Hello everyone, today we are taking a look at WannaCrypt
a ransomware that made headlines around the world because of its fast
Propagation and it's infection of many computers in the NHS
Now I received a few requests to take a look at this ransomware, but at the time I was out of town
So now I'm back home got the VM all ready to go, so let's go ahead and take a look at WannaCrypt
we've got our standard a
Series of bait files here we have a .docx which is just a recipe
That I like to make sometimes I've got a test document that says test document
We've got a photo from my car like five years ago, or thought it was 129 degrees outside
Got this other picture. Oh, no, where did it go?
Oh, Now it works, okay, the video is already broken, but anyway
We got this picture that accurately represents my feelings every time I build with legos. It's got a rich text document
and finally we have this spam .pdf that was emailed to me
and these will all be...
...encrypted by the worm/Trojan
so
Let's go ahead and run WannaCrypt and we have everything disabled all network shares
There's not even a network card attached to this virtual machine
Because I have quite a few devices on this network
And I don't think my roommates or girlfriend would appreciate having all of their files encrypted
Because the thing that says WannaCrypt apart from most other
Types of ransomware is the fact that it not only encrypts files on your local computer it sends emails or stuff like that
It will seek out random IP addresses and all the computers they can find on the network and encrypt those files as well
yeah, yeah, we'll go ahead and allow this to happen sounds good to me and
so because of this worm
Component it enables it to spread very quickly and is what actually enabled it to infect all those computers in the NHS
So here's the actual Wannadecrypt that pops up we can see our files Just disappeared here, They have all been encrypted and
Now no longer function if we open this up with notepad
um
Any more apps notepad it is no longer our
Excellent text file however it has been encrypted and the same goes with all these others
and we see
Other than this wannadecrypt window which we'll take a look at it in a bit our desktop has been replaced with "ooops
Your important files are encrypted if you see this text, but don't see Wana Decrypt0r" then antivirus removed it you gotta get it back
So you can decrypt your files
We can also see here that it drops a bitmap to the desktop. Which is just the background that we see here that replace everything
We also have a new text document
Saying what's wrong with my files ooops your important files are encrypted
So basically just tells you the wallet that you need to send your bitcoins to
The application that you need to find on your desktop in order to decrypt your files, and then I like this part right here
How can I trust don't worry about decryption We will decrypt your files surely because nobody will trust us if we cheat users
And I'm sure that's the truth
Now we'll go over the actual ransomware itself. It's got the standard ransomware fare going on here
what happened to my computer your important files are encrypted and
Maybe you're busy looking for a way to recover your files, but do not waste your time
Nobody can recover your files without our decryption service and
Essentially you have to go through pay $300 in bitcoin
and it channels it through a series of Tor addresses until finally the scammers receive it and
Decide whether or not to actually give you your decryption code now the only reason this actually popped up and encrypted my files is
because I disconnected everything on this virtual machine from the internet as it turns out the malware has a
Sort of kill switch activated in it in which attests for a domain name which at the time that the ransomware was
propagating was not activated nobody had registered it and
as long as it found that it was not able to connect to it it would encrypt your files and
Continue trying to infect new computers however one Malware researcher from the Malware Tech blog
Discovered that when he registered this domain name it activated the kill switch in the ransomware
Pretty much effectively stopping it from continuing to propagate infecting new systems, so kudos to you
we see here that the actual domain has been replaced with a sinkhole tech line, sinkhole tech - where the bots party hard and
the researchers harder
Looking back at the ransomware
There's not much you can do once you're at this point other than if you really need your files attempt to pay that ransom
But I would not recommend it because paying that Ransom only serves to further fuel these types of attacks in the future
but if it's something like the NHS, I could see
Some degree of compliance with the scammers demand in order to receive some very important patient documents and stuff like that
There's not much more to say as we can see here the payment will actually be raised if you don't pay it within three days
And then if you don't pay it in a week, you lose all your files supposedly
But I bet they'd be willing to grant you some leniency on that if you paid probably triple or quadruple the price
And going even further beyond this you can tell this was a pretty serious outbreak because Microsoft actually released patches for Windows XP
Which has been out of date for about three years now
So you can tell this is something big and that's about it for WannaCrypt thank you very much for watching take care
So I just noticed one more thing
There's a contact us button it opens up Just a plain message box You're gonna send a message to these guys
"Greet from Danooct1 to get boy with the malware
yooooooooooooooooooooooooo", and it's a real shame this isn't connected to the [internet] because I really wanted them to receive this but
Now that's really about it for the WannaCrypt ransomware, Thank you for watching take care
One more thing I noticed that if you send a message
And you're not connected to the internet the ransomware just crashes every single time
Well good luck getting your files back now
naah I'm just kidding you can actually close the program and
Just launch it one more time, then you're good to go you can pay the ransom for your files
(8-BIT MUSIC)
-THE LOVELY 8-BIT MUSIC ENDS-