← Reports Ransomware · Ransomworm · Worm WannaCry - invoice_greenanimals.pdf.exe Author Moise Medici Updated 15 Feb 2026 · Completed Difficulty Medium Platform Windows Family WannaCryptor Languages C++ MITRE T1047 (Windows Management Instrumentation) T1059.003 (Command and Scripting Interpreter: Windows Command Shell) T1059.005 (Command and Scripting Interpreter: Visual Basic) T1569.002 (System Services: Service Execution) T1543.003 (Create or Modify System Process: Windows Service) T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) T1027.007 (Obfuscated Files or Information: Dynamic API Resolution) T1027.009 (Obfuscated Files or Information: Embedded Payloads) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1036.004 (Masquerading: Masquerade Task or Service) T1036.005 (Masquerading: Match Legitimate Resource Name or Location) T1036.007 (Masquerading: Double File Extension) T1070.004 (Indicator Removal: File Deletion) T1140 (Deobfuscate/Decode Files or Information) T1480 (Execution Guardrails) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1620 (Reflective Code Loading) T1222.001 (File and Directory Permissions Modification: Windows Permissions) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1046 (Network Service Discovery) T1083 (File and Directory Discovery) T1680 (Local Storage Discovery) T1210 (Exploitation of Remote Services) T1570 (Lateral Tool Transfer) T1486 (Data Encrypted for Impact) T1490 (Inhibit System Recovery) T1491.001 (Defacement: Internal Defacement) Appendix 1 ↩ MalwareLearn: Load Resources 2 ↩ Microsoft: icacls 3 ↩ Microsoft: attrib 4 ↩ Microsoft: Interprocess Communication 5 ↩ Microsoft: GetTempPathW function 6 ↩ Microsoft: GetWindowsDirectoryW function 7 ↩ Microsoft: GetLogicalDrives function 8 ↩ Microsoft: FindFirstFileW function 9 ↩ Microsoft: LoadLibrary function 10 ↩ x86 and amd64 instruction reference: MOVS/MOVSB/MOVSW/MOVSD/MOVSQ - Move Data From String to String 11 ↩ Microsoft: InternetOpenUrlA function 12 ↩ Microsoft: sprintf function 13 ↩ Microsoft: CreateProcess function 14 ↩ Microsoft: GetProcAddress function 15 ↩ Microsoft: CreateFile function 16 ↩ Microsoft: EnterCriticalSection function 17 ↩ Microsoft: ReadFile function 18 ↩ Microsoft: CryptDecrypt function 19 ↩ Microsoft: memcpy function 20 ↩ Wikipedia: Rijndael S-box 21 ↩ Github: Christophe Devine AES Implementation 22 ↩ Microsoft: GlobalAlloc function 23 ↩ Microsoft: GetFileAttributes function 24 ↩ Microsoft: GetCurrentDirectoryA function 25 ↩ Microsoft: WaitForSingleObject function 26 ↩ Microsoft: GetModuleFileName function 27 ↩ Microsoft: SetCurrentDirectory function 28 ↩ Microsoft: GetUserNameW function 29 ↩ Microsoft: Well-known SIDs 30 ↩ Microsoft: GetCurrentProcess function 31 ↩ Microsoft: GetTokenInformation function 32 ↩ Microsoft: ConvertSidToStringSid function 33 ↩ Microsoft: InitializeCriticalSection function 34 ↩ Microsoft: DeleteCriticalSection function 35 ↩ Microsoft: CryptGenRandom function 36 ↩ Microsoft: CryptReleaseContext function 37 ↩ Filedesc.com: Details of extension .pky 38 ↩ Microsoft: GetDriveTypeW function 39 ↩ Microsoft: GetTempPath function 40 ↩ Microsoft: WIN32_FIND_DATA structure 41 ↩ Microsoft: File attributes constants 42 ↩ Microsoft: GetTempFileNameW function 43 ↩ SentinelOne: EternalBlue Exploit: What It Is And How It Works 44 ↩ Microsoft: 2.2.2.1 SMB_COM Command Codes Section 28 of 28: Appendix ← Full Import Address Table