Free Preparation Discussions
MENU
Eccouncil ICS-SCADA Exam - Topic 1 Question 36 Discussion
Topic #: 1
What share does the WannaCry ransomware use to connect with the target?
The WannaCry ransomware utilizes the $IPC (Inter-Process Communication) share to connect with and infect target machines. This hidden network share supports the operation of named pipes, which facilitates the communication necessary for WannaCry to execute its payload across networks. Reference:
CISA Analysis Report, 'WannaCry Ransomware'.
WannaCry ransomware uses the SMB (Server Message Block) protocol to propagate through networks and connect to target systems. Specifically, it exploits a vulnerability in SMBv1, known as EternalBlue (MS17-010).
IPC Share: The $IPC (Inter-Process Communication) share is a hidden administrative share used for inter-process communication. WannaCry uses this share to gain access to other machines on the network.
SMB Exploitation: By exploiting the SMB vulnerability, WannaCry can establish a connection to the $IPC share, allowing it to execute the payload on the target machine.
Propagation: Once connected, it deploys the DoublePulsar backdoor and then spreads the ransomware payload.
Given these details, the correct answer is $IPC.
Reference
'WannaCry Ransomware Attack,' Wikipedia, WannaCry.
'MS17-010: Security Update for Windows SMB Server,' Microsoft, MS17-010.
Bong
3 months agoRobt
3 months agoSerita
3 months agoRosamond
3 months agoMona
4 months agoDomitila
4 months agoMammie
4 months agoTy
4 months agoLonny
5 months agoFelicitas
5 months agoSharen
5 months agoLyla
5 months agoLorrine
5 months agoWilliam
6 months agoSantos
6 months agoEric
6 months agoJunita
6 months agoNicolette
6 months agoLourdes
6 months agoEden
7 months agoBritt
7 months agoCarmela
7 months agoShayne
8 months agoRashad
8 months agoDarrel
8 months agoCaitlin
2 months agoCarli
2 months agoKerry
3 months agoDelfina
7 months agoYolande
7 months ago