WannaCry Ransomeware Analysis

################################
# Good references for WannaCry #
################################

References:

https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168
https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html



############################
# Download the Analysis VM #
############################
https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
user: infosecaddicts
pass: infosecaddicts



- Log in to your Ubuntu system with the username 'infosecaddicts' and the password 'infosecaddicts'.






################
# The Scenario #
################
You've come across a file that has been flagged by one of your security products (AV Quarantine, HIPS, Spam Filter, Web Proxy, or digital forensics scripts).


The fastest thing you can do is perform static analysis.



###################
# Static Analysis #
###################

- After logging please open a terminal window and type the following commands:


---------------------------Type This-----------------------------------
cd Desktop/

wget https://s3.amazonaws.com/infosecaddictsfiles/wannacry.zip

unzip wannacry.zip
     infected

file wannacry.exe

mv wannacry.exe malware.pdf

file malware.pdf

mv malware.pdf wannacry.exe

hexdump -n 2 -C wannacry.exe

----------------------------------------------------------------------


***What is '4d 5a' or 'MZ'***
Reference:
http://www.garykessler.net/library/file_sigs.html




---------------------------Type This-----------------------------------
objdump -x wannacry.exe

strings wannacry.exe

strings --all wannacry.exe | head -n 6

strings wannacry.exe | grep -i dll

strings wannacry.exe | grep -i library

strings wannacry.exe | grep -i reg

strings wannacry.exe | grep -i key

strings wannacry.exe | grep -i rsa

strings wannacry.exe | grep -i open

strings wannacry.exe | grep -i get

strings wannacry.exe | grep -i mutex

strings wannacry.exe | grep -i irc

strings wannacry.exe | grep -i join

strings wannacry.exe | grep -i admin

strings wannacry.exe | grep -i list
----------------------------------------------------------------------










Hmmmmm.......what's the latest thing in the news - oh yeah "WannaCry"

Quick Google search for "wannacry ransomeware analysis"


Reference
https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/

- Yara Rule -


Strings:
$s1 = “Ooops, your files have been encrypted!” wide ascii nocase
$s2 = “Wanna Decryptor” wide ascii nocase
$s3 = “.wcry” wide ascii nocase
$s4 = “WANNACRY” wide ascii nocase
$s5 = “WANACRY!” wide ascii nocase
$s7 = “icacls . /grant Everyone:F /T /C /Q” wide ascii nocase








Ok, let's look for the individual strings


---------------------------Type This-----------------------------------
strings wannacry.exe | grep -i ooops

strings wannacry.exe | grep -i wanna

strings wannacry.exe | grep -i wcry

strings wannacry.exe | grep -i wannacry

strings wannacry.exe | grep -i wanacry			**** Matches $s5, hmmm.....
----------------------------------------------------------------------






####################################
# Tired of GREP - let's try Python #
####################################
Decided to make my own script for this kind of stuff in the future. I

Reference1:
https://s3.amazonaws.com/infosecaddictsfiles/analyse_malware.py

This is a really good script for the basics of static analysis

Reference:
https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html


This is really good for showing some good signatures to add to the Python script


Here is my own script using the signatures (started this yesterday, but still needs work):
https://pastebin.com/guxzCBmP



---------------------------Type This-----------------------------------
sudo apt install -y python-pefile
     infosecaddicts



wget https://pastebin.com/raw/guxzCBmP


mv guxzCBmP am.py


vi am.py

python am.py wannacry.exe
----------------------------------------------------------------------









##############
# Yara Ninja #
##############
----------------------------------------------------------------------
cd ~/Desktop

sudo apt-get remove -y yara
     infosecaddcits

sudo apt -y install libtool
     infosecaddicts

wget https://github.com/VirusTotal/yara/archive/v3.6.0.zip


unzip v3.6.0.zip

cd yara-3.6.0

./bootstrap.sh

./configure

make

sudo make install
	infosecaddicts

yara -v

cd ~/Desktop
----------------------------------------------------------------------



NOTE:
McAfee is giving these yara rules - so add them to the hashes.txt file

Reference:
https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/

----------------------------------------------------------------------------
rule wannacry_1 : ransom
{
	meta:
		author = "Joshua Cannell"
		description = "WannaCry Ransomware strings"
		weight = 100
		date = "2017-05-12"

	strings:
		$s1 = "Ooops, your files have been encrypted!" wide ascii nocase
		$s2 = "Wanna Decryptor" wide ascii nocase
		$s3 = ".wcry" wide ascii nocase
		$s4 = "WANNACRY" wide ascii nocase
		$s5 = "WANACRY!" wide ascii nocase
		$s7 = "icacls . /grant Everyone:F /T /C /Q" wide ascii nocase

	condition:
		any of them
}

----------------------------------------------------------------------------
rule wannacry_2{
	meta:
		author = "Harold Ogden"
		description = "WannaCry Ransomware Strings"
		date = "2017-05-12"
		weight = 100

	strings:
		$string1 = "msg/m_bulgarian.wnry"
		$string2 = "msg/m_chinese (simplified).wnry"
		$string3 = "msg/m_chinese (traditional).wnry"
		$string4 = "msg/m_croatian.wnry"
		$string5 = "msg/m_czech.wnry"
		$string6 = "msg/m_danish.wnry"
		$string7 = "msg/m_dutch.wnry"
		$string8 = "msg/m_english.wnry"
		$string9 = "msg/m_filipino.wnry"
		$string10 = "msg/m_finnish.wnry"
		$string11 = "msg/m_french.wnry"
		$string12 = "msg/m_german.wnry"
		$string13 = "msg/m_greek.wnry"
		$string14 = "msg/m_indonesian.wnry"
		$string15 = "msg/m_italian.wnry"
		$string16 = "msg/m_japanese.wnry"
		$string17 = "msg/m_korean.wnry"
		$string18 = "msg/m_latvian.wnry"
		$string19 = "msg/m_norwegian.wnry"
		$string20 = "msg/m_polish.wnry"
		$string21 = "msg/m_portuguese.wnry"
		$string22 = "msg/m_romanian.wnry"
		$string23 = "msg/m_russian.wnry"
		$string24 = "msg/m_slovak.wnry"
		$string25 = "msg/m_spanish.wnry"
		$string26 = "msg/m_swedish.wnry"
		$string27 = "msg/m_turkish.wnry"
		$string28 = "msg/m_vietnamese.wnry"


	condition:
		any of ($string*)
}
----------------------------------------------------------------------------


#######################
# External DB Lookups #
#######################

Creating a malware database (sqlite)
---------------------------Type This-----------------------------------
sudo apt install -y python-simplejson python-simplejson-dbg
	infosecaddicts



wget https://raw.githubusercontent.com/mboman/mart/master/bin/avsubmit.py



python avsubmit.py -f wannacry.exe -e
----------------------------------------------------------------------

Analysis of the file can be found at:
http://www.threatexpert.com/report.aspx?md5=84c82835a5d21bbcf75a61706d8ab549









###############################
# Creating a Malware Database #
###############################
Creating a malware database (mysql)
-----------------------------------
- Step 1: Installing MySQL database
- Run the following command in the terminal:
---------------------------Type This-----------------------------------
sudo apt install -y mysql-server
     infosecaddicts

- Step 2: Installing Python MySQLdb module
- Run the following command in the terminal:
---------------------------Type This-----------------------------------
sudo apt-get build-dep python-mysqldb
     infosecaddicts

sudo apt install -y python-mysqldb
     infosecaddicts

Step 3: Logging in
Run the following command in the terminal:
---------------------------Type This-----------------------------------
mysql -u root -p					(set a password of 'malware')

- Then create one database by running following command:

create database malware;

exit;

wget https://raw.githubusercontent.com/dcmorton/MalwareTools/master/mal_to_db.py

vi mal_to_db.py						(fill in database connection information)

python mal_to_db.py -i

------- check it to see if the files table was created ------

mysql -u root -p
	malware

show databases;

use malware;

show tables;

describe files;

exit;

---------------------------------


- Now add the malicious file to the DB
---------------------------Type This-----------------------------------
python mal_to_db.py -f wannacry.exe -u



- Now check to see if it is in the DB
---------------------------Type This-----------------------------------
mysql -u root -p
	malware

mysql> use malware;

select id,md5,sha1,sha256,time FROM files;

mysql> quit;