> For the complete documentation index, see [llms.txt](https://0xsec.gitbook.io/0xsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xsec.gitbook.io/0xsec/malware-analysis/2025-12-18-wannacry.md). # WannaCry Analysis(Malware) ### NOTE With estimates over 100,000 computers impacted globally thus far, many people received unwelcome notes Friday similar to those below demanding a fee to decrypt their files. While the notes promise to return the data, it’s not guaranteed that paying the ransom will return data safely, but if it gets this far and adequate backups are not in place, it may be the only recourse the victim has. No one ever wants to see one of these.

Figure 1: Ransom Note

### Technical Summary `SHA256 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c/ MD5 Db349b97c37d22f5ea1d1841e3c89eb4` from [VirusTotal](https://virustotal.com). It consists of two parts: stage-0 executable and an unpacked stage-2 encryption and worm program. It first attempts to contact its kill switch URL (*hxxps\://iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com*). If the URL is alive it does not execute. If the URL is not found then the malware unpacks **tasksche.exe** and creates a service to start tasksche.exe on startup. This executable encrypts all the files, and popup ransom window and changes the background of Desktop. It creates a random folder inside C:\ProgramData with some random naming to store all the wannacry files. It exploits the EternalBlue vulnerability on port 445(SMB) to spread to other computers. Initial executable runs and checks if the kill switch url is alive or not. If it is alive then stops the execution and if not it unpacks the persistance binary **tasksche.exe**. **Tasksche.exe** was residing in a randomly named directory inside ProgramData which tries to spread over network using port 445 to infect other computers by encrypting all files and ransom popup window. ### Static Analysis #### Basic On running *floss* on the executable its shows modules used to open a url and service name used, kill switch url, and randomly named path which is likely used to store the unpacked data of ransomware.

Figure 2: Network Modules

Figure 3: Service name, kill switch url, random path

Then it shows commands used, `icacls` used to modify the access control of files and `attrib +h .` used to hide the file attributes and a string `WNcry@2ol7` which look like a password.

Figure 4: commands, modifying access control, hiding file attrib, password

Here is list of all imports which include certain socket, Read/write file, and many other modules utilised by this executable.

Figure 5: Import_1

Figure 6: Import_2

Figure 7: Import_3

Figure 8: Information from pestudio

#### Advanced On viewing the assembly code in *IDA* it shows that the binary first tries to connect with the kill switch url if that returned anything other than zero it means the url is active and working so binary stops its execution there otherwise calls a function `sub_408090`.

Figure 9: Assembly code in IDA

### Dynamic Analysis With [fakenet](https://github.com/mandiant/flare-fakenet-ng) running and wireshark opened when i executed the binary, it made a **DNS** query to url *[www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com](http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com)* to check if its alive or not.

Figure 10: DNS Query to kill switch

It created a random directory named `dyxbnfbi618` in ProgramData which is staging area of rasomware files and start encrypting all the files in the system.

Figure 11: Staging area of ransomware files

Figure 12: Encrypts every file

Using **tasksche.exe** it creates a service named same as the random directory which invokes tasksche.exe on startup.

Figure 13: Service named randomly

Figure 14: Service Properties

After infection it changes the background, encryptes all old files and popup a ransom payment window.

Figure 15: Ransom Window

### IOCs

Figure 16: Connection to kill switch url

Figure 17: Locating other machine and exploiting with port 445

### Rules and Signatures ```yara rule Ransomware_WannaCry { meta: last_updated = "2025-12-18" author = "0xSec" description = "Yara Rule for WannaCry Ransomware" strings: $string1 = "attrib +h ." fullword ascii $cmd = "icacls . /grant Everyone:F /T /C /Q" fullword ascii $string3 = "C:\\%s\\dyxbnfbi618" fullword ascii $passwd = "WNcry@2ol7" fullword ascii $ext = "wnry" ascii $ext1 = "WNCRY" ascii $kill_switch = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" ascii $payload = "tasksche.exe" ascii $PE_magic_byte = "MZ" condition: $PE_magic_byte at 0 and ($url or 1 of ($string*) or $payload) } ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://0xsec.gitbook.io/0xsec/malware-analysis/2025-12-18-wannacry.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.