Skip to main content Link Menu Expand (external link) Document Search Copy Copied
DFIR Ransomware Project
Category Details References
Actors    
First Observed May 2017 1
Threat Actors North Korea 2
Environment    
Platforms Windows 1
Artifacts    
Extensions .wannacry
.wcry
.Wnry
.wncry		 3
4
5
Ransomware Notes info.hta 6
Services It Disables    
Other Observables Various YARA rules in existence 7
Automation    
Automatically Gains Access Yes, via EternalBlue SMB exploit 8
Automatically Escalates Privileges No.
Not needed because it encrypts only local files.		  
Requires Human Interaction No.
Encrypts and spreads automatically. But does install DoublePulsar backdoor that could later be used by a human.		 9
10
Automatic Exfiltration No  
Automatic Propagation Yes.
Exploits other computers using EternalBlue.		 11

Please note, this page was last updated at 2023-03-14 20:21.

  1. https://www.csoonline.com/article/3227906/wannacry-explained-a-perfect-ransomware-storm.html ↩ ↩2

  2. https://www.cisa.gov/uscert/ncas/alerts/TA17-132A ↩

  3. https://www.pcrisk.com/removal-guides/15883-wannacry-ransomware ↩

  4. https://fileinfo.com/extension/wcry#:~:text=A%20WCRY%20file%20is%20a,ransomware%20infection%20utilized%20by%20cybercriminals ↩

  5. https://www.secureworks.com/research/wcry-ransomware-analysis ↩

  6. https://www.pcrisk.com/removal-guides/15883-wannacry-ransomware ↩

  7. https://www.google.com/search?q=wannacry+ransomware+yara+rules ↩

  8. https://www.csoonline.com/article/3227906/wannacry-explained-a-perfect-ransomware-storm.html ↩

  9. https://usa.kaspersky.com/resource-center/threats/ransomware-wannacry ↩

  10. https://www.bitsight.com/blog/understanding-doublepulsar-wannacry-across-industries-is-key-to-protecting-supply-chain ↩

  11. https://www.malwarebytes.com/wannacry ↩