CRITICAL — WannaCry Ransomware | Lazarus Group (APT38) | Kill Switch: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

🔴 机制1: Registry Run

path	HKLM\Software\Microsoft\Windows\CurrentVersion\Run
trigger	Boot

graph TD
    A["WannaCry Start"] --> B["DnsQuery_W()\niuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com"]
    B -->|NXDOMAIN| C["Generate RSA-2048 Keypair"]
    B -->|Resolved| Z["ExitProcess(0)\nSELF-DESTRUCT"]
    C --> D["AES-128 Encrypt Files"]
    D --> E["Append .WNCRY"]
    E --> F["Display Ransom GUI"]
    F --> G["Wait for BTC Payment"]

(无 ASCII 回退)

🌐 C2 通信深度分析

Step 1: DNS Query	WannaCry calls DnsQuery_W() or getaddrinfo() to resolve iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com. This is the FIRST thing the ransomware does after execution — before any encryption occurs.
Step 2: HTTP GET	If DNS resolves, WannaCry makes an HTTP GET request to http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/ using InternetOpenUrlW() (WinINet API). It does NOT need a specific HTTP response — the mere fact that the domain resolves is sufficient.
Step 3a: Domain Resolves → SELF-DESTRUCT	If the domain resolves (currently sinkholed by security researchers), WannaCry calls ExitProcess(0) immediately. No encryption occurs. No files are touched. This is the kill switch.
Step 3b: Domain Unresolved → ENCRYPT	If DNS returns NXDOMAIN (no internet, or domain not registered), WannaCry proceeds to: generate RSA-2048 keypair → AES-128 encrypt files → append .WNCRY → display ransom GUI.

3. Self-Destruction Chain

WannaCry Entry (WinMain)
  |
  +-> InternetOpenW("Microsoft CryptoAPI/6.0")
  +-> InternetOpenUrlW("http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com")
  |     |
  |     +-> DNS resolution succeeds?
  |           |
  |           YES --> InternetCloseHandle() --> ExitProcess(0)  // SELF-DESTRUCT
  |           NO  --> InternetCloseHandle() --> Proceed to Encrypt()
  |
  +-> [If NO] CryptGenKey() generate RSA-2048
  +-> [If NO] CryptExportKey() export pubkey
  +-> [If NO] EncryptFiles() loop: AES-128 CBC per file
  +-> [If NO] MoveFileEx() rename to *.WNCRY
  +-> [If NO] CreateProcess("WanaDecrypt0r") display ransom GUI

4. Why This Design?
The kill switch was likely designed as an "emergency stop" for the WannaCry operators: - If the campaign spiraled out of control or attracted too much attention, they could register the domain → all active infections stop. - In sandboxed/air-gapped environments (like our Win11 NAT sandbox), DNS never resolves → ransomware proceeds. - The domain was registered by Marcus Hutchins on 2017-05-12, effectively killing the initial outbreak globally within hours.

5. Our Sandbox Result
In our Win11 sandbox (NAT network, no outbound internet): - DNS query to iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com → NXDOMAIN (unresolved) - Kill switch NOT triggered → WannaCry proceeded to full encryption - Ransomware GUI confirmed visible at t=15s+, GUI locked through t=60s+ - This confirms the kill switch logic works as designed — it ONLY self-destructs when the domain resolves.