WannaCry - invoice_greenanimals.pdf.exe

Executive Summary

A sample of the WannaCry ransomware was analyzed in a controlled environment. The malware exhibits typical traits of the WannaCry family, including encryption of user files, destruction of backups, and propagation via SMB once it detects that the kill-switch infrastructure is unreachable.
The executable lies dormant if it can resolve a specific hardcoded domain. Otherwise, it initiates file encryption, disables recovery options, and attempts to move laterally within the network using SMB-based exploitation.
Persistence is achieved through Windows service creation and registry modifications. While inactive under standard network conditions, its behavior changes significantly when isolated from the internet, highlighting its reliance on an external kill switch as a form of control flow.

Impact

• File loss through encryption
• Backup deletion via system tools
• Internal network scanning and spreading
• Stealth via service disguise and anti-debugging