Ransomware · Ransomworm · Worm

WannaCry - invoice_greenanimals.pdf.exe

Author: Moise Medici
Updated: 15 Feb 2026 · Completed
Difficulty: Medium
Platform: Windows
Family: WannaCryptor
Languages: C++
MITRE: T1047 (Windows Management Instrumentation) T1059.003 (Command and Scripting Interpreter: Windows Command Shell) T1059.005 (Command and Scripting Interpreter: Visual Basic) T1569.002 (System Services: Service Execution) T1543.003 (Create or Modify System Process: Windows Service) T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) T1027.007 (Obfuscated Files or Information: Dynamic API Resolution) T1027.009 (Obfuscated Files or Information: Embedded Payloads) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1036.004 (Masquerading: Masquerade Task or Service) T1036.005 (Masquerading: Match Legitimate Resource Name or Location) T1036.007 (Masquerading: Double File Extension) T1070.004 (Indicator Removal: File Deletion) T1140 (Deobfuscate/Decode Files or Information) T1480 (Execution Guardrails) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1620 (Reflective Code Loading) T1222.001 (File and Directory Permissions Modification: Windows Permissions) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1046 (Network Service Discovery) T1083 (File and Directory Discovery) T1680 (Local Storage Discovery) T1210 (Exploitation of Remote Services) T1570 (Lateral Tool Transfer) T1486 (Data Encrypted for Impact) T1490 (Inhibit System Recovery) T1491.001 (Defacement: Internal Defacement)

Question 18

The first time the machine was infected, the content of f.wnry was a list of .rtf files previously containing the VSCode license. After restoring a snapshot and reinfecting the system the content is:

1
C:\Users\REM\Desktop\Malware\Day6\officeDocs\edit1-invoice.zip.WNCRY
2
C:\Users\REM\AppData\Local\Programs\Python\Python39\Tools\pynche\webcolors.txt.WNCRY
3
C:\Users\REM\Pictures\REM_Desktop-1.jpg.WNCRY
4
C:\$Recycle.Bin\S-1-5-21-1866265027-1870850910-1579135973-1000\$R4ITUGO\VMware Tools\vm-support.vbs.WNCRY
5
C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRY
6
C:\Users\REM\.vscode\extensions\ms-vscode.powershell-2023.1.0\examples\PathProcessingNoWildcards.ps1.WNCRY
7
C:\Users\REM\.vscode\extensions\ms-vscode.powershell-2023.1.0\modules\PowerShellEditorServices\Start-EditorServices.ps1.WNCRY
8
C:\Users\REM\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\base\worker\workerMain.js.WNCRY
9
C:\Users\REM\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\output\common\outputLinkComputer.js.WNCRY
10
C:\Users\REM\AppData\Local\Programs\Python\Python39\include\ceval.h.WNCRY

In fact, they are. The Decryptor UI allows decrypting some files as “proof” that they can be restored, to make the victim more inclined to pay the ransom.

Fig. 28: The Decrypt dialog listing the files the operators will restore for free as proof that decryption works.