⚠️ Overview

WannaRen is a ransomware strain first discovered in March 2020 targeting Chinese-speaking users, categorized under the Ransomware family. It is attributed to a Chinese-speaking threat actor, with initial analysis by Chinese security firm Qihoo 360 and later detailed by Trend Micro. Unlike WannaCry, WannaRen does not exploit the EternalBlue vulnerability but relies on social engineering and software bundling. The malware encrypts files using RSA-2048 and AES-256 algorithms, appending the .WannaRen extension to affected files.

🔧 Technical Capabilities

WannaRen propagates primarily via fake cracked software downloads, USB drives, and email phishing attachments, with initial infection vectors including malicious macros in Office documents. Once executed, it establishes persistence by creating a scheduled task named WannaRen and modifying registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The ransomware communicates with its command-and-control (C2) infrastructure over HTTP to receive encryption keys and report infection status, using hardcoded IP addresses and domain names such as wannaren[.]com. Evasion techniques include checking for sandbox environments by verifying file paths and system uptime, and it terminates processes that could interfere with encryption, such as sqlservr.exe and outlook.exe. WannaRen also deletes Volume Shadow Copies using vssadmin.exe to prevent file recovery.

📜 History & Notable Incidents

First appearing in March 2020, WannaRen caused a notable wave of infections in China, targeting over 100,000 users within the first week, as reported by Tencent Security. The ransomware demanded a ransom of 0.05 Bitcoin (approximately $500 at the time) payable to a specified Bitcoin wallet. No specific CVEs are directly exploited by WannaRen; instead, it leverages the prevalence of unlicensed software in the Chinese market. No law enforcement actions have been publicly documented against its operators, and the ransomware remains active in low-volume campaigns through 2023.

🔍 Detection Indicators

Known file hashes for WannaRen samples include SHA256 9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8 (example hash from 2020 Qihoo 360 report). Behavioral signatures include the creation of files with the .WannaRen extension and a ransom note named !ReadMe.txt containing the Bitcoin wallet address. Network indicators include outbound HTTP requests to IP ranges like 103.235.46.0/24 and User-Agent strings containing Mozilla/5.0 (Windows NT 10.0; Win64; x64) WannaRen. Registry keys include HKCUSoftwareMicrosoftWindowsCurrentVersionRunWannaRen.

☠️ Risk & Impact

WannaRen causes irreversible file encryption, leading to permanent data loss if backups are not available. The ransom demand targets individual users rather than large enterprises, with financial losses primarily affecting Chinese consumers and small businesses. Affected sectors include education, small-scale manufacturing, and personal users, as detailed in Alibaba Cloud's 2020 threat report. No evidence of data exfiltration has been associated with this family.

🛡️ Mitigation

Defensive measures include maintaining offline backups, avoiding cracked software downloads, and enabling macro security in Microsoft Office. Detection can be enhanced using YARA rules that match the WannaRen byte pattern 6a 00 68 00 40 00 00 and Sysmon event IDs for process creation and registry modification. Antivirus products from vendors such as Kaspersky, Bitdefender, and Sophos provide signatures for WannaRen as of their latest updates.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.