论文标题
勒索软件：分析对Windows Active Directory域服务的影响
Ransomware: Analysing the Impact on Windows Active Directory Domain Services
论文作者
论文摘要
在过去的十年中，勒索软件已成为越来越流行的恶意软件类型，并且由于其高利润率而继续受欢迎。组织和企业已成为勒索软件的主要目标，因为它们更有可能屈服于赎金需求，这是应对停机时间产生的成本的运营费用的一部分。尽管勒索软件是对组织的威胁，但很少有信息概述勒索软件如何影响Windows Server环境，尤其是其专有域服务，例如Active Directory。因此，我们旨在提高利用这些环境的组织和公司的网络情况意识。使用三个勒索软件变体进行了动态分析，以发现加密货币软件如何影响特定于Windows Server的服务和流程。我们的工作概述了对WannaCry，Teslacrypt和Jigsaw进行的实际调查，并针对多个领域服务进行了测试。研究结果表明，这三个变体中没有一个停止了流程，并且绝对使所有域服务都没有受到影响。但是，尽管这些服务仍在运营，但由于勒索软件对这些服务的文件进行了加密，因此它们变得唯一的功能失调
Ransomware has become an increasingly popular type of malware across the past decade and continues to rise in popularity due to its high profitability. Organisations and enterprises have become prime targets for ransomware as they are more likely to succumb to ransom demands as part of operating expenses to counter the cost incurred from downtime. Despite the prevalence of ransomware as a threat towards organisations, there is very little information outlining how ransomware affects Windows Server environments, and particularly its proprietary domain services such as Active Directory. Hence, we aim to increase the cyber situational awareness of organisations and corporations that utilise these environments. Dynamic analysis was performed using three ransomware variants to uncover how crypto-ransomware affects Windows Server-specific services and processes. Our work outlines the practical investigation undertaken as WannaCry, TeslaCrypt, and Jigsaw were acquired and tested against several domain services. The findings showed that none of the three variants stopped the processes and decidedly left all domain services untouched. However, although the services remained operational, they became uniquely dysfunctional as ransomware encrypted the files pertaining to those services
