← Reports

Ransomware · Ransomworm · Worm

WannaCry - invoice_greenanimals.pdf.exe

Author
Moise Medici
Updated
15 Feb 2026 · Completed
Difficulty
Medium
Platform
Windows
Family
WannaCryptor
Languages
C++
MITRE
T1047 (Windows Management Instrumentation) T1059.003 (Command and Scripting Interpreter: Windows Command Shell) T1059.005 (Command and Scripting Interpreter: Visual Basic) T1569.002 (System Services: Service Execution) T1543.003 (Create or Modify System Process: Windows Service) T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) T1027.007 (Obfuscated Files or Information: Dynamic API Resolution) T1027.009 (Obfuscated Files or Information: Embedded Payloads) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1036.004 (Masquerading: Masquerade Task or Service) T1036.005 (Masquerading: Match Legitimate Resource Name or Location) T1036.007 (Masquerading: Double File Extension) T1070.004 (Indicator Removal: File Deletion) T1140 (Deobfuscate/Decode Files or Information) T1480 (Execution Guardrails) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1620 (Reflective Code Loading) T1222.001 (File and Directory Permissions Modification: Windows Permissions) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1046 (Network Service Discovery) T1083 (File and Directory Discovery) T1680 (Local Storage Discovery) T1210 (Exploitation of Remote Services) T1570 (Lateral Tool Transfer) T1486 (Data Encrypted for Impact) T1490 (Inhibit System Recovery) T1491.001 (Defacement: Internal Defacement)

Basic Dynamic Analysis

Question 10 is probably something more for the code analysis section, but for the rest it is already possible to think about which tools need to be started before the analysis: Procmon for question 4 and parts of 5, 7, and 8; Wireshark and INetSim on the Linux machine for question 6. Question 5 can be easily answered post infection by looking at the services page in combination with Procmon data.

Before running the sample, a test.rtf file was created on the desktop to see if and when it gets encrypted. Notice that the .rtf extension is included in the potential extensions that might get encrypted in the “File format to encrypt” appendix.

The sample is first run as a standard user.
After running the sample, only the DNS query and an HTTP GET request can be seen. No file is created, no service is created, nothing is encrypted.

Run as a standard user, the sample only resolves the hardcoded domain and issues one HTTP GET, answered with 200 OK.
Fig. 5: Run as a standard user, the sample only resolves the hardcoded domain and issues one HTTP GET, answered with 200 OK.

After running the sample as admin, the result is the same as above.

At this point it is needed to remove some of the tools, as they might be getting tracked by the sample and interrupt the execution. Stopping INetSim and running the .exe as admin, it actually started the encryption process.

With INetSim stopped and the sample run as admin the encryption starts, and the Wana Decrypt0r 2.0 window appears over the changed desktop.
Fig. 6: With INetSim stopped and the sample run as admin the encryption starts, and the Wana Decrypt0r 2.0 window appears over the changed desktop.

In addition to encryption, the following activity is visible:

  • Internal network discovery
  • Communication attempts with unknown IP addresses

Once the connection with the domain fails, 445 (SMB) traffic to internal and external IP addresses starts showing up:

SYN packets to port 445 aimed at unrelated public addresses, interleaved with BROWSER announcements for the local host.
Fig. 7: SYN packets to port 445 aimed at unrelated public addresses, interleaved with BROWSER announcements for the local host.

After an hour of letting Wireshark run there were around 3000 IP addresses used to attempt the connection.