[FireEye]WannaCry Malware Profile

[igor51]

WannaCry Malware Profile

[html]

WannaCry (also known as WCry or WanaCryptor) malware is a
  self-propagating (worm-like) ransomware that spreads through internal
  networks and over the public internet by exploiting a vulnerability in
  Microsoft’s Server Message Block (SMB) protocol, MS17-010. The   href="https://www.fireeye.com/blog/products-and-services/2017/05/wannacry-ransomware-campaign.html">WannaCry
  malware consists of two distinct components, one that provides
  ransomware functionality and a component used for propagation, which
  contains functionality to enable SMB exploitation capabilities.

 

The malware leverages an exploit, codenamed “EternalBlue”, that was
  released by the Shadow Brokers on April 14, 2017.

 

The malware appends encrypted data files with the .WCRY extension,
  drops and executes a decryptor tool, and demands $300 or $600 USD (via
  Bitcoin) to decrypt the data.

 

The malware uses encrypted Tor channels for command and control (C2) communications.

 

File Characteristics

 
   
     
   
              width="126">

db349b97c37d22f5ea1d1841e3c89eb4

        width="57">

3723264

        width="66">

2010-11-20T09:03:08Z

          width="84">

Loader + Worm Component

        width="54">

EXE

   
              width="126">

84c82835a5d21bbcf75a61706d8ab549

        width="57">

3514368

        width="66">

2010-11-20T09:05:05Z

        width="84">

Loader

   
              width="126">

f351e1fcca0c4ea05fc44d15a17f8b36

        width="57">

65536

        width="54">

DLL

   
              width="126">

7bf2b57f2a205768755c07f238fb32cc

        width="57">

245760

        width="54">

EXE

Filename	MD5 Hash	Size (bytes)	Compile Time	Description	Filetype
mssecsvc.exe
tasksche.exe	EXE
Unavailable	2009-07-14         01:12:55Z	Encryptor
@WanaDecryptor@.exe	2009-07-13         23:19:35Z	Decryptor

 

  Table 1: File characteristics

 

Persistence Mechanism

 

The malware creates the following two registry run keys to ensure persistence:

 

• Key:
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Random>

 

Value: <Full_path>\tasksche.exe

 

• Key:
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Random>

 

Value: <Full_path>\tasksche.exe

 

The malware creates the following service to ensure persistence of mssecsvc.exe:

 

• ServiceName: mssecsvc2.0
• DisplayName: Microsoft
      Security Center (2.0) Service
• BinaryPath: <path to
      mssecsvc> -m security

 

The malware creates the following service to ensure persistence of tasksche.exe

 

• ServiceName: <8-15lower><3number>

   
• DisplayName: <Same as Service Name>
• BinaryPath
      <path to tashsche.exe>

 

Host-Based Signatures

 

File System Artifacts

 

Checksum

 

• Actual: 0x00018AF7
• Header: 0x00000000

 

Dropped Files

 

  Loader Files

 

• Name: