- Overview
WannaCry—also known as WanaCrypt0r, WCry, or Wanna Decryptor—was a global ransomware cyberattack that erupted on May 12, 2017, rapidly infecting over 300,000 systems across 150+ countries. It exploited a Windows SMB vulnerability called EternalBlue to achieve worm-like, automated propagation without user interaction. The attack disrupted hospitals, logistics companies, governments, telecoms, and countless others.
- Historical Context
2.1 Origins of the Vulnerabilities
- EternalBlue was an exploit developed by the NSA targeting SMBv1 (Server Message Block protocol), specifically the MS17-010 vulnerability.
- In April 2017, a hacker group named The Shadow Brokers leaked NSA tools, including EternalBlue and DoublePulsar (a backdoor implant).
2.2 Timing of the Attack
- Microsoft had already released security patch MS17-010 on March 14, 2017, two months before the attack.
- Many organizations, however, had not applied the patch—especially those running legacy or unmaintained Windows systems.
- Technical Breakdown of WannaCry
3.1 Infection Vector: EternalBlue
WannaCry spreads by exploiting CVE-2017-0144, a buffer overflow vulnerability in SMBv1. EternalBlue allows:
- Remote code execution (RCE)
- No authentication required
- Automatic spreading across networks
How the exploit works (simplified):
- Malicious SMB packets are sent to port 445 of target machines.
- Vulnerable systems mishandle specially crafted packets.
- Attackers gain kernel-level access.
- Payload (WannaCry dropper) is executed.
This means users didn’t need to click anything—infection could happen silently.
3.2 DoublePulsar Backdoor
After EternalBlue succeeds, WannaCry deploys DoublePulsar, a backdoor tool that:
- Injects malicious DLLs into system processes
- Enables further payload installation
- Allows re-infection and propagation
DoublePulsar made the attack more persistent and resilient.
3.3 WannaCry Payload Structure
The ransomware component consists of several modules:
3.3.1 Dropper
- Decrypted embedded ransomware files
- Installed the main executable and encrypted resources
3.3.2 Encryption Module
Used a hybrid encryption scheme:
- AES-128 to encrypt user files
- RSA-2048 to encrypt AES keys
Encrypted file types included documents, images, archives, databases, etc.
3.3.3 File Renaming + Ransom Extension
Encrypted files were appended with:
- .WNCRY
- .WCRY
3.3.4 Ransom Note
Displayed in multiple languages, instructing victims to pay $300–$600 worth of Bitcoin.
3.4 Worm-like Self-Propagation
WannaCry behaved like a worm by:
- Scanning the local network for machines with port 445 open
- Scanning random IP addresses on the internet
- Automatically launching infections via EternalBlue
This capability is what caused global spread within hours, unlike past ransomware that required phishing emails.
- The Kill Switch Domain: How the Attack Stopped
4.1 Discovery of a Hardcoded Domain
The malware contained a strange URL: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
The ransomware checked this domain before executing.
Why was it there?
Most likely:
- A sandbox evasion technique
- Some malware observes whether domains resolve; sandboxes often resolve all domains automatically.
- If the domain resolves, it assumes it is being analyzed and shuts down.
4.2 Accidental Shutdown of the Attack
- Malware researcher Marcus Hutchins (MalwareTech) registered the domain.
- Upon registration, the domain started returning a valid response.
- This caused WannaCry to self-terminate, acting as a global kill switch.
4.3 Why Not All Systems Were Saved
- Some variants were modified without the kill switch.
- Many infected networks blocked outbound DNS queries or traffic.
- Systems already infected remained encrypted.
- Attack Vector & TTPs
5.1 Tactics
- Initial Access: Exploiting SMBv1
- Execution: Kernel-level remote code execution
- Persistence: DoublePulsar implant
- Lateral Movement: Automated SMB probing
- Impact: File encryption + extortion
5.2 Techniques
- T1210: Exploitation of Remote Services
- T1486: Data Encryption for Impact
- T1105: Ingress Tool Transfer
- T1047: WMI for execution on compromised hosts
- Indicators of Compromise (IoCs)
6.1 File Indicators
- Encrypted files with .WNCRY or .WCRY extensions
- Droppers: tasksche.exe, taskdl.exe, taskse.exe
6.1.1 SHA 256 :
- 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
- ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
- b4e3b4a8d8915b8f4dbcb35f6d161dce14e66c550f36beb5e6b1b54f1e6f27c1
- 050c6b14a0308fc4adbafec1465b2202b8d378b0e8df7cce38b04e35772b04f3
6.1.2 Dropped Executables:
- exe (encryption component)
- exe (dropper)
- exe (service installer)
- exe (fake Microsoft service)
6.1.3 Folder Locations:
- C:\ProgramData\
- C:\Users\<user>\AppData\Local\
- C:\Windows\
6.1.4 Ransom Note Files
- !Please Read Me!.txt
- @[email protected]
- @[email protected]
6.2 Network Indicators
- Traffic to kill-switch domain
- Repeated SMB probing on port 445
- Command & Control (C2) / Kill Switch Domains
| Type | Domain |
| Kill-switch domain | iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com |
| Variant kill-switch | ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com |
| Additional sinkholed | Ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf[.]com |
6.3 TOR Payment Gateways
- gx7ekbenv2riucmf[.]onion
- xxlvbrloxvriy2c5[.]onion
- 57g7spgrzlojinas[.]onion
- 76jdd2ir2embyv47[.]onion
- qj3m7wxqk4azopi4[.]onion
6.4 Bitcoin Wallets
- 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX
- 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
- 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
6.5 Malicious IPs seen in campaign
- 195[.]12.28.134
- 82[.]137.255.109
- 212[.]14.51.1
- 128[.]31.0.39 (TOR directory)
6.6 Mutex (Mutual Exclusion) Indicators
- MsWinZonesCacheCounterMutexA
- MsWinZonesCacheCounterMutexW
- Global\MsWinZonesCacheCounterMutexA
- Global\MsWinZonesCacheCounterMutexW
6.7 Registry Indicators
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mssecsvc
- HKLM\SYSTEM\CurrentControlSet\Services\mssecsvc2.0
6.8 Observed Ports
| Port | Protocol | Purpose |
| 445 | SMBv1 | Exploitation & propagation |
| 137–139 | NetBIOS | Scanning & enumeration |
| 9001 | TOR | TOR relay communication |
6.9 Behavioral Indicators
- Sudden creation of ransom notes in multiple languages
- System inability to access file shares
- Mitigation Recommendations
- Apply MS17-010 patch immediately
- Disable SMBv1
- Implement network segmentation
- Deploy EDR solutions to detect SMB exploitation patterns
- Maintain offline, versioned backups
- WannaCry implemented its cryptography incorrectly:
- The malware generated unique RSA keys per infection, but never used them correctly, making decryption difficult.
- The payment system was flawed:
- Only three Bitcoin wallets were used for all victims
- No automated payment confirmation
- No reliable decryption pipeline
This suggests:
- Poor operational sophistication
- Likely rushed development
- Focus on disruption more than profit
- Microsoft’s Response
9.1 Emergency Patch for Unsupported Systems
Microsoft took the unusual step of releasing patches for:
- Windows XP
- Windows Server 2003
- Windows 8
9.2 Criticism of Government Hoarding of Zero-Days
Microsoft publicly criticized intelligence agencies for:
- Stockpiling exploit tools
- Failing to disclose critical vulnerabilities
- Lessons Learned
10.1 Technical Lessons
- Disable SMBv1 permanently
- Regular patching is essential
- Network segmentation limits worm spread
- Backups must be offline or immutable
10.2 Policy Lessons
- Governments hoarding vulnerabilities increases global risk
- Critical infrastructure needs priority cybersecurity investment
10.3 Organizational Lessons
- Incident response plans must cover ransomware
- Legacy systems must be upgraded or isolated
- Conclusion
WannaCry is a landmark cybersecurity event demonstrating the catastrophic potential of combining:
- Leaked nation-state tools
- Unpatched systems
- Worm-enabled ransomware
It was not just a technical failure but a global reminder that cybersecurity hygiene, patching, and protocol modernization are non-optional in an interconnected world.
