Ransomware · Ransomworm · Worm

WannaCry - invoice_greenanimals.pdf.exe

Author: Moise Medici
Updated: 15 Feb 2026 · Completed
Difficulty: Medium
Platform: Windows
Capabilities: Command and Control C2 Communication Command Execution via Powershell Cmd Bash File Encryption Persistence Mechanisms
Tags: C++WannaCryptor

Question 5

Starting from the service: in Windows, services are just registry keys, so their details appear clearly in Regshot:

1
HKLM\SYSTEM\ControlSet001\Services\mssecsvc2.0\Type: 0x00000010
2
HKLM\SYSTEM\ControlSet001\Services\mssecsvc2.0\Start: 0x00000002
3
HKLM\SYSTEM\ControlSet001\Services\mssecsvc2.0\ErrorControl: 0x00000001
4
HKLM\SYSTEM\ControlSet001\Services\mssecsvc2.0\ImagePath: "C:\Users\REM\Desktop\invoice_greenanimals.pdf.exe -m security"
5
HKLM\SYSTEM\ControlSet001\Services\mssecsvc2.0\DisplayName: "Microsoft Security Center (2.0) Service"
6
HKLM\SYSTEM\ControlSet001\Services\mssecsvc2.0\WOW64: 0x0000014C
7
HKLM\SYSTEM\ControlSet001\Services\mssecsvc2.0\ObjectName: "LocalSystem"
8
HKLM\SYSTEM\ControlSet001\Services\mssecsvc2.0\FailureActions:  00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 14 00 00 00 01 00 00 00 60 EA 00 00
9
HKLM\SYSTEM\ControlSet001\Services\pafhcsxxsfdrw600\Type: 0x00000010
10
HKLM\SYSTEM\ControlSet001\Services\pafhcsxxsfdrw600\Start: 0x00000002
11
HKLM\SYSTEM\ControlSet001\Services\pafhcsxxsfdrw600\ErrorControl: 0x00000001
12
HKLM\SYSTEM\ControlSet001\Services\pafhcsxxsfdrw600\ImagePath: "cmd.exe /c "C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe""
13
HKLM\SYSTEM\ControlSet001\Services\pafhcsxxsfdrw600\DisplayName: "pafhcsxxsfdrw600"
14
HKLM\SYSTEM\ControlSet001\Services\pafhcsxxsfdrw600\WOW64: 0x0000014C
15
HKLM\SYSTEM\ControlSet001\Services\pafhcsxxsfdrw600\ObjectName: "LocalSystem"

The services Microsoft Security Center (2.0) Service and pafhcsxxsfdrw600 are created, respectively executing the sample with parameter -m security and a new file C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe.

Fig. 8: The Microsoft Security Center (2.0) Service, service name mssecsvc2.0, whose executable is the sample run with -m security.

Fig. 9: The pafhcsxxsfdrw600 service, which runs cmd.exe /c C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe automatically at startup.