wannacry | ee467c9fac778090c378fb779db9a5e002b5781c8e98ddbcfc5d578b969cf0cf

Analysis

max time kernel
150s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/03/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee467c9fac778090c378fb779db9a5e002b5781c8e98ddbcfc5d578b969cf0cf.dll
Size 5.0MB
Sample260312-aa91xab12v
SHA256 ee467c9fac778090c378fb779db9a5e002b5781c8e98ddbcfc5d578b969cf0cf
MD5 45fc2d4ab1de2f9f46f89b4b9c80f329
SHA1 2fbb0570dd9fd2dd3a7cfbb5595f9bd6388c46ee
SHA512 9f63ed43a5e372347ebde9bfb99d996fe3edb22c7916a75f18c563f58944121b9f0a958c813ff9e5f07036ab5aee274c55ef629908c773bb7909db12c607823c
SSDEEP 49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQm:TDqPoBhz1aRxcSUDkL
TLSH
T1F636335D317C91BCD106667854B78E67A7F33C5962FD6A0F8B808B7A0C13B48BFA4642
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (2678) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
1180	mssecsvc.exe
5416	mssecsvc.exe
5328	tasksche.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1108	3528	rundll32.exe	80
PID 1108 wrote to memory of 1180	1108	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee467c9fac778090c378fb779db9a5e002b5781c8e98ddbcfc5d578b969cf0cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee467c9fac778090c378fb779db9a5e002b5781c8e98ddbcfc5d578b969cf0cf.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1180
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:5328

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 06ce2f2021de4d80448cc34c183da0928d3f2a99d367ded2c3a36d5c084d48c7
MD5 06e9d480b86033acf3212aae3a95b5c4
SHA1 d02fba743ac9b54380d22578fcb2434f9e7a7240
SHA512 a9cdc7d50bedf93c4c4a689e586c2d493ca497214512d805b984a73ff907510fc0721159b9c8f6a9e8585b37643400b76a7cdb7a782fb3861a31f142241c2111
SSDEEP 49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQmI:XDqPoBhz1aRxcSUDkLI
TLSH
T1D706335D317C91BCD106667854B78E67A7F33C5962FDAA0F8B808B7A0C13B44BFA4642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 1a1ea37e1c61d0049cdbc134f69833d8cd00bd0b1787c2714883fd4275476635
MD5 48ca6f503547211aff9c7460685c621b
SHA1 5474f48ae07e4abead3fc738d11e651630cb0ab2
SHA512 e63098cf725e7395e2c4bca6701ba17531c7438786f7052bd9db03167e97167ef80ca8a6300171b1adc93f5e7583ae829975f950b790b57fcb76a4c2332a0b22
SSDEEP 24576:nQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+vbOSSqTPVXmiHkQg6ev:nQqMSPbcBVQej/1INRx+TSqTdX1HkQmj
TLSH
T162F533EC7071B77CE3062EBD24ABC99726D229E575DE3E06DBC406AA5C04E1D9F841C2
MD5 SHA1 SHA512 SSDEEP TLSH