About WannaCry

WannaCry ransomware encrypts files in infected Microsoft Windows system. This generally spreads using vulnerability in implementation of server message block (SMB) in the systems. It encrypts the data in the victim's computer to WanaCrypt0r 2.0 and asks for US$ 300-600 within 96 hours in Bitcoin (digital asset or crypto currency). If unpaid, the ransomware developers may delete the decryption key, causing the victim to lose all files permanently. Several such instances of users losing all their data following a ransomware attack have been reported earlier.

In the first phase of WannaCry attack, hacker(s) put down major airlines, educational institutions, health networks and computer systems, which caused delay in service.

How it spread

WannaCry spreads through phishing (fraudulent emails claiming to be from reputable institutions that induce individuals to reveal personal information), emails and hacked websites. Hackers run several email campaigns and send these with attachments such as .exe, .ly6, .sqlite3, and .class. Users opening the attachment, activates the ransomware and it gets installed in the computer and encrypts data.

Indicators of compromise

WannaCry appears as a random character folder in the ProgramData folder with the file name taskche.exe or under Windows folder with the mssecsv.exe and taskshe.exe file name

How to prevent attacks

System administrators, especially individual users, are advised a flurry of measures to protect their computers and the entire network from ransomware infections:

• Apply Microsoft's security patch MS17-010. The security update resolves vulnerabilities in Windows systems

• Back up important files to an external hard disk drive and keep it in offline mode

• Avoid using pirated copies of Windows

• Corporate houses should establish strong sender policy framework (SPF) and email filters to disallow these kinds of emails from coming in

• Server administrators should strengthen their firewalls to prevent the injection of such ransomware into the system. They should also disable the execution of .exe files on the server

• Users must disable remote desktop connections

• Administrators should restrict user's ability to install unwanted applications

• Keep operating system, third party software and anti-viruses updated

• If a computer in your networking system is attacked by ransomware, immediately disconnect the computer from the network

• A ransomware victim may try boot-level scanning of their system