{"id":7626,"date":"2017-05-12T15:10:39","date_gmt":"2017-05-12T23:10:39","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/05\/12\/news-1411\/"},"modified":"2017-05-12T15:10:39","modified_gmt":"2017-05-12T23:10:39","slug":"news-1411","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/05\/12\/news-1411\/","title":{"rendered":"The worm that spreads WanaCrypt0r"},"content":{"rendered":"

Credit to Author: Zammis Clark| Date: Fri, 12 May 2017 22:02:24 +0000<\/strong><\/p>\n

Something that many security researchers have feared has indeed come true. Threat actors have integrated a critical exploit taking advantage of a popular communication protocol used by Windows systems, crippling thousands of computers worldwide with ransomware.<\/p>\n

Within hours of being leveraged, a\u00a0flaw that\u00a0had been recently patched by Microsoft has been used to distribute\u00a0the WanaCrypt0r ransomware and wreak havoc worldwide<\/a>.<\/p>\n

In this blog post, we will describe the worm responsible for spreading\u00a0this ransomware by looking at its capabilities and what has made this threat so successful.<\/p>\n

Main functionality<\/h3>\n

WanaCrypt0r has been most effective\u2014not only does the ransomware loop through every open RDP session on a system and run the ransomware as that user, but the initial component that gets dropped on systems appears to be a worm that contains and runs the ransomware, spreading itself using the ETERNALBLUE<\/code> SMB vulnerability (MS17-010<\/a>).<\/p>\n

The WinMain<\/code> of this executable<\/a> first tries to connect to the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com.<\/code>\u00a0It doesn’t actually download anything there, just tries to connect. If the connection succeeds, the binary exits.<\/p>\n

This was probably some kind of kill switch or anti-sandbox technique. Whichever it is, it has backfired on the authors of the worm, as the domain has been sinkholed and the host in question now resolves to an IP address that hosts a website. Therefore,\u00a0nothing will happen on any new systems that runs the executable. This only applies to the binary with the hash listed above; there may well be new versions released in the future.<\/p>\n

\"\"<\/p>\n

After this check passes, the first thing the worm does is check the number of arguments it was launched with. If it was run with less than two arguments passed, it installs a service called mssecsvc2.0<\/code> with display name Microsoft Security Center (2.0) Service<\/code> (where the binary ran is itself with two arguments), starts that service, drops the ransomware binary located in the resources of the worm, and runs it.<\/p>\n

If it was run with two arguments or more\u2014in other words, if it was run as a service\u2014execution eventually falls through to the worm function.<\/p>\n

\"\"<\/p>\n

The initialization function called first calls WSAStartup()<\/code> to initialize networking, then CryptAcquireContext()<\/code> to initialize the crypto API so it can use a cryptographically-secure pseudo-random number generator. It then calls a function that initializes two buffers used for storing the worm payload DLLs, one x86 and one x64. It copies the payload DLLs from the .data<\/code> section of the worm and then copies the entire worm binary after it.<\/p>\n

\"\"<\/p>\n

The code of each payload DLL is very small, just getting the resource content (i.e. the worm binary), dropping to disk as C:WINDOWSmssecsvc.exe<\/code> (this path is actually hardcoded) and executing it.<\/p>\n

\"\"<\/p>\n

SMB vulnerability leveraged to spread ransomware\u00a0worldwide<\/h3>\n

After initializing the functionality used by the worm, two threads are created. The first thread scans hosts on the LAN. The second thread gets created 128 times and scans hosts on the wider Internet.<\/p>\n

The first thread (in charge of scanning LAN) uses GetAdaptersInfo()<\/code> to get a list of IP ranges on the local network, then creates an array of every IP in those ranges to scan.<\/p>\n

\"\"<\/p>\n

The LAN scanning is multithreaded itself, and there is code to prevent scanning more than 10 IP addresses on the LAN at a time.<\/p>\n

\"\"<\/p>\n

The scanning thread tries to connect to port 445, and if so creates a new thread to try to exploit the system using MS17-010\/EternalBlue. If the exploitation attempts take over 10 minutes, then the exploitation thread is stopped.<\/p>\n

\"\"<\/p>\n

The threads that scan the Internet generate a random IP address, using either the OS’s cryptographically secure pseudo-random number generator initialized earlier, or a weaker pseudo-random number generator if the CSPRNG failed to initialize. If connection to port 445 on that random IP address succeeds, the entire \/24<\/code> range is scanned, and if port 445 is open, exploit attempts are made. This time, exploitation timeout for each IP happens not after 10 minutes but after one hour.<\/p>\n

\"\"
\"\"<\/p>\n

The exploitation thread tries several times to exploit, with two different sets of buffers used (perhaps one for x86 and one for x64). If it detects the presence of DOUBLEPULSAR<\/code> after any exploitation attempt, it uses DOUBLEPULSAR<\/code> to load the relevant payload DLL.<\/p>\n

\"\"<\/p>\n

Protection<\/h3>\n

It is critical<\/b> that you install all available OS updates to prevent getting exploited by the MS17-010 vulnerability. Any systems running a Windows version that did not receive a patch for this vulnerability should be removed from all networks. If your systems have been affected, DOUBLEPULSAR<\/code> will have also been installed, so this will need to also be removed. A script is available<\/a> that can remotely detect and remove the DOUBLEPULSAR<\/code> backdoor. Consumer and business customers of Malwarebytes are protected from this ransomware by the premium version of Malwarebytes<\/a> and Malwarebytes Endpoint Security<\/a>, respectively.<\/p>\n

The post The worm that spreads WanaCrypt0r<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Zammis Clark| Date: Fri, 12 May 2017 22:02:24 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
WanaCrypt0r is a ransomware infection that has spread through many corporate networks. Read a technical analysis of the worm that allowed it to do this.<\/p>\n

Categories: <\/p>\n