Yet another WanaCry Ransomware – Analysis

Recently, organizations are being targeted with new ransomware labelled as WanaCry.

Being curious, I downloaded the sample to understand how the malware actually behaved. The tests were performed on VM connected to internet and NOT connected to the internet. In both tests, machine was successfully infected.

Sample analysed : 84c82835a5d21bbcf75a61706d8ab549

As seen in the screenshot the executable is “Wana Decryptor 2.0”.

Following screenshot shows the process tree.

In the screenshot above, the malware creates taskhsvc.exe which contains TOR data and the CnC server addresses :

• 57g7spgrzlojinas.onion
• gx7ekbenv2riucmf.onion

Looked at the dump file for @WanaDecryptor@.exe and identified same domains with additional .onion sites

• xxlvbrloxvriy2c5.onion
• 76jdd2ir2embyv47.onion
• cwwnhwhlz52maqm7.onion

Malware using .onion domains for CnC communications is a technique to stay resilient.

The sample, in my opinion, is a packer/installer that unpacks files shown in below screenshot and also creates @WanaDecrypto@.exe that continuously runs as a process. It is worth noting the folder “msg” and “TaskData” were created when VM was infected connected to internet connection. I will explain each file in the later section.

Executable when connected to internet creates two additional folder
called “msg” and “TaskData”.

Below are MD5 of the files that were in the “TaskData” Folder.

MD5 (./TaskData/Tor/libeay32.dll) = 6ed47014c3bb259874d673fb3eaedc85
MD5 (./TaskData/Tor/libevent-2-0-5.dll) = 90f50a285efa5dd9c7fddce786bdef25
MD5 (./TaskData/Tor/libevent_core-2-0-5.dll) =
e5df3824f2fcad0c75fd601fcf37ee70
MD5 (./TaskData/Tor/libevent_extra-2-0-5.dll) =
6d6602388ab232ca9e8633462e683739
MD5 (./TaskData/Tor/libgcc_s_sjlj-1.dll) = 73d4823075762ee2837950726baa2af9
MD5 (./TaskData/Tor/libssp-0.dll) = 78581e243e2b41b17452da8d0b5b2a48
MD5 (./TaskData/Tor/ssleay32.dll) = a12c2040f6fddd34e7acb42f18dd6bdc
MD5 (./TaskData/Tor/taskhsvc.exe) = fe7eb54691ad6e6af77f8a9a0b6de26d
MD5 (./TaskData/Tor/tor.exe) = fe7eb54691ad6e6af77f8a9a0b6de26d
MD5 (./TaskData/Tor/zlib1.dll) = fb072e9f69afdb57179f59b512f828a4

Folder “msg” contains language packs which also gets encrypted and gets
extension “.wnry”.

Below are the files that were created :

1. @Please_Read_Me@
2. @WanaDecryptor@.exe
3. 00000000.res
4. c.wnry – contains links to .onion sites and tor browser
5. f.wnry – List of random files that are encrypted
6. u.wnry – @WanaDecryptor@.exe decrypter file
7. b.wnry – bitmap file containing decryption details
8. r.wnry – some more information about decryption and instructions for the decryption tool
9. s.wnry – Tor zip file
10. t.wnry – encryption format instructions
11. 00000000.eky – Infected machines private RSA key
12. 00000000.pky – Microsoft public key – RSA 2048
13. 00000000.res — Data for C2 communication
14. taskdl.exe – file deletion tool
15. taskse.exe – enumerates RDP connection and executes malware – TOR process runs underneath
16. msg – language packs. See screenshot below.
17. TaskData – TOR browser executable and other files. See screenshot below.

When the malware got executed it queried following domains :

– tor.relay.wardsback.org
– tor.ybti.net
– javadl-esd-secure.oracle.com
– belegost.csail.mit.edu
– tor1.mdfnet.se
– zebra620.server4you.de
– maatuska.471.se

System also communicated to 212.47.241.21 which resolves to sa1.sblo.ch. Ran the malware again and this time it went to different domains :

– tor.dizum.com
– tor1e1.digitale-gessellschaft.ch
– lon.anondroid.com

This could likely be due to malware using TOR. Analysed TOR process and saw multiple IP addresses hard-coded. Here you can find all the directory servers used by TOR.

Extensions that are getting encrypted :

Extract from PE Explorer :

Extract from Sysmon can be found sysmon logs.

WannaCry Fact Sheet – Here.

Kill-chain Phases – Here.

Final Words :

1. The malware was not delivered via phishing, but rather via EternalBlue Exploit, taking non-traditional way of infecting systems.
2. No obfuscation was done – meaning when you open the executable you can see the functions.
3. Exploit such as EthernalBlue, suggests that getting access to vulnerable systems with user interaction is available. The only we detected this was attacker actually use EternalBlue exploit for financial gain – WannaCry ransomware – however, others can just gain access to the system and perform other tasks. Motive, based on evidence, is financial gain.
4. Although, patching of systems would have definitely helped, however, we must understand the exploit was only used after dump by Shadow Brokers. Although, the intention of the group would be to expose NSA and its tools, the exploit was used for financial gain. So, may be intention to expose NSA may have been for good, it just did more damage.
5. Number of articles says that creator of malware made mistakes and they just earned 55 K. However, one must understand all those money are paid ransomware and one must also understand the affects/impact of the malware attack. Although, we cannot quantify the time spent to patch the systems, re-image infected systems, people not being in production globally, it is not small. Although, some analysis suggests that attackers were not sophisticated, but it worked.
6. Can host based security controls would have helped? Controls such as Application whitelisting, no admin rights to logged in users, use of AppLocker in Windows may have helped in reducing the impact. However, how feasible is to apply this in a corporate environment ?