WannaCry Encryption Flow
Encryption Flow Generating RSA Key pair Sample generates RSA public and private key pair and export them to disk. Public RSA key is written in file 00000000.pky and private RSA key is encrypted with another public RSA key embedded in malware binary and written to file 00000000.eky . Embedded Public RSA key in sample used to encrypt generated private RSA key. File Enumeration Enumerate Files in a Directory using Windows API’s FindFirstFile and FindNextFile . Before encrypting file in a directory, malware checks for list of directories and files to be excluded. Directories to Exclude File Extensions to Exclude Exclude Files Dropped by Malware File Types to Encrypt File types to be encrypted is present as hard coded list in malware binary. ...