wannacry: ad4df92f — WannaCry v2.0 sibling, kill-switch wea.com, service name 2.0

Executive Summary

A PE32+ x64 DLL compiled 11 May 2017, mislabeled dionaea by OpenCTI but confirmed as a wannacry outbreak sibling. It is byte-identical in structure to the previously-analyzed 16fdcfbc sample — same timestamp, same size, same .rsrc ZIP payload — but carries version-2.0 deltas: a distinct kill-switch domain (wea.com vs wff.com), service name (2.0 vs 2.1), and mssecsvc.exe references. Static-only analysis (no CAPE Windows guest).

What It Is

This sample shares every structural fingerprint with 16fdcfbc (see wannacry entity page for the shared build-stack analysis): same .text entropy (6.32), same 5,124,608-byte .rsrc section containing a password-protected ZIP archive ^[pefile.txt:162-179] ^[binwalk.txt], same launcher.dll / PlayGame export masquerade ^[strings.txt:177-178], same WS2_32.dll + iphlpapi.dll + WININET.dll import profile for SMB propagation and HTTP kill-switch checks. The delta is strictly in versioned strings and the kill-switch domain.

How It Works

Kill-Switch Gate (Version 2.0)

The kill-switch domain is http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com ^[strings.txt:656]. This differs from the 16fdcfbc sibling only in the TLD suffix (wea.com vs wff.com). Same InternetOpenUrlA → InternetOpenA WinInet call chain ^[strings.txt:247-248], same circuit-breaker behavior: if the domain resolves and returns data, the payload exits without encryption. See kill-switch-domain-check for the technique deep-dive.

Service Persistence (Version 2.0)

The DLL installs itself as a Windows service named Microsoft Security Center (2.0) Service ^[strings.txt:646] (vs 2.1 in 16fdcfbc). Same OpenSCManagerA → CreateServiceA → StartServiceCtrlDispatcherA API chain ^[strings.txt:231-232] ^[strings.txt:235-236]. The local service binary is referenced as mssecsvc.exe ^[strings.txt:74] ^[strings.txt:297] ^[strings.txt:371] and mssecsvc2.0 ^[strings.txt:645] (vs mssecsvr.exe / mssecsvc2.1 in the 2.1 sibling).

SMB Propagation

Identical to 16fdcfbc: \\%s\IPC$ ^[strings.txt:642] share path for EternalBlue exploitation, WS2_32.dll socket APIs ^[strings.txt:239]. The actual exploit payload is embedded inside the encrypted s.wnry resource and not visible statically.

Embedded Resource Payload

The .rsrc section (5,124,608 bytes, 98% of file) contains a password-protected ZIP with the same contents as 16fdcfbc:

• c.wnry — encrypted configuration (780 bytes compressed) ^[binwalk.txt]
• msg/m_*.wnry — 27 ransom-note translations ^[binwalk.txt]
• r.wnry — encrypted Tor client (864 bytes compressed) ^[binwalk.txt]
• s.wnry — encrypted main payload (~3 MB compressed) ^[binwalk.txt]

The ZIP is encrypted with ZIP 2.0 password protection. The outer DLL decrypts and extracts these at runtime via FindResourceA / LoadResource / LockResource / SizeofResource ^[strings.txt:109-113].

Decompiled Behavior

Radare2 analysis (level 2, 209 functions) shows the same entry-point layout as 16fdcfbc:

• entry0 at 0x1800015ec — DLL entry point with DllMain reason-code dispatch ^[rabin2-info.txt]
• fcn.180001000 — service control dispatcher path (persistence)
• fcn.18000137c — payload execution path (encryption)

The decompiled entry point is standard MSVC CRT-initialized with SEH frames, FLS/TLS setup, and no anti-debug or VM checks in the outer layer. No notable function deltas from 16fdcfbc.

C2 Infrastructure

No hardcoded IP addresses, Bitcoin wallets, or email addresses visible in the outer DLL.

Interesting Tidbits

• OpenCTI mislabel: Tagged dionaea and exe ^[triage.json] — it is neither a Dionaea honeypot artifact nor an EXE; it is a DLL and it is WannaCry.
• Version 2.0 vs 2.1: The only meaningful deltas from 16fdcfbc are the service version string, kill-switch TLD, and mssecsvc.exe vs mssecsvr.exe naming. This suggests a rapid re-build or minor revision during the May 2017 outbreak.
• Same timestamp, different hash: Both samples carry TimeDateStamp 0x59145729 (2017-05-11 12:20:57 UTC) but have different SHA-256s. This is consistent with link-time stamping rather than source changes — the version strings and domain were likely patched post-compile or the build pipeline stamped the same time across multiple compiles.
• Task scheduler reference: tasksche.exe ^[strings.txt:651] is present (also in 16fdcfbc), suggesting the inner payload (s.wnry) schedules its own re-execution.
• CRT bloat: Same MSVCP60.dll linkage as 16fdcfbc — Visual C++ 6.0 runtime despite VS2010 compilation, a known WannaCry build artefact.

Deployable Signatures

YARA Rule

rule WannaCry_v20_DLL {
    meta:
        description = "WannaCry v2.0 DLL variant with wea.com kill-switch"
        author = "PacketPursuit SOC"
        date = "2026-06-15"
        sha256 = "ad4df92f352378948654b371e619072118f8e6eb3550a6d47ced2710ccf438c3"
    strings:
        $kill = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" ascii wide
        $svc  = "Microsoft Security Center (2.0) Service" ascii wide
        $msse = "mssecsvc.exe" ascii wide
        $msse2 = "mssecsvc2.0" ascii wide
        $task = "tasksche.exe" ascii wide
        $wnry = ".wnry" ascii wide
        $ipc  = "\\%s\\IPC$" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x4550 and
        3 of them
}

Sigma Rule

title: WannaCry v2.0 Service Installation
detection:
    selection:
        EventID: 7045
        ServiceName: 'Microsoft Security Center (2.0) Service'
    condition: selection

IOC List

Behavioral Fingerprint

This DLL, when loaded by a launcher or rundll32, first attempts an outbound HTTP GET to www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com. If the domain resolves and returns data, the process terminates immediately. On failure, it installs itself as a fake "Microsoft Security Center (2.0)" service for persistence, then extracts an encrypted ZIP payload from its own .rsrc section and begins SMB scanning on TCP/445 for lateral movement. No anti-debug checks in the outer layer; defense is the kill-switch gate and payload encryption.

Detection Signatures

References

• MITRE ATT&CK: WannaCry (S0367) — https://attack.mitre.org/software/S0367/
• Wiki sibling: 16fdcfbc — WannaCry v2.1 DLL with wff.com kill-switch ^[/intel/analyses/16fdcfbc4c5d2a7d5e2ccfd28e4b99208797c91315390718de532d9bd9e46d20.html]
• Wiki: wannacry entity page, kill-switch-domain-check technique page

Provenance

• file.txt — file(1) 5.44
• pefile.txt — pefile 2023.2.7
• strings.txt — GNU strings 2.40
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 5.9.4
• exiftool.json — ExifTool 12.76
• triage.json — PacketPursuit triage-fast, 2026-05-26
• Radare2 decompilation — r2mcp, analysis level 2, 209 functions