WannaCry - invoice_greenanimals.pdf.exe

mssecsvc.exe

While getting the Windows 7 client exploited, there was curiosity about whether mssecsvc.exe was present in the Windows 7 machine, and it was actually found in C:\Windows as expected. It seems very similar to the original sample, even though the SHA256 hashes are different. However, they both have the same tasksche.exe resource attached, and a lot of similar strings, like:

1
mssecsvc2.0
2
Microsoft Security Center (2.0) Service
3
%s -m security
4
C:\%s\qeriuwjhrf
5
tasksche.exe
6
CloseHandle
7
CreateFileA
8
CreateProcessA
9
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
10

11
tasksche.exe
12
icacls . /grant Everyone:F /T /C /Q
13
attrib +h .
14
WNcry@2ol7
15

16
msg/m_filipino.wnry
17
msg/m_finnish.wnry~
18
msg/m_french.wnry

So this is probably where the sample copies to when the Eternalblue exploit is successful and continues the infection on the new machine.