Windows Server 2008 R2: WannaCry / EternalBlue-Related Crash Case

Case observations

One or more Windows Server 2008 R2 systems intermittently blue-screened and rebooted. The source records:

• Application event 59, source SideBySide: activation-context generation for C:\Windows\tasksche.exe failed because of invalid XML at line 0 of the manifest/policy file.
• System event 1001, source BugCheck, with bugchecks 0x00000050 or 0x0000001e and dump files under C:\Windows.

Probably caused by : Unknown_Image ( srvnet!SrvNetWskReceiveComplete+7d )

The dump could also point to a system component such as ntkrnlmp.exe. The case found mssecsvc.exe, qeriuwjhrf and tasksche.exe under C:\Windows, with related processes visible in Task Manager.

Diagnosis and response

The vendor attributed this incident to WannaCry/EternalBlue-related attack activity. The filenames, events or a srvnet stack frame alone do not prove the diagnosis; correlate them with malware analysis and the affected host’s evidence.

After confirming infection, the source calls for antivirus/remediation and checks of other LAN servers. It notes that cleanup can be difficult and that network attack traffic can continue triggering crashes. Isolate affected hosts and coordinate containment/remediation before restoring service.

Reduce further exposure

• Restrict/block TCP port 445 where SMB access is not required. Consider the effect on legitimate file services.
• Install the update applicable to the host for Microsoft MS17-010 or its applicable superseding update.

MS17-010 fixes SMBv1 vulnerabilities; applying it is not itself malware removal or proof that a compromised host is clean. The original case concerns Windows Server 2008 R2 and should not be read as a complete incident-response procedure.