2

So I booted up two windows 7 64bit sp1 versions in virtualbox and shared their network and the operating systems are vulnerable to the SMB exploit that the wannacry ransomware is using. The Issue is that when I'm running wireshark I don't see any attempts of the SMB exploit on the other machine. Is it because wannacry is detecting the vm?

I want to see SMB activity in my lab, which is my main goal of this test.

Photo of my vms

  • Are they completely isolated or can they access the Wannacry sinkhole domains? – Sim Jan 3 at 3:41
  • @Sim I'm using modified versions that has removed the killswitch – Farzad Henareh Jan 3 at 11:56
1

WannaCry does not have any VM detection features, at least according to all the existing analysis. WannaCry itself also does not launch the EternalBlue SMB exploit; the WannaCry dropper does. If you're just trying to use the unpacked crypter executable, you won't see it attempting to exploit EternalBlue.

The first thing the dropper does is attempt to resolve and connect to a particular domain (later referred to as the "killswitch domain") on port 80. If it succeeds, the malware exits. It is unclear what the purpose of this was in the original malware, but it could either have been an intentional killswitch or a way to avoid analysis on malware honeypot/sandbox platforms that cause every domain lookup and connection to succeed. Security researcher Marcus Hutchins (aka. MalwareTech) registered the domain after seeing it during analysis and discovering that it was available, without really realising the impact of the domain, and that effectively stopped the progression of the malware in the wild.

The domain in question was:

iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

If your VM is able to resolve and connect to the killswitch domain, the malware will simply exit.

Since the dropper uses the InternetOpenUrl API to perform the check, it respects the proxy settings, so you can configure a non-existent proxy in the Internet Explorer settings in order to make the check always fail and make the malware run.

  • I've tried making an non existent proxy however the kill switch is still working. – Farzad Henareh Jan 3 at 15:05
  • You could just also block it in your Firewall. – Polynomial Jan 3 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.