Loading malware…
WannaCry is a Windows ransomware cryptoworm that combines file encryption and extortion with self-propagating worm behavior. It emerged in 2017 and spread globally at exceptional speed by exploiting the SMB vulnerability addressed by MS17-010 using the EternalBlue exploit, primarily impacting unpatched or unsupported Microsoft Windows systems. The outbreak affected organizations across more than 150 countries and caused major disruption in sectors where downtime was critical, including healthcare, with the UK National Health Service among the most prominent victims.
Once executed, WannaCry encrypts victim data and presents a ransom demand in bitcoin. In addition to local encryption, it can monitor for newly attached drives and encrypt files on those devices as they appear. The malware also uses Windows service creation for execution and persistence, including creation of the mssecsvc2.0 service, and hides some artifacts by setting hidden file attributes. Its worming capability enabled rapid propagation across reachable vulnerable Windows hosts, making it one of the most consequential ransomware outbreaks of its era.
WannaCry is widely assessed as linked to North Korean operators, with multiple reports associating it with the Lazarus Group. Earlier variants were reportedly used in more targeted enterprise activity before the large-scale global outbreak. The campaign is also notable for demonstrating how leaked nation-state exploitation tools can be repurposed for criminal or disruptive operations. WannaCry remains a landmark case in ransomware history because it fused ransomware, worm propagation, and exploit-driven lateral spread into a single high-impact event.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Port 445 (SMB) — Brought hospitals down worldwide via WannaCry ransomware (2017). The EternalBlue exploit (leaked NSA tool) targeted this port. | Port 445 (SMB) — Brought hospitals down worldwide via WannaCry ransomware (2017).
BlueKeep (CVE-2019-0708) exists within the Remote Desktop Protocol (RDP) used by the Microsoft Windows OSs listed above. An attacker can exploit this vulnerability to perform remote code execution on an unprotected system.
a ransomware campaign with a bite, named WannaCry, autonomously infected vulnerable systems leveraging an exploit leaked on the internet. | This port is important because the SMB service that listens on it is what the initial exploit targets (MS17-010,CVE-2017-0143).
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Five years ago, the WannaCry ransomware cryptoworm targeted computers running Microsoft Windows, encrypting data at organizations around the world.
The WannaCry ransomware attacks have received extensive coverage since a widespread attack on May 12 caused the systems of many large organizations around the world, including the NHS in the UK, to come to a juddering halt.
WannaCry paralysed computers running mostly older versions of Microsoft Windows by encrypting users' computer files and displaying a message demanding anywhere from $US300 to $US600 to release them; failure to pay would leave the data mangled and likely beyond repair.
The exploit chains in play included EternalBlue, DoublePulsar, and WannaCry, all tools that have been publicly known and patchable for years.
The WannaCry attack was a massive ransomware cyberattack... This ransomware leverages an NSA exploit known as EternalBlue... Wincry was the base of the encryption, but two additional exploits, EternalBlue and DoublePulsar, were used by the malware to make it a cryptoworm.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The response to cyberattacks such as the “WannaCry” worm could have been held up in export control paperwork for days, if not weeks, as would any other vulnerability disclosure or incident response in which command and control software or technical analysis of that software, were to cross a country’s virtual or physical border.
The malware’s current working directory is saved to the “wd” registry value under the \SOFTWARE\WanaCrypt0r key... If WCry is running with elevated privileges, the key is created in the HKLM registry hive; otherwise, it is created in the HKCU hive.
Hackers exploited vulnerabilities in outdated systems to encrypt critical data.
Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.
Upon starting, the worm attempts an HTTP connection to www . iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea . com. If the connection is successful, then the worm stops running and exits. The threat actors may have added this HTTP connection test to prevent automated sandboxes from running and analyzing the malware.
Agent Tesla has created hidden folders. AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings. APT28 has saved files with hidden file attributes. FIN13 has created hidden files and folders within a compromised Linux system /tmp directory and also used attrib.exe to hide gathered local host information.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
Scanning for Targets: Once executed, WannaCry scans local networks for vulnerable devices, attempting to exploit them without user interaction.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
Upon starting, the worm attempts an HTTP connection to www . iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea . com. If the connection is successful, then the worm stops running and exits. The threat actors may have added this HTTP connection test to prevent automated sandboxes from running and analyzing the malware.
One method is communicating directly with IP addresses instead of domains, making it harder for security tools to collect information about a connection.
WCry installs the Tor network anonymity software on the infected system... Tor establishes a SOCKS5 proxy server on the loopback interface (127.0.0.1) that listens on TCP port 9050. WCry connects to this proxy and attempts to contact the configured C2 hidden services.
The SMB worm delivers itself to the compromised system as a DLL file payload. After the DLL is executed with a single exported function named PlayGame, it writes a copy of the original SMB worm to C:\Windows\mssecsvc.exe and then executes this file. The SMB worm then drops a secondary payload from its resources section to C:\Windows\tasksche.exe and executes this file.
Once the attacker has positioned themselves for maximum damage, two things typically happen in quick succession: sensitive data is quietly copied out of the network (exfiltration), and then ransomware payloads are deployed across as many systems as possible simultaneously, encrypting files and displaying a ransom demand. | A ransomware attack is a type of cyberattack in which malicious software encrypts an organization’s files or systems, then demands payment, usually in cryptocurrency, in exchange for the decryption key.
WCry terminates several services so that their data stores can be encrypted: taskkill.exe /f /im mysqld.exe ... sqlwriter.exe ... sqlserver.exe ... MSExchange* ... Microsoft.Exchange.*
WCry executes the following single command... to complicate system and data recovery... vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Self-propagating ransomware that spread globally in 2017 by exploiting a Windows vulnerability, causing widespread operational disruption.
Ransomware referenced as a historical example of attacks leveraging SMB over port 445.
Large-scale ransomware/worm outbreak cited as an example of the period when cybersecurity became a serious business threat rather than primarily a compliance issue.
Referenced as a historical self-spreading malware outbreak used for comparison with the proposed Intelligent Worm model.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.