These are quick first looks and trend and threats

Written by the security and AV professionals from team K7, meant for the general audience
These are usually articles that go into internals of a virus or deal with security issues
Senior managers speak on areas of interest to them, inside and outside the industry

May 16th, 2017

WannaCry ransomware, a security disaster has already infected thousands of computers all over the world, especially in Russia, India and China, and has hit emergency services in various countries, e.g. the UK. There have been images of infected ATMs, gigantic billboards, etc., making this attack a high-profile event.

This attack is a macabre reminder of the ill effects of

  • exploiting a critical vulnerability in the Windows OS
  • using a pirated version of an operating system
  • leaving computer unpatched and connected to the internet, in other words highly vulnerable

In most of the attack scenarios tracked, WannaCry ransomware infects a computer by using the “EternalBlue” exploit (developed by the NSA and released to the public by Shadowbrokers in April 2017), which exploits a critical vulnerability in Microsoft SMBv1 server (CVE-2017-0143 to CVE-2017-0148) by sending a specially-crafted packet. There was a Microsoft patch MS17-010 available to fix this vulnerability released in March 2017. It is also alleged, although without any concrete evidence, that this malware may enter a computer by the common email-borne route.

Please note that K7 security products contains heuristic anti-ransomware functionality which is capable of stopping WannaCry in its tracks without any signatures updates (please read the Virus Bulletin blog which includes a video of K7’s talk from 2015 about fighting back against ransomware). However to ensure stopping all variants of the ransomware before any encryption starts, we at K7 Threat Control Lab have taken the necessary steps to block it at all of its possible execution points. Users of K7 Security products are protected against this ransomware and the detection names at the time of writing are as follows:

Trojan (0050db011)

Trojan (0050d8371)

Trojan (0050d7201)

In addition, K7 blocks this multi-component malware with the behavioral detection as

Suspicious Program ( ID21236 )

Suspicious Program ( ID21237 )

Suspicious Program ( ID21238 )

Before we look at the technical details of this malware and explore how it works we must urge users to apply the latest Windows patches which Microsoft has made available even for the unsupported Windows XP, and may be applicable on pirated versions of Windows too (note, using pirated software is an extremely bad idea). In order to better protect the computer against being exploited from an external source, blocking in-bound connections on TCP ports 139 and 445 and UDP ports 137 and 138 might be an option to carefully consider. The client firewall in K7 Security Products can be configured to restrict traffic as described on the mentioned ports.

In addition there has been some misinformation aggressively disseminated on social media and the news that using a certain password which is embedded in the code can be used to decrypt the encrypted data. This is far from the truth. WannaCry uses the embedded password to decrypt its internal embedded ZIP containing ransomware components. Users are strongly advised to ignore any mention about this password and avoid being influenced by a whole lot of scaremongering junk information being released irresponsibly. There is currently no way to retrieve all the encrypted data barring use of the cyber criminals’ own decryption service at a cost of US$300-US$600.

WannaCry involves multiple executable files to infect an end user.  The main dropper EXE accesses the URL as shown in the images below,

This URL is now known as the “kill switch” since if it is accessible the dropper stops execution. Such a “kill switch” is unprecedented in the history of ubiquitous run-of-the-mill ransomware and raises interesting questions about the true purpose of the attack. Interestingly the above domain has now been registered by researchers, thus stopping the attack at the dropper stage in many situations. There are few recent samples which ignores whether or not the URL connection is successful.

MD5: d724d8cc6420f06e8a48752f0da11c66

MD5: E8089341EE0442A2ECF82E4B70829143

Anyway, let’s assume the executable proceeds with its malicious behavior. The dropper EXE starts itself as a service with the security parameters as “-m security”, service name “mssecsvc2.0” and display name as “Microsoft Security Center (2.0) service”

Then it tries to load the payload executable which it carries within itself under the resource named “R” in the sample which we analyzed (d5dcd28612f4d6ffca0cfeaefd606bcf).

In any PE parsing tool, it shows that the resource contains an embedded PE

It extracts the file with the name “tasksche.exe” under the directory called “windows\<randomname>” as shown below. Note, we have also seen occurrences of this file being dropped under “ProgramData\<randomname>.”

After which the dropper starts the payload “tasksche.exe” using CreateProcessA. The payload tasksche.exe (84C82835A5D21BBCF75A61706D8AB549) contains the required functionality for encrypting data on the computer, and the files to display the ransom notes, etc. It carries within itself a password-protected ZIP in .resource section, as mentioned earlier. Interestingly, the password for the ZIP is plain text and not encrypted.

Upon further research we found that even though the password is in plain text, the password keeps changing. Sample 4da1f312a214c07143abeeafb695d904 uses the password “wcry@123”.

Unzipping the password-protected ZIP drops the following files in the desktop directory,

Folder “msg” contains the rtf files with extension .wnry for different languages.

Here are the details of the other files that are unzipped:

1. b.wnry – BMP image file (desktop background mentioning the decryptor tool @WanaDecryptor@.exe to receive ransom payment)

2. c.wnry – contains Tor browser download link

3. r.wnry – Text Message

4. s.wnry – ZIP file with has tor.exe along with its dependent DLLs

5. t.wnry – Encrypted data which then decrypts itself in memory (it’s a DLL file)

6. u.wnry

7. taskdl.exe

8. taskse.exe

It also unzips a batch file that writes a VBScript file m.vbs, that points to an LNK file to run “@WanaDecryptor@.exe” a shown below,

This @WanaDecryptor@.exe, once run, calls taskdl.exe and displays the below screen to the user,

It also copies itself to other locations like


The following file extensions are susceptible to encryption:

.der, .pfx, .key, .crt, .csr, .p12, .pem, .odt, .ott, .sxw, .stw, .uot, .3ds, .max, .3dm, .ods, .ots, .sxc, .stc, .dif, .slk, .wb2, .odp, .otp, .sxd, .std, .uop, .odg, .otg, .sxm, .mml, .lay, .lay6, .asc, .sqlite3, .sqlitedb, .sql, .accdb, .mdb, .dbf, .odb, .frm, .myd, .myi, .ibd, .mdf, .ldf, .sln, .suo, .cpp, .pas, .asm, .cmd, .bat, .ps1, .vbs, .dip, .dch, .sch, .brd, .jsp, .php, .asp, .java, .jar, .class, .mp3, .wav, .swf, .fla, .wmv, .mpg, .vob, .mpeg, .asf, .avi, .mov, .mp4, .3gp, .mkv, .3g2, .flv, .wma, .mid, .m3u, .m4u, .djvu, .svg, .psd, .nef, .tiff, .tif, .cgm, .raw, .gif, .png, .bmp, .jpg, .jpeg, .vcd, .iso, .backup, .zip, .rar, .tgz, .tar, .bak, .tbk, .bz2, .PAQ, .ARC, .aes, .gpg, .vmx, .vmdk, .vdi, .sldm, .sldx, .sti, .sxi, .602, .hwp, .snt, .onetoc2, .dwg, .pdf, .wk1, .wks, .123, .rtf, .csv, .txt, .vsdx, .vsd, .edb, .eml, .msg, .ost, .pst, .potm, .potx, .ppam, .ppsx, .ppsm, .pps, .pot, .pptm, .pptx, .ppt, .xltm, .xltx, .xlc, .xlm, .xlt, .xlw, .xlsb, .xlsm, .xlsx, .xls, .dotx, .dotm, .dot, .docm, .docb, .docx, .doc

Encrypted files would have extension .wncry  appended to the user file name, e.g. if the file name is user_pic.jpg, after encryption it would be user_pic.jpg.wncry.  The bytes of encrypted file at offset zero would be ‘0×57 0×41 0x4E 0×41 0×43 0×52 0×59 0×21’ (ASCII “WANACRY!”)

In all the folder locations in which encryption occurs there also two additional files dropped:
@WanaDecryptor@.exe.lnk which points to @WanaDecryptor@.exe and @Please_Read_Me@.txt, which contains the ransom note.

As with all ransomware, and to guard against data loss in general, it is important to maintain regular backups of critical data to be able to retrieve it in the case of file or disk corruption.

What is in store for the world now with respect to WannaCry? Are we going to see a different infection strategy, will the binaries be custom-packed, will strings be encrypted? Or will the attack lie low for a while? We’ll be monitoring the twists and turns in the WannaCry saga over time, and will publish new information as and when required.

K7 Threat Control Lab

If you wish to subscribe to our blog, please add the URL provided below to your blog reader:

April 6th, 2017

We at K7 Threat Control Lab recently encountered an incident reiterating the power of social engineering to trick smartphone users to install bad stuff.

The picture above is self-explanatory. It is clearly a fake message, but it is more convincing since it displays the device make and the current WiFi SSID of the victim, and even uses Google colours and identifiers.

This scareware message attempts to coerce the user to “download the latest Antivirus App”. It is likely from the message “0 minutes and 00 seconds” that upon clicking on the link “REMOVE VIRUS NOW”  user will be redirected to download some dangerous app either from a third party market or even from Google Play Store. The download was never attempted but the app may well have been a deceptor which would claim to have discovered all manner of issues with the device, the fixing of which would require payment.

This fake message may well be generated from the Mi4i device itself (place of manufacture also plays a role in the device’s integrity) or from the WiFi router to which the device was connected at the time.

These kinds of specially crafted user-specific messages exploit the user’s fear factor to force them to download the app recommended in the message, thus compromising their devices themselves.

To avoid any such unwanted circumstances we recommend the smartphone users to:

  • Carefully analyse the messages or alerts which they receive before taking any action. Ignore irrelevant messages
  • Not install apps recommended by strangers
  • Use a top-rated mobile security product such as K7 Mobile Security to block any infection
  • Regularly update the mobile OS and security application installed to be free from mobile malware

K7 Threat Control Lab

If you wish to subscribe to our blog, please add the URL provided below to your blog reader:

October 21st, 2016

The sensational, massive theft of critical data from Indian debit card holders, and the subsequent abuse of card data in China and USA, have been widely reported in the Indian media.


Unfortunately the information available seems to be largely based on hearsay and conjecture, some of it even contradictory. The following Donald Rumsfeld (ex-United States Secretary of Defense) quote from February, 2012 comes to mind:

“Reports that say that something <redacted for effect> happened are always interesting to me, because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don’t know we don’t know.”

We may use the above quote to analyse the facts or lack thereof:

  • Known knowns – The critical details of lots of cards (32 lakh may be a paranoid extrapolation of the real figures) have been potentially compromised, many of which have been abused in China and USA
  • Known unknowns –  How exactly was the data stolen? Was there really ATM malware or some skimming device? Or was there a breach on the backend ATM infrastructure either via malware or via direct database hacking? How was the stolen data relayed back to the cyber criminals?
  • Unknown unknowns – Given the nature of this breach, what other parts of the ATM and banking networked infrastructure are vulnerable to attack? What will those scary headlines read in the future?

We are still in the hunt for real technical detail relevant to this particular breach. Malware samples or hashes would be very useful.

ATM and Point of Sale (PoS) malware are not a recent phenomenon. ATMs can be considered to be computers with some customised hardware, e.g. card reader, attached. They tend to:

  • run Windows XP as the OS hosting the ATM services
  • have no Anti-Virus software installed
  • perhaps employ inadequate encryption mechanisms to prevent the leakage of transaction data

Obviously these factors are not conducive to the maintenance of data security on ATM networks. Windows XP is known to be vulnerable and has been unsupported by Microsoft since 2014! Regardless of the true nature of the current breach it seems clear that the banking industry does need to take ATM security more seriously than employing security guards outside terminals who may doze, if even present, or worse. A good place to start would be to address the vulnerabilities highlighted above, i.e.:

  1. Upgrade the host OS to a more secure, light-weight one, and ensure that it is adequately patched
  2. Install customised Anti-Virus software with slim, relevant security updates
  3. Employ industry-standard encryption (AES/RSA/ECDH, etc.) across critical data transfer channels and storage areas
  4. Get the whole infrastructure vetted by competent third-party agencies through black-box (vulnerability assessment, pen testing, etc.), and white-box (code review) mechanisms

We shall keenly monitor developments in this case, especially if samples are forthcoming.

Image by Karl Hilzinger courtesy of:

Samir Mody

If you wish to subscribe to our blog, please add the URL provided below to your blog reader:

September 30th, 2016

Continuing our series on Cyber Security, this blog post aims to shed some light on a security term that is casually thrown around these days, Denial-of-Service.

As the term conveys a “Denial-of- Service” (DoS) attack aims to cut off the provision of a service. When we speak of it in terms of computing we would generally refer to an online network-based service that is renderred inaccessible to legitimate users during the course of the attack. A successful DoS attack would require a large number of requests being sent to the network service at a specific point in time.

In general for a seamless network communication to happen a “request-acknowledge” signal is essential, i.e. when a user makes a request to a network service his request would first be acknowledged and then data corresponding to his query would be sent back along with a request for acknowledgement once the data is received. The user then sends an acknowledge signal once the requested data has been received. All this happens in the order of milliseconds hence they are barely noticeable.

Every server that hosts a service would have a maximum request-handling capacity, and when that threshold is exceeded the server or the service becomes unavailable. It is this request limit which is exploited and abused by a DoS attack.

When speaking in terms of malware related DoS, malware authors employ their botnet (a collection of computers infected with silently-running backdoor Trojans) to perform this kind of attack. A botnet controller (aka “Bot Master”) can send out instructions to the entire botnet under his command to target a specific service, typically a web service, to effect a DoS on the target website.

Several DoS attacks have been orchestrated targeting organizations along with ransom demands to call off the attack. In the days of e-commerce and online services it is essentials that business organizations keep their services up and running in order to retain their customer base.

In this series we shall have a look at various flavours of DoS attacks and how they are orchestrated.

Image Courtesy of:

K7 Threat Control Lab

If you wish to subscribe to our blog, please add the URL provided below to your blog reader:

September 12th, 2016

Last week one of our Enterprise customers reported that they had received an email threatening them with a DDos attack on their allegedly vulnerable servers if one bitcoin (about US$600) were not paid to them. Furthermore, to force a greater sense of panic, there was a threat of spreading nasty ransomware on their network.

The extortionary email resembled the following:

It turns out that this so called “Armada Collective” group has made similar ransom demands in the past, and the threat has always turned out to be fake to date. No occurrence of an actual DDos attack has yet been reported by the Enterprise customer who received the aforementioned threat or by any of our other customers.

Of course there are real world examples of DDoS attacks which target businesses but the attackers’ modus operandi is typically different from that described above. Historically many DDoS attacks have taken place without prior warning and without a ransom demand.

If any of our customers or any other businesses receive threatening messages of the form shown above we recommend that you do not panic as there is no proof of an actual attack by these scaremongering cyber criminals disguised as “Armada Collective”. There is certainly no need to pay the ransom demanded. Instead we recommend that you implement adequate boundary-level protection for your servers and network, and assess/pen-test the servers for potential vulnerabilities to be identified and mitigated against ASAP.

Image courtesy of

Samir Mody
K7 Threat Control Lab

If you wish to subscribe to our blog, please add the URL provided below to your blog reader:

September 2nd, 2016

K7 Computing celebrated its 24th anniversary last week with the annual “bay decoration” event, which puts to the test teamwork, camaraderie, creativity and sheer effort, of course. The following collage should give you an idea of how our workspaces were transformed for a day.


K7 Team

If you wish to subscribe to our blog, please add the URL provided below to your blog reader:

August 19th, 2016

This week’s hot news within network security circles is likely to be about the most recent update to the TCP specification which allegedly allows communication channels to be hijacked by a remote attacker. This latest TCP specification has been implemented on Linux systems, but is yet to be on Windows, apparently.

This is essentially an information disclosure flaw. The latest TCP specification may leak information about established, active connections through a side channel. The researchers who discovered the flaw claim it could allow a hacker to insert malicious or unwanted data packets into a data packet series between any two arbitrary machines whose IPs are known. Interestingly this Man-in-the-Middle type scenario would not require the attacker to insert himself/herself on the same communication channel as the connected target machines.

How serious is this flaw to a typical end user, though? To attack an end user, a hacker would need to identify a spoofed IP address to pretend to come from a specific source with which the user has already established a connection, and the user’s own target IP address. Hence, the probability that any specific user gets targeted at random is less, the reason being that there is a huge user base of dynamically-allocated IPs. Exploitation of the flaw could be more likely to succeed in IPv4 cases, but with the introduction of IPv6 the probability that an individual user’s IP would be found at random is small, both in the case of mobile devices and desktop computers.

Given the nature of an attempted attack perhaps this flaw will be more worrisome to web servers, etc., which are required to be ON all the time, and more likely to have predictable IPs.

As for the malware injection claim, it seems less likely that a malware payload by itself would be sent within a data packet. Rather, it could be a malicious URL that redirects the user to download the malware.

Installing a reputed and updated security product like K7 Total Security should block any malicious URLs being accessed or malicious files from being downloaded onto a victim’s computer.

Image courtesy:

Samir Mody, K7 Threat Control Lab
V.Dhanalakshmi, K7 Threat Control Lab

If you wish to subscribe to our blog, please add the URL provided below to your blog reader:

August 11th, 2016

Shattering the period of calm after the discovery of Android Stagefright exploit, Android Quadrooter has become the current hot topic in the mobile security industry. Quadrooter, as its name suggests, is a group of four vulnerabilities in the software drivers for Qualcomm chipsets within certain Android devices.  These drivers are responsible for communication between chipset components in the Android packages developed by the manufacturer.

Exploiting any one of these four vulnerabilities in the drivers would provide a hacker with root access on the device. Unlike Stagefright, which was exploitable via remotely sent crafted messages, these Quadrooter vulnerabilities are apparently exploitable only through apps which must be explicitly downloaded and installed by the user.  Although this is may be considered another dangerous method that hackers can incorporate into their malware to attain root permissions, at the time of writing, not a single actual sample has been found in the wild.

Patching the vulnerable software drivers with appropriate security updates would be the most suitable solution to mitigate the risk caused by these vulnerabilities. However it is a never ending debate whether a security update from Google (or Qualcomm, etc.,) can be customized to suit a handset manufacturer’s model within a reasonable time frame. In fact how quickly does a manufacturer’s customized security update reach its own users’ devices? “ .

The  good news is that Google claims that these exploits can be blocked by the “Verify Apps” feature in the Android OS from version 4.2 (Jelly Bean). Locate this feature at:

Settings>System>Security>Verify Apps

Here are a few steps to follow to help avoid dangerous security issues when downloading an application and other unwanted scenarios:

  • Always prefer to download an application from the official Google Play
  • Think twice before you download an application whether you really need it
  • Check any documented usage of the application to ensure that it does not perform any functionality separate from your expectations
  • Verify the reputation of the application by checking the reviews available
  • Avoid using free Wi-Fi hotspots, in particular those that are not password protected
  • Install a reputed and up-to-date mobile security product like “K7 Mobile Security”
  • Avail of the available application verification features like “verify apps” in recent Android OSs to identify a malware before installation.

Senior Threat Researcher, K7TCL

If you wish to subscribe to our blog, please add the URL provided below to your blog reader:

July 13th, 2016

Ransomware, a nasty and, unfortunately, common subclass of malware, are really bad news. The good news, however, is that K7′s heuristic, dynamic behaviour-based anti-ransomware feature, Ransomware Protection, was “productionised” and released some time ago. We strongly believe Ransomware Protection will provide users with robust safeguards against various strains of crypto ransomware, from the past (e.g. CryptoLocker), the present (e.g. Locky) and the future (???).

Ransomware Protection_cropped.png

Ransomware Protection’s blocking logic is based on recognising and arresting fundamental changes that take place in targeted files when the ransomware’s industry-grade encryption algorithms are applied to them.

At the Virus Bulletin 2015 international security conference we demonstrated a PoC of the anti-ransomware technology in our presentation “Dead and Buried in Their Crypts: Defeating Modern Ransomware”, and explained how the technology works in some detail so that all of us in the security industry could implement an effective strategy against this highly-damaging type of malware.

Elevating a PoC to a full-blown production-level feature is a time-consuming process since many factors related to stability, false positives and performance need to be considered in an end user environment. We are delighted to have been able to develop and release an anti-ransomware jab which will boost end-user resistance to any ransomware attack. Your precious documents, images and videos should now be safe. Note, we still highly recommend that you backup your important files as the spectre of bad sectors developing on your hard drive continues to loom large.

Samir Mody, Senior Manager, K7 Threat Control Lab
Gregory Panakkal, Senior Software Architect, K7 Product Engineering Team

If you wish to subscribe to our blog, please add the URL provided below to your blog reader:

July 8th, 2016

It is possible for even an unintended person to view the personal information you post online, whether from a PC or from a mobile device. Sadly there is a high possibility of ladies being targeted, bullied or harassed. A recent shameful incident reported in the news where a man in Delhi has been arrested for harassing ladies in the region with unsavoury messages or phone calls after viewing their WhatsApp profile pictures.

Enhancements in social networking sites and their applications have attracted a huge user base especially amongst youngsters. As we recommended in our previous blog, online users, ladies  in particular, should be vigilant while posting their personal information like photos, contact details, address, etc., in all social networking forums, even applications that simply connect people around.

Women should also be aware that the information shared online stays forever and is free for public viewing. Reiterating, here are few tips to avoid falling prey to such incidents.

  • Tweak privacy settings in applications carefully to prevent strangers from contacting you
    • WhatsApp > Menu Button > Settings > Account > Privacy
  • Avoid posting your personal pictures online such that anybody can view them
  • Never accept strangers to your contact list
  • Avoid sharing your personal information especially photos, phone numbers, address,etc. online

Image courtesy:

Senior Threat Researcher, K7TCL

If you wish to subscribe to our blog, please add the URL provided below to your blog reader: