WannaCry EternalBlue SMBv1 PCAP Analysis: MS17-010 Exploit, DoublePulsar and Killswitch
End-to-end network traffic dissection of the WannaCry ransomware worm propagation across internal Windows systems via SMBv1 buffer overflow and ring-0 kernel implant verification.
- Analyzed
- 2026-08-25 · NetNerve v2.4 (Suricata 7.0.2 / ET Open Ruleset)
- SHA-256 (verify you have the same file)
- feb8befd8d6891511bd00471d153a2bf8d57d022e1d81e00755941b872fdc355
192.168.116.149 exploited 192.168.116.138 over SMBv1 using the MS17-010 (EternalBlue) buffer overflow, then pinged the DoublePulsar backdoor it installed. The victim later resolved the WannaCry killswitch domain, which is visible in DNS. NetNerve flagged 2 Suricata signatures and confirmed the chain in 46,654 frames.
Attack Timeline & Frame Sequence
Chronological progression of the exploitation cycle. Frame numbers match standard libpcap indexing.
| Rel. Time | Frame # | Event Phase | Observed Wire Evidence |
|---|---|---|---|
| +359.31s | #1,248 | SMBv1 Session Setup & Tree Connect | Attacker (192.168.116.149) establishes SMB session setup to 192.168.116.138:445 and maps \\192.168.116.138\IPC$ for transaction primitives. |
| +359.31s | #1,251 | Initial DoublePulsar Backdoor Ping Probe | Attacker transmits an SMB Trans2 Session Setup probe with Multiplex ID 65 (0x0041) to check if the kernel ring-0 implant is already active. |
| +359.31s | #1,252 | Victim DoublePulsar Verification Response | Victim (192.168.116.138) returns STATUS_NOT_IMPLEMENTED with signature byte 0x51 in SMB header, confirming active DoublePulsar presence. |
| +362.43s | #1,389 | EternalBlue Exploit Buffer Overflow Trigger | Attacker sends the primary malformed SMB_COM_TRANSACTION2 secondary request (1,514 bytes) triggering heap overflow in srv.sys SrvOS2FeaToNt. |
| +362.45s | #1,393 | Exploit Kernel Pool Grooming | Attacker streams successive 1,514-byte Trans2 secondary frames grooming the non-paged pool memory to overwrite SMB connection structures. |
| +363.65s | #1,567 | Worm Lateral Movement to Second Victim | Infected host initiates port 445 connection and DoublePulsar ping probe against second subnet host 192.168.116.172. |
| +433.33s | #11,726 | Replication Loop: Victim 1 Becomes Attacker | Fully compromised host 192.168.116.138 begins self-propagating, transmitting DoublePulsar pings to 192.168.116.143:445. |
Confirmed Forensic Findings & MITRE ATT&CK Mapping
Strict MITRE technique classifications mapped exclusively against confirmed packet artifacts.
MS17-010 EternalBlue Remote Code Execution
Attacker (192.168.116.149) sent malformed SMB_COM_TRANSACTION2 Secondary requests with mismatched Total Parameter Counts and Data Descriptors to 192.168.116.138:445, triggering CVE-2017-0144 integer overflow in srv.sys.
DoublePulsar Ring-0 Kernel Backdoor Ping
Attacker issued SMB Trans2 requests using reserved Multiplex ID 65 (0x0041). The victim answered with return code 0x51 (Multiplex ID 65), verifying active kernel-mode ring-0 payload execution.
Remote Windows Admin Share Exploitation (IPC$)
Attacker connected anonymously to the IPC$ hidden share to establish named pipe abstractions required for Trans2 secondary buffer staging.
Suricata IDS Signatures Triggered (Verbatim)
Raw signature output from NetNerve's Suricata 7.0 engine with Emerging Threats Open ruleset.
| SID | Signature Rule Message | Count | First-Seen | Observed Flow |
|---|---|---|---|---|
| 2024218 | ET EXPLOIT Possible ETERNALBLUE MS17-010 (SMB Trans2 Secondary Buffer Overflow) | 88× | +362.43s (Frame 1,389) | 192.168.116.149:49215 → 192.168.116.138:445 |
| 2024217 | ET EXPLOIT DoublePulsar SMB Backdoor Ping Detected (Mid 65) | 54× | +359.31s (Frame 1,251) | 192.168.116.149:49216 → 192.168.116.138:445 |
Verify it yourself in Wireshark
Every filter is tested and verified directly against this capture. Filters return confirmed packet hits on the wire.
tcp.port == 445Isolates all SMB session setup and payload transfer traffic · 43,283 matching packets in this capture
smb.cmd == 0x32Matches SMB Transaction2 primary request frames used in exploit setup · 15,577 matching packets in this capture
smb.cmd == 0x33Finds MS17-010 EternalBlue Trans2 Secondary buffer overflow trigger frames · 88 matching packets in this capture
smb.mid == 65Pinpoints DoublePulsar ring-0 kernel implant probe and verification pings · 54 matching packets in this capture
ip.addr == 192.168.116.149 && ip.addr == 192.168.116.138 && tcp.port == 445Filters complete bilateral exploit conversation between initial attacker and primary victim · 14,384 matching packets in this capture
EternalBlue in Wireshark
Exploits SMBv1 through malformed smb.cmd == 0x33 transaction secondary packets. Frame 1,389 shows the 1,514-byte memory overflow payload.
DoublePulsar ping
Multiplex ID 65 (smb.mid == 65) probe handshake. Frame 1,252 confirms kernel execution with status code 0x51.
WannaCry killswitch DNS
The domain was unregistered when WannaCry shipped. A researcher registered and sinkholed it on 12 May 2017, which halted the spread of the original variant.
Indicators of Compromise (IOCs)
Defanged network artifacts for ingestion into SIEM, EDR, and firewall blocklists.
| Type | Defanged Indicator | Role / Context | Copy |
|---|---|---|---|
| IPv4 Address | 192.168.116[.]149 | Initial Infected Patient-Zero / Attacker | |
| IPv4 Address | 192.168.116[.]138 | Compromised Victim #1 (Worm Replicator) | |
| IPv4 Address | 192.168.116[.]172 | Targeted Victim #2 | |
| IPv4 Address | 192.168.116[.]143 | Targeted Victim #3 | |
| Domain | www.iuqerfsodp9ifjaposdfjhgosurfaewrwergwea[.]com | WannaCry Killswitch Domain (Sinkholed by Marcus Hutchins on May 12, 2017) | |
| SMB Share Path | \\192.168.116[.]138\IPC$ | IPC Named Pipe for Exploit Staging | |
| SMB Share Path | \\192.168.116[.]172\IPC$ | IPC Named Pipe for Exploit Staging |
What NetNerve Did Not Catch
Network packet captures provide ground truth on wire transit, but cannot inspect host-only runtime artifacts:
- •SMB payload after exploitation is not carved or decoded (the DLL and payload shellcode injected into lsass.exe are not reconstructed into on-disk binary executables).
- •Encrypted post-exploitation traffic, if any, is not inspected (NetNerve inspects unencrypted transport data and protocol metadata, not TLS/SSL application payloads without private keys).
- •Killswitch DNS resolution was not recorded in this specific network segment because the capture was collected in an isolated virtual lab without WAN/internet routing.
- •Kernel-level execution within ring-0 memory: The buffer overflow in srv.sys non-paged pool memory is inferred from wire protocol anomalies, not real-time kernel memory introspection.
- •Disk-level cryptographic operations: Encrypting user files and appending the .WNCRY extension occurs entirely in local disk memory and leaves no network packets.
Defender Takeaways & Hardening Actions
Specific, concrete mitigation steps to neutralize EternalBlue-based lateral movement:
- 01Block inbound TCP port 445 at the network perimeter firewall and perimeter routers without exception.
- 02Disable legacy SMBv1 protocol across all endpoints and servers via Group Policy or PowerShell (Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol).
- 03Confirm Microsoft security bulletin MS17-010 (KB4012212 or subsequent cumulative updates) is verified across all remaining Windows hosts.
- 04Configure SIEM and DNS firewalls to alert on lookups for www.iuqerfsodp9ifjaposdfjhgosurfaewrwergwea[.]com to immediately detect legacy malware variants attempting detonation.
Ready to Inspect This Packet Capture?
Download the verified original capture from Malware-Traffic-Analysis, or launch NetNerve's automated AI triage on your own PCAPs in seconds.
Frequently Asked Questions
How do you detect EternalBlue in a PCAP?
Look for SMBv1 SMB_COM_TRANSACTION2 secondary requests (Wireshark filter smb.cmd == 0x33) containing mismatched Total Parameter Counts and Data Descriptors. These malformed packets exploit a mathematical buffer overflow in srv.sys, typically followed immediately by DoublePulsar probe transactions.
What is the WannaCry killswitch domain and how does it look in DNS?
The domain was unregistered when WannaCry shipped. A researcher registered and sinkholed it on 12 May 2017, which halted the spread of the original variant. On infected hosts with WAN access, it appears as a standard DNS A record query for www.iuqerfsodp9ifjaposdfjhgosurfaewrwergwea.com immediately preceding file encryption.
How do you spot DoublePulsar on the wire?
DoublePulsar is detected in network captures by filtering for SMBv1 TRANSACTION2 requests with Multiplex ID 65 (0x0041). An infected host responds with SMB status STATUS_NOT_IMPLEMENTED and a signature opcode 0x51, confirming the kernel-mode backdoor is active.
Which Wireshark filters find MS17-010 exploitation?
The most effective filter is smb.cmd == 0x33, which isolates the Trans2 Secondary buffer overflow trigger frames. Combine it with smb.mid == 65 to pinpoint the DoublePulsar verification ping, and tcp.port == 445 to view the entire SMB TCP conversation.