wannacry | b76c49cbb1a72437bb687db48f42525d3073a3a0356b7fef0220f707e0547539

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20251229-en
resource tags

arch:x64arch:x86image:win11-20251229-enlocale:en-usos:windows11-21h2-x64system
submitted
06/01/2026, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b76c49cbb1a72437bb687db48f42525d3073a3a0356b7fef0220f707e0547539.dll
Size 5.0MB
Sample260106-kmsx9symby
SHA256 b76c49cbb1a72437bb687db48f42525d3073a3a0356b7fef0220f707e0547539
MD5 132cd5c5c2266a5f712bb76fc2e42c3b
SHA1 fb64a5fdf3a976c8aaef32e67e333588d8683e7e
SHA512 5376f826ae370248f5db331b09b85dba9149e92134ec60e51b2c396cae129e120cbbf1f262f925224e14959602090ef06a22f804b141e1ebbc3552895a0382ef
SSDEEP 98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2H:dDqPe1Cxcxk3ZAEUadzRkc4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3359) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
4656	mssecsvc.exe
2200	mssecsvc.exe
4356	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4692	4828	rundll32.exe	77
PID 4692 wrote to memory of 4656	4692	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b76c49cbb1a72437bb687db48f42525d3073a3a0356b7fef0220f707e0547539.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b76c49cbb1a72437bb687db48f42525d3073a3a0356b7fef0220f707e0547539.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4356

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 fa4b2fb8e563324a13ec4b8173fae351a2ca781e416283e04e2507a0d2be5e75
MD5 f9b77842153a85199b21a1564e8b54d7
SHA1 b06727bd00503f90e15a55fbb38b4629f6e6c110
SHA512 f0ddb97f757116604421d52780e3d4f3192527e3554db610cb06de117f9d535915e37dbf1040202e5f38b19bdcb51d5b66bcad87970581d89ea07095bcf8589d
SSDEEP 98304:ZDqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2HI:ZDqPe1Cxcxk3ZAEUadzRkc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 21a2da6d4b00480ae75a70c0ecbd0915579b713f5261c389ce3c1919398046d7
MD5 55ef5240fd5040496d9bb6fc39ef7962
SHA1 cbb4e0e243654319838f8da88ac2417c84152d0a
SHA512 e472dbc52a25846498dfb61fe2f9e5c268679cf64ef8938c607de5b2be0d85c8aeb5f3673fb110cbc4429d29359833010bf2415840d0d91ba6b37c5636250bcc
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2Hj:QqPe1Cxcxk3ZAEUadzRkc4Hj
MD5 SHA1 SHA512 SSDEEP