Full Report
In the last decade, cybercrime has become more sophisticated. Most individuals are not very keen on cybercrime and assume only corporates and businesses are targets. Ransomware is a prevalent form... The post A Comprehensive Answer to the Frequently Asked Question “What is WannaCry Ransomware?’ appeared first on Hacker Combat.
Analysis Summary
# Tool/Technique: WannaCry
## Overview
WannaCry is a highly infamous and widespread ransomware strain known for encrypting sensitive data on infected Microsoft Windows systems and demanding a ransom in Bitcoin for the decryption keys. It achieved global notoriety in May 2017 by spreading rapidly across numerous networks.
## Technical Details
- Type: Malware family (Ransomware, Crypto-ransomware)
- Platform: Microsoft Windows operating system
- Capabilities: File encryption, network propagation via SMB vulnerability, use of a "Kill Switch" mechanism, demands ransom in Bitcoin.
- First Seen: May 12, 2017
## MITRE ATT&CK Mapping
*Note: Based on the description of propagation and encryption methods, the following mappings are inferred/most relevant.*
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application (Implied via reliance on vulnerable SMB)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File (Implied for initial delivery vector)
- **TA0003 - Persistence**
- T1105 - Ingress Tool Transfer (Implied via component download/assembly)
- **TA0004 - Privilege Escalation**
- T1068 - Exploitation for Privilege Escalation (Achieved via EternalBlue)
- **TA0007 - Discovery**
- T1082 - System Information Discovery (To check for kill switch and system state)
- **TA0010 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (Implied via kill switch domain lookup)
- **TA0011 - Exfiltration**
- (Not explicitly detailed, but standard for ransomware to verify C2 connection)
- **TA0012 - Impact**
- T1486 - Data Encrypted for Impact
## Functionality
### Core Capabilities
- **Data Encryption:** Encrypts Windows users' files using cryptographic methods (crypto-ransomware).
- **Ransom Demand:** Demands a ransom, initially \$300 then escalating to \$600, payable in Bitcoin.
- **SMB Exploitation:** Spreads laterally using a vulnerability in the Windows SMB protocol.
### Advanced Features
- **Modular Structure:** Consists of four main components:
1. **Double Pulsar dropper:** Self-contained program to deploy other parts.
2. **Encryption/Decryption App:** Handles the core ransomware function.
3. **Encryption Keys:** Documents containing necessary keys.
4. **Tor Component:** A bundled copy of Tor for anonymous communication (likely for potential centralized C2 or key retrieval, though the article focuses on the kill switch).
- **Kill Switch Mechanism:** Before encrypting data, WannaCry attempts to connect to a specific, long, nonsensical URL. If this connection succeeds, the ransomware halts execution (shuts down). If the domain is unreachable, the encryption process proceeds.
- **Lateral Movement:** Despite the kill switch, if it fails to execute, the malware attempts to spread to other connected computers via the local network.
## Indicators of Compromise
- File Hashes: [Not provided in the text]
- File Names: [Not provided in the text, relies on bundled components]
- Registry Keys: [Not provided in the text]
- Network Indicators:
- Kill Switch Domain: A long, nonsensical URL (defanged example: `hxxp://[very-long-random-string].com`)
- Behavioral Indicators:
- Attempts to contact the Kill Switch URL.
- Exploitation attempts against the Server Message Block (SMB) protocol using specific, maliciously crafted packets.
- Attempts to execute the Double Pulsar dropper payload if initial access is successful.
## Associated Threat Actors
- The text describes the attack methodology leveraging tools allegedly stolen from the NSA and released by **The Shadow Brokers**. The specific cybercriminal group behind the initial WannaCry deployment is often attributed to North Korean state-sponsored actors, although the article itself focuses on the technical mechanism rather than attribution.
## Detection Methods
- Signature-based detection: Detection for the specific payloads and components (Double Pulsar, encryption modules).
- Behavioral detection: Monitoring for unauthorized SMB interaction used for propagation and file modification indicative of encryption.
- YARA rules: [Not provided in the text]
## Mitigation Strategies
- **Update Operating Systems & Software Regularly:** Applying security patches released by Microsoft, especially those addressing SMB vulnerabilities (like MS17-010, which fixed the flaw exploited by the NSA/EternalBlue tool).
- **Avoid Suspicious Links/Attachments:** Do not open untrusted email attachments; avoid enabling macros when prompted to view documents.
- **Trusted Downloads Only:** Only download files and applications from official and trusted sources (e.g., Microsoft Store).
- **USB Device Safety:** Refrain from inserting USB or external storage devices from unknown sources.
- **Use VPN:** Utilize a Virtual Private Network (VPN) when connecting to public or unsecured Wi-Fi networks.
- **Data Backup:** Regularly back up data to cloud storage or disconnected external drives.
## Related Tools/Techniques
- **EternalBlue (Exploit):** The exploit tool developed by the NSA used to leverage the vulnerability exploited by WannaCry.
- **Double Pulsar (Dropper):** The specific dropper component used by WannaCry to deploy its subsequent modules.
- **SMB Protocol:** The targeted network service for lateral movement.