The Anatomy of WannaCry: The EternalBlue Kill Chain and How to Reverse-Engineer the Payload

Even years after it brought the NHS and global logistics to a grinding halt, WannaCry remains one of the most fascinating pieces of malware ever deployed. It wasn't just ransomware—it was a self-propagating ransomware worm.

If you've ever wondered exactly how a machine gets attacked over the wire, or how you can set up a lab to rip this malware apart yourself, here is a deep technical dive into the mechanics of WannaCry.

1. The Infection Vector (How Networks Get Attacked)

Unlike traditional ransomware that relies on a user clicking a phishing link, WannaCry spreads autonomously over the network.

* The Target: It scans local subnets and random public IP addresses for devices listening on TCP port 445 (Server Message Block, or SMBv1).

* The Exploit (EternalBlue): If it finds an unpatched Windows machine, it deploys the EternalBlue (MS17-010) exploit. EternalBlue sends specially crafted packets that trigger a buffer overflow in the Windows kernel's non-paged pool memory (specifically within srv.sys).

* The Backdoor (DoublePulsar): Once kernel execution is achieved, the shellcode installs DoublePulsar, a ring-0 kernel implant. DoublePulsar hooks into SMB transaction processing, acting as an ephemeral backdoor. It doesn't write to disk—it lives in memory and allows the attacker to silently inject and execute the actual WannaCry payload (mssecsvc2.0.exe).

1. The Infamous "Kill Switch" (Sandbox Evasion Gone Wrong)

The very first thing the payload does upon execution is make an HTTP GET request to a hardcoded, unregistered domain (e.g., [www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\](https://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com)).

* The Logic: If the HTTP connection FAILS, the malware proceeds to encrypt the system. If the connection SUCCEEDS, the malware terminates itself.

* Why? The authors built this to evade analysis. When security researchers put malware into an isolated "sandbox" VM, the sandbox will often spoof DNS requests and return a fake 200 OK HTTP response to trick the malware into revealing its behavior. WannaCry checked if the junk domain resolved to detect if it was being monitored. A researcher famously registered the domain on the open internet, which inadvertently stopped the global worm in its tracks.

1. The Cryptography (A Multi-Tiered Nightmare)

WannaCry uses the Windows CryptoAPI to execute a structurally brilliant, multi-layered encryption routine:

* File Level: The malware generates a unique, pseudo-random AES-128-CBC symmetric key for every single file it encrypts.

* System Level: Next, it generates a unique RSA-2048 key pair specifically for that infected victim. The public key of this pair encrypts all 10,000+ individual AES file keys.

* Attacker Level: Finally, the victim's private RSA key is encrypted using the attacker's master RSA public key (which is hardcoded into the binary).

The Result: To decrypt a file, you need the victim's private RSA key, but that key is locked behind the attacker's master private key.

1. How to "Get Into It" (Reverse Engineering Lab Setup)

If you want to pull apart the PE (Portable Executable) file yourself, you need an air-gapped environment. DO NOT run this on your host machine or a bridged VM.

* The Sandbox: Spin up an unpatched Windows 7 VM. Ensure the network adapter is set strictly to Host-Only or internal LAN.

* Network Simulation: Put a Linux VM (like REMnux) on that same internal network running INetSim and Wireshark. INetSim will fake internet services, allowing you to intercept the SMB scanning and the kill-switch HTTP GET request.

* Static Analysis: Toss the executable into Ghidra or IDA Pro. If you look at the Imports table, you'll easily spot the Windows CryptoAPI calls (CryptGenKey, CryptEncrypt). You can also find the base64-encoded Bitcoin addresses and the hardcoded domain in the .rdata section.

* Dynamic Analysis: Attach x64dbg to the payload. Set a breakpoint right after the HTTP request to the kill switch. By manually flipping the Zero Flag (ZF) in the CPU registers at the jump instruction, you can bypass the kill-switch logic entirely and force the malware down the encryption execution path to watch it work.

Let me know if you guys want a follow-up on how the SMB packet structure looks during the initial buffer overflow, or if you want to see the assembly code for the kill switch check!