2

I've dealt with ransomware threats in the past, such as LOCKY that not only encrypt data it considers user documents found on the local machine, but also on any network drive to which the user has sufficient permissions to change data.

Do any of the Wanna Cry variants enumerate and encrypt data on:

  1. Mapped network drives?
  2. Network shares that are not currently connected via a mapped drive?

I've Googled my question but not found a direct answer.

Note: I'm not asking about how the Wanna Cry threat infects other nodes via the EternalBlue SMB exploit.

5

Yes, WannaCry will target network drives and removable media, according to Talos Intelligence:

The file tasksche.exe [a WannaCry component] checks for disk drives, including network shares and removable storage devices mapped to a letter, such as 'C:/', 'D:/' etc. The malware then checks for files with a file extension as listed in the appendix and encrypts these using 2048-bit RSA encryption.

This is specifically worrisome because according to the technical analysis by Endgame Inc the malware also grants full permissions to Everyone on files which it is capable to do so which could have severe ramifications in the case of Active Directory shares.

1

The short answer is "It's possible".

It's important to understand the circumstanced where this is possible:

1: If your shared network drives exist on a vulnerable server, and the server itself is infected

2: If the user context in which the infection is running has an established connection to a network resource, is authenticated at the time of infection, and permission to change it. As an example, a cryptomalware running in the context of "SYSTEM" -unless exploiting a vulnerability- should not be able to make changes to a network share that requires authentication, provided another user with write permissions is not already actively authenticated.

3: If fileshares are poorly implemented. As an example, a very antequated and dangerous method that I have seen in widespread use is throwing a script in the startup folder of a computer that both connects and authenticates to a fileshare. As a matter of principal, in Windows (and mostly anywhere else), automated tasks should only occur within the context of an authenticated session, and should never be initiated by a script that contains hardcoded credentials

A good rule of thumb to consider when thinking about cryptomalware or really any malware: If a given machine or session is indexing files for quick search on a resource, there is at the very least a risk of disclosure or destruction by a threat operating on that machine or session.

  • As helpful as this is, it doesn't answer my question. I want to know if this threat is coded to encrypt data stored on network shares to which the user has write access. – Twisty Impersonator May 23 '17 at 19:03
  • 2
    Fair enough. My intent was to say "Yes", and provide the circumstances. Wannacry, does not discriminate by location, only by file type. – MildotPhil May 23 '17 at 19:14
  • @MildotPhil I'm not sure your restrictions are necessary for mapped network drives. Are you trying to answer the non-mapped drives? – schroeder May 24 '17 at 14:27
  • @Schroeder, I am not sure what you're asking. Can you elaborate? – MildotPhil May 24 '17 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.