Rewterz Threat Alert – WannaCry still Lurks on Infected Computers, 18 months after the initial outburst

SEVERITY: LOW

CATEGORY: INFORMATIVE UPDATES

ANALYSIS SUMMARY:

Eighteen months after the initial outburst, WannaCry ransomware still lurks on hundreds of infected computers and continues towards infecting more computers.

When the WannaCry was first unleashed, Kryptos Logic security researcher Marcus Hutchins registered a domain that acted as a killswitch for the ransomware component of the infection. If the infection would connect to this killswitch domain, the ransomware component would not activate. The infection however, silently runs in the background and keeps on checking the killswitch routinely to check whether the domain is still live.

The initial outburst of WannaCry in 2017 was just a beginning, as many security analysts predicted higher levels of attack. Here’s one of such alerts.

As they predicted, the espionage continues till date. The WannaCry domain is observed to be receiving 17 million
connections coming from 630 unique IP addresses from 194 different countries in a week.

What is WannaCry?

The WannaCry ransomware has multiple components. It arrives on the infected machine in form of a dropper. It’s a self contained program which extracts the other application components embedded within itself.
Those components are:

• An application that encrypts and decrypts data
• Files containing encryption keys
• A copy of Tor

Once it is launched, WannaCry tries to access a hard coded URL (Killswitch), and if it can’t, it searches for and encrypts files in a slew of important formats ranging from MS Office to MP3s, leaving them inaccessible to the user and displays a ransom notice to the user, demanding bitcoins to decrypt the files.

Below is the graph showing countries that are still infected with WannaCry.

All it needs is an Internet outage to occur and for the kill switch domain to no longer be accessible for the ransomware to kick in.

REMEDIATION:

It is recommended to monitor your range of IP addresses for all known infections, including WannaCry and similar malware families.