Loading malware…
WannaCry is a ransomware cryptoworm that emerged in May 2017 and caused one of the most disruptive global cyber incidents recorded on Microsoft Windows systems. It combines file-encrypting ransomware behavior with worm-like self-propagation, allowing it to spread rapidly across vulnerable networks without requiring user interaction on each host. The malware is widely associated with exploitation of the SMB vulnerability addressed by Microsoft in MS17-010, using the EternalBlue exploit to compromise unpatched and unsupported Windows systems at scale.
Once executed, WannaCry encrypts victim data and presents a ransom demand in Bitcoin. In addition to local file encryption, it can scan for newly attached drives and encrypt files on those devices as they appear. It also exhibits defense-evasion and persistence behavior, including hiding some files and creating a Windows service masquerading as a legitimate Microsoft security component. Its worming capability enabled propagation across organizations and countries, contributing to widespread operational disruption in sectors including healthcare, government, and business. The 2017 outbreak notably affected the UK National Health Service and many other large organizations worldwide.
WannaCry has been attributed by multiple governments and security researchers to North Korea, with reporting and technical analysis commonly linking it to the Lazarus Group. Earlier variants were reportedly used in more targeted enterprise attacks before the large-scale outbreak, and the later mass propagation was enabled by the public leak of offensive cyber tooling that included EternalBlue. The campaign is frequently cited as a landmark example of how leaked nation-state exploitation capabilities can be repurposed for financially motivated ransomware operations.
WannaCry is best characterized as both ransomware and a worm, but its most specific classification here is ransomware because its core payload encrypts victim files and extorts payment. Its historical significance stems from the combination of automated network propagation, large-scale impact, and reliance on patchable Windows vulnerabilities, making it a canonical case study in ransomware outbreaks, wormable exploitation, and the security consequences of delayed patching.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The cryptoworm leveraged the EternalBlue exploit, which the National Security Agency developed to attack older Windows Systems. | Five years ago, the WannaCry ransomware cryptoworm targeted computers running Microsoft Windows, encrypting data at organizations around the world.
BlueKeep (CVE-2019-0708) exists within the Remote Desktop Protocol (RDP) used by the Microsoft Windows OSs listed above. An attacker can exploit this vulnerability to perform remote code execution on an unprotected system.
a ransomware campaign with a bite, named WannaCry, autonomously infected vulnerable systems leveraging an exploit leaked on the internet. | This port is important because the SMB service that listens on it is what the initial exploit targets (MS17-010,CVE-2017-0143).
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Five years ago, the WannaCry ransomware cryptoworm targeted computers running Microsoft Windows, encrypting data at organizations around the world.
The WannaCry ransomware attacks have received extensive coverage since a widespread attack on May 12 caused the systems of many large organizations around the world, including the NHS in the UK, to come to a juddering halt.
WannaCry paralysed computers running mostly older versions of Microsoft Windows by encrypting users' computer files and displaying a message demanding anywhere from $US300 to $US600 to release them; failure to pay would leave the data mangled and likely beyond repair.
The exploit chains in play included EternalBlue, DoublePulsar, and WannaCry, all tools that have been publicly known and patchable for years.
The WannaCry attack was a massive ransomware cyberattack... This ransomware leverages an NSA exploit known as EternalBlue... Wincry was the base of the encryption, but two additional exploits, EternalBlue and DoublePulsar, were used by the malware to make it a cryptoworm.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The response to cyberattacks such as the “WannaCry” worm could have been held up in export control paperwork for days, if not weeks, as would any other vulnerability disclosure or incident response in which command and control software or technical analysis of that software, were to cross a country’s virtual or physical border.
The malware’s current working directory is saved to the “wd” registry value under the \SOFTWARE\WanaCrypt0r key... If WCry is running with elevated privileges, the key is created in the HKLM registry hive; otherwise, it is created in the HKCU hive.
Hackers exploited vulnerabilities in outdated systems to encrypt critical data.
Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.
Upon starting, the worm attempts an HTTP connection to www . iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea . com. If the connection is successful, then the worm stops running and exits. The threat actors may have added this HTTP connection test to prevent automated sandboxes from running and analyzing the malware.
Agent Tesla has created hidden folders. AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings. APT28 has saved files with hidden file attributes. FIN13 has created hidden files and folders within a compromised Linux system /tmp directory and also used attrib.exe to hide gathered local host information.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
Scanning for Targets: Once executed, WannaCry scans local networks for vulnerable devices, attempting to exploit them without user interaction.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
Upon starting, the worm attempts an HTTP connection to www . iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea . com. If the connection is successful, then the worm stops running and exits. The threat actors may have added this HTTP connection test to prevent automated sandboxes from running and analyzing the malware.
One method is communicating directly with IP addresses instead of domains, making it harder for security tools to collect information about a connection.
WCry installs the Tor network anonymity software on the infected system... Tor establishes a SOCKS5 proxy server on the loopback interface (127.0.0.1) that listens on TCP port 9050. WCry connects to this proxy and attempts to contact the configured C2 hidden services.
The SMB worm delivers itself to the compromised system as a DLL file payload. After the DLL is executed with a single exported function named PlayGame, it writes a copy of the original SMB worm to C:\Windows\mssecsvc.exe and then executes this file. The SMB worm then drops a secondary payload from its resources section to C:\Windows\tasksche.exe and executes this file.
the WannaCry ransomware cryptoworm targeted computers running Microsoft Windows, encrypting data at organizations around the world. The attackers demanded a ransom of just $300 worth of bitcoins
WCry terminates several services so that their data stores can be encrypted: taskkill.exe /f /im mysqld.exe ... sqlwriter.exe ... sqlserver.exe ... MSExchange* ... Microsoft.Exchange.*
WCry executes the following single command... to complicate system and data recovery... vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a historical self-spreading malware outbreak used for comparison with the proposed Intelligent Worm model.
Ransomware that used the EternalBlue exploit and spread globally, infecting organizations across 150 countries.
Named as a past ransomware incident affecting healthcare; no further technical detail is provided in the content.
A ransomware family noted here as being behaviorally distinct due to SMB-based spread.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.