Wannacry

How Wannacry typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via WannaCry.

1. T1047 Windows Management Instrumentation Execution

   What they do: WannaCry utilizes wmic to delete shadow copies.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

2. T1543.003 Windows Service PersistencePrivilege Escalation

   What they do: WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center (2.0) Service."

   What that means: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

3. T1564.001 Hidden Files and Directories Stealth

   What they do: WannaCry uses attrib +h to make some of its files hidden.

   What that means: Adversaries may set files and directories to be hidden to evade detection mechanisms.

4. T1222.001 Windows Permissions Defense Impairment

   What they do: WannaCry uses attrib +h and icacls . /grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls.

   What that means: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

5. T1016 System Network Configuration Discovery Discovery

   What they do: WannaCry will attempt to determine the local network segment it is a part of.

   What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

6. T1018 Remote System Discovery Discovery

   What they do: WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.

   What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

7. T1083 File and Directory Discovery Discovery

   What they do: WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.

   What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

8. T1120 Peripheral Device Discovery Discovery

   What they do: WannaCry contains a thread that will attempt to scan for new attached drives every few seconds.

   What that means: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

9. T1210 Exploitation of Remote Services Lateral Movement

   What they do: WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.

   What that means: Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

10. T1563.002 RDP Hijacking Lateral Movement

    What they do: WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.

    What that means: Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment.

11. T1570 Lateral Tool Transfer Lateral Movement

    What they do: WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.

    What that means: Adversaries may transfer tools or other files between systems in a compromised environment.

12. T1090.003 Multi-hop Proxy Command and Control

    What they do: WannaCry uses Tor for command and control traffic.

    What that means: Adversaries may chain together multiple proxies to disguise the source of malicious traffic.

13. T1573.002 Asymmetric Cryptography Command and Control

    What they do: WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.

    What that means: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

14. T1486 Data Encrypted for Impact Impact

    What they do: WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

15. T1489 Service Stop Impact

    What they do: WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

16. T1490 Inhibit System Recovery Impact

    What they do: WannaCry uses vssadmin, wbadmin, bcdedit, and wmic to delete and disable operating system recovery features.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122