Does Wanna Cry encrypt files on network drives?

Question

I've dealt with ransomware threats in the past, such as LOCKY that not only encrypt data it considers user documents found on the local machine, but also on any network drive to which the user has sufficient permissions to change data.

Do any of the Wanna Cry variants enumerate and encrypt data on:

1. Mapped network drives?
2. Network shares that are not currently connected via a mapped drive?

I've Googled my question but not found a direct answer.

Note: I'm not asking about how the Wanna Cry threat infects other nodes via the EternalBlue SMB exploit.

Answer 1

Yes, WannaCry will target network drives and removable media, according to Talos Intelligence:

The file tasksche.exe [a WannaCry component] checks for disk drives, including network shares and removable storage devices mapped to a letter, such as 'C:/', 'D:/' etc. The malware then checks for files with a file extension as listed in the appendix and encrypts these using 2048-bit RSA encryption.

This is specifically worrisome because according to the technical analysis by Endgame Inc the malware also grants full permissions to Everyone on files which it is capable to do so which could have severe ramifications in the case of Active Directory shares.

Answer 2

The short answer is "It's possible".

It's important to understand the circumstanced where this is possible:

1: If your shared network drives exist on a vulnerable server, and the server itself is infected

2: If the user context in which the infection is running has an established connection to a network resource, is authenticated at the time of infection, and permission to change it. As an example, a cryptomalware running in the context of "SYSTEM" -unless exploiting a vulnerability- should not be able to make changes to a network share that requires authentication, provided another user with write permissions is not already actively authenticated.

3: If fileshares are poorly implemented. As an example, a very antequated and dangerous method that I have seen in widespread use is throwing a script in the startup folder of a computer that both connects and authenticates to a fileshare. As a matter of principal, in Windows (and mostly anywhere else), automated tasks should only occur within the context of an authenticated session, and should never be initiated by a script that contains hardcoded credentials

A good rule of thumb to consider when thinking about cryptomalware or really any malware: If a given machine or session is indexing files for quick search on a resource, there is at the very least a risk of disclosure or destruction by a threat operating on that machine or session.