Win32/Filecoder.WannaCryptor [Threat Name] go to Threat

Win32/Filecoder.WannaCryptor.B [Threat Variant Name]

Category	trojan
Size	237568 B
Aliases	Ransom:Win32/WannaCrypt!rfn (Microsoft)
	Ransom.Wannacry (Symantec)
	Trojan.Encoder.10609 (Dr.Web)

Short description

Win32/Filecoder.WannaCryptor.B is a trojan that encrypts files on local drives. To decrypt files, the user is asked to send information/certain amount of money via the Bitcoin payment service.

Installation

When executed, the trojan creates the following files:

%malwarefolder%\%number%.pkey
%malwarefolder%\%number%.dkey
%malwarefolder%\%number%.ekey
%malwarefolder%\%number%.res
%malwarefolder%\b.wry
%malwarefolder%\c.wry
%malwarefolder%\m.wry
%malwarefolder%\r.wry
%malwarefolder%\t.wry
%malwarefolder%\u.wry
%malwarefolder%\f.wry
%malwarefolder%\n.wry
%malwarefolder%\TaskHost\Data\Tor\geoip
%malwarefolder%\TaskHost\Data\Tor\geoip6
%malwarefolder%\TaskHost\Tor\libeay32.dll
%malwarefolder%\TaskHost\Tor\libevent-2-0-5.dll
%malwarefolder%\TaskHost\Tor\libevent_core-2-0-5.dll
%malwarefolder%\TaskHost\Tor\libevent_extra-2-0-5.dll
%malwarefolder%\TaskHost\Tor\libgcc_s_sjlj-1.dll
%malwarefolder%\TaskHost\Tor\libssp-0.dll
%malwarefolder%\TaskHost\Tor\ssleay32.dll
%malwarefolder%\TaskHost\Tor\taskhosts.exe
%malwarefolder%\TaskHost\Tor\tor.exe
%malwarefolder%\TaskHost\Tor\tor-gencert.exe
%malwarefolder%\TaskHost\Tor\zlib1.dll
%temp%\hibsys
%drive%\hibsys

A string with variable content is used instead of %number% .

The trojan may set the following Registry entries:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "Microsoft Update Scheduler" = "%malwarepath% /r %number%"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
- "Microsoft Update Scheduler" = "%malwarepath% /r %number%"

This causes the trojan to be executed on every system start.

The following Registry entries are created:

[HKEY_LOCAL_MACHINE\SOFTWARE\WannaCryptor]
- "wd" = "%malwarefolder%"
[HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper]
- "Wallpaper" = "%malwarefolder%\!WannaCryptor!.bmp"

Payload information

Win32/Filecoder.WannaCryptor.B is a trojan that encrypts files on local drives.

The trojan searches local drives for files with the following file extensions:

.123
.602
.3dm
.3ds
.3g2
.3gp
.7z
.aes
.ai
.ARC
.asc
.asf
.asp
.avi
.backup
.bak
.bmp
.brd
.c
.cgm
.class
.cpp
.crt
.cs
.csr
.csv
.db
.dbf
.dch
.der
.dif
.dip
.doc
.docb
.docm
.docx
.dot
.dotm
.dotx
.dwg
.edb
.eml
.fla
.flv
.frm
.gif
.gpg
.gz
.h
.hwp
.ibd
.jar
.java
.jpeg
.jpg
.js
.jsp
.key
.lay
.lay6
.ldf
.m3u
.m4u
.max
.mdb
.mdf
.mid
.mkv
.mml
.mov
.mp3
.mp4
.mpeg
.mpg
.msg
.myd
.myi
.nef
.odb
.odg
.odp
.ods
.odt
.ost
.otg
.otp
.ots
.ott
.p12
.PAQ
.pas
.pdf
.pem
.pfx
.php
.pl
.png
.pot
.potm
.potx
.ppam
.pps
.ppsm
.ppsx
.ppt
.pptm
.pptx
.psd
.pst
.rar
.raw
.rb
.rtf
.sch
.sh
.slk
.sln
.sql
.sqlite3
.sqlitedb
.stc
.std
.stw
.suo
.swf
.sxc
.sxd
.sxm
.sxw
.tar
.tar.bz2
.tbk
.tgz
.tif
.tiff
.txt
.uop
.uot
.vb
.vdi
.vmdk
.vmx
.vob
.vsd
.vsdx
.wav
.wb2
.wk1
.wks
.wma
.wmv
.xlc
.xlm
.xls
.xlsb
.xlsm
.xlsx
.xlt
.xltm
.xltx
.xlw
.zip

It avoids files from the following directories:

\WINDOWS
\Program Files
\Program Files (x86)
\ProgramData

It avoids files with the following filenames:

!Please Read Me!.txt
!WannaDecryptor!.exe.lnk
!WannaCryptor!.bmp

The trojan encrypts the file content.

The RSA, AES encryption algorithm is used.

The extension of the encrypted files is changed to:

%filepath%.WCRY

To decrypt files, the user is asked to send information/certain amount of money via the Bitcoin payment service.

Some examples follow.

Other information

When searching the drives, the trojan creates the following file in every folder visited:

!WannaDecryptor!.exe.lnk

The file is a shortcut to a following file:

%malwarefolder%\!WannaDecryptor!.exe

The following file is dropped in the same folder:

!Please Read Me!.txt

It contains the following text:

Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $200 worth of bitcoin to this bitcoin address: 1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY
Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe".
If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.)
https://www.dropbox.com/s/c1gn29iy8erh1ks/m.rar?dl=1
rar password: wcry123
Run and follow the instructions!

The trojan may delete the following files:

%temp%\hibsys
%drive%\hibsys

The trojan executes the following commands:

cmd.exe /c start /b !WannaDecryptor!.exe c
cmd.exe /c start /b !WannaDecryptor!.exe v
cmd.exe /c start /b vssadmin.exe Delete Shadows /All /Quiet
%malwarefolder%\TaskHost\Tor\taskhost.exe

The trojan contains a list of (2) URLs.

It tries to download a file from the addresses. The HTTPS protocol is used in the communication.