← Reports

Ransomware · Ransomworm · Worm

WannaCry - invoice_greenanimals.pdf.exe

Author
Moise Medici
Updated
15 Feb 2026 · Completed
Difficulty
Medium
Platform
Windows
Capabilities
Command and Control C2 CommunicationCommand Execution via Powershell Cmd BashFile EncryptionPersistence Mechanisms
Tags
C++WannaCryptor

Question 15

A quick analysis on them is feasible given they are relatively small in size. Starting with taskse.exe:

With pestudio, the landing page shows that it is a C++ executable that has been compiled on Tue Jul 14 00:12:07 2009 UTC. It has a very short list of imports:

  • GetTempPathW
  • GetWindowsDirectoryW
  • DeleteFileW
  • FindClose
  • FindNextFileW
  • FindFirstFileW
  • Sleep
  • GetDriveTypeW
  • GetLogicalDrives
  • GetModuleHandleA
  • GetStartupInfoA

From these APIs, it appears that it will look for the %TEMP% directory (GetTempPathW 5 ), the C:\Windows directory (GetWindowsDirectoryW 6 ), attached drives (GetLogicalDrives 7 ), look through the files (FindFirstFileW 8 and FindNextFileW), and potentially delete them.

For example, in Procmon, filtering by “ProcessID equals 5500” shows some access to the CD drive, D drive, and the C:\Windows\Temp directory.

Procmon filtered on PID 5500, where taskdl.exe walks D:\, the CD-ROM device and C:\Windows\Temp looking for *.WNCRYT files.
Fig. 11: Procmon filtered on PID 5500, where taskdl.exe walks D:\, the CD-ROM device and C:\Windows\Temp looking for *.WNCRYT files.

taskse.exe seems even more restricted in terms of activities:

  • WaitForSingleObject
  • GetProcAddress
  • LoadLibraryA
  • GetModuleHandleA
  • Sleep
  • GetStartupInfoA

The LoadLibrary 9 call is notable as it allows DLLs to be imported. However, with Procmon there is not much visible activity other than starting the @WanaDecryptor@.exe process.