Please enable JavaScript.

Coggle requires JavaScript to display documents.

wannaCryReverse, to define the name of function were trying ot analyse its…

- - - - Nothing (exits)
    - - Real Entry function for the Malware
        checks for arguments
        
        no Arguments Function calls 2 functions
        
        create wannaCry service
        wannaCry.exe -m security
        if hSCManager (service connector manager) successfully opened we use to create a service mssecsvc2.0 with some flags to make it start on boot and with all permissions.. this service is basicallu our wannaCry service
        
        writing res 1831 into taksche.exe
        we take a handle to kernel32 dll and if thats successful we load 4 functions pointers from the module all identified by a string argument
        we check weither the loading was successful and we start loading ressources
        creating the path strings for 2 files > taskche.exe and qeriuw.. and moving the taskche file to the qeriuw.. .path using the MoveFileExA function
        createFileA function is used to create a new task as taskche.exe and return a file handler after that we use writeFileA function to write ressources into the file using the created file handler
        finally at the end we hace the taskche.exe process created using the createProcessA function
        Run the process with /i argument
        
        res 1831
        extracting this ressrouces turns out that its a binary itself so we open it using Ghidra
        wretool --name=1831 -R -x wannacry > 1831.bin -- extracting the ressrouce
        
        analyzing this ressources > looking at the defined strings we can see that it hold files extenstions thats gonna get encrypted and bitcoin addresses
        
        entry
        
        winMain
        general a random string using randomstring_gene funtcion based on computername
        depending on the arguments given to our executable taskche.exe
        
        1 argument = /i
        create a hidden random Dir and set it as current working Dir
        create a random service and launch hidden copy of itself
        
        no argument
        set_or_query_registry_cwd
        extract_enc_ressources
        select_and_write_bitcoinf_address
        2 command being run
        attrib set the Dir to hidden
        icacls grant permissions
        init_func_pointers just like before
        
        3 more items...
        
        Arguments