WannaCry ransomware is a 2017 of the most popular ransomware, which uses a Microsoft vulnerability in the global range attacks make the world more than 100 countries, hundreds of thousands of users by the impact. Has a global range of network security education for all. As a security industry worker, I WannaCry conducted in-depth analysis. The complete analysis can help the security industry workers to understand the hacker's latest attack means of protection in the field of solution provide valuable information, further try to find software weaknesses, to provide customers with valuable data recovery service. I before CryptXXX, the Cerber and Locky this several heat points ransomware conducted in-depth analysis, Wannacry this ransomware obviously learned before the ransomware software design experience, and upgrading a two-stage attack method. What is the second stage of the attack? In simple terms, is a malicious program itself and not aggressive behavior, such as Wannacry the program itself does not do data encryption to work, it will be true with aggressive behavior of the code dynamically released, the data is encrypted, the behavior is hidden to the released code. This sounds similar to the shell of the behavior, such as Locky is a shell of ransomware, it is up and running after going through the Housing Code release malicious code. But the shell code itself is also a very obvious feature, such as added through the shell of the code can not be disassembled, and General case information entropy is high, many protection software on this program to improve the level of danger, once the user came across, or this program once Drop to the user's machine will be Detect. But Wannacry different, it is the first phase of the program completely without any shell code, The EntryPoint is also not doing any customization, without any thought to modify the traces, and perhaps this is also Wannacry in the use of Microsoft vulnerability scale is propagated to the Endpoint is not found. Hack Weapon Before you begin your analysis, think first, talk about Hack Weapon this concept, according to many professional institutions analysis, this black industry chain has been developed very Mature. In the dark net, you can buy a variety of attack components, the composition of an effective attack entity; for example, there are vulnerabilities, there download Controller, encryption module, etc., then I can based on my need to buy the appropriate module, then to be assembled into a real offensive of the malicious program. Wherein the module is a Hack Weapon, we collected a lot of Sample are the multi-module combination, through in-depth reverse analysis found a malware in the presence of a variety of attack weapons, when the possibility of these attacks the weapons extracted, to establish a separate one Hack Weapon and these Hack Weapon feature modeling, and behavior modeling to improve our Security Products? From a technical point of view, the Machine Instruction level reuse is absolute consistency, not like the source code level of multiplexing because of the compiler options does not result in the final Machine Instruction occurred subtle changes. Hack arms the provider should not provide source code, but the weapon as a binary provided to the downstream of the hackers, so the establishment of this Arsenal, providing a very strong feature. And from the arms of the angle to match the malicious program has a more accurate ability to identify, for example, I think a covert Peloader module belongs to malicious software, so for this Weapon feature or behavior modeling will be more directed to the use of this Weapon all the malicious software, it will be[the security guard]()the software has to combat the multi-point capabilities. I once extracted a paragraph for the program, the String is encrypted, and always performed prior to decryption Hack Weapon, at the time I did not think of the malicious software will have a modular this design, until the in a malware see the same behavior, and extraction are found throughout the function of the flow and even Instruction are exactly the same. This time in the analysis process, I at least can already identify the two Hack Weapon: PeLoader and Resource Extractor, the former is used to load a PE file into memory, and without calling the Microsoft API, inaccurate, minimal call, because the allocated memory also need to call VirtualAlloc to the case to solve the Import Table, Base Relocation and other troublesome matters that use the Monitor such procedures are found not he has a LoadDll behavior; the latter is used from the Resource to extract an encrypted attacks with a PE payload, the two module are very delicate. I think even the author did not re-write it again the idea, which requires a lot of careful coding and lots of testing, because of the slightly some negligence will lead to the final attack fall short（refers to loading the Payload fail. In this time after the end of analysis, I will both Hack Weapon drawn out, and write a POC code, The multiplexing of the two components. phase one tasksche Wannacry的主程序会被修改会tasksche.exe and, since this name is intended to confuse the user. Below we together to analyze this program from the WinMain function begins. In order to easily illustrate the behavior of the program, the following code fragments will all use C++language to Express, unless you come across C++Express confusion or due to compiler optimization causes C++can not Express the case, we will use Assembly language and added detail. int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) { char **argv; void *lpPEFile; CPeBuilder *pPeBuilder; void (__stdcall *fpTaskStart)(_DWORD, _DWORD); CProgram Program; char szModuleFileName[520]; int nFileSize; szModuleFileName[0] = szSelfName; memset(&szModuleFileName[1], 0, 516u); *&szModuleFileName[517] = 0; szModuleFileName[519] = 0; GetModuleFileNameA(0, szModuleFileName, 520u); CreateRandomSequence(szServiceName); if ( *_p___argc() != 2 || (argv = _p___argv(), strcmp(*(*argv + 1), aI)) || ! CreateHiddenData(0) || (CopyFileA(szModuleFileName, FileName, 0), GetFileAttributesA(FileName) == INVALID_FILE_ATTRIBUTES) || ! StartMalware() ) { if ( strrchr(szModuleFileName, '\\\') ) *strrchr(szModuleFileName, '\\\') = 0; SetCurrentDirectoryA(szModuleFileName); WriteRegistery(1); ExtractFromResource(0, WNcry); ModifyOneByte(); StartProcess(CommandLine, 0, 0); // attrib +h : Sets the hidden file attribute. **[1] [[2]](<87243_2.htm>) [[3]](<87243_3.htm>) [[4]](<87243_4.htm>) [[5]](<87243_5.htm>) [[6]](<87243_6.htm>) [[7]](<87243_7.htm>) [[8]](<87243_8.htm>) [[9]](<87243_9.htm>) [[10]](<87243_10.htm>) [[11]](<87243_11.htm>) [[12]](<87243_12.htm>) [next] (<87243_2.htm>)**

Wannacry depth of analysis: the first stage tasksche-vulnerability warning-the black bar safety net