{"id":1902,"date":"2022-05-06T16:41:15","date_gmt":"2022-05-06T08:41:15","guid":{"rendered":"https:\/\/blog.billows.com.tw\/?p=1902"},"modified":"2023-02-13T11:04:28","modified_gmt":"2023-02-13T03:04:28","slug":"%e7%be%8e%e8%b3%87%e5%ae%89%e7%a0%94%e7%a9%b6%e6%8f%ad%e4%b8%ad%e5%9c%8bapt%e9%a7%ad%e5%ae%a2%e7%b5%84%e7%b9%94winnti%e4%bb%a5%e4%bc%81%e6%a5%aderp%e7%b3%bb%e7%b5%b1%e5%ad%98%e5%9c%a8%e7%9a%84","status":"publish","type":"post","link":"https:\/\/blog.billows.com.tw\/?p=1902","title":{"rendered":"\u7f8e\u8cc7\u5b89\u7814\u7a76\u63ed\u4e2d\u570bAPT\u99ed\u5ba2\u7d44\u7e54Winnti\u4ee5\u4f01\u696dERP\u7cfb\u7d71\u5b58\u5728\u7684\u6f0f\u6d1e\uff0c\u4f5c\u70ba\u5207\u5165\u9ede\uff0c\u6578\u5e74\u4f86\u4e00\u76f4\u7aca\u53d6\u6d89\u53ca\u7f8e\u6b50\u4e9e30\u4f01\u696d\u7684\u5546\u696d\u6a5f\u5bc6"},"content":{"rendered":"\n

\u8cc7\u5b89\u516c\u53f8Cyber\u200b\u200beason\u7684\u7814\u7a76\u6307\u51fa<\/a>\uff0cWinnti\uff08\u4e5f\u7a31\u70ba APT41\u3001Blackfly \u548c BARIUM\uff09\u662f\u4e00\u500b\u6548\u529b\u65bc\u4e2d\u570b\u653f\u5e9c\u7684\u99ed\u5ba2\u7d44\u7e54\uff0c\u81ea 2010 \u5e74\u4ee5\u4f86\u4e00\u76f4\u5f88\u6d3b\u8e8d\uff0c\u4ee5\u8907\u96dc\u3001\u96b1\u79d8\u548c\u5c08\u6ce8\u65bc\u7aca\u53d6\u6280\u8853\u6a5f\u5bc6\u800c\u805e\u540d\uff0c\u9019\u6b21\u7684\u767c\u73fe\u662fWinnti\u4ee5\u540d\u70baCuckooBees\u7684\u9593\u8adc\u884c\u52d5\u591a\u6b21\u7684\u5165\u4fb5\u88fd\u9020\u3001\u79d1\u6280\u3001\u80fd\u6e90\u548c\u88fd\u85e5\u7b49\u7522\u696d\u7684\u7d0430\u5bb6\u8de8\u570b\u516c\u53f8\u4e26\u7aca\u53d6\u4e86\u5927\u91cf\u5546\u696d\u6a5f\u5bc6\u548c\u667a\u6167\u8ca1\u7522\uff0c\u8a72\u7db2\u8def\u7aca\u5bc6\u884c\u52d5\u81f3\u5c11\u53ef\u4ee5\u56de\u6eaf\u52302019\u5e74\uff0c\u4f46\u76f4\u5230\u6700\u8fd1\u624d\u66dd\u5149\u3002Cyber\u200b\u200beason \u767c\u5e03\u4e86\u5169\u4efd\u8207 CuckooBees \u884c\u52d5\u76f8\u95dc\u7684\u5831\u544a\uff0c\u7b2c\u4e00\u4efd<\/a>\u662f\u95dc\u65bcWinnti \u7684\u5165\u4fb5\u7b56\u7565\u548c\u7368\u7279\u6027\uff0c\u7b2c\u4e8c\u4efd<\/a>\u5247\u662f\u95dc\u65bcWinnti\u6240\u4f7f\u7528\u7684\u60e1\u610f\u8edf\u9ad4\u548c\u6f0f\u6d1e\u7684\u6df1\u5165\u5206\u6790\u3002 <\/p>\n\n\n\n

\"\"
\u653b\u64ca\u93c8\u548c\u6709\u6548\u8ca0\u8f09\u90e8\u7f72\u662f\u901a\u904e\u201c\u7d19\u724c\u5c4b\u201d\u65b9\u6cd5\u5be6\u73fe\u7684\uff0c\u6bcf\u500b\u7d44\u4ef6\u90fd\u4f9d\u8cf4\u65bc\u5176\u4ed6\u7d44\u4ef6\u624d\u80fd\u6b63\u5e38\u904b\u884c\uff0c\u9019\u4f7f\u5f97\u55ae\u7368\u5206\u6790\u6bcf\u500b\u7d44\u4ef6\u8b8a\u5f97\u56f0\u96e3\u3002<\/figcaption><\/figure>\n\n\n\n

\u6839\u64daCybereason\u7684\u8abf\u67e5\uff0c\u81ea\u7db2\u8def\u9593\u8adc\u6d3b\u52d5\u958b\u59cb\u4ee5\u4f86\uff0cWinnti\u8fc4\u4eca\u5df2\u5f9e 30 \u591a\u500b\u5168\u7403\u7d44\u7e54\u7aca\u53d6\u4e86\u6578\u767e GB \u7684\u6578\u64da\u5305\u62ec\u85cd\u5716\u3001\u5716\u8868\u3001\u914d\u65b9\u548c\u8207\u88fd\u9020\u76f8\u95dc\u7684\u5c08\u6709\u6578\u64da\u548c\u5176\u4ed6\u5546\u696d\u6a5f\u5bc6\u3002\u6b64\u5916\uff0cCyber\u200b\u200beason\u8868\u793a\uff0cWinnti\u9084\u6536\u96c6\u4e86\u6709\u95dc\u76ee\u6a19\u7d44\u7e54\u7684\u7db2\u8def\u67b6\u69cb\u3001\u7528\u6236\u5e33\u6236\u3001\u6191\u8b49\u3001\u5ba2\u6236\u6578\u64da\u548c\u696d\u52d9\u7684\u8a73\u7d30\u8cc7\u6599\uff0c\u653b\u64ca\u8005\u53ef\u4ee5\u5728\u672a\u4f86\u7684\u653b\u64ca\u4e2d\u5229\u7528\u9019\u4e9b\u8cc7\u6599\u3002Cyber\u200b\u200beason\u7684\u8abf\u67e5\u9084\u63ed\u793a\u5f9eCuckooBees\u884c\u52d5\u4e2d\u767c\u73feWinnti\u7684\u6b66\u5668\u5eab\u4e2d\u65b0\u589e\u4e86\u524d\u4ee5\u88ab\u672a\u8a18\u9304\u540d\u70baDEPLOYLOG\u7684\u65b0\u60e1\u610f\u8edf\u9ad4\uff0c\u5176\u6709\u6548\u8ca0\u8f09\u96b1\u85cf\u548c\u6aa2\u6e2c\u898f\u907f\u662f\u57fa\u65bc\u5c0d Windows CLFS \u529f\u80fd\u7684\u6feb\u7528\u3002\u6b64\u5916\uff0cWinnti\u4e5f\u5728\u653b\u64ca\u4e2d\u4f7f\u7528\u5df2\u77e5\u7684\u60e1\u610f\u8edf\u9ad4\uff0c\u5305\u62ecSpyder Loader\uff0cPRIVATELOG\u548cWINNKIT\u7b49\u3002<\/p>\n\n\n\n

\u5165\u4fb5\u8abf\u67e5\u63ed\u793a\u4e86\u5165\u4fb5\u59cb\u65bc\u99ed\u5ba2\u5229\u7528\u4f01\u696d\u8cc7\u6e90\u898f\u5283 (ERP)\u5e73\u53f0\u4e2d\u5b58\u6709\u7684\u9060\u7aef\u7a0b\u5f0f\u78bc\u57f7\u884c\u6f0f\u6d1e\uff0c\u5728ERP Web \u61c9\u7528\u7a0b\u5f0f\u4f3a\u670d\u5668\u4e0a\u90e8\u7f72JSB WebShell\u5f8c\u9580\u4ee5\u4fdd\u6301\u6301\u4e45\u6027\uff0c\u4e26\u958b\u59cb\u7db2\u8def\u5075\u5bdf\u548c\u6191\u8b49\u8f49\u5132\uff0c\u9019\u9032\u4e00\u6b65\u5141\u8a31\u6a6b\u5411\u79fb\u52d5\uff0c\u6700\u7d42\u5c0e\u81f4\u654f\u611f\u6578\u64da\u5f9e\u95dc\u9375\u4f3a\u670d\u5668\u548c\u54e1\u5de5\u7684\u7aef\u9ede\u5916\u6d29\u3002\u5728CuckooBees \u884c\u52d5\u4e2d\u4f7f\u7528Winnti\u591a\u7a2e\u6301\u4e45\u6027\u6280\u8853\u3002\u7b2c\u4e00\u500b\u662f\u522a\u9664 WebShell \u7684 VBScript \u7248\u672c\uff0c\u4f7f\u7528 wscript \u57f7\u884c\u5b83\uff0c\u7136\u5f8c\u5c07\u7d50\u679c\u8907\u88fd\u5230\u5916\u90e8\u53ef\u5b58\u53d6\u7684\u6a94\u6848\u593e\u4e2d\u3002\u7b2c\u4e8c\u7a2e\u6301\u4e45\u6027\u65b9\u6cd5\u63d0\u4f9b\u4e86\u4e00\u500b\u984d\u5916\u7684\u5099\u4efd\u5207\u5165\u9ede\uff0c\u6d89\u53ca\u4fee\u6539 WinRM \u9060\u7aef\u7ba1\u7406\u5354\u8b70\u4ee5\u555f\u7528 HTTP \u548c HTTPS \u5075\u807d\u5668\u4ee5\u9032\u884c\u9060\u7aef shell\u5b58\u53d6\u3002<\/p>\n\n\n\n

\"\"
\u89c0\u5bdf\u5230\u7684Winnti\u653b\u64ca\u93c8\uff0cPhoto credit: Cybereason<\/figcaption><\/figure>\n\n\n\n

\u7b2c\u4e09\u7a2e\u65b9\u6cd5\u5229\u7528\u7c3d\u540d\u7684\u5167\u6838 rootkit\uff0c\u800c\u7b2c\u56db\u7a2e\u6280\u8853\u6feb\u7528\u5408\u6cd5\u7684IKEEXT\u548cPrintNotify Windows \u670d\u52d9\u4f86\u5074\u8f09 Winnti DLL \u4e26\u4fdd\u6301\u6301\u4e45\u6027\u3002\u6700\u521d\u7684\u5075\u5bdf\u4f7f\u7528\u5167\u7f6e\u7684 Windows \u547d\u4ee4\u4f86\u6536\u96c6\u6709\u95dc\u53d7\u611f\u67d3\u670d\u52d9\u5668\u7684\u4fe1\u606f\u3002\u4e00\u65e6\u5728\u591a\u53f0\u6a5f\u5668\u4e0a\u5efa\u7acb\u4e86\u7acb\u8db3\u9ede\uff0cWinnti \u5c31\u958b\u59cb\u4f7f\u7528\u8a08\u5283\u4efb\u52d9\u4f86\u57f7\u884c\u4e0d\u540c\u6a5f\u5668\u4e4b\u9593\u4e0d\u540c\u7684batch scripts\uff0c\u4e26\u6839\u64da\u653b\u64ca\u8005\u7684\u76ee\u6a19\u4f7f\u7528\u4e0d\u540c\u7684\u547d\u4ee4\u3002\u6191\u8b49\u8f49\u5132\u4f7f\u7528\u4e86\u5169\u7a2e\u65b9\u6cd5\uff1areg save \u547d\u4ee4\u548c\u540d\u70baMFSDLL.Exe\u7684\u672a\u77e5\u5de5\u5177\uff0c\u5df2\u77e5\u7684 reg save \u7528\u65bc\u8f49\u5132SYSTEM\u3001SAM\u548cSECURITY\u8a3b\u518a\u8868\u914d\u7f6e\u55ae\u5143\uff0c\u4f7f\u653b\u64ca\u8005\u80fd\u5920\u5728\u672c\u5730\u7834\u89e3\u5bc6\u78bc\u7684hash\u3002Cyber\u200b\u200beason \u7121\u6cd5\u6062\u5fa9 MFSDLL \u7684\u6a23\u672c\uff0c\u4f46\u5df2\u7d93\u4e86\u89e3\u4e86\u5b83\u7684\u4f7f\u7528\u65b9\u5f0f\u548c\u8f09\u5165\u5167\u5bb9\uff0c\u5b83\u8f09\u5165\u4e86\u4e00\u500b\u540d\u70bamktzx64.dll\u7684 DLL \uff0c\u8a72 DLL\u8207 Mimikatz \u5de5\u5177\u7684\u4f7f\u7528\u6709\u95dc\u3002<\/p>\n\n\n\n

Winnti \u4f7f\u7528\u53d7\u88ab\u5165\u4fb5\u611f\u67d3\u7684\u7db2\u57df\u7ba1\u7406\u54e1\u6191\u8b49\uff0c\u9032\u800c\u4f7f\u7528scheduled tasks\u5728\u6578\u5341\u53f0\u53d7\u611f\u67d3\u7684\u96fb\u8166\u4e0a\u57f7\u884c\u547d\u4ee4\uff0c\u4f7f\u5176\u80fd\u5920\u6a6b\u5411\u79fb\u52d5\u4e26\u4f7f\u7528\u88ab\u76dc\u6191\u8b49\u611f\u67d3\u5927\u91cf\u4e3b\u6a5f\u3002<\/p>\n\n\n\n

\u5c0d\u65bc\u6578\u64da\u6536\u96c6\uff0c\u653b\u64ca\u8005\u4f7f\u7528\u91cd\u65b0\u547d\u540d\u7684\u4e2d\u6587\u7248\u672c\u7684WinRAR\u4f86\u5efa\u7acb\u5305\u542b\u88ab\u76dc\u6578\u64da\u7684\u5bc6\u78bc\u4fdd\u8b77\u6a94\u6848\uff0c\u4e26\u88ab\u91cd\u65b0\u547d\u540d\u70barundll32.exe\u507d\u88dd\u6210\u5176\u4ed6Windows\u7cfb\u7d71\u6a94\u6848\u3002<\/p>\n\n\n\n

Cybereason\u8a8d\u70ba\uff0c\u5728\u8af8\u5982CuckooBees\u884c\u52d5\u7b49\u99ed\u5ba2\u653b\u64ca\u6d3b\u52d5\u4e2d\u6700\u5e38\u898b\u88ab\u5229\u7528\u7684\u5b89\u5168\u6f0f\u6d1e\u5305\u542b\u56e0\u70ba\u7cfb\u7d71\u672a\u6253\u4fee\u88dc\u3001\u7db2\u8def\u5206\u6bb5\u4e0d\u8db3\u3001\u8cc7\u7522\u4e0d\u53d7\u7ba1\u7406\u3001\u5e33\u6236\u88ab\u907a\u5fd8\u4ee5\u53ca\u7f3a\u4e4f\u591a\u56e0\u7d20\u8eab\u4efd\u9a57\u8b49\u7522\u54c1\u3002\u5118\u7ba1\u9019\u4e9b\u6f0f\u6d1e\u770b\u8d77\u4f86\u5f88\u5bb9\u6613\u4fee\u5fa9\uff0c\u4f46\u7576\u4eca\u7684\u5b89\u5168\u6027\u5f88\u8907\u96dc\uff0c\u5927\u898f\u6a21\u5be6\u65bd\u7de9\u89e3\u63aa\u65bd\u4e26\u4e0d\u7e3d\u662f\u90a3\u9ebc\u5bb9\u6613\u3002\u9632\u79a6\u8005\u61c9\u9075\u5faa MITRE\u6216\u985e\u4f3c\u6846\u67b6\uff0c\u4ee5\u78ba\u4fdd\u4ed6\u5011\u64c1\u6709\u9069\u7576\u7684\u53ef\u898b\u6027\u3001\u6aa2\u6e2c\u548c\u88dc\u6551\u80fd\u529b\u4f86\u4fdd\u8b77\u4ed6\u5011\u7684\u6700\u95dc\u9375\u7684\u8cc7\u7522\u3002<\/p>\n\n\n\n

\u53e6\u5916\uff0c\u9451\u65bc\u653b\u64ca\u7684\u8907\u96dc\u7a0b\u5ea6\u4ee5\u53ca\u8a72\u6d3b\u52d5\u65bc 2019 \u5e74\u767c\u8d77\u4e14\u76f4\u5230\u53bb\u5e74\u624d\u88ab\u767c\u73fe\u7684\u4e8b\u5be6\uff0c\u5168\u7403\u53ef\u80fd\u9084\u6709\u66f4\u591a\u53d7\u5bb3\u8005\u3002<\/p>\n\n\n\n

\u00a0“\u8f49\u8cbc\u3001\u5206\u4eab\u6216\u5f15\u7528\u6587\u7ae0\u5167\u5bb9\uff0c\u8acb\u8a3b\u660e\u51fa\u8655\u70ba\u7ae3\u76df\u79d1\u6280\u00a0https:\/\/www.billows.com.tw<\/a>\u00a0, \u4ee5\u514d\u89f8\u6cd5”<\/p>\n","protected":false},"excerpt":{"rendered":"

\u8cc7\u5b89\u516c\u53f8Cyber\u200b\u200beason\u7684\u7814\u7a76\u6307\u51fa\uff0cWinnti\uff08\u4e5f\u7a31\u70ba APT41\u3001Blackfly \u548c BARIU READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[131,79],"class_list":["post-1902","post","type-post","status-publish","format-standard","hentry","category-6","tag-winnti","tag-winnti-group"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1902","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1902"}],"version-history":[{"count":4,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1902\/revisions"}],"predecessor-version":[{"id":2444,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1902\/revisions\/2444"}],"wp:attachment":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}