Technical intelligence and weaponization dossier for CVE-2017-0144. Documented exploitation across 8 active malware families totaling 6,283 analyzed telemetry samples.
| Vulnerability ID | CVE-2017-0144 |
|---|---|
| Common Name / Bulletin | Microsoft Windows SMBv1 Remote Code Execution (EternalBlue / MS17-010) (MS17-010) |
| CWE Classification | CWE-119: Buffer Overflow in SMBv1 Driver (srv.sys) |
| Affected Software & Versions | Microsoft Windows XP, Vista, 7, 8.1, 10, Server 2003, 2008, 2012, 2016 |
| Technical Root Cause | Mathematical error in SMBv1 buffer length calculation when handling SrvOs2FeaListSizeToNt in srv.sys. Shadow Brokers leak, weaponized in WannaCry and NotPetya global pandemics. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 8 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| wannacry | Ransomware Worm | 4,876 | WannaCry (cataloged across security vendors and intelligence agencies as WanaCrypt0r, WCry, WannaCrypt, and Ransom.WannaCry) is an unprecedented global ransomwa... |
| trickbot | Trojan | 466 | TrickBot (often dubbed Trickloader or Totep) is one of the most prolific and dangerous modular trojans and enterprise access vectors in modern cybercrime histor... |
| maener | Cryptominer | 387 | Maener (cataloged by security vendors as Trojan:Win32/Maener, Trojan.Win32.Maener, Worm:Win32/Maener, and Bindmaener) is a persistent cryptocurrency mining troj... |
| tofsee | Spam Bot | 264 | Tofsee (also widely cataloged as Gheg, Backdoor.Win32.Tofsee, and Spambot.Tofsee) is an extraordinarily resilient and sophisticated multi-purpose modular trojan... |
| bsymem | Ransomware | 144 | Trojan:Win32/Bsymem (cataloged across vendor telemetry as Trojan.Bsymem or Ransom.Bsymem) is a stealthy dual-stage remote access backdoor and enterprise ransomw... |
| petya | Ransomware | 121 | Petya is one of the most historically destructive malware architectures ever deployed. Originally developed in early 2016 as a commercial ransomware strain by a... |
| crysis | Ransomware | 24 | Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emer... |
| killdisk | Wiper | 1 | Trojan:Win32/KillDisk is a catastrophic industrial wiper malware family developed and deployed by Russian military intelligence hackers belonging to the Russian... |
Threat intelligence confirms the following adversaries weaponize CVE-2017-0144 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2017-0144 in enterprise networks:
Snort/Suricata SID: 2024218 (ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response); SMB traffic on port 445 containing NT_TRANSACT_SECONDARY requests with mismatched DataOffset.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →