wannacry | 1dd001ef5ae3fdc07d44feae5246b23f199e01ce4f7e2b7dd5a354f7aea227fa

Analysis

max time kernel
150s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
06/01/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1dd001ef5ae3fdc07d44feae5246b23f199e01ce4f7e2b7dd5a354f7aea227fa.dll
Size 5.0MB
Sample260106-jc5zeaxphy
SHA256 1dd001ef5ae3fdc07d44feae5246b23f199e01ce4f7e2b7dd5a354f7aea227fa
MD5 62186bebffffcfafb1c70a8ff03fa317
SHA1 6fc4434a5fc48ef8c1792f8d7ca49cba14556378
SHA512 8cb8d6f6e26cf4e5dd9a894025fe4c8063f3c13bf52a4b0faefcb27f1c95ec2121d9f8d3a4365da34483061d69f1c0da639fc7429a49e4091a2a35dac5775135
SSDEEP 49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARd:d8qPoBhz1aRxcSUDk36SAEd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3347) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
1992	mssecsvc.exe
4348	mssecsvc.exe
3848	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3824	5064	rundll32.exe	80
PID 3824 wrote to memory of 1992	3824	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dd001ef5ae3fdc07d44feae5246b23f199e01ce4f7e2b7dd5a354f7aea227fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dd001ef5ae3fdc07d44feae5246b23f199e01ce4f7e2b7dd5a354f7aea227fa.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1992
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3848

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 3d57f0bc2b6d14cf215d70d5f6e525622d1e451626c26a8fa9d2daf47de6c8f8
MD5 929b5c4d4aa798214e85226ad735c229
SHA1 7d7f88545a844bd9e4e51263d8e3f2548e3d112f
SHA512 fc89df57b54be5aef57fd9e2328bdc181895aee73813d0ecb867815e69d8987f084ffbb570f049c1ff371851500ef0121dd12ebe809acbc6cc2337203444353d
SSDEEP 49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARd:Z8qPoBhz1aRxcSUDk36SAEd
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 4038bd684b85e9451ca37e7233c2b39dbf0ad7967829179b75cafc0c661c986b
MD5 db04f37a8f947c39285253dbf4eb490f
SHA1 ac9c6ae440c86c6df633c8c156809cfce4254064
SHA512 b17162b1dfe12465e2b8fbf9f70f8e5a646a9798ff6625cf6181a62e65ebbd4a1773daa7cc954caf7bf6907c990b487847aa3a4cbb5cf6f5575cdeb5b1d09296
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARd:QqPoBhz1aRxcSUDk36SAEd
MD5 SHA1 SHA512 SSDEEP