Install WanaDecryptor persistence via .lnk file

WannaCry installs a copy of the decryptor, @WanaDecryptor@.exe, in each folder along with a ransom note. This technique stages and writes a PneumaEX agent and corresponding .lnk file.
View Command

To view this TTPs command, you must be logged in with a professional or enterprise license.


Test this TTP

Download Operator (1.7.1)
Test this TTP using one of our Operator chains
APT38 WannaCry


Perform lateral movement using EternalBlue and DoublePulsar exploits.