wannacry | 9395b8f1ef8bd964b349b320a5079816bae8b676caa2d8df17a69d41009eab1d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
06/01/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9395b8f1ef8bd964b349b320a5079816bae8b676caa2d8df17a69d41009eab1d.dll
Size 5.0MB
Sample260106-jdcdgsdq9v
SHA256 9395b8f1ef8bd964b349b320a5079816bae8b676caa2d8df17a69d41009eab1d
MD5 ebaf4de7ec5324a5abe73fdb45e6fff4
SHA1 9a7c9ec13d6ae505bf1e230300d0b5c27dcaa61a
SHA512 2d506e7acc678e0979a434c773431d482a34772137c5a147705e9d7d6ac84700dea7be2d49c68916e854518a251a34091c5ebc42cc904d1f5d6b606f2488ad57
SSDEEP 49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:d8qPoBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3371) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2824	mssecsvc.exe
4932	mssecsvc.exe
3636	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3900	404	rundll32.exe	77
PID 3900 wrote to memory of 2824	3900	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9395b8f1ef8bd964b349b320a5079816bae8b676caa2d8df17a69d41009eab1d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9395b8f1ef8bd964b349b320a5079816bae8b676caa2d8df17a69d41009eab1d.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2824
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3636

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 5a28b6f7db853568bfc409bfce3377cd6acf6b92122dd61244541c0d37ec2797
MD5 9457b9440f67532e443acd776adef68c
SHA1 bd921f3939b04a44019562edd299d94d7c0d1846
SHA512 af9b1f8884b6ecaadf55208be2273476f8b42bed27d1dbbb46374bf454c9f1de2cb7dd82323860ac321acb18899fe9fce6805a7f030d19408e3317d46e8a5707
SSDEEP 49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:Z8qPoBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 e3825cad783a302902576ca4cfae9fdfc8640a012876402c89e7dd22475cda91
MD5 ba8922fceaeed80297c3c391c8844b70
SHA1 2ef2a451fbcd42a938ae3d7bfad93dbc8ebe144f
SHA512 faee2d00623ab8a0db455a4b26074faed6da189220630f5260c331ed3d7f633f4cb253efaae25101c64ca836bea92b2de9e8c18614da483d4614b2e176d159bb
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:QqPoBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP