One reachable workstation, eight weeks of exposure
At the beginning of May 12, 2017, WS-17 is an ordinary Windows workstation with SMBv1 reachable on TCP 445. It has not installed Microsoft's March security update. Nobody needs to open an attachment or click a link. A remote scanner can speak directly to the SMB server, trigger a kernel memory-corruption path, deliver WannaCry, and turn WS-17 into the next scanner. Within minutes, the victim is also an origin.
That loop is why WannaCry should not be remembered as merely ransomware with a famous exploit. Its global effect came from a composition: a remotely reachable SMBv1 server vulnerability, a mature leaked exploit ecosystem, a large susceptible population, aggressive local and public scanning, and a file-encryption payload. The cryptography was good enough to make ordinary brute-force recovery unrealistic, while the payment workflow was clumsy enough to make reliable victim-to-payment matching difficult.
The first date changes how we assign responsibility. Microsoft published Open source: MS17-010 on March 14, almost two months before the outbreak. The Shadow Brokers released the Lost in Translation archive containing EternalBlue and DoublePulsar on April 14. Large-scale WannaCry activity began on May 12. The crisis therefore landed on machines for which a fix already existed, plus unsupported or operationally fragile systems that normal servicing had left behind.
We will follow WS-17 through one complete cycle: reachability, exploitation, loader execution, kill-switch decision, service installation, encryption, and outbound scanning. Then we will work backward through containment and attribution. The aim is not to reproduce an exploit. It is to show exactly which boundaries made the campaign reproduce, and which controls break which link.
| 14 March 2017 | Microsoft releases MS17-010 | The defensive fix existed before the public EternalBlue release and before WannaCry. |
| 14 April 2017 | Shadow Brokers publishes Lost in Translation | A mature Windows exploitation toolkit becomes broadly available. |
| 12 May 2017 | WannaCry spreads globally within hours | Patch latency and flat reachability turn a vulnerability backlog into an operational crisis. |
| 12 May 2017, later that day | The hard-coded domain is registered | Susceptible builds begin exiting, but already encrypted hosts and later variants are not repaired. |
1. Why TCP 445 made the vulnerability wormable
SMB is a stateful client/server protocol for shared files, printers, named pipes, and related Windows resources. SMBv1 can be hosted directly on TCP 445. The critical point is the direction of trust: EternalBlue attacked the SMB server. WS-17 did not need to mount an attacker-controlled share, authenticate to a malicious service, or start a client connection. A crafted request could reach the vulnerable server code as soon as the network path was open.
Modern writing should call the exploit EternalBlue, conventionally CVE-2017-0144, within the MS17-010 family. Early reporting sometimes mixed identifiers from the same bulletin. Microsoft's later NotPetya analysis and detailed reverse engineering use CVE-2017-0144 for EternalBlue and CVE-2017-0145 for EternalRomance. The larger operational fact is unchanged: MS17-010 fixed a family of severe SMBv1 flaws, several allowing unauthenticated remote code execution.
At the implementation boundary, the best-known EternalBlue primitive sits in Windows SMB server logic that converts OS/2 File Extended Attribute lists into NT structures. A size-handling defect can leave an unexpectedly large effective length, after which the conversion copies more data than the destination kernel allocation can hold. Open source: Check Point's reverse engineering traces how the exploit turned that overflow into controlled execution rather than a random crash.
Reliability required several linked techniques: SMB transaction fragmentation staged the data, parallel network activity groomed nonpaged kernel pool allocations, selected allocations were freed to create a predictable hole, and the overflow corrupted a neighboring srvnet structure. Manipulated memory-descriptor and callback fields then redirected execution into attacker-controlled kernel shellcode. The exact assumptions varied by architecture and Windows build, which is why EternalBlue was much more than one magic malformed packet.
DoublePulsar: adjacent capability, not a universal extra hop
DoublePulsar was a separate post-exploitation implant in the leaked toolset. It used unusual SMB transaction messages to check for an implant, execute a payload, or uninstall itself. WannaCry could detect an existing DoublePulsar implant, but its built-in exploitation path used DoublePulsar-derived kernel shellcode and loader logic to deliver a WannaCry DLL on x86 or x64. Saying every victim first received an unchanged DoublePulsar backdoor adds a step the evidence does not require.
2. The infection loop: target, execute, scan, repeat
Once the process passes its initial reachability check, it creates the service mssecsvc2.0, displayed as Microsoft Security Center (2.0) Service. That name is camouflage, not a Microsoft component. The service launches propagation threads while the same delivery binary extracts the ransomware loader and bundled resources. Propagation and encryption can therefore advance independently on the same host.
The scanner looked in two directions. Local-subnet scanning walked nearby address space, where corporate routing and open workstation-to-workstation SMB made successive hops cheap. Random public IPv4 scanning searched for Internet-reachable TCP 445. Mandiant observed roughly 25 random-IP probes per second in a Open source: representative sample. Local discovery supplied density; public scanning supplied geographic reach.
A reachable target was checked for SMB behavior and, in some paths, an existing DoublePulsar implant. A susceptible SMBv1 server then entered the EternalBlue chain. The derived kernel loader selected x86 or x64 delivery, wrote or executed the WannaCry payload on the new host, and started the same top-level process. WS-17 has now changed roles: what began as the target of a probe becomes another source of probes.
This feedback loop explains why raw infection estimates are less important than network topology. Vendors measured endpoints, exploit attempts, sinkhole connections, or unique addresses, so totals vary. The stable operational conclusion is that a wormable service turned a remotely exploitable host population into worldwide disruption on an Internet timescale. A flat enterprise amplified the same logic internally.
3. The kill switch was one HTTP branch
At process start, the outbreak-era build attempted an HTTP connection to a long, apparently nonsensical hard-coded domain. If the connection succeeded, the process exited before its normal worm and ransomware path. If it failed, execution continued. Marcus Hutchins found the unregistered domain while analyzing the sample, registered it on May 12, and then saw infected systems reach it. His telemetry placed the large campaign's beginning around 08:00 UTC.
The term kill switch can make the result sound broader than it was. Registration did not install MS17-010, disable SMBv1, delete the worm service, reverse an AES operation, or recover the victim RSA private key. It caused susceptible builds that could resolve and reach the domain to stop before normal execution. Files already encrypted stayed encrypted, and vulnerable hosts stayed vulnerable.
The mechanism was also build-specific. Variants with alternate domains appeared quickly, while some analysis environments accidentally changed behavior by intercepting every unknown domain and returning a synthetic response. Defenders therefore had to keep the sinkhole domain reachable for affected samples while separately patching and containing the underlying service exposure.
Hutchins' Open source: first-person account is the best source for this sequence because it distinguishes observation from later mythology: he registered the domain to observe the malware, the response changed execution, and further reverse engineering established the branch's effect and limits.
4. The ransomware path: AES for data, RSA for keys
WannaCry's encryption design was stronger than its payment operations. The malware generated an infection-specific RSA-2048 key pair. It protected the victim private key with an operator-controlled embedded RSA public key, leaving the host with an encrypted private-key artifact. For each target file, it generated a fresh AES-128 key and used AES in CBC mode to encrypt the file contents.
The victim RSA public key then encrypted that per-file AES key. WannaCry stored the wrapped AES key alongside metadata in a file beginning with the signature WANACRY! and typically used the .WNCRY extension. This hybrid design matters: RSA was not repeatedly applied to a multi-gigabyte document. AES handled bulk data efficiently; RSA protected the small AES key that was necessary to reverse each file operation.
Normal recovery therefore depended on the victim RSA private key. Guessing AES keys per file or brute-forcing RSA was not the practical weakness. A narrow recovery opportunity existed because some Windows cryptographic APIs could leave the RSA prime factors in process memory after key destruction. Open source: WannaKey and Open source: WannaKiwi attempted to recover those residues on supported systems, but only before memory was overwritten or the machine rebooted. That was a volatile-memory accident, not broken AES or RSA.
This is why incident order matters. Pulling power or rebooting immediately may stop visible activity, but it also destroys volatile evidence and the rare residue needed by memory-based recovery. A response team must balance ongoing spread and encryption against evidence preservation, isolate network paths first when safe, and make recovery decisions from the affected system's actual state.
TEXT
WannaCry encrypted-file layout (conceptual)
WANACRY! signature
version / metadata
length of wrapped key
RSA(victim_public_key, per_file_AES_key)
IV / encryption metadata
AES-128-CBC(per_file_AES_key, original_file_bytes)TEXT
victim_rsa_public_key -> wraps each per-file AES key
victim_rsa_private_key -> required to unwrap those AES keys
operator_public_key -> protects the victim private-key artifact
Recovery question:
Can the responder recover the victim private key from backup, operator response,
or narrow volatile-memory residue before it is overwritten?5. Persistence, Tor, and payment operations
The infection left a collection of durable artifacts rather than one self-contained executable. The worm commonly created mssecsvc2.0. The ransomware loader tasksche.exe could persist through a randomly named service and Run keys under HKCU or HKLM. The WanaCrypt0r\wd registry entry identified its working directory. Extracted resources included the decryptor UI, language files, key files, Tor executables, ransom notes, and the target extension list.
The ransom application bundled Tor and used a local SOCKS proxy, commonly 127.0.0.1:9050, to contact operator infrastructure. Yet the payment side did not have the same engineering quality as the exploit and encryption. The outbreak build exposed only a few hard-coded Bitcoin addresses to a vast victim population. Without a unique address per victim, automatically proving that one payment corresponded to one encrypted machine was difficult.
The interface could check balances and update local status, but public analyses found gaps between the promise of automated decryption and a scalable process for mapping payments to victim keys. This did not make the encryption harmless. It made the commercial exchange unreliable: a victim could pay and still have no dependable automated route to the correct private key.
That unevenness is one of WannaCry's most useful lessons. EternalBlue was a sophisticated kernel exploit. The worm loop was extremely effective. Hybrid encryption was competent. The kill-switch branch was brittle, and payment attribution was crude. Calling the whole operation simply advanced or unsophisticated hides the systems reality that quality varies by subsystem.
| mssecsvc2.0 | Worm service and propagation host | Service creation and execution telemetry; correlate with outbound TCP 445. |
| tasksche.exe + random service/Run key | Ransomware loader and persistence | File, service, and autorun triage; do not rely on filename alone. |
| WANACRY! header / .WNCRY | Encrypted-file format and extension | Scope file impact and preserve representative samples for recovery analysis. |
| @WanaDecryptor@.exe and ransom notes | Victim interface and payment instructions | Confirms payload family; interface claims do not prove payment or recovery capability. |
| Bundled Tor / local SOCKS 9050 | Operator communication path | Process and network correlation; isolate before investigating external destinations. |
6. Incident response: stop reproduction before rebuilding
The first response objective is containment, not perfect attribution. Isolate affected hosts and block unnecessary TCP 445 between user segments and at the perimeter. Keep the known kill-switch domain reachable or sinkholed for the affected build. Identify systems missing MS17-010, systems still exposing SMBv1, and legacy devices that cannot be safely patched. Assume each compromised endpoint may already be scanning other segments.
Preserve volatile and durable evidence when operational safety allows: process memory, service configuration, autoruns, working-directory artifacts, representative encrypted files, network connections, and relevant event logs. Memory capture is especially time-sensitive if a responder wants to evaluate the narrow WannaKey/WannaKiwi conditions. Do not run untrusted recovery tooling on the original evidence or reconnect a quarantined host to production to test whether it is clean.
Eradication is a control sequence. Apply MS17-010 or a supported cumulative update. Disable SMBv1 where it is not strictly required. Remove or rebuild affected hosts from trusted media, rotate credentials that may have been exposed during the incident, and restore data from offline or otherwise protected backups. Validate the restored host with the vulnerable protocol absent or blocked before reconnecting it.
Exposure assessment can translate reverse engineering into safe checks. Nmap's Open source: smb-vuln-ms17-010 and Open source: smb-double-pulsar-backdoor document non-destructive network signatures used by defenders. Such checks belong inside explicitly authorized inventory and incident-response scope. Their job is to find exposure and implants, not to prove that a patch-management dashboard is accurate.
| Contain | Quarantine infected hosts; restrict TCP 445 paths; preserve sinkhole reachability. | Network telemetry shows scanning stopped crossing the controlled boundaries. |
| Preserve | Capture volatile state and durable artifacts before destructive recovery. | Timestamped, hashed evidence set and documented chain of custody. |
| Remediate | Patch, disable SMBv1, rebuild, rotate exposed credentials, restore known-good data. | Host inventory confirms supported build and update; protocol and services are absent. |
| Validate | Probe the actual network path and monitor for renewed service creation or scans. | Authorized reachability test fails safely and no outbound worm behavior returns. |
7. Attribution without collapsing four different actors
The public story contains several names that describe different roles. The Equation Group was a researcher-assigned name for a sophisticated operation widely associated with U.S. intelligence capabilities. The Shadow Brokers claimed possession of tooling from that ecosystem and publicly released the Windows archive. Those facts do not make Shadow Brokers the author or operator of WannaCry.
The WannaCry-to-Lazarus link began with forensic clues. Google researcher Neel Mehta pointed researchers to code similarity between an early February 2017 WannaCry cryptor and a 2015 Lazarus-associated sample. Open source: Kaspersky reproduced the overlap and called it a significant clue, while warning that code reuse alone was insufficient and discussing false-flag possibilities. Additional clustering can strengthen an assessment, but a shared code fragment is not equivalent to operator infrastructure or intelligence evidence.
Government language later became stronger. On December 19, 2017, the UK stated that NCSC assessed it highly likely that Lazarus Group was behind WannaCry and linked Lazarus to North Korea. In 2018, the U.S. Department of Justice charged Park Jin Hyok in a complaint alleging involvement in WannaCry and other operations. A complaint is an allegation, not a conviction, so the precise verbs are assessed, attributed, charged, and alleged.
The narrow capability chain is still clear. Microsoft patched the SMB vulnerability family in March. Shadow Brokers released the exploit toolkit in April. The WannaCry operators incorporated the capability into a worm-ransomware campaign in May. The public evidence does not require those organizations to have coordinated, and it does not resolve Shadow Brokers' identity.
| Equation Group / NSA-associated tooling | Origin ecosystem widely associated with the leaked offensive capabilities | Associated or attributed; do not infer every unpublished development detail. |
| Shadow Brokers | Claimed possession and publicly released the tool archive | Operator of the leak remains publicly unresolved in the cited evidence. |
| Lazarus Group / DPRK | Public forensic link and later UK/U.S. attribution | Use the confidence and attribution language of the named source. |
| Park Jin Hyok | Defendant named in a U.S. criminal complaint | Charged and alleged; do not describe the complaint as a conviction. |
8. Defense changes the worm's reproduction rate
Patching MS17-010 removes the vulnerable execution path from a supported host. Disabling SMBv1 removes the legacy protocol that exposes it. Restricting TCP 445 changes which peers can even attempt the conversation. Segmenting workstation networks reduces the pool of reachable neighbors after one endpoint is compromised. Each control attacks a different term in the propagation loop.
Legacy systems are where policy meets reality. A hospital device, industrial controller, or business-critical application may not tolerate an immediate OS change. That constraint should create visible compensating controls, not silent indefinite acceptance: isolate the host, permit only required peers, put access through a gateway, monitor the narrow flows, prevent general Internet SMB, protect recoverable backups, and fund replacement.
This is also why patch priority cannot be one flat severity queue. An unauthenticated remote-code-execution flaw in a ubiquitous network service, with public worm-capable exploitation and broad reachability, deserves a qualitatively shorter SLA than a same-score workstation bug requiring local interaction. Asset criticality, exposure, exploit maturity, and propagation potential determine operational urgency together.
WannaCry remained visible long after May 2017, and EternalBlue was reused by miners such as Adylkuzz and WannaMine and by Open source: NotPetya alongside other movement methods. NotPetya is not a WannaCry variant. Its credential-based PsExec/WMIC paths also showed the limit of vulnerability-only defense: a patched machine can still be reached through stolen administrative trust. Patch management, identity controls, protocol reduction, and segmentation are complementary.
Whole-system summary
The focused figures explained each local mechanism. The Nodefall canvas below reconnects them. Start at the kill-switch decision, then follow the host into the service and encryption path. In parallel, follow TCP 445 scans to WS-17, through EternalBlue and the DoublePulsar-derived loader, and into a new infected host that becomes another scanner. The cycle is the system.
Use the four walkthrough steps to compare two kinds of boundary. The kill switch changes one malware build's control flow. MS17-010, SMBv1 retirement, and segmentation change the environment that lets the worm reproduce. Confusing those layers is how a temporary interruption becomes mistaken for remediation.
WannaCry: process start, exploitation, encryption, and propagation
The full execution loop: kill-switch decision, host encryption, TCP 445 scanning, EternalBlue exploitation, DoublePulsar-derived delivery, and the next infected scanner.
Sources and what is original
The supplied WannaCry technical research dossier was the primary research source for this article's chronology, exploit and malware architecture, cryptography, artifacts, economics, attribution caveats, related campaigns, and long-term lessons. The WS-17 running example, composition, wording, tables, response sequence, Nodefall graph, and generated visuals are original Nodefall work. The dossier remains an internal editorial source; the public links below let readers verify the main claims directly.
Vulnerability and outbreak behavior: Open source: Microsoft MS17-010 and Open source: Microsoft's WannaCrypt analysis for the patch family, services, scanning, kill-switch logic, and mitigations.
Malware components and cryptography: Open source: Mandiant's WannaCry Malware Profile for representative artifacts, persistence, key construction, file format, Tor, and dynamic behavior.
Exploit and loader boundaries: Open source: Check Point's EternalBlue reverse engineering for the FEA bug, pool grooming, srvnet/MDL manipulation, and execution chain.
Kill-switch discovery: Open source: Marcus Hutchins' first-person account for the domain registration, telemetry, experimental verification, and limits.
Enterprise defense: Open source: UK NCSC WannaCry guidance for patching, filtering, SMBv1 removal, segmentation, and legacy-system isolation.
Public attribution and legal language: Open source: UK government attribution statement and Open source: U.S. DOJ complaint announcement for the highly-likely assessment and criminal allegations.
Each public link sits beside the concept it supports. The complete dossier also catalogues SecureWorks, Symantec, CrowdStrike, Kaspersky, ESET, CISA, Europol, NHS Digital, Nmap, recovery-tool, blockchain-analysis, and academic healthcare-impact sources for readers who want the full evidence trail.