{"id":75663,"date":"2017-05-12T23:40:41","date_gmt":"2017-05-13T06:40:41","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/?p=75663"},"modified":"2023-05-15T23:12:03","modified_gmt":"2023-05-16T06:12:03","slug":"wannacrypt-ransomware-worm-targets-out-of-date-systems","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2017\/05\/12\/wannacrypt-ransomware-worm-targets-out-of-date-systems\/","title":{"rendered":"WannaCrypt ransomware worm targets out-of-date systems"},"content":{"rendered":"

On May 12, 2017 we detected a new ransomware that spreads like a worm by leveraging vulnerabilities that have been previously fixed. While security updates are automatically applied in most computers, some users and enterprises may delay deployment of patches. Unfortunately, the ransomware, known as WannaCrypt<\/a>, appears to have affected computers that have not applied the patch for these vulnerabilities. While the attack is unfolding, we remind users to install MS17-010<\/a> if they have not already done so.<\/p>\n\n\n\n
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.<\/em><\/p>\n

Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017<\/strong><\/a><\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Microsoft antimalware telemetry immediately picked up signs of this campaign. Our expert systems gave us visibility and context into this new attack as it happened, allowing Windows Defender Advanced Threat Protection (ATP)<\/a> to deliver real-time defense. Through automated analysis, machine learning, and predictive modeling, we were able to rapidly protect against this malware.<\/p>\n

In this blog, we provide an early analysis of the end-to-end ransomware attack. Please note this threat is still under investigation. The attack is still active, and there is a possibility that the attacker will attempt to react to our detection response.<\/p>\n

To test how Windows Defender ATP can help your organization detect, investigate, and respond to advanced attacks, sign up for a free trial<\/a><\/strong>.<\/p>\n

Attack vector<\/h2>\n

Ransomware threats do not typically spread rapidly. Threats like WannaCrypt (also known as WannaCry, WanaCrypt0r, WCrypt, or WCRY) usually leverage social engineering or email as primary attack vector, relying on users downloading and executing a malicious payload. However, in this unique case, the ransomware perpetrators used publicly available exploit code for the patched SMB “EternalBlue<\/a>” vulnerability, CVE-2017-0145<\/a>, which can be triggered by sending a specially crafted packet to a targeted SMBv1 server. This vulnerability was fixed in security bulletin MS17-010<\/a>, which was released on March 14, 2017.<\/p>\n

WannaCrypt\u2019s spreading mechanism is borrowed from well-known<\/a> public SMB exploits<\/a>, which armed this regular ransomware with worm-like functionalities, creating an entry vector for machines still unpatched even after the fix had become available.<\/p>\n

The exploit code used by WannaCrypt was designed to work only against unpatched Windows 7 and Windows Server 2008 (or earlier OS) systems, so Windows 10 PCs are not affected by this attack<\/a>.<\/p>\n

We haven\u2019t found evidence of the exact initial entry vector used by this threat, but there are two scenarios that we believe are highly possible explanations for the spread of this ransomware:<\/p>\n