WannaCry (also known as WCry or WanaCryptor) malware is a
self-propagating (worm-like) ransomware that spreads through internal
networks and over the public internet by exploiting a vulnerability in
Microsoft’s Server Message Block (SMB) protocol, MS17-010. The
malware consists of two distinct components, one that provides
ransomware functionality and a component used for propagation, which
contains functionality to enable SMB exploitation capabilities.
The malware leverages an exploit, codenamed “EternalBlue”, that was
released by the Shadow Brokers on April 14, 2017.
The malware appends encrypted data files with the .WCRY extension,
drops and executes a decryptor tool, and demands $300 or $600 USD (via
Bitcoin) to decrypt the data.
The malware uses encrypted Tor channels for command and control (C2) communications.
|
|
|
|
|
|
mssecsvc.exe | |||||
tasksche.exe | EXE | ||||
Unavailable | 2009-07-14 | Encryptor | |||
@WanaDecryptor@.exe | 2009-07-13 | Decryptor |
Table 1: File characteristics
The malware creates the following two registry run keys to ensure persistence:
Value: <Full_path>\tasksche.exe
Value: <Full_path>\tasksche.exe
The malware creates the following service to ensure persistence of mssecsvc.exe:
The malware creates the following service to ensure persistence of tasksche.exe
Loader Files