IAANSEC | WannaCry Analysis Report
Tags: malwareanalysis, security, reverseengineering, report
Published: 2022-04-10 05:53:43

![](https://i.imgur.com/IR12KEs.png)
# WannaCry Ransomware Report
#### Apr 09, 2022 | L0WK3Y 

<br />

## Table of Contents

1. [Executive Report](##executive-summary)
2. [High-Level Technical Summary](##high-level-technical-summary)
3. [Malware Composition](##malware-composition)
4. [Static Analysis](##static-analysis)
5. [Dynamic Analysis](##dynamic-analysis)
6. [Indicators of Compromise](##indicators-of-compromise)
7. [Yara Rules](##Yara-Rules)


<br />

---

## Executive Summary
`sha256: 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c`

Wannacry is a ransomware that utilized the <a href="https://blog.malwarebytes.com/glossary/eternalblue/" target="_blank">EternalBlue</a> exploit to propagate through the targets network and attacked outdated Windows computers globally in May of 2017. WannaCry was a multistage attack starting with a dropper which unpacked a payload onto the targets system under the right conditions. Once the files were encrypted, the threat actors demanded a ransom of $300 worth of Bitcoin. If the ransom is not paid in a specified amount of time, the ransom is increased to $600. This attack infected around 230,000 computers across 150 countries. Marcus Hutchins later discovered a kill switch that stalled the spread of the attack. Click <a href="https://app.any.run/tasks/04098f9a-244d-453f-8d75-891e5631a135/" target="_blank">here</a> to view the full analysis report.

<br />


## High-Level Technical Summary
WannaCry consist of 2 stages: 

1. The first stage being a dropper that tries to make contact with a suspicious URL that can be found in the strings `hxxp[://]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com` if a connection is established the program exits, if a connection is not established the program proceeds with the rest of the execution. Once the program proceeds with execution a service is created by the program `mssecsvc2.0` and has the display name `Microsoft Security Center (2.0) Service`. The service also contains a path to the executable `<PATH_TO_WANNACRY>\wannacry.exe -m security`. During this stage the program will attempt to propagate by reaching out to a large range of IPv4 addresses.

2. Stage two the payload is unpacked from the dropper and proceeds to create persistence mechanisms such as creating a folder in the `C:\ProgramData\<GENERATED_STRING>\` directory and creating a file named `tasksche.exe` in the `C:\Windows\` path and copying itself to the newly created directory. Once the file has been copied to the directory, a service is created and is named after the same generated string as the newly created folder and contains a path leading to the payload `C:\ProgramData\<GENERATED_STRING>\tasksche.exe`. After the service is created and the payload is executed the encryption process starts which changes the background image, drops instructions on how to decrypt the files and more in the generated directory. 

![](https://i.imgur.com/Q2IJlJo.png)
*Fig.0 <a href="https://bit.ly/3xkU3F9" target="_blank">Execution flow graph*</a>

<br />

## Malware Composition

| Item | SHA-256 Hash |
| ----------------------------------------------------- |:---------------------------------------------------------------------------------------------------- | 
| **Ransomware.wannacry.exe** | `24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c` |
| **tasksche.exe**            | `ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa` |
| **@WanaDecryptor@[.]exe**     |  `b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25` |
| **taskdl.exe**              |  `4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79` |
| **taskhsvc.exe**            |  `e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb` |
| **taskse.exe**              |  `2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d` |


| Item | Description |
| ----------------------------------------------------- |:---------------------------------------------------------------------------------------------------- | 
| **Ransomware.wannacry.exe** | `Initial file detonated`                                                                             | `24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c` |
| **tasksche.exe**            | `The payload unpacked from the dropper`                                                              | `ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa` |
| **@WanaDecryptor@[.]exe**     | `The GUI application that is executed by tasksche after all files have been encrypted and handles ransom payment` | `b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25` |
| **taskdl.exe**              | `SQL Client Configuration Utility EXE`                                                                                   | `4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79` |
| **taskhsvc.exe**            | `Handles communication to TOR URL and other TOR activites`                                                                                   | `e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb` |
| **taskse.exe**              | `Waitfor - Wait/send a signal over a network `                                                                                   | `2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d` |

<br />

---

## Static Analysis

<br />

#### The original file name can be found in the "Version" tab of PE Studio
![](https://i.imgur.com/jto5qbO.png)
*Fig.1 Original filename of dropper.*

<br />

#### Compiler time stamp reports Nov. 20, 2010 in PE Studio.
![](https://i.imgur.com/v0Tp9lb.png)
*Fig.2 Image showing was date dropper was compiled.*

<br />

#### Executable can be found in the .rsrc section of the dropper executable.
![](https://i.imgur.com/NyQ6JPP.png)
*Fig.3 Image of executable in the .rsrc header of the dropper.*

<br />

![](https://i.imgur.com/sVj2p6O.png)
*Fig.4 Payload found in the 00407ce0 function*
<br />

#### Found a URL that the dropper tries to communicate with at the start of it's execution. 

![](https://i.imgur.com/J9DALBN.png)
![](https://i.imgur.com/ga1ionK.png)
*Fig.5 Reference to DNS query URL string.*

<br />

#### A few imports of interest:

![](https://i.imgur.com/IjxH9eC.png)
*Fig.6 Imports of interest in the dropper.*

<br />

#### Addresses to the bitcoin wallets can be found in the function starting at address 0x00401E9E within the `tasksche.exe` executable. BTC addresses are randomly selected. 

![](https://i.imgur.com/FpXyHUc.png)
*Fig.7 Bitcoin addresses found in the payload*

<br />
---

## Dynamic Analysis

<br />

#### Dropper tries to reach out to the suspicious URL.

![](https://i.imgur.com/XjLZqRM.png)
![](https://i.imgur.com/VUjL95Z.png)
*Fig.8 Dropper making DNS query to suspicious URL.*

<br />

#### If the connection to the URL fails, the program proceeds and pushes two arguments to the stack `<PATH_TO_WANNACRY>` and `-m security` which are then passed as parameters to the `CreateServiceA` function. The strings `mssecsvc2.0` and `Microsoft Security Center (2.0) Service` are also pushed to the stack in preparation for the creation of the service. The program proceeds to create a service named `mssecsvc2.0` with the display name of `Microsoft Security Center (2.0) Service`. Below are images of the service being prepared and the service after creation.

![](https://i.imgur.com/HZ5XUnV.png)
![](https://i.imgur.com/MuvHeEg.png)
*Fig.9 Dropper creates service as a persistence mechanism*

<br />

#### After the creation of the service the payload attempts to connect to a range of IPv4.

![](https://i.imgur.com/7wdSiPQ.png)
*Fig.10 Service attempts to reach out to a range of IPv4.*

<br />


#### A reference to the payload can be seen being pushed to the stack along with another string of interest can be found stepping through the dropper in x32dbg.

![](https://i.imgur.com/mkKu1oS.png)
*Fig.11 Reference to packed payload.*

<br />

#### The payload is later unpacked on to the system in the `C:\Windows` directory and is executed.

![](https://i.imgur.com/RNesclW.png)
![](https://i.imgur.com/PDT2qqS.png)
![](https://i.imgur.com/1x0Ba69.png)
*Fig.12 Payload is unpacked by dropper.*

<br />

#### The payload generates a string based on the host name of the system and creates a folder named after the generated string in the `C:\ProgramData` directory. After the creation of the directory a copy of the payload is moved to the directory.

![](https://i.imgur.com/EOTrT6q.png)
![](https://i.imgur.com/cFLr8Zb.png)
*Fig.13 Payload generates random string based on the system name, creates a folder in the `C:\ProgramData` directory with the generated name and copies the payload to the generated directory.*

<br />

#### Along with the creation of the new directory a service is also created with the same generated name as the directory which uses cmd to execute tasksche as a persistence mechanism. 

![](https://i.imgur.com/H8cdzPD.png)
*Fig.14 Service is created with the same name as the generated string.*

<br />

#### A registry named `WanaCrypt0r` and registry key named `wd` are created with the key value set to the newly created directory in `C:\ProgramData\<RANDOMLY_GENERATED_STRING>`.
![](https://i.imgur.com/4Kg2n7h.png)
![](https://i.imgur.com/y4Y3G08.png)
*Fig.15 Registry key created by payload service.*

<br />


#### After the payload has executed the `@WanaDecryptor@.exe` executable is dropped along with various other files in the same directory as the payload's execution and creates a shortcut to the executable on the Desktop.

![](https://i.imgur.com/xIjt4Tf.png)
*Fig.16 Files dropped from payload after encryption process has begun.*

<br />

#### Lastly, the system background is changed and a GUI of the `@WanaDecryptor@.exe` is displayed. 

![](https://i.imgur.com/TyJjmn4.png)
![](https://i.imgur.com/3sh4GrU.png)
*Fig.17 Background changed and GUI application displayed*

<br />

---

## Indicators of Compromise



### Network Indicators

<br />

#### Dropper observed making DNS Query to suspicious domain.

![](https://i.imgur.com/VUjL95Z.png)

<br />

#### Payload attempts establish contact with a range of IPv4 addresses.

![](https://i.imgur.com/7wdSiPQ.png)

---

### Host Based Indicators

<br />

#### Payload is unpacked on to system in `C:\Windows`.

*(Note) During the debugging process, there was a mention of a file in the directory `C:\Windows` named `qeriuwjhrf` but the file was never created.*
![](https://i.imgur.com/1x0Ba69.png)

<br />

#### Creation of services.

![](https://i.imgur.com/MuvHeEg.png)
![](https://i.imgur.com/H8cdzPD.png)

<br />

#### Creation of registry key.

![](https://i.imgur.com/4Kg2n7h.png)
![](https://i.imgur.com/y4Y3G08.png)

<br />

#### Creation of files following the execution of the payload in the same directory as the execution. Along with files ending in the `.WNCRY` extension.

![](https://i.imgur.com/xIjt4Tf.png)

#### Background change and appearance of GUI application.

![](https://i.imgur.com/TyJjmn4.png)
![](https://i.imgur.com/3sh4GrU.png)


<br />

---

## Yara Rules

<br />


``` yara
rule wannacry_ruleset {
    meta:
    last_updated = "04-09-2022"
    author = "IAANSEC"
    description = "Yara rule to detect wannacry ransomware."
    hash256 = "24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c"

    strings:
        $MZ_byte = "MZ"
        $querydomain_killswitch = "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea" ascii
        $weird_windows_dir_str = "qeriuwjhrf" ascii
        $reg_name = "WanaCrypt0r" ascii
        $service = "Microsoft Security Center (2.0) Service" ascii
        $payload = "tasksche" ascii
        $exe1 = "taskdl" ascii
        $exe2 = "taskse" ascii
        $import = "Crypt" ascii
        $str = "WNcry@2017" ascii
        $decrypt_exe = "@WanaDecryptor@.exe" ascii
        $wnry = "wnry" ascii
        $decrypt = "decrypt" ascii
        $bitcoin = "bitcoin" ascii
        $btc_wallet1 = "115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn" fullword ascii
        $btc_wallet2 = "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94" fullword ascii
        $btc_wallet3 = "12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw" fullword ascii
        
    condition:
        $MZ_byte at 0 and
        5 of them     
}
```

---

# Connect With Me :slightly_smiling_face: 

[![Website](https://img.shields.io/website?label=IAANSec&style=for-the-badge&url=https%3A%2F%2Fiaansec.com&color=green)](https://iaansec.com) [![Website](https://img.shields.io/website?label=dev.to&style=for-the-badge&url=https%3A%2F%2Fdev.to/l0wk3y&color=orange)](https://dev.to/l0wk3y) [![Website](https://img.shields.io/website?label=GitHub&style=for-the-badge&url=https%3A%2F%2Fgithub.com/l0wk3y&color=yellow)](https://github.com/L0WK3Y-IAAN) [![Website](https://img.shields.io/website?label=LinkedIn&style=for-the-badge&url=https%3A%2F%2Flinkedin.com/in/l0wk3yiaansec&color=blue)](https://www.linkedin.com/in/l0wk3yiaansec)