Procedure examples

WannaCry will attempt to determine the local network segment it is a part of.

WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.

WannaCry utilizes wmic to delete shadow copies.

WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.

WannaCry uses Tor for command and control traffic.

WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.

WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.

WannaCry uses attrib +h and icacls . /grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls.

WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.

WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.

WannaCry uses vssadmin, wbadmin, bcdedit, and wmic to delete and disable operating system recovery features.

WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center (2.0) Service."

WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.

WannaCry uses attrib +h to make some of its files hidden.

WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.

WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.