Ransomware · Ransomworm · Worm

WannaCry - invoice_greenanimals.pdf.exe

Author: Moise Medici
Updated: 15 Feb 2026 · Completed
Difficulty: Medium
Platform: Windows
Family: WannaCryptor
Languages: C++
MITRE: T1047 (Windows Management Instrumentation) T1059.003 (Command and Scripting Interpreter: Windows Command Shell) T1059.005 (Command and Scripting Interpreter: Visual Basic) T1569.002 (System Services: Service Execution) T1543.003 (Create or Modify System Process: Windows Service) T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) T1027.007 (Obfuscated Files or Information: Dynamic API Resolution) T1027.009 (Obfuscated Files or Information: Embedded Payloads) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1036.004 (Masquerading: Masquerade Task or Service) T1036.005 (Masquerading: Match Legitimate Resource Name or Location) T1036.007 (Masquerading: Double File Extension) T1070.004 (Indicator Removal: File Deletion) T1140 (Deobfuscate/Decode Files or Information) T1480 (Execution Guardrails) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1620 (Reflective Code Loading) T1222.001 (File and Directory Permissions Modification: Windows Permissions) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1046 (Network Service Discovery) T1083 (File and Directory Discovery) T1680 (Local Storage Discovery) T1210 (Exploitation of Remote Services) T1570 (Lateral Tool Transfer) T1486 (Data Encrypted for Impact) T1490 (Inhibit System Recovery) T1491.001 (Defacement: Internal Defacement)

Question 4

Another relatively easy question to answer is question 4, which only requires to open the sample in pestudio and extract the resource. To do that, in the section Resources → [Right-click on the entry] → Instance → Dump to File. Save the dump. Opening the new file, it is possible to see that it is a .exe and it has an additional resource attached.

Loading the file with DetectItEasy shows that it is a password-protected zip: Zip(2.0)[encrypted,55.8%,36 files]. The password is not yet known, but if it is unzipped with a random password, some of the file names in the target directory become visible:

dump
- b.wnry
- c.wnry
- f.wnry
- msg
  - m_bulgarian.wnry
  - m_chinese (simplified).wnry
  - m_chinese (traditional).wnry
  - m_croatian.wnry
  - m_czech.wnry
  - m_danish.wnry
  - m_dutch.wnry
  - m_english.wnry
  - m_filipino.wnry
  - m_finnish.wnry
  - m_french.wnry
  - m_german.wnry
  - m_greek.wnry
  - m_indonesian.wnry
  - m_italian.wnry
  - m_japanese.wnry
  - m_korean.wnry
  - m_latvian.wnry
  - m_norwegian.wnry
  - m_polish.wnry
  - m_portuguese.wnry
  - m_romanian.wnry
  - m_russian.wnry
  - m_slovak.wnry
  - m_spanish.wnry
  - m_swedish.wnry
  - m_turkish.wnry
  - m_vietnamese.wnry
- r.wnry
- s.wnry
- t.wnry
- taskdl.exe
- taskse.exe
- u.wnry

The content above matches with the path found above: %ProgramData%\pafhcsxxsfdrw600. This directory actually exists and contains quite a few files:

pafhcsxxsfdrw600
- 00000000.eky
- 00000000.pky
- 00000000.res
- @ Please_Read_Me@.txt
- @ WanaDecryptor@.exe
- @ WanaDecryptor@.exe.lnk
- b.wnry
- c.wnry
- f.wnry
- msg
  - m_bulgarian.wnry
  - m_chinese (simplified).wnry
  - m_chinese (traditional).wnry
  - m_croatian.wnry
  - m_czech.wnry
  - m_danish.wnry
  - m_dutch.wnry
  - m_english.wnry
  - m_filipino.wnry
  - m_finnish.wnry
  - m_french.wnry
  - m_german.wnry
  - m_greek.wnry
  - m_indonesian.wnry
  - m_italian.wnry
  - m_japanese.wnry
  - m_korean.wnry
  - m_latvian.wnry
  - m_norwegian.wnry
  - m_polish.wnry
  - m_portuguese.wnry
  - m_romanian.wnry
  - m_russian.wnry
  - m_slovak.wnry
  - m_spanish.wnry
  - m_swedish.wnry
  - m_turkish.wnry
  - m_vietnamese.wnry
- r.wnry
- s.wnry
- t.wnry
- TaskData
  - Data
    Tor/
    …
  - Tor
    libeay32.dll
    libevent-2-0-5.dll
    libevent_core-2-0-5.dll
    libevent_extra-2-0-5.dll
    libgcc_s_sjlj-1.dll
    libssp-0.dll
    ssleay32.dll
    taskhsvc.exe
    tor.exe
    zlib1.dll
- taskdl.exe
- tasksche.exe
- taskse.exe
- u.wnry

Note that tasksche.exe is present here but not in the original zip.

One answer has been given, but two new questions come to mind.

Continuing with question 7, filtering for “Path contains qeriuwjhrf” or “CommandLine contains qeriuwjhrf” in Procmon has not returned any value. The Regshot results are also not showing it. So that will be postponed for the code analysis.

Moving on to question 8, this currently has the same answer as question 7. In Procmon, values for mssecsvc can be seen since one of the services created has that name; however, nothing directly related to mssecsvc.exe has been found yet.