The Mystery of WannaCry Mutants - Revealing Mechanism of Infoleak Caused by the Mutation

No ratings

Presented at CODEBLUE2018@TOKYO 2018 by

Makoto Iwamura

WannaCry is a Ransomware with a worm function that brought massive damage in May 2017. An paper said that it infected more than 300,000 computers in 150 countries, and generated approximately 60,000 variants in 3 months from this appearance. We doubted that WannaCry has diversity in its executable file despite having no self mutation function and investigated the cause of mutation. As a result, we discovered the condition that the uninitialized area of ​​the kernel memory is mixed into the executable file of WannaCry when infected with WannaCry. This is because the backdoor DoublePulsar operating in kernel mode does not properly process the payload received from WannaCry. Unfortunately, the existence of this special condition not only explains the mutation of Wanna Cry but also implies leakage of confidential data triggered by infection to Wanna Cry. In other words, the uninitialized area of ​​the kernel memory contains all the data handled by that terminal including confidential data, and the executable file of WannaCry mixed with such data continues to spread all over the world by the worm function There is a fear there is.In this presentation, we report on the mechanism of mutation from aWannaCry infection, procedure of examination that reproduces one, and its results. Also, we will show examples which contain some kind of unexpected information (NTFS's master file table, evidence of Web access, icons of prominent software, etc.), and describe what we should do against spreading WannaCry mutant.