Technical intelligence and weaponization dossier for CVE-2017-0145. Documented exploitation across 2 active malware families totaling 4,997 analyzed telemetry samples.
| Vulnerability ID | CVE-2017-0145 |
|---|---|
| Common Name / Bulletin | Microsoft Windows SMBv1 Remote Code Execution (EternalRomance / MS17-010) (MS17-010) |
| CWE Classification | CWE-20: Improper Input Validation in SMBv1 |
| Affected Software & Versions | Microsoft Windows Vista, 7, 8.1, 10, Server 2008, 2012, 2016 |
| Technical Root Cause | Type confusion in SMBv1 handling transaction requests over port 445, enabling arbitrary kernel memory read/write primitives. Exploited in NotPetya and BadRabbit. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 2 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| wannacry | Ransomware Worm | 4,876 | WannaCry (cataloged across security vendors and intelligence agencies as WanaCrypt0r, WCry, WannaCrypt, and Ransom.WannaCry) is an unprecedented global ransomwa... |
| petya | Ransomware | 121 | Petya is one of the most historically destructive malware architectures ever deployed. Originally developed in early 2016 as a commercial ransomware strain by a... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2017-0145 in enterprise networks:
Suricata SID: 2024297 (ET EXPLOIT EternalRomance/EternalSynergy SMBv1 Exploit Attempt); abnormal SMB Write AndX requests targeting session setup.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →