WANNACRY
RANSOMWARE - 2017 - 230k+ computers infected
The attack began at 07:44 UTC on 12 May 2017 and was halted a few hours later at 15:03 UTC by the registration of a kill switch discovered by Marcus Hutchins. The kill switch prevented already infected computers from being encrypted or further spreading WannaCry.[5] The attack was estimated to have affected more than 300,000 computers across 150 countries, with total damages ranging from hundreds of millions to billions of dollars. At the time, security experts believed from preliminary evaluation of the worm that the attack originated from North Korea or agencies working for the country. In December 2017, the United States and United Kingdom formally asserted that North Korea was behind the attack, although North Korea has denied any involvement with the attack.
A new variant of WannaCry forced Taiwan Semiconductor Manufacturing Company (TSMC) to temporarily shut down several of its chip-fabrication factories in August 2018. The worm spread onto 10,000 machines in TSMC's most advanced facilities.
WannaCry is a ransomware cryptoworm, which targets computers running the Microsoft Windows operating system by encrypting (locking) data and demanding ransom payments in the Bitcoin cryptocurrency. The worm is also known as WannaCrypt, Wana Decrypt0r 2.0, WanaCrypt0r 2.0, and Wanna Decryptor. It is considered a network worm because it also includes a transport mechanism to automatically spread itself. This transport code scans for vulnerable systems, then uses the EternalBlue exploit to gain access, and the DoublePulsar tool to install and execute a copy of itself. WannaCry versions 0, 1 and 2 were created using Microsoft Visual C++ 6.0.
EternalBlue is an exploit of Microsoft's implementation of their Server Message Block (SMB) protocol released by The Shadow Brokers. Much of the attention and comment around the event was occasioned by the fact that the U.S. National Security Agency (NSA) (from whom the exploit was likely stolen) had already discovered the vulnerability, but used it to create an exploit for its own offensive work, rather than report it to Microsoft. Microsoft eventually discovered the vulnerability, and on Tuesday, 14 March 2017, they issued security bulletin MS17-010, which detailed the flaw and announced that patches had been released for all Windows versions that were currently supported at that time, these being Windows Vista, Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2016.
DoublePulsar is a backdoor tool, also released by The Shadow Brokers on 14 April 2017. Starting from 21 April 2017, security researchers reported that there were tens of thousands of computers with the DoublePulsar backdoor installed. By 25 April, reports estimated that the number of infected computers could be up to several hundred thousand, with numbers increasing every day. The WannaCry code can take advantage of any existing DoublePulsar infection, or installs it itself. On 9 May 2017, private cybersecurity company RiskSense released code on GitHub with the stated purpose of allowing legal white hat penetration testers to test the CVE-2017-0144 exploit on unpatched systems.
When executed, the WannaCry malware first checks the kill switch domain name (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com); if it is not found, then the ransomware encrypts the computer's data, then attempts to exploit the SMB vulnerability to spread out to random computers on the Internet, and laterally to computers on the same network. On the local system, the WannaCry executable file extracts and installs binary and configuration files from its resource section. It also hides the extracted directory, modifies security descriptors, creates an encryption key, deletes shadow copies, and so on. As with other modern ransomware, the payload displays a message informing the user that their files have been encrypted, and demands a payment of around US$300 in bitcoin within three days, or US$600 within seven days (equivalent to about $370 and $750 in 2023), warning that "you have not so enough time. [sic]" Three hardcoded bitcoin addresses, or wallets, are used to receive the payments of victims. As with all such wallets, their transactions and balances are publicly accessible even though the cryptocurrency wallet owners remain unknown.
Several organizations released detailed technical write-ups of the malware, including a senior security analyst at RiskSense, Microsoft, Cisco, Malwarebytes, Symantec, and McAfee.
The attack began on Friday, 12 May 2017, with evidence pointing to an initial infection in Asia at 07:44 UTC. The initial infection was likely through an exposed vulnerable SMB port, rather than email phishing as initially assumed.[34] Within a day the code was reported to have infected more than 230,000 computers in over 150 countries.
Organizations that had not installed Microsoft's security update from March were affected by the attack. Those still running unsupported versions of Microsoft Windows, such as Windows XP and Windows Server 2003 were at particularly high risk because no security patches had been released since April 2014 for Windows XP and July 2015 for Windows Server 2003. A Kaspersky Lab study reported, however, that less than 0.1 percent of the affected computers were running Windows XP, and that 98 percent of the affected computers were running Windows 7. In a controlled testing environment, the cybersecurity firm Kryptos Logic found that it was unable to infect a Windows XP system with WannaCry using just the exploits, as the payload failed to load, or caused the operating system to crash rather than actually execute and encrypt files. However, when executed manually, WannaCry could still operate on Windows XP.
Defensive Response
Experts quickly advised affected users against paying the ransom due to no reports of people getting their data back after payment and as high revenues would encourage more of such campaigns. As of 14 June 2017, after the attack had subsided, a total of 327 payments totaling US$130,634.77 (51.62396539 BTC) had been transferred (worth approximately US$5,390,000 as of January 23rd, 2025).
The day after the initial attack in May, Microsoft released out-of-band security updates for end-of-life products Windows XP, Windows Server 2003 and Windows 8; these patches had been created in February, but were previously only available to those who paid for a custom support plan. Organizations were advised to patch Windows and plug the vulnerability in order to protect themselves from the cyber attack.[citation needed] The head of Microsoft's Cyber Defense Operations Center, Adrienne Hall, said that "Due to the elevated risk for destructive cyber-attacks at this time, we made the decision to take this action because applying these updates provides further protection against potential attacks with characteristics similar to WannaCrypt [alternative name to WannaCry]".
Researcher Marcus Hutchins discovered the kill switch domain hardcoded in the malware. Registering a domain name for a DNS sinkhole stopped the attack spreading as a worm, because the ransomware only encrypted the computer's files if it was unable to connect to that domain, which all computers infected with WannaCry before the website's registration had been unable to do. While this did not help already infected systems, it severely slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in North America and Asia, which had not been attacked to the same extent as elsewhere. On 14 May, a first variant of WannaCry appeared with a new and second kill-switch registered by Matt Suiche on the same day. This was followed by a second variant with the third and last kill-switch on 15 May, which was registered by Check Point threat intelligence analysts. A few days later, a new version of WannaCry was detected that lacked the kill switch altogether.
On 19 May, it was reported that hackers were trying to use a Mirai botnet variant to effect a distributed denial-of-service attack on WannaCry's kill-switch domain with the intention of knocking it offline. On 22 May, Hutchins protected the domain by switching to a cached version of the site, capable of dealing with much higher traffic loads than the live site.
Separately, researchers from University College London and Boston University reported that their PayBreak system could defeat WannaCry and several other families of ransomware by recovering the keys used to encrypt the user's data.
It was discovered that Windows encryption APIs used by WannaCry may not completely clear the prime numbers used to generate the payload's private keys from the memory, making it potentially possible to retrieve the required key if they had not yet been overwritten or cleared from resident memory. The key is kept in the memory if the WannaCry process has not been killed and the computer has not been rebooted after being infected. This behaviour was used by a French researcher to develop a tool known as WannaKey, which automates this process on Windows XP systems. This approach was iterated upon by a second tool known as Wanakiwi, which was tested to work on Windows 7 and Server 2008 R2 as well.
Within four days of the initial outbreak, new infections had slowed to a trickle due to these responses.
Attribution
Linguistic analysis of the ransom notes indicated the authors were likely fluent in Chinese and proficient in English, as the versions of the notes in those languages were probably human-written while the rest seemed to be machine-translated. According to an analysis by the FBI's Cyber Behavioral Analysis Center, the computer that created the ransomware language files had Hangul language fonts installed, as evidenced by the presence of the "\fcharset129" Rich Text Format tag.[14] Metadata in the language files also indicated that the computers that created the ransomware were set to UTC+09:00, which is used in Korea.
A security researcher initially posted a tweet referencing code similarities between WannaCry and previous malware. The cybersecurity companies Kaspersky Lab and Symantec have both said the code has some similarities with that previously used by the Lazarus Group (believed to have carried out the cyberattack on Sony Pictures in 2014 and a Bangladesh bank heist in 2016—and linked to North Korea). This could also be either simple re-use of code by another group or an attempt to shift blame—as in a cyber false flag operation; but a leaked internal NSA memo is alleged to have also linked the creation of the worm to North Korea. Brad Smith, the president of Microsoft, said he believed North Korea was the originator of the WannaCry attack, and the UK's National Cyber Security Centre reached the same conclusion.
On 18 December 2017, the United States Government formally announced that it publicly considers North Korea to be the main culprit behind the WannaCry attack. President Donald Trump's Homeland Security Advisor, Tom Bossert, wrote an op-ed in The Wall Street Journal about this charge, saying "We do not make this allegation lightly. It is based on evidence." In a press conference the following day, Bossert said that the evidence indicates that Kim Jong-un had given the order to launch the malware attack. Bossert said that Canada, New Zealand and Japan agree with the United States' assessment of the evidence that links the attack to North Korea, while the United Kingdom's Foreign and Commonwealth Office says it also stands behind the United States' assertion.
North Korea, however, denied being responsible for the cyberattack.
On 6 September 2018, the U.S. Department of Justice (DoJ) announced formal charges against Park Jin-hyok for involvement in the Sony Pictures hack of 2014. The DoJ contended that Park was a North Korean hacker working as part of a team of experts for the North Korean Reconnaissance General Bureau. The Department of Justice asserted this team also had been involved in the WannaCry attack, among other activities.
Impact
The ransomware campaign was unprecedented in scale according to Europol,[38] which estimates that around 200,000 computers were infected across 150 countries. According to Kaspersky Lab, the four most affected countries were Russia, Ukraine, India and Taiwan.[102]
One of the largest agencies struck by the attack was the National Health Service hospitals in England and Scotland,[103][104] and up to 70,000 devices—including computers, MRI scanners, blood-storage refrigerators and theatre equipment—may have been affected.[105] On 12 May, some NHS services had to turn away non-critical emergencies, and some ambulances were diverted.[106][107] In 2016, thousands of computers in 42 separate NHS trusts in England were reported to be still running Windows XP.[41] In 2018 a report by Members of Parliament concluded that all 200 NHS hospitals or other organisations checked in the wake of the WannaCry attack still failed cybersecurity checks.[108][109] NHS hospitals in Wales and Northern Ireland were unaffected by the attack.[106][110]
Nissan Motor Manufacturing UK in Tyne and Wear, England, halted production after the ransomware infected some of their systems. Renault also stopped production at several sites in an attempt to stop the spread of the ransomware.[111][112] Spain's Telefónica, FedEx and Deutsche Bahn were hit, along with many other countries and companies worldwide.[113][114][115]
The attack's impact is said to be relatively low compared to other potential attacks of the same type and could have been much worse had Hutchins not discovered that a kill switch had been built in by its creators[116][117] or if it had been specifically targeted on highly critical infrastructure, like nuclear power plants, dams or railway systems.[118][119]
According to cyber-risk-modeling firm Cyence, economic losses from the cyber attack could reach up to US$4 billion, with other groups estimating the losses to be in the hundreds of millions.[120]
learn more
typedef double float64_t;
typedef long double float80_t;
// ------------------------ Structures ------------------------
struct WSAData {
int16_t e0;
int16_t e1;
int16_t e2;
int16_t e3;
char * e4;
char e5[1];
char e6[1];
};
struct _LARGE_INTEGER {
int64_t e0;
};
struct _LIST_ENTRY {
struct _LIST_ENTRY * e0;
struct _LIST_ENTRY * e1;
};
struct _OVERLAPPED {
int32_t e0;
int32_t e1;
int32_t e2;
char * e3;
};
struct _RTL_CRITICAL_SECTION {
struct _RTL_CRITICAL_SECTION_DEBUG * e0;
int32_t e1;
int32_t e2;
char * e3;
char * e4;
int32_t e5;
};
struct _RTL_CRITICAL_SECTION_DEBUG {
int16_t e0;
int16_t e1;
struct _RTL_CRITICAL_SECTION * e2;
struct _LIST_ENTRY e3;
int32_t e4;
int32_t e5;
int32_t e6;
int16_t e7;
int16_t e8;
};
struct _SERVICE_STATUS {
int32_t e0;
int32_t e1;
int32_t e2;
int32_t e3;
int32_t e4;
int32_t e5;
int32_t e6;
};
struct _SERVICE_TABLE_ENTRYA {
char * e0;
void (**e1)(int32_t, char **);
};
struct _TYPEDEF_IP_ADDRESS_STRING__PIP_ADDRESS_STRING_IP_MASK_STRING__PIP_MASK_STRING {
char e0[1];
};
struct _IP_ADDR_STRING {
struct _IP_ADDR_STRING * e0;
struct _TYPEDEF_IP_ADDRESS_STRING__PIP_ADDRESS_STRING_IP_MASK_STRING__PIP_MASK_STRING e1;
struct _TYPEDEF_IP_ADDRESS_STRING__PIP_ADDRESS_STRING_IP_MASK_STRING__PIP_MASK_STRING e2;
int32_t e3;
};
struct _IP_ADAPTER_INFO {
struct _IP_ADAPTER_INFO * e0;
int32_t e1;
char e2[1];
char e3[1];
int32_t e4;
char e5[1];
int32_t e6;
int32_t e7;
int32_t e8;
struct _IP_ADDR_STRING * e9;
struct _IP_ADDR_STRING e10;
struct _IP_ADDR_STRING e11;
struct _IP_ADDR_STRING e12;
bool e13;
struct _IP_ADDR_STRING e14;
struct _IP_ADDR_STRING e15;
int32_t e16;
int32_t e17;
};
struct _IP_PER_ADAPTER_INFO_W2KSP1 {
int32_t e0;
int32_t e1;
struct _IP_ADDR_STRING * e2;
struct _IP_ADDR_STRING e3;
};
struct fd_set {
int32_t e0;
int32_t e1[1];
};
struct in_addr {
int32_t e0;
};
struct sockaddr {
int16_t e0;
char e1[14];
};
struct timeval {
int32_t e0;
int32_t e1;
};