The static analysis of WannaCry ransomware

Hacking weapons come in handy for cyber criminals anytime. Ransomware has increased in popularity. Its creators are playing our fears. The rapid proliferation of ransomware attack indicates the growing tendency of ransomware-as-a-service (RaaS) and the integration of hacking weapons. This paper presents the static analysis of the infamous WannaCry ransomware, which is one of the most impacted and propagated malware in 2017. This international wave of cyber threats is reported to have struck over 150 countries worldwide. Through the static analysis, the details of WannaCry processes and functions are revealed. The anatomy of ransomware attack is discussed to dissect the multi-staged execution of Wannacry, including deployment, installation, destruction, and command-and-control. The WannaCry ransomware not only implements the strong encrypting algorithm and key structure, but also integrates the hacking weapons leaked by the Shadow Brokers. In this paper, the reverse engineering analysis is conducted to explore each chain of malware execution.