Ransomware · Ransomworm · Worm
WannaCry - invoice_greenanimals.pdf.exe
- Author
- Moise Medici
- Updated
- 15 Feb 2026 · Completed
- Difficulty
- Medium
- Platform
- Family
- Languages
- MITRE
MITRE ATT&CK
Execution
Windows Management Instrumentation
A
cmd.exe /c chain started under tasksche.exe runs wmic shadowcopy delete, using WMI to remove volume shadow copies in case the preceding vssadmin deletion fails.Command and Scripting Interpreter: Windows Command Shell
tasksche.exe spawns cmd.exe /c for the shadow copy, boot recovery and reg add commands, and kbdlv.dll writes a randomly named batch file such as 122221764070810.bat and starts it with CreateProcessA.Command and Scripting Interpreter: Visual Basic
The batch file echoes a VBScript into
m.vbs that calls WScript.Shell CreateShortcut to build @WanaDecryptor@.exe.lnk, then runs it with cscript.exe //nologo m.vbs.System Services: Service Execution
The
pafhcsxxsfdrw600 service runs cmd.exe /c "C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe" through the service control manager, and the mssecsvc2.0 service starts the sample with -m security, which hands control to StartServiceCtrlDispatcherA.Persistence
Create or Modify System Process: Windows Service
The sample creates two auto-start LocalSystem services with
CreateServiceA: mssecsvc2.0, which reruns the sample with -m security, and pafhcsxxsfdrw600, which launches C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe.Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
tasksche.exe runs reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pafhcsxxsfdrw600" so that C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe starts at every logon (Regshot shows the value under WOW6432Node).Stealth
Obfuscated Files or Information: Dynamic API Resolution
The dropper fetches
CreateProcessA and WriteFile with GetProcAddress and calls them through stored pointers, and tasksche.exe and kbdlv.dll resolve their file and Crypt* APIs the same way at runtime.Obfuscated Files or Information: Embedded Payloads
The dropper carries
tasksche.exe as a resource filling 94.5% of the file, plus two PE blobs in its data (one is launcher.dll), and tasksche.exe in turn embeds its .wnry payloads as an XIA resource.Obfuscated Files or Information: Encrypted/Encoded File
tasksche.exe keeps its payload set in a password-protected ZIP resource, and t.wnry stores kbdlv.dll encrypted behind a WANACRY! header followed by a 256-byte encrypted key block.Masquerading: Masquerade Task or Service
The
mssecsvc2.0 service uses the display name Microsoft Security Center (2.0) Service, so the sample, running as a service with -m security, passes for a Windows security component.Masquerading: Match Legitimate Resource Name or Location
The sample’s version resource copies the
lhdfrgui.exe internal and original file names and the Microsoft® Disk Defragmenter description from the genuine C:\Windows\system32\lhdfrgui.exe, posing as the Windows defragmenter.Masquerading: Double File Extension
The sample is named
invoice_greenanimals.pdf.exe, so on systems that hide known extensions it appears as a PDF invoice while actually being a Windows executable.Indicator Removal: File Deletion
The batch file written by
kbdlv.dll ends with del m.vbs and del /a %0, removing the VBScript and the batch file itself once the @WanaDecryptor@.exe.lnk shortcut exists.Deobfuscate/Decode Files or Information
tasksche.exe passes WNcry@2ol7 to load_resources to extract its ZIP resource, then decrypts t.wnry with CryptDecrypt and an embedded AES routine into a GlobalAlloc buffer that holds kbdlv.dll.Execution Guardrails
kill_switch_check (FUN_00408140) calls InternetOpenUrlA on http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com and exits if it gets an answer; only a failed connection leads to service_open and the rest of the infection.Hide Artifacts: Hidden Files and Directories
tasksche.exe runs attrib +h . on its working directory, and kbdlv.dll creates a $RECYCLE folder on non-system drives and hides it with attrib +h +s.Reflective Code Loading
kbdlv.dll is never written to disk: tasksche.exe decrypts it from t.wnry into a GlobalAlloc buffer, locates its TaskStart export with its own FUN_00402924 instead of GetProcAddress, and calls it.Defense Impairment
File and Directory Permissions Modification: Windows Permissions
tasksche.exe runs icacls . /grant Everyone:F /T /C /Q, giving Everyone full control over its working directory and everything below it, recursively and without stopping on errors.Discovery
System Network Configuration Discovery
The dropper imports
GetAdaptersInfo and GetPerAdapterInfo from iphlpapi.dll, which capa flags as network configuration discovery, and in the dynamic run it targets internal addresses alongside external ones.System Owner/User Discovery
running_as_admin (FUN_100012d0) in kbdlv.dll compares GetUserNameW with SYSTEM, or the token SID from GetTokenInformation and ConvertSidToStringSidW with S-1-5-18, to learn whether it runs as LocalSystem.Network Service Discovery
Once the kill-switch request fails, the sample sends TCP SYN packets to port 445 on about 3,000 internal and public IP addresses within an hour, looking for hosts with SMB open.
File and Directory Discovery
kbdlv.dll walks each drive with FindFirstFileW and FindNextFileW, skips folders such as \WINDOWS and \Program Files, and sorts files by extension in file_ext_identifier to pick encryption targets.Local Storage Discovery
kbdlv.dll enumerates volumes with GetLogicalDrives, starting a thread per drive and using GetDriveTypeW to skip CD-ROMs, and taskdl.exe walks the same drives looking for *.WNCRYT files.Lateral Movement
Exploitation of Remote Services
In the Windows 7 test the sample exploits SMBv1 with EternalBlue: an
NT_TRANSACT request (packet 257) is followed by a run of TRANSACTION2_SECONDARY requests that trigger the FEA list overflow.Lateral Tool Transfer
After the exploit,
mssecsvc.exe appears in C:\Windows on the Windows 7 host, carrying the same tasksche.exe resource and mssecsvc2.0 strings as the original sample.Impact
Data Encrypted for Impact
kbdlv.dll encrypts files whose extensions match its built-in lists using CryptGenKey and CryptEncrypt, renames them to .WNCRY, and leaves @Please_Read_Me@.txt and the @WanaDecryptor@.exe ransom window.Inhibit System Recovery
A
cmd.exe /c chain under tasksche.exe runs vssadmin delete shadows /all /quiet, bcdedit /set {default} recoveryenabled no, bcdedit /set {default} bootstatuspolicy ignoreallfailures and wbadmin delete catalog -quiet.