WannaCry - What is it? How to prevent it?

WannaCry, also known as WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor, wcrypt, is a ransomware program that targets Microsoft Windows software. It's just a normal ransomware that encrypts files for a cash, but what makes is famous is the virus is spreading so fast like a wildfire. It infects over 230,000 computer in 99 countries.

This ransomware uses EternalBlue exploit, which a leaked exploit on Server Message Block feature. This exploit is actually patched in March 2017, but most users don't care about it until this happends. This ransomware demands $300 worth of bitcoin. It also has 23 languages of the message.

A security researcher accidentally triggering a "kill switch" by registering a domain that hardcoded on the malware. The malware actually checks that domain. If the malware failes to connect that domain, it starts to encrypt your files. (eventually the next version has no kill switch)
Microsoft patches the exploit (MS17-010). Microsoft patches all Windows, including the outdated ones, which is unusual.

On this kind-of-article, I will show you the mitigation steps to prevent WannaCry infects your computer.

---------
MITIGATION STEPS:
All steps are important! If you can't do some of this steps, just skip and do the other one! Each step is powerfull!
Most of these steps requires Administrator previleges!

1. Update your Windows

Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, Windows Server 2016
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Windows Server 2003 SP2, Windows XP SP2, Windows XP Embedded SP3, Windows 8,
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

2. Forbid ports

Run this commands on an elevated Command Prompt.
netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=135 name="PreventWannaCry Block_TCP-135"
netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=445 name="PreventWannaCry Block_TCP-445"
netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=139 name="PreventWannaCry Block_TCP-139"
netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=3389 name="PreventWannaCry Block_TCP-3389"

3. Disable SMBv1

Windows 7, Windows Server 2008 R2, Windows Vista, and Windows Server 2008
Method 1
1. Open PowerShell
2. Run this command.
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force
3. Restart your computer

Method 2
1. Open regedit
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry
3. Find SMB1, and modify its value to 0.
4. Close it.
5. Restart your computer

Windows 8 and Windows Server 2012
Run this command on PowerShell.
Set-SmbServerConfiguration -EnableSMB1Protocol $false
No restart needed.

Windows 8.1/Windows Server 2012 R2 and later
Method 1
1. Press Win+R, enter "optionalfeatures", then click Run
2. Untick "SMB1.0/CIFS File Sharing Support" and click OK
3. Restart your computer.

Method 2
Run this command on an elevated Command Prompt.
dism /online /norestart /disable-feature /featurename:SMB1Protocol

Method 3
Run this command on PowerShell.
Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

4. Use an Antivirus. Windows Defender is OK, but it's recommended to install other antivirus.

5. Do backups. Save all your files in a seperated disk. (including online storages, external hard disks, flash drives, CD/DVD's, etc)

----------

Affected file extensions.

.der, .pfx, .key, .crt, .csr, .p12, .pem, .odt, .ott, .sxw, .stw, .uot, .3ds, .max, .3dm, .ods, .ots, .sxc, .stc, .dif, .slk, .wb2, .odp, .otp, .sxd, .std, .uop, .odg, .otg, .sxm, .mml, .lay, .lay6, .asc, .sqlite3, .sqlitedb, .sql, .accdb, .mdb, .dbf, .odb, .frm, .myd, .myi, .ibd, .mdf, .ldf, .sln, .suo, .cpp, .pas, .asm, .cmd, .bat, .ps1, .vbs, .dip, .dch, .sch, .brd, .jsp, .php, .asp, .java, .jar, .class, .mp3, .wav, .swf, .fla, .wmv, .mpg, .vob, .mpeg, .asf, .avi, .mov, .mp4, .3gp, .mkv, .3g2, .flv, .wma, .mid, .m3u, .m4u, .djvu, .svg, .psd, .nef, .tiff, .tif, .cgm, .raw, .gif, .png, .bmp, .jpg, .jpeg, .vcd, .iso, .backup, .zip, .rar, .tgz, .tar, .bak, .tbk, .bz2, .PAQ, .ARC, .aes, .gpg, .vmx, .vmdk, .vdi, .sldm, .sldx, .sti, .sxi, .602, .hwp, .snt, .onetoc2, .dwg, .pdf, .wk1, .wks, .123, .rtf, .csv, .txt, .vsdx, .vsd, .edb, .eml, .msg, .ost, .pst, .potm, .potx, .ppam, .ppsx, .ppsm, .pps, .pot, .pptm, .pptx, .ppt, .xltm, .xltx, .xlc, .xlm, .xlt, .xlw, .xlsb, .xlsm, .xlsx, .xls, .dotx, .dotm, .dot, .docm, .docb, .docx, .doc

The file extensions that the malware is targeting contain certain clusters of formats including:

1. Commonly used office file extensions (.ppt, .doc, .docx, .xlsx, .sxi).
2. Less common and nation-specific office formats (.sxw, .odt, .hwp).
3. Archives, media files (.zip, .rar, .tar, .bz2, .mp4, .mkv)
4. Emails and email databases (.eml, .msg, .ost, .pst, .edb).
5. Database files (.sql, .accdb, .mdb, .dbf, .odb, .myd).
6. Developers’ sourcecode and project files (.php, .java, .cpp, .pas, .asm).
7. Encryption keys and certificates (.key, .pfx, .pem, .p12, .csr, .gpg, .aes).
8. Graphic designers, artists and photographers files (.vsd, .odg, .raw, .nef, .svg, .psd).
9. Virtual machine files (.vmx, .vmdk, .vdi).

----------
References:

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
https://support.microsoft.com/id-id/help/4013389/title
https://support.microsoft.com/id-id/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012
https://www.windows-commandline.com/run-command-windows-features-turn-on-off/
https://stackoverflow.com/questions/43952057/how-to-protect-from-wcrypt-wanna-cry
http://blog.talosintelligence.com/2017/05/wannacry.html
https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/
https://thehackernews.com/2017/05/wannacry-ransomware-cyber-attack.html
https://en.wikipedia.org/wiki/WannaCry_cyber_attack