20170517_secureport.pdf (902 KB)

WannaCry is analyzed as ransomware that spread globally from 12 May 2017 by abusing Windows SMB vulnerabilities on unpatched systems. The infection chain includes malicious email or websites as initial delivery, then worm-like propagation across local and randomly generated IP ranges over SMB port 445. After execution, the mssecsvc.exe dropper checks a kill-switch domain, registers itself as the mssecsvc2.0 service, launches tasksche.exe, and supports both SMB exploitation and file encryption. The report identifies the MS17-010-related CVEs, affected Windows versions, ransomware components, hashes, ransom behavior, and defensive steps such as isolating infected hosts, blocking SMB ports, patching, updating security tools, and maintaining offline backups.