\u8a31\u7684\u8b8a\u66f4\u3002<\/li>\n
  6. \u5be6\u65bd\u8cc7\u6599\u5206\u985e<\/a>\u4ee5\u53ca\u7db2\u8def\u5206\u5272\uff0c\u9032\u4e00\u6b65\u964d\u4f4e\u8cc7\u6599\u7684\u98a8\u96aa\u8207\u640d\u5bb3\u3002<\/li>\n<\/ol>\n

    \u6211\u5011\u5c07\u6301\u7e8c\u66f4\u65b0\u8a0a\u606f\uff0c\u4e00\u6709\u6700\u65b0\u5206\u6790\u7d50\u679c\u5c31\u6703\u7acb\u5373\u767c\u5e03\u3002<\/p>\n

    \u8da8\u52e2\u79d1\u6280\u89e3\u6c7a\u65b9\u6848<\/strong><\/em><\/p>\n

    \u642d\u8f09XGen<\/a>\u7aef\u9ede\u9632\u8b77\u7684\u8da8\u52e2\u79d1\u6280 OfficeScan\u2122 \u7d50\u5408\u4e86\u9ad8\u6e96\u5ea6\u7684\u6a5f\u5668\u5b78\u7fd2\u8207\u5176\u4ed6\u5075\u6e2c\u6280\u8853\u548c\u5168\u7403\u5a01\u8105\u60c5\u5831\uff0c\u63d0\u4f9b\u5b8c\u6574\u7684\u52d2\u7d22\u75c5\u6bd2\u8207\u5176\u4ed6\u5a01\u8105\u9632\u8b77\u3002\u8da8\u52e2\u79d1\u6280\u5167\u5efa\u6a5f\u5668\u5b78\u7fd2\u80fd\u529b\u7684\u8cc7\u5b89\u89e3\u6c7a\u65b9\u6848\u4ee5\u53ca\u6240\u6709\u76f8\u95dc\u7684\u52d2\u7d22\u75c5\u6bd2\u9632\u8b77\u529f\u80fd\uff0c\u90fd\u5df2\u7d93\u80fd\u5920\u9632\u7bc4 UIWIX \u548c WannaCry \u9019\u985e\u7684\u5a01\u8105\u3002<\/p>\n

    \u8da8\u52e2\u79d1\u6280\u7684 \u8da8\u52e2\u79d1\u6280Deep Security<\/a>\u3001\u8da8\u52e2\u79d1\u6280 Vulnerability Protection \u6f0f\u6d1e\u9632\u8b77<\/a>\u3001\u8da8\u52e2\u79d1\u6280\u7684Deep Discovery Inspector<\/a>\u3001TippingPoint \u4ee5\u53ca Home Network Security\u00a0\u90fd\u80fd\u5354\u52a9\u4f01\u696d\u548c\u4e00\u822c\u4f7f\u7528\u8005\u9632\u7bc4\u4e0a\u8ff0\u5a01\u8105\u3002<\/p>\n

    \u5165\u4fb5\u6307\u6a19\u8cc7\u6599<\/em><\/strong><\/p>\n

    146581F0B3FBE00026EE3EBE68797B0E57F39D1D8AECC99FDC3290E9CFADC4FC (SHA256) \u2014 \u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba \u00a0RANSOM_UIWIX.A<\/a>
    \nC72BA80934DC955FA3E4B0894A5330714DD72C2CD4F7FF6988560FC04D2E6494 (SHA256) \u2013 \u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba\u00a0     TROJ_COINMINER.WN<\/a><\/p>\n

    TROJ_COINMINER.WN \u76f8\u95dc\u7684\u5e55\u5f8c\u64cd\u7e31 (C&C) \u7db2\u57df\uff1a<\/em><\/p>\n