Discuss EC-Council ICS-SCADA Exam Topic 1 Question 36

What share does the WannaCry ransomware use to connect with the target?

A$IPC

B$Admin

C$SPOOL

D$C

Suggested Answer: A

The WannaCry ransomware utilizes the $IPC (Inter-Process Communication) share to connect with and infect target machines. This hidden network share supports the operation of named pipes, which facilitates the communication necessary for WannaCry to execute its payload across networks. Reference:

CISA Analysis Report, 'WannaCry Ransomware'.

WannaCry ransomware uses the SMB (Server Message Block) protocol to propagate through networks and connect to target systems. Specifically, it exploits a vulnerability in SMBv1, known as EternalBlue (MS17-010).

IPC Share: The $IPC (Inter-Process Communication) share is a hidden administrative share used for inter-process communication. WannaCry uses this share to gain access to other machines on the network.

SMB Exploitation: By exploiting the SMB vulnerability, WannaCry can establish a connection to the $IPC share, allowing it to execute the payload on the target machine.

Propagation: Once connected, it deploys the DoublePulsar backdoor and then spreads the ransomware payload.

Given these details, the correct answer is $IPC.

Reference

'WannaCry Ransomware Attack,' Wikipedia, WannaCry.

'MS17-010: Security Update for Windows SMB Server,' Microsoft, MS17-010.

Get Premium ICS-SCADA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

30 comments · newest first

Bong 6 months ago

I feel confident about A) $IPC. It’s well-known in ransomware cases.

Robt 6 months ago

D) $C sounds too generic. I doubt it's that one.

Serita 7 months ago

C) $SPOOL could be a trick option. Not sure though.

Rosamond 7 months ago

I’m leaning towards B) $Admin. Seems like a logical choice.

Mona 7 months ago

I agree, $IPC is commonly used for that.

Domitila 7 months ago

I think it's A) $IPC. It makes sense for network connections.

Mammie 7 months ago

Definitely $C, I read that somewhere.

Ty 7 months ago

Wait, is it really $IPC? That seems too obvious.

Lonny 8 months ago

$SPOOL sounds right to me.

Felicitas 8 months ago

I thought it was $Admin!

Sharen 8 months ago

Ah, the classic ransomware share options. Gotta love the creativity.

Lyla 9 months ago

$SPOOL? Is that what the ransomware uses to print your files hostage notes?

Lorrine 9 months ago

D) $C? What is this, Windows 95?

William 9 months ago

C) $SPOOL? Really? That's just silly.

Santos 9 months ago

B) $Admin would make sense for a ransomware to target.

Eric 9 months ago

I’m leaning towards $IPC as the answer, but I might be mixing it up with another malware. I should have reviewed my notes better!

Junita 9 months ago

I practiced a question about ransomware shares, and I think $SPOOL was mentioned, but I don't remember if it was for WannaCry specifically.

Nicolette 10 months ago

I think WannaCry uses the $IPC share, but I'm not entirely sure. I remember it being a common target in similar questions.

Lourdes 10 months ago

I'm pretty confident the answer is A) $IPC. That's the standard inter-process communication share that a lot of malware uses to connect to remote systems. The other options don't seem as likely for how WannaCry would have spread.

Eden 10 months ago

Okay, let me think this through step-by-step. WannaCry was a worm that spread via the EternalBlue SMB vulnerability, so it would need to connect to a share on the target system. Based on that, I'm guessing the answer is either A) $IPC or D) $C, since those are common administrative shares. I'll have to review my notes to be sure.

Britt 10 months ago

A) $IPC seems like the most likely option for WannaCry to use.

Carmela 10 months ago

It's $IPC for sure.

Shayne 11 months ago

I feel like I studied this, but I can't recall if it was $Admin or $IPC. They both sound familiar in the context of ransomware.

Rashad 11 months ago

Hmm, I'm a bit confused on this one. I know WannaCry used a specific SMB vulnerability, but I can't remember the exact share name it used to spread. I'll have to think this through carefully.

Darrel 11 months ago

I'm pretty sure it's A) $IPC, that's the standard share used for network connections in a lot of malware.

Caitlin 6 months ago

↳ replying to Darrel

$IPC is the standard for sure.

Carli 6 months ago

↳ replying to Darrel

A) $IPC is definitely the right choice.

Kerry 6 months ago

↳ replying to Darrel

Yeah, I've read that before.

Delfina 10 months ago

↳ replying to Darrel

I think it's A) $IPC too. Makes sense.

Yolande 11 months ago

↳ replying to Darrel

Agreed! It's commonly used in attacks.

EC-Council ICS-SCADA Exam - Topic 1 Question 36 Discussion