On the left PC is the source of infection configured as the following:
- Windows 7 Pro SP1
- IP: 10.10.10.128
On the right is the innocent user PC configured as the following:
- Windows 7 Pro SP1
- IP: 10.10.10.129
The following URL are the PCAP file captured during the demo:
https://www.dropbox.com/s/rd2xa93mxb3...
Password: infected
Here the malware samples in-case you want to analyze:
https://www.dropbox.com/s/oakyt9apstn...
Password: infected
DISCLAIMER: Any further damage cause by this sample will fall under your own action and responsibility.
NOTE: There is not audio on this demo.
Trivia:
- Using Windows 7 Professional SP1
- With SMBv1, SMBv2 enabled.
- The "killswitch" has been disabled. "/etc/hosts" point to random dead IP.
- Simulate internet/DNS using Mandiant ApateDNS.
- There is no internet connection on both VM.
- Only "host only" connected to both VM within same subnet.
- WannaCry binary = md5(5bef35496fcbdbe841c82f4d1ab8b7c2)
In general, the infection vector could be from various sources including email with malicious attachment, RDP with weak password, compromised from other malware infection, etc.
#WannaCry
#WCry
WannaCry 2.0 Infection Cross PC over vulnerable SMB Demo camera iphone 8 plus apk | |
| 5 Likes | 5 Dislikes |
| 1,089 views views | 27 followers |
| Science & Technology | Upload TimePublished on 15 May 2017 |
Không có nhận xét nào:
Đăng nhận xét