wannacry | ca66d96b074b784b8a3cbd9492053e56e2cb630ed1a929cfc94f412d7a54cc40

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
06/01/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca66d96b074b784b8a3cbd9492053e56e2cb630ed1a929cfc94f412d7a54cc40.dll
Size 5.0MB
Sample260106-jc985adq7x
SHA256 ca66d96b074b784b8a3cbd9492053e56e2cb630ed1a929cfc94f412d7a54cc40
MD5 719e3211a56696c1eaaece793d90b064
SHA1 c158a7bd3d82c0aaa120acb1b1071c61eabf07d4
SHA512 b80f4a4592457c239b29d4812d7a7b9268c0aa85f244b96f5d0a6ca16452005f3fd573e300fff62c1c0a5865bea32058ae61a69a41b56a9fcd85b05347da9257
SSDEEP 49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:+DqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3320) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2480	mssecsvc.exe
3848	mssecsvc.exe
4840	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4600	4812	rundll32.exe	77
PID 4600 wrote to memory of 2480	4600	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca66d96b074b784b8a3cbd9492053e56e2cb630ed1a929cfc94f412d7a54cc40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca66d96b074b784b8a3cbd9492053e56e2cb630ed1a929cfc94f412d7a54cc40.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2480
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4840

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 c2f469d8c55198e41035beb929346f173c2484a3952cbae38b635bc728de0cf2
MD5 8d4e23c18de0e0e3f51e9a2816588341
SHA1 9c226b27a6cfeb88de9b08071cda86ab32c0bea5
SHA512 c1989cd3b07fb4ad380f412ad2ddf84273cc2fba84cbf3bc542af1333fc199a1030f3a78cf9f9f9ca88a481751e162a00f217e946e2337f2de489123173348b4
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:yDqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 10946800b4e80b3084a2bf32844838f1873cdebe36ee9bf6a13bc8e2da8ca53f
MD5 481b7fd39eadbbdf10b2a6e6fa5c9c9a
SHA1 0df65867be5d463ec5dcf594370c849a6677faf1
SHA512 e5afcb818760552ee37efd7fb7e4b00430df3d9ee513bbc8ca4d40eea51eb7537a48950046d068c124679cc87a2cbca5b56c954257b22d633e7d6a0022b24351
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9t:QqPoBhz1aRxcSUDk36SAEdhvxWa9t
MD5 SHA1 SHA512 SSDEEP