1. Overview

WannaCry—also known as WanaCrypt0r, WCry, or Wanna Decryptor—was a global ransomware cyberattack that erupted on May 12, 2017, rapidly infecting over 300,000 systems across 150+ countries. It exploited a Windows SMB vulnerability called EternalBlue to achieve worm-like, automated propagation without user interaction. The attack disrupted hospitals, logistics companies, governments, telecoms, and countless others.

2. Historical Context

2.1 Origins of the Vulnerabilities

• EternalBlue was an exploit developed by the NSA targeting SMBv1 (Server Message Block protocol), specifically the MS17-010 vulnerability.
• In April 2017, a hacker group named The Shadow Brokers leaked NSA tools, including EternalBlue and DoublePulsar (a backdoor implant).

2.2 Timing of the Attack

• Microsoft had already released security patch MS17-010 on March 14, 2017, two months before the attack.
• Many organizations, however, had not applied the patch—especially those running legacy or unmaintained Windows systems.

3. Technical Breakdown of WannaCry

3.1 Infection Vector: EternalBlue

WannaCry spreads by exploiting CVE-2017-0144, a buffer overflow vulnerability in SMBv1. EternalBlue allows:

• Remote code execution (RCE)
• No authentication required
• Automatic spreading across networks

How the exploit works (simplified):

1. Malicious SMB packets are sent to port 445 of target machines.
2. Vulnerable systems mishandle specially crafted packets.
3. Attackers gain kernel-level access.
4. Payload (WannaCry dropper) is executed.

This means users didn’t need to click anything—infection could happen silently.

3.2 DoublePulsar Backdoor

After EternalBlue succeeds, WannaCry deploys DoublePulsar, a backdoor tool that:

• Injects malicious DLLs into system processes
• Enables further payload installation
• Allows re-infection and propagation

DoublePulsar made the attack more persistent and resilient.

3.3 WannaCry Payload Structure

The ransomware component consists of several modules:

3.3.1 Dropper

• Decrypted embedded ransomware files
• Installed the main executable and encrypted resources

3.3.2 Encryption Module

Used a hybrid encryption scheme:

• AES-128 to encrypt user files
• RSA-2048 to encrypt AES keys

Encrypted file types included documents, images, archives, databases, etc.

3.3.3 File Renaming + Ransom Extension

Encrypted files were appended with:

• .WNCRY
• .WCRY

3.3.4 Ransom Note

Displayed in multiple languages, instructing victims to pay $300–$600 worth of Bitcoin.

3.4 Worm-like Self-Propagation

WannaCry behaved like a worm by:

• Scanning the local network for machines with port 445 open
• Scanning random IP addresses on the internet
• Automatically launching infections via EternalBlue

This capability is what caused global spread within hours, unlike past ransomware that required phishing emails.

4. The Kill Switch Domain: How the Attack Stopped

4.1 Discovery of a Hardcoded Domain

The malware contained a strange URL: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com

The ransomware checked this domain before executing.

Why was it there?

Most likely:

• A sandbox evasion technique
  • Some malware observes whether domains resolve; sandboxes often resolve all domains automatically.
  • If the domain resolves, it assumes it is being analyzed and shuts down.

4.2 Accidental Shutdown of the Attack

• Malware researcher Marcus Hutchins (MalwareTech) registered the domain.
• Upon registration, the domain started returning a valid response.
• This caused WannaCry to self-terminate, acting as a global kill switch.

4.3 Why Not All Systems Were Saved

• Some variants were modified without the kill switch.
• Many infected networks blocked outbound DNS queries or traffic.
• Systems already infected remained encrypted.

5. Attack Vector & TTPs

5.1 Tactics

• Initial Access: Exploiting SMBv1
• Execution: Kernel-level remote code execution
• Persistence: DoublePulsar implant
• Lateral Movement: Automated SMB probing
• Impact: File encryption + extortion

5.2 Techniques

• T1210: Exploitation of Remote Services
• T1486: Data Encryption for Impact
• T1105: Ingress Tool Transfer
• T1047: WMI for execution on compromised hosts

6. Indicators of Compromise (IoCs)

6.1 File Indicators

• Encrypted files with .WNCRY or .WCRY extensions
• Droppers: tasksche.exe, taskdl.exe, taskse.exe

6.1.1 SHA 256 :

• 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
• ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
• b4e3b4a8d8915b8f4dbcb35f6d161dce14e66c550f36beb5e6b1b54f1e6f27c1
• 050c6b14a0308fc4adbafec1465b2202b8d378b0e8df7cce38b04e35772b04f3

6.1.2 Dropped Executables:

• exe (encryption component)
• exe (dropper)
• exe (service installer)
• exe (fake Microsoft service)

6.1.3 Folder Locations:

• C:\ProgramData\
• C:\Users\<user>\AppData\Local\
• C:\Windows\

6.1.4 Ransom Note Files

• !Please Read Me!.txt
• @[email protected]
• @[email protected]

6.2 Network Indicators

• Traffic to kill-switch domain
• Repeated SMB probing on port 445

• Command & Control (C2) / Kill Switch Domains

Type	Domain
Kill-switch domain	iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
Variant kill-switch	ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
Additional sinkholed	Ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf[.]com

 

6.3 TOR Payment Gateways

• gx7ekbenv2riucmf[.]onion
• xxlvbrloxvriy2c5[.]onion
• 57g7spgrzlojinas[.]onion
• 76jdd2ir2embyv47[.]onion
• qj3m7wxqk4azopi4[.]onion

6.4 Bitcoin Wallets

• 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX
• 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
• 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

6.5 Malicious IPs seen in campaign

• 195[.]12.28.134
• 82[.]137.255.109
• 212[.]14.51.1
• 128[.]31.0.39 (TOR directory)

6.6 Mutex (Mutual Exclusion) Indicators

• MsWinZonesCacheCounterMutexA
• MsWinZonesCacheCounterMutexW
• Global\MsWinZonesCacheCounterMutexA
• Global\MsWinZonesCacheCounterMutexW

6.7 Registry Indicators

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mssecsvc
• HKLM\SYSTEM\CurrentControlSet\Services\mssecsvc2.0

6.8 Observed Ports

Port	Protocol	Purpose
445	SMBv1	Exploitation & propagation
137–139	NetBIOS	Scanning & enumeration
9001	TOR	TOR relay communication

 

6.9 Behavioral Indicators

• Sudden creation of ransom notes in multiple languages
• System inability to access file shares

7. Mitigation Recommendations

• Apply MS17-010 patch immediately
• Disable SMBv1
• Implement network segmentation
• Deploy EDR solutions to detect SMB exploitation patterns
• Maintain offline, versioned backups

8. WannaCry implemented its cryptography incorrectly:

• The malware generated unique RSA keys per infection, but never used them correctly, making decryption difficult.
• The payment system was flawed:
  • Only three Bitcoin wallets were used for all victims
  • No automated payment confirmation
  • No reliable decryption pipeline

This suggests:

• Poor operational sophistication
• Likely rushed development
• Focus on disruption more than profit

9. Microsoft’s Response

9.1 Emergency Patch for Unsupported Systems

Microsoft took the unusual step of releasing patches for:

• Windows XP
• Windows Server 2003
• Windows 8

9.2 Criticism of Government Hoarding of Zero-Days

Microsoft publicly criticized intelligence agencies for:

• Stockpiling exploit tools
• Failing to disclose critical vulnerabilities

10. Lessons Learned

10.1 Technical Lessons

• Disable SMBv1 permanently
• Regular patching is essential
• Network segmentation limits worm spread
• Backups must be offline or immutable

10.2 Policy Lessons

• Governments hoarding vulnerabilities increases global risk
• Critical infrastructure needs priority cybersecurity investment

10.3 Organizational Lessons

• Incident response plans must cover ransomware
• Legacy systems must be upgraded or isolated

11. Conclusion

WannaCry is a landmark cybersecurity event demonstrating the catastrophic potential of combining:

• Leaked nation-state tools
• Unpatched systems
• Worm-enabled ransomware

It was not just a technical failure but a global reminder that cybersecurity hygiene, patching, and protocol modernization are non-optional in an interconnected world.