Zin.9ken

wjy19800315

密码：infected

测测你的主防，建议虚拟机双击，安全至上啊

xu3160668

AVG  我又来了      只测试双击    刚才放错了一张  另外一个样本好像杀的 衍生物

毛豆新人

这两个是之前的样本了，不过找不到是哪里的了。现在毛豆全杀了，测试关闭云查询，将样本加入实时扫描白名单
两个都带有典型恶意程序特征：进程注入+自删除

两个按理说很接近，自动入沙情况下不触发加密行为，需要手动复制衍生物到桌面双击
以第二个为例：
C:\Users\Admin\Desktop\Zin.9ken\doc_.exe         虚拟化运行
2015-11-23 23:25:56         C:\Windows\System32\bcdedit.exe         虚拟化运行          
2015-11-23 23:25:56         C:\Windows\SysWOW64\cmd.exe         虚拟化运行          
2015-11-23 23:26:07         C:\Windows\System32\vssadmin.exe         虚拟化运行          
2015-11-23 23:26:07         C:\VTRoot\HarddiskVolume2\Users\Admin\AppData\Roaming\bnfsy-a.exe         访问内存         C:\Windows\System32\smss.exe
2015-11-23 23:26:12         C:\VTRoot\HarddiskVolume2\Users\Admin\AppData\Roaming\bnfsy-a.exe         访问内存         C:\Windows\System32\svchost.exe
2015-11-23 23:26:12         C:\VTRoot\HarddiskVolume2\Users\Admin\AppData\Roaming\bnfsy-a.exe         终止进程         C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
2015-11-23 23:26:12         C:\VTRoot\HarddiskVolume2\Users\Admin\AppData\Roaming\bnfsy-a.exe         访问内存         C:\Windows\System32\svchost.exe
2015-11-23 23:26:12         C:\VTRoot\HarddiskVolume2\Users\Admin\AppData\Roaming\bnfsy-a.exe         终止进程         C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe               想收拾毛豆
（然后不停重复最后四个动作：不断访问svchost、amdagent、cmdvirth，并识图结束后两者）
图片中的txt和html大约与警报同时出现。  毛豆在发现有东西枚举硬盘并大规模加密时报警


好吓人 可是你这就翻来覆去就这两个文件（html + txt），都没有穿沙而出，让我很为难啊

衍生物的大小变化

aboringman

wjy19800315 发表于 2015-11-23 23:00
这家伙动作不少啊
@aboringman  上菜了

我看到了，正在准备吃菜

Trend Micro：

扫描：kill all files.

doc_.exe:

Threat:        Ransom_CRYPTESLA.JM
Source:        Threat
Affected Files:        C:\Documents and Settin…\doc_.exe
Response:        Removed
Detected By:        Queued Scan

doc.exe：

Threat:        Ransom_CRYPTESLA.JM
Source:        Threat
Affected Files:        C:\Documents and Settings…\doc.exe
Response:        Removed
Detected By:        Real Time Scan

双击：两个都入库了，不过我还是尝试进行排除后玩主防。其中，doc.exe被Aegis击杀，而doc_.exe则是不停的击杀它所释放的衍生物（by real-time scan）。

doc.exe的情况：先报未经授权的更改，然后击杀之。

Name:        doc.exe
From:        Unknown
Version:       
Copyright:       
Detected Resource or Process ID:        ZwWriteVirtualMemory
Response:        Cleaned

Threat:        HEU_AEGISCS230
Source:        Threat
Affected Files:        C:\Documents and Settings…\doc.exe
Response:        Removed
Detected By:        Real Time Scan

doc_.exe则是不停地击杀它所释放的衍生物（由于本体被排除，所以本体并未被干掉）。

衍生物信息：

Threat:        Ransom_CRYPTESLA.JM
Source:        Threat
Affected Files:        C:\Sandbox\Administrat…\fveqj-a.exe
Response:        Removed
Detected By:        Real Time Scan

sanhu35

2015-11-23 23:54:19    创建文件 (12)    阻止
进程: c:\documents and settings\administrator\桌面\新建文件夹\zin.9ken\doc_.exe
目标: C:\Documents and Settings\Administrator\Application Data\bypso-a.exe
规则: [应用程序组]【授权】高限制组 -> [文件组]保护高危文件


==============

上面允许后 开始创造条件，然后大面积改写感染文件


2015-11-23 23:56:37    修改注册表值    允许
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLinkedConnections
值: 0x00000001(1)
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2015-11-23 23:56:44    修改注册表值    允许
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qewr2342
值: C:\Documents and Settings\Administrator\Application Data\ktohi-a.exe
规则: [应用程序组]『询问』病毒测试 -> [注册表组]自动运行 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Run*

2015-11-23 23:57:17    修改文件    允许
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\Application\6.2.1.232\adblock.zip
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2015-11-23 23:57:17    修改注册表值    阻止
进程: c:\program files\agnitum\outpost firewall pro\acs.exe
目标: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ParseAutoexec
值: 1
规则: [注册表组]WinLogon -> [注册表]*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

2015-11-23 23:57:34    创建文件    允许
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\Application\6.2.1.232\adblock.zip.ccc
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2015-11-23 23:57:37    修改文件    阻止
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\Application\6.2.1.232\apps.zip
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2015-11-23 23:57:43    修改文件    阻止
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\apps\bin\se\ExtFeedRenRen\sidelogo.png
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2015-11-23 23:57:46    修改文件    阻止
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\apps\bin\se\ExtFeedWeibo\sidelogo.png
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2015-11-23 23:57:50    修改文件    阻止
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\apps\bin\se\ExtHistory\sidelogo.png
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2015-11-23 23:57:56    修改文件    阻止
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\apps\bin\se\ExtVideoGallery\sidelogo.png
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2015-11-23 23:57:59    修改文件    阻止
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\apps\bin\se\ExtWebmail\sidelogo.png
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2015-11-23 23:58:03    修改文件    阻止
进程: c:\documents and settings\administrator\application data\ktohi-a.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\User Data\chrome_shutdown_ms.txt
规则: [应用程序组]『询问』病毒测试 -> [文件]*




被修改后的文件

!!!!!!!!!-------------------------------------------------------------------------------------------
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them,
it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.
All your files were encrypted with the public key, which has been transferred to your computer via the Internet.
Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
------------------------------------------------------------------------------------------------------------------------------------------------------------
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.
If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.
------------------------------------------------------------------------------------------------------------------------------------------------------------

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://ym7wmciue9n.bg3hd7smh73.com/7BF8FB392EF7A163
2. http://psbc532jm8c.hsh73cu37n1.net/7BF8FB392EF7A163
3. https://3st7uyjfocyourll.onion.to/7BF8FB392EF7A163

If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser and wait for initialization.
3. Type in the address bar: 3st7uyjfocyourll.onion/7BF8FB392EF7A163
4. Follow the instructions on the site.

IMPORTANT INFORMATION:
Your personal pages:
http://ym7wmciue9n.bg3hd7smh73.com/7BF8FB392EF7A163
http://psbc532jm8c.hsh73cu37n1.net/7BF8FB392EF7A163
https://3st7uyjfocyourll.onion.to/7BF8FB392EF7A163  
Your personal page (using TOR-Browser): 3st7uyjfocyourll.onion/7BF8FB392EF7A163
Your personal identification number (if you open the site (or TOR-Browser's) directly): 7BF8FB392EF7A163

htc360

WD直杀

wjy19800315

htc360 发表于 2015-11-23 22:48
WD直杀

无图无真相！

eset9全杀

htc360

wjy19800315 发表于 2015-11-23 22:48
无图无真相！

eset9全杀

已补上

wjy19800315

xu3160668 发表于 2015-11-23 22:47
AVG  我又来了      只测试双击    刚才放错了一张  另外一个样本好像杀的 衍生物

这家伙动作不少啊
@aboringman  上菜了

xu3160668

wjy19800315 发表于 2015-11-23 23:00
这家伙动作不少啊

确实多  第一个样本 母体被爆了  第二个杀了衍生物  你看第一个倒数第二排 衍生物的名字跟 第二个的差不多样子  

XywCloud

样本重复。