WannaCry - invoice_greenanimals.pdf.exe

Question 7

Using the same approach as before, searching for the qeriuw string in the Defined Strings window and going to the single address where the string is used, the relevant code is:

1
00407e06     LEA      ECX=>local_104, [ESP + 0x16c]
2
00407e0d     PUSH     s_WINDOWS_00431364                              ; = "WINDOWS"
3
00407e12     PUSH     s_C:\%s\qeriuwjhrf_00431344                     ; char * _Format for sprintf
4
00407e17     PUSH     ECX                                             ; char * _Dest for sprintf
5
00407e18     CALL     ESI=>MSVCRT.DLL::sprintf
6
00407e1a     ADD      ESP, 0xc
7
00407e1d     LEA      EDX=>local_104, [ESP + 0x16c]
8
00407e24     LEA      EAX=>local_208, [ESP + 0x68]
9
00407e28     PUSH     0x1                                             ; DWORD dwFlags for MoveFileExA
10
00407e2a     PUSH     EDX                                             ; LPCSTR lpNewFileName for MoveFileExA
11
00407e2b     PUSH     EAX                                             ; LPCSTR lpExistingFileName for MoveFileExA
12
00407e2c     CALL     dword ptr [->KERNEL32.DLL::MoveFileExA]         ; = 0000a576

The string is pushed on the stack and sprintf is called. From the Microsoft documentation 12, sprintf is used to “write formatted data to a string” and has the following signature:

1
int sprintf(
2
   char *buffer,
3
   const char *format [,
4
   argument] ...
5
);

In this case, the destination where the string is saved is ECX (identified by _Dest, and being the last PUSH before the CALL). Note that ECX contains the address of local_104, as shown by the first instruction in the code snippet.
The string written is C:\Windows\qeriuwjhrf, where Windows is taken from the first PUSH and the rest of the string is from the _Format.

So at this point local_104/ECX contains the Windows path. The next step is to see how it is used.

At instruction 00407e1d, the address of local_104 is moved to EDX, which is then pushed to the stack at 00407e2a and recognized by Ghidra as the target of the MoveFileExA function. The original file is in EAX, which, looking back (00407e24), is retrieved from local_208.

Just before the snippet under discussion, there is the same exact pattern where sprintf is called with local_208 as target:

1
00407dea     PUSH     s_tasksche.exe_0043136c                         ; = "tasksche.exe"
2
00407def     STOSW    ES:EDI
3
00407df1     STOSB    ES:EDI
4
00407df2     PUSH     s_WINDOWS_00431364                              ; = "WINDOWS"
5
00407df7     LEA      EAX=>local_208, [ESP + 0x70]
6
00407dfb     PUSH     s_C:\%s\%s_00431358                             ; char * _Format for sprintf
7
00407e00     PUSH     EAX                                             ; char * _Dest for sprintf
8
00407e01     CALL     ESI=>MSVCRT.DLL::sprintf

The result is that sprintf is called to save in local_208 the string C:\Windows\tasksche.exe, which is already known from earlier observations.

The reason why C:\Windows\qeriuwjhrf was not found on the system is due to the 1 value (MOVEFILE_REPLACE_EXISTING) of the dwFlags set at instruction 00407e28. This only replaces the file if the destination file exists already.