WannaCry, Reopened

What a modern triage of a 2017 ransomware sample teaches about killswitch logic and staging behaviour

Vasilis Mantas — Threat Detection Engineer

Verdict: WannaCry checks a hardcoded URL before doing anything destructive. If the URL responds, the sample exits without encrypting. If it cannot be reached, encryption proceeds. This inverted logic is the single most instructive thing in the binary, and it is easy to get backwards — including in a lab, where a network simulator that answers every request will silently prevent the malware from detonating at all.

WannaCry has been analysed exhaustively since May 2017. This walkthrough is not an attempt to say something new about the campaign. It is a demonstration of triage method on a sample whose ground truth is already known, which makes it a useful benchmark: every conclusion below can be checked against the public record.

The analysis was performed in an isolated lab with no route to the internet.

Surface behaviour

Detonating the sample produces the outcome the sample is famous for. Files across the system are renamed with a .WNCRY extension, a ransom interface titled Wana Decrypt0r 2.0 appears demanding $600 in Bitcoin, and the desktop wallpaper is replaced with a plaintext version of the same message.

A practical note for anyone running this in a lab: several FlareVM analysis tools become unusable after detonation, because their own files are encrypted along with everything else. Snapshot before, not after.

Basic static analysis

Extracting strings with FLOSS, filtering short noise:

FLOSS.exe -n 7 Ransomware.wannacry.exe.malz > outputstrings.txt

The DOS header string !This program cannot be run in DOS mode. appears multiple times. A PE header appearing more than once inside a single file means embedded executables, and each occurrence is followed by a distinct set of DLL imports — a different API surface per embedded binary. PEStudio confirmed three packed binaries in total.

The remaining strings are unusually generous:

cmd.exe /c "%s"
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Global\MsWinZonesCacheCounterMutexA
tasksche.exe
TaskStart
icacls . /grant Everyone:F /T /C /Q
attrib +h .
C:\%s\qeriuwjhrf
C:\%s\%s
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

Three Bitcoin wallets, a named mutex, a dropped executable name, two format-string paths, and one conspicuously random-looking domain. The icacls and attrib commands grant everyone full control over a directory tree and hide it — staging behaviour, visible before a single instruction is executed.

The import table reinforces the picture. CryptGenRandom and CryptAcquireContextA for key generation. A dense block of ws2_32.dll socket functions — socket, connect, send, recv, WSAStartup — alongside GetAdaptersInfo, indicating network enumeration and self-propagation. InternetOpenA and InternetOpenUrlA from wininet.dll, which turn out to matter more than anything else in the list.

Dynamic analysis, and a lab trap

The second detonation was run with REMnux providing inetsim as a fake DNS resolver and HTTP responder. The sample did nothing. No encryption, no ransom note, no filesystem activity of consequence.

That is not a broken sample. It is the killswitch working.

When inetsim answers the request to iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com with a 200 OK, WannaCry concludes the domain is live and exits. In the first detonation, with no simulator running, the request failed, the sample concluded the domain was unregistered, and it encrypted the filesystem.

The consequence for analysts is worth stating directly. A generic network simulator that returns success for every request will suppress this sample's entire payload. An analyst who only ever detonates with full simulation would conclude the binary is inert.

With the payload allowed to run, TCPView showed the propagation attempt: a large volume of TCP SYN packets to sequential and apparently random addresses on port 445, the SMB service port — the sample scanning for further hosts to infect. A second listener appeared, taskhsvc.exe bound to 127.0.0.1:9050, the Tor SOCKS port, providing the anonymised channel back to the operators.

Procmon, filtered on the sample's process name and CreateFile, showed the drop:

Ransomware.wan... → C:\Windows\tasksche.exe   SUCCESS

followed in the process tree by tasksche.exe executing with the argument /i. Filtering again on the new PID revealed the staging directory:

C:\ProgramData\dveqybpwqzws072\
    msg\                      TaskData\
    @Please_Read_Me@.txt      @WanaDecryptor@.exe
    00000000.eky              00000000.pky        00000000.res
    b.wnry  c.wnry  f.wnry  r.wnry  s.wnry  t.wnry  u.wnry
    taskdl.exe                taskse.exe

The C:\%s\%s format string from the strings output is now explained: the directory name is generated at runtime, which is why the folder is dveqybpwqzws072 here and something else elsewhere. A service is created bearing the same random name — the persistence mechanism.

Advanced static analysis

Loading the binary into Cutter and navigating to main puts the killswitch logic on screen in a dozen instructions:

0x0040814a   mov  esi, str.http:__www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
0x0040817b   call dword [InternetOpenA]
0x00408194   call dword [InternetOpenUrlA]
0x0040819a   mov  edi, eax
0x004081a3   test edi, edi
0x004081a5   jne  0x4081bc

The decompiler view is clearer still:

eax = InternetOpenUrlA(esi, ecx, 0, 0, 0x84000000, 0);
edi = eax;
esi = *(InternetCloseHandle);
if (edi == 0) {
    (*esi)();
    (*esi)(0);
    eax = fcn_00408090();
    eax = 0;
    return eax;
}

InternetOpenUrlA returns a handle, or NULL on failure. The handle lands in edi, and test edi, edi sets the zero flag only when the call failed.

The branch is therefore: handle is NULL — the domain did not resolve — call fcn_00408090, the encryption routine. Handle is valid — the domain responded — close the handles, clean up the stack, return.

The graph view makes the asymmetry obvious. One path is labelled normal execution and leads into the encryption function. The other is a short exit stub. The condition separating them is a single test on the result of a web request.

Registering that domain is what stopped the campaign in 2017. The disassembly above is the mechanism, in six instructions.

Indicators of compromise

MITRE ATT&CK mapping

Detection guidance

The hashes and the killswitch domain have limited value now. The behavioural sequence does not.

1. Permission-widening plus attribute-hiding on a freshly created directory. The icacls . /grant Everyone:F /T /C /Q and attrib +h . pair is staging behaviour that predates encryption. Catching it means catching the sample before impact, which is the only detection that actually matters for ransomware.

title: Mass Permission Grant Followed by Directory Hiding
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  icacls:
    Image|endswith: '\icacls.exe'
    CommandLine|contains|all:
      - '/grant'
      - 'Everyone:F'
      - '/T'
  attrib:
    Image|endswith: '\attrib.exe'
    CommandLine|contains: '+h'
  condition: icacls or attrib
falsepositives:
  - Some software installers and backup agents
level: high

Correlate the two within a short window on one host rather than alerting on either alone — that is what separates a real staging sequence from routine installer noise.

2. Executable written to C:\Windows\ by a non-system process, then executed. A user-context process dropping a binary directly into the Windows directory and launching it is a narrow, high-value pattern.

3. Outbound SMB scanning from a workstation. A single host opening connections to TCP/445 across many destinations in a short window is almost never legitimate on an endpoint. Threshold on distinct destination count per source per minute.

4. Local Tor SOCKS listener. A process binding 127.0.0.1:9050 is worth an alert in any enterprise that has not deliberately deployed Tor.

5. Suspicious process spawning cmd.exe /c. Present here, and generic enough to earn its place in any ruleset — with the tuning that implies.

Analyst takeaways

Environment shapes behaviour, so vary the environment. The single most important finding in this analysis only appeared because the sample was detonated both with and without network simulation. One configuration produced a functioning ransomware; the other produced an inert file. Detonating once tells you what a sample does under one set of conditions, not what it does.

Strings foreshadow structure. icacls, attrib, C:\%s\%s and tasksche.exe were all visible before execution, and each was confirmed by dynamic analysis. Reading strings carefully turns dynamic analysis into confirmation rather than exploration.

The decisive logic is often tiny. The behaviour that defined a global incident reduces to one API call, one test, and one conditional jump. Finding that block took longer than understanding it — which is usually how reverse engineering goes.

Written by Vasilis Mantas, Senior Threat Detection Engineer. Analysis performed in an isolated lab using FlareVM, REMnux, FLOSS, PEStudio, PEview, Wireshark, Procmon, TCPView and Cutter.