Worm.Win32.WANNACRY.RGN

N该恶意软件不具(jù)有(yǒu)任何后门例程。

然后，它将执行植入的文(wén)件。结果，已植入文(wén)件的恶意例程将呈现在受感染的系统中(zhōng)。

该恶意软件不具(jù)有(yǒu)任何信息窃取功能(néng)。

自启动技(jì )术

它通过添加下列注册表项，注册為(wèi)系统服務(wù)，确保在每次系统启动时自动执行：

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\mssecsvc2.0
Type = "16"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\mssecsvc2.0
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\mssecsvc2.0
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\mssecsvc2.0
ImagePath = "{initial malware file path} -m security"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\mssecsvc2.0
DisplayName = "Microsoft Security Center (2.0) Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\mssecsvc2.0
ObjectName = "LocalSystem"

它通过添加下列注册表键值注册為(wèi)系统服務(wù)，确保在每次系统启动时自动执行:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\mssecsvc2.0

它启动下列服務(wù)：

• Service Name: mssecsvc2.0
  Display Name: Microsoft Security Center (2.0) Service
  Path to Executable: "{Initial Malware File Path} -m security"

后门例程

该恶意软件不具(jù)有(yǒu)任何后门例程。

植入例程

它植入下列文(wén)件：

• %Windows%\tasksche.exe ← detected as Ransom.Win32.WCRY.DAM

然后，它将执行植入的文(wén)件。结果，已植入文(wén)件的恶意例程将呈现在受感染的系统中(zhōng)。

信息窃取

该恶意软件不具(jù)有(yǒu)任何信息窃取功能(néng)。

其他(tā)详细信息

该程序执行以下操作(zuò)：

• It connects to http://www.{BLOCKED}sodp9ifjaposdfjhgosurijfaewrwergwea.com. It is initially used as a kill switch for infection, however on this variant, it will still continue with its routine regardless of the connection.
• It scans the following to check for open port 445:
  • Local Area Network
  • Randomly-generated IP addresses over the Internet
• If it finds a host on the Local Area Network or the Internet with open port 445, it will attempt to exploit MS17-010 vulnerability to drop and execute a copy of itself to the remote host.
• It uses the following file path for its dropped copies on the remote hosts.
  • %Windows%\mssecsvc.exe
• It checks for the presence of the file %Windows%\tasksche.exe. If the file exists, it will rename the file using the following name %Windows%\qeriuwjhrf.
• It executes %Windows%\tasksche.exe with /i parameter.