A massive attack with a cryptor Wana decrypt0r 2.0

At the moment, we can observe a massive attack with a Trojan-decryptor "Wana decrypt0r 2.0"
The attack is observed in different networks completely unrelated between themselves.

A ransomware spreading in the lab at the university ( from here )

Some companies advise their users to turn off their computers and wait for further instructions.

Contacting former colleagues, I was surprised by similar stories.

As for me, today I prepared several new Windows images for our cloud system, among them was Windows Server 2008 R2.

What is most interesting is that when I just installed Windows and set up a static IP address on it, it was immediately infected for several minutes.

All Windows images were obtained from MSDN, the hashes are the same, so the possibility of image infection is excluded.

And this is despite the fact that the firewall configuration for a single network interface looking outward has been configured as a “Public Network”.

Nmap does not find open ports . The nmap output shows that even in this case, some ports are open outside by default:

Host is up (0.017s latency).
Not shown: 997 filtered ports
PORT      STATE SERVICE
135/tcp   open  msrpc
445/tcp   open  microsoft-ds
49154/tcp open  unknown

— Virtio-, Windows CD.
ISO- — Fedora, .

Windows .

, .

:

• Virustotal
• Mmalwr
• WannaCry GitHub
• Wana Decrypt0r 2.0 Pentestit

, :

UPD: , SMBv1.

:

• Microsoft Security Bulletin MS17-010
• , (Windows XP, Winows Server 2003R2)

- , SMBv1. ( Windows 8.1 ):

dism /online /norestart /disable-feature /featurename:SMB1Protocol

UPD2: . :

• , Windows 7 Windows Server 2008 R2, 4012212 4012215
• cmd.exe ( )
• :
  

  wmic qfe list | findstr 4012212

• Enter
• - , :
  

  http://support.microsoft.com/?kbid=4012212 P2 Security Update KB4012212 NT AUTHORITY\ 3/18/2017

• ,
• , UPD9

100% .
, , Windows .

UPD3: :

, . FuzzBunch, Shadow Brokers Equation Group, . .
Microsoft MS 17-010, .
https://github.com/fuzzbunch/fuzzbunch .
DoublePulsar.
, 445 MS 17-010, DoublePulsar
, .

UPD4: :

UPD5: :

UPD6: :

- WannaCrypt , iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com.
, @MalwareTechBlog, , - , .

, , , ; , . , .

- 12 . 300 . 99 , , «», . , , . .
, , Windows, .

UPD7: Microsoft (Windows XP Windows Server 2003R2)

UPD8: 2ch.hk

Shadow brokers
C/Python
Linux

?

Linux
IP
445
SMB , ,
.

UPD9: :

UPD10: killswitch UPD6.

xsash, Inflame, Pulse, nxrighthere, waisberg, forajump, Akr0n, LESHIY_ODESSA, Pentestit, alguryanow .