👑 BOSSFIGHT MASTERCLASSGLOBAL OUTBREAK ANALYSISCRITICAL RISK 98/100

WannaCry.exe (WanaCrypt0r 2.0 / tasksche.exe)

Comprehensive dissection of the MS17-010 EternalBlue SMB worm, hardcoded killswitch sinkhole mechanics, encrypted resource extraction, and x32dbg memory patching.

Infection Vectors

SMBv1 (Port 445) + Dropper

MD5: 84c82835a5d21bbcf75a61706d8ab549

Hardcoded Killswitch Domain Probe

Before executing any malicious encryption or spawning the propagation threads, WannaCry queries a hardcoded unregistered domain via InternetOpenA and InternetOpenUrlA.

Hardcoded Killswitch URL

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

INVERTED LOGIC

Reverse Engineering Disassembly: Inverted Exit Logic

0x00408138: 50 push eax ; hInternet

0x00408139: 68 a4 e0 40 00 push offset aIuqerfsodp9... ; URL string

0x0040813e: ff 15 d0 80 40 00 call ds:InternetOpenUrlA

0x00408144: 85 c0 test eax, eax

0x00408146: 74 08 jz loc_DETONATE_PAYLOAD ; If URL FAIL (0) → DETONATE!

; If URL succeeds (non-zero handle returned), ransomware exits cleanly!

0x00408148: 50 push eax

0x00408149: ff 15 d4 80 40 00 call ds:InternetCloseHandle

0x0040814f: 31 c0 xor eax, eax

0x00408151: c3 retn ; Exit Process (Killswitch activated)

Live Sinkhole Simulation Switch

Toggle the DNS sinkhole state to observe how Marcus Hutchins (MalwareTech) halted the global outbreak by registering the dead domain.

Outcome: Killswitch inactive. Ransomware proceeds to MS17-010 SMB scan & file wipe.