> Family · WannaCry_

~/packetpursuit $ cat /intel/families/wannacry.md

typeentityconfidencehighcreated2026-06-10updated2026-06-10malware-familyransomwareimpactlateral-movementc2

WannaCry

Overview

WannaCry (also known as WannaCrypt, WCry, or Wana Decrypt0r) is a ransomware worm that caused a global outbreak in May 2017. It combines AES-128 file encryption with RSA-2048 key management, SMB-based lateral movement via the EternalBlue exploit (CVE-2017-0144), and a hardcoded kill-switch circuit breaker. The outbreak infected over 200,000 systems across 150 countries within four days.

Build Stack

  • Compiler: MSVC 10.0 (Visual Studio 2010) ^[raw/analyses/16fdcfbc/report.md]
  • Runtime: MSVCP60.dll + MSVCRT.dll (C++ CRT from Visual C++ 6.0 era)
  • Target: PE32+ x64 DLL with console subsystem
  • Packing: None on outer DLL; inner payload (s.wnry) is encrypted inside a password-protected ZIP in .rsrc
  • Signing: Unsigned

Deploy / TTPs

TTP Implementation
Kill switch Hardcoded HTTP GET to www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com; aborts if domain resolves ^[raw/analyses/16fdcfbc/report.md]
Persistence Installs as Windows service: Microsoft Security Center (2.1) Service ^[raw/analyses/16fdcfbc/report.md]
Lateral movement EternalBlue exploit over SMB (TCP/445) to random internal IPs ^[raw/analyses/16fdcfbc/report.md]
Encryption AES-128 per-file keys, encrypted with embedded RSA-2048 public key
Ransom note 27-language notes embedded as encrypted .wnry files inside .rsrc ZIP ^[raw/analyses/16fdcfbc/report.md]
Tor C2 Embedded Tor client (r.wnry) connects to .onion payment portal
File deletion Deletes shadow copies and disables recovery in inner payload

Variants / Aliases

  • WannaCrypt — alternate spelling used in early media coverage
  • WCry — shortened form
  • Wana Decrypt0r — UI title shown by decryptor
  • Version 2.0 — emerged after initial kill-switch domain was sinkholed; removed the kill switch in some builds

Notable Analyses

  • 16fdcfbc — PE32+ x64 DLL with kill-switch (wff.com), service persistence (2.1), and 27-language ransom-note ZIP. Mislabeled dionaea by OpenCTI. ^[raw/analyses/16fdcfbc/report.md]
  • ad4df92f — Near-identical sibling: same timestamp, same size, same ZIP payload, but kill-switch domain wea.com and service version 2.0. Rapid outbreak re-build. ^[raw/analyses/ad4df92f/report.md]

Related Entities / Techniques

  • ransomware — parent malware category
  • kill-switch-domain-check — the circuit-breaker anti-analysis technique
  • EternalBlue SMB propagation — lateral-movement technique (create technique page if observed in 2+ analyses)

Capabilities

  • kill-switch-domain-check
  • eternalblue-smb-propagation
  • windows-service-persistence
  • embedded-rsrc-zip-payload
  • aes-rsa-hybrid-encryption
  • tor-hidden-service-c2
  • shadow-copy-deletion
  • multilingual-ransom-note