{"id":5452,"date":"2018-11-03T17:30:06","date_gmt":"2018-11-03T12:00:06","guid":{"rendered":"https:\/\/antivirus.comodo.com\/blog\/?p=5452"},"modified":"2020-09-23T13:26:28","modified_gmt":"2020-09-23T07:56:28","slug":"what-is-wannacry-ransomware","status":"publish","type":"post","link":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/","title":{"rendered":"What is WannaCry Ransomware?"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-5454\" src=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/wannacry-ransomware.png\" alt=\"WannaCry Ransomware\" width=\"650\" height=\"300\" srcset=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/wannacry-ransomware.png 650w, https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/wannacry-ransomware-300x138.png 300w, https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/wannacry-ransomware-225x104.png 225w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/p>\n<p>The wannacry ransomware is composed of various components<\/p>\n<ul>\n<li>Files with encryption keys<\/li>\n<li>Application to encrypt data<\/li>\n<li>Application to decrypt data<\/li>\n<li>A copy of Tor Browser<\/li>\n<\/ul>\n<p>Unlike other ransomware, wannacry has taken the internet world by storm as it created a very bad impact on almost all the business from all parts of world. It was developed as a self-contained program with all the application components, made to infect the computer and find its way into the infected computer as a dropper.<\/p>\n<p><strong>How does WannaCry infect Windows PCs?<\/strong><br \/>\nThe program code is simple and clear that the IT security experts find it easy to examine. The wanna cry <a href=\"https:\/\/enterprise.comodo.com\/ransomware-attacks.php\" target=\"_blank\" title=\"Ransomware\">ransomware<\/a> tries to access the kill switch URL (hard coded). In case if it fails to do so, it proceeds to search and encrypt files in an uncontrollable fashion from MP3 files to MS office files. By this way the files are left inaccessible to the user. A ransom notice is then sent to the victim demanding a huge sum of money ($300 in bitcoin) to unlock the encrypted files.<\/p>\n<p>The malware authors of WannaCry have exploited the vulnerability called EternalBlue found in Windows. This Microsoft vulnerability was fixed by patch update MS17-010 on March 14th 2018. The cyber criminals gain access to the system through the vulnerability and introduces an encrypter file to lock the important files which is made inaccessible by the user.<\/p>\n<p>Once the PC is infected with Wannacry it does not start encrypting files immediately. It initially tries to gain access to an URL before it starts to encrypt the files. Reports says, the wanna cry tries to contact this URL to increase the complexity of the URL.<\/p>\n<p><strong>Wannacry \u2013 where does it originate from?<\/strong><\/p>\n<p>The source of infection is still unknown. And the information is still unclear though some security researchers claim that the infection is passed through emails.<\/p>\n<ul>\n<li>WannaCry has two key parts<\/li>\n<li>Worm Module<\/li>\n<li>Ransomware Module<\/li>\n<\/ul>\n<p>The ransomware module is passed on to infect the system and the worm module exploits the vulnerability of SMB Server Remote Code Execution (CVE-2017-0144) and (CVE-2017-0145) to infect the target system.<\/p>\n<p><strong>Symptoms that confirm that the ransomware is infected\u00a0<\/strong><\/p>\n<ul>\n<li>If the system is compromised with WannaCry ransomware, a system displays a black background with commands mentioned in red.<\/li>\n<li>The victim is given a guideline on how to pay the demanded ransom<\/li>\n<li>The ransomware encrypts and leaves the data files inaccessible by adding .WCRY extension at the end of each locked file.<\/li>\n<li>There can be unknown files in the folders where the important data is encrypted.<\/li>\n<\/ul>\n<p><strong>WannaCry Patch\u00a0<\/strong><\/p>\n<p>The patch that was required to prevent WannaCry ransomware was developed even before the attacks were started.<\/p>\n<p>There was a Bulletin released by the Microsoft Security Team on March 14, 2017, the Windows implementation of the SMB protocol was updated to deny infection through the vulnerability Eternal Blue.<\/p>\n<p>Nevertheless, the Windows users were lethargic and took it light that most of the systems are yet to be patched as of May 2017 even after showing red alerts by the Microsoft Security teams.<\/p>\n<p>The unpatched system that were infected would not be able to restore files from a safe backup. While there are some indications that says some people on paying ransom are regaining access to their encrypted files.<\/p>\n<p><strong>Preventive Measures<\/strong><\/p>\n<p>Update the Windows OS with the latest available patches. Outdates OSes are prone to malware infectionsClose port 445 by implementing the use of firewall \u2013 this can be an alternative option if there is no option available to update the security patch.<\/p>\n<p>Implementing the use of an effective security suite like <a href=\"https:\/\/www.comodo.com\/home\/internet-security\/antivirus.php\" rel=\"noopener\" target=\"_blank\">Comodo Antivirus<\/a> which delivers enhanced <a href=\"https:\/\/antivirus.comodo.com\/virus-protection.php\" target=\"_blank\" rel=\"noopener\">virus protection<\/a> from ransomware and preventing the same from interfering with regular operations of the computer.<\/p>\n<p><a href=\"https:\/\/antivirus.comodo.com\/download\/thank-you.php?prod=cloud-antivirus&#038;track=16678&#038;af=16678\" target=\"_blank\" rel=\"noopener\" onclick=\"ga('send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Download', eventLabel: 'Bottom FREE DOWNLOAD banner Product AV'});ga('nT.send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Download', eventLabel: 'Bottom FREE DOWNLOAD banner Product AV'});\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-8604\" src=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/04\/Comodo-Free-Antivirus.png\" alt=\"comodo antivirus\"\/><\/a><\/p>\n<p><a href=\"https:\/\/secure.nurd.com\/home\/purchase.php?pid=109&#038;af=16166\" target=\"_blank\" rel=\"noopener\" onclick=\"ga('send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Click', eventLabel: 'GET COMPLETE PROTECTION banner Product CIS Pro'});ga('nT.send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Click', eventLabel: 'GET COMPLETE PROTECTION banner Product CIS Pro'});\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-8604\" src=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/08\/complete-antivirus.png\" alt=\"comodo antivirus\" width=\"650\" height=\"83\" \/><\/a><\/p>\n<p><strong>Related Resource<\/strong><\/p>\n<p><a href=\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/best-antivirus-of-2019\/\" target=\"blank\" rel=\"noopener\">Best Antivirus<\/a><\/p>\n<p><a href=\"https:\/\/antivirus.comodo.com\/antivirus-for-android.php\" target=\"blank\" rel=\"noopener\">Antivirus for Android<\/a><\/p>\n<p><a href=\"https:\/\/cwatch.comodo.com\/website-status-checker.php\" rel=\"noopener\" target=\"_blank\">Website Status<\/a><\/p>\n<p><a href=\"https:\/\/cwatch.comodo.com\/website-checker.php\" rel=\"noopener\" target=\"_blank\">Website Checker<\/a><\/p>\n<p><strong><a href=\"https:\/\/cwatch.comodo.com\/website-backup\/\" rel=\"noopener\" target=\"_blank\">Website Backup<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The wannacry ransomware is composed of various components Files with encryption keys Application to encrypt data Application to decrypt data A copy of Tor Browser Unlike other ransomware, wannacry has taken the internet world by storm as it created a very bad impact on almost all the business from all parts of world. It was [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":5453,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[47,99],"class_list":["post-5452","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-comodo-news","tag-ransomware","tag-wannacry-ransomware"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>What is Wannacry Ransomware? | How does Wannacry Infect PCs?<\/title>\n<meta name=\"description\" content=\"Wannacry Ransomware is the malicious worm that spreads across multiple computer networks and infects them by encrypting data files on their hard drive.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is Wannacry Ransomware? | How does Wannacry Infect PCs?\" \/>\n<meta property=\"og:description\" content=\"Wannacry Ransomware is the malicious worm that spreads across multiple computer networks and infects them by encrypting data files on their hard drive.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/\" \/>\n<meta property=\"og:site_name\" content=\"Comodo Antivirus Blogs | Anti-Virus Software Updates\" \/>\n<meta property=\"article:published_time\" content=\"2018-11-03T12:00:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-09-23T07:56:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/what-is-wannacry.png\" \/>\n\t<meta property=\"og:image:width\" content=\"225\" \/>\n\t<meta property=\"og:image:height\" content=\"170\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"seo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"seo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/\",\"name\":\"What is Wannacry Ransomware? | How does Wannacry Infect PCs?\",\"isPartOf\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/what-is-wannacry.png\",\"datePublished\":\"2018-11-03T12:00:06+00:00\",\"dateModified\":\"2020-09-23T07:56:28+00:00\",\"author\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462\"},\"description\":\"Wannacry Ransomware is the malicious worm that spreads across multiple computer networks and infects them by encrypting data files on their hard drive.\",\"breadcrumb\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#primaryimage\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/what-is-wannacry.png\",\"contentUrl\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/what-is-wannacry.png\",\"width\":225,\"height\":170,\"caption\":\"what is wannacry\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/antivirus.comodo.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What is WannaCry Ransomware?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#website\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/\",\"name\":\"Comodo Antivirus Blogs | Anti-Virus Software Updates\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/antivirus.comodo.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462\",\"name\":\"seo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g\",\"caption\":\"seo\"},\"url\":\"https:\/\/antivirus.comodo.com\/blog\/author\/seo\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What is Wannacry Ransomware? | How does Wannacry Infect PCs?","description":"Wannacry Ransomware is the malicious worm that spreads across multiple computer networks and infects them by encrypting data files on their hard drive.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/","og_locale":"en_US","og_type":"article","og_title":"What is Wannacry Ransomware? | How does Wannacry Infect PCs?","og_description":"Wannacry Ransomware is the malicious worm that spreads across multiple computer networks and infects them by encrypting data files on their hard drive.","og_url":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/","og_site_name":"Comodo Antivirus Blogs | Anti-Virus Software Updates","article_published_time":"2018-11-03T12:00:06+00:00","article_modified_time":"2020-09-23T07:56:28+00:00","og_image":[{"width":225,"height":170,"url":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/what-is-wannacry.png","type":"image\/png"}],"author":"seo","twitter_card":"summary_large_image","twitter_misc":{"Written by":"seo","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/","url":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/","name":"What is Wannacry Ransomware? | How does Wannacry Infect PCs?","isPartOf":{"@id":"https:\/\/antivirus.comodo.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#primaryimage"},"image":{"@id":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/what-is-wannacry.png","datePublished":"2018-11-03T12:00:06+00:00","dateModified":"2020-09-23T07:56:28+00:00","author":{"@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462"},"description":"Wannacry Ransomware is the malicious worm that spreads across multiple computer networks and infects them by encrypting data files on their hard drive.","breadcrumb":{"@id":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#primaryimage","url":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/what-is-wannacry.png","contentUrl":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/11\/what-is-wannacry.png","width":225,"height":170,"caption":"what is wannacry"},{"@type":"BreadcrumbList","@id":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/what-is-wannacry-ransomware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/antivirus.comodo.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What is WannaCry Ransomware?"}]},{"@type":"WebSite","@id":"https:\/\/antivirus.comodo.com\/blog\/#website","url":"https:\/\/antivirus.comodo.com\/blog\/","name":"Comodo Antivirus Blogs | Anti-Virus Software Updates","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/antivirus.comodo.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462","name":"seo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g","caption":"seo"},"url":"https:\/\/antivirus.comodo.com\/blog\/author\/seo\/"}]}},"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/5452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/comments?post=5452"}],"version-history":[{"count":17,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/5452\/revisions"}],"predecessor-version":[{"id":15503,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/5452\/revisions\/15503"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/media\/5453"}],"wp:attachment":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/media?parent=5452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/categories?post=5452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/tags?post=5452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}