wannacry | f77dbed714575efb8146899633f87b268aa81c20db6fa5abbb3bdbdbb96ca3d0

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/03/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f77dbed714575efb8146899633f87b268aa81c20db6fa5abbb3bdbdbb96ca3d0.dll
Size 5.0MB
Sample260312-aansnsfv3k
SHA256 f77dbed714575efb8146899633f87b268aa81c20db6fa5abbb3bdbdbb96ca3d0
MD5 aadead8a2cd84e2c3e7c8e35812b8b06
SHA1 d05697267903386e474aa14cc6e9d5f0e74d2a53
SHA512 bd80c68f2a73b3f39018bd1b1839e1ee51f933a924ddfb2d5567a7d62a6c98029cc071a990823f968c7475d5bd885424e44d47f5c28793dfaf89abeaa86a49ab
SSDEEP 98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:+DqPe1Cxcxk3ZAEUadzR8yc4
TLSH
T17B3633A4A26CE2FCF0440EB44463895BB7773C6567BE5E1F8B8085670D43B5BAFD0A41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (2686) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
744	mssecsvc.exe
896	mssecsvc.exe
4248	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3076	2004	rundll32.exe	80
PID 3076 wrote to memory of 744	3076	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f77dbed714575efb8146899633f87b268aa81c20db6fa5abbb3bdbdbb96ca3d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f77dbed714575efb8146899633f87b268aa81c20db6fa5abbb3bdbdbb96ca3d0.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:744
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4248

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 08b9f4da7a11bacf879b3495132c5b93107546cdd5e1befa4e19643d04b5f1d5
MD5 b3214131f8246b6c909def1657cd2ad5
SHA1 6444d7632b6119dc49dbb2b1bfb51ada6a4734c6
SHA512 db633c15233a91e1ec812c863e82bc65de0e40dbf91eab3cb1f13174e2a3be8033b8205111596a65043bcfe8b9e5f1dfd04c7bb7597cb8779fb1a865b4dc1b16
SSDEEP 98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:yDqPe1Cxcxk3ZAEUadzR8yc4
TLSH
T171063394A12CE2FCF0450EB44463896BB7B73C6567BE5E1F8B8085A70D43B5BAFD0A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 83a0f9ca30df74c4040a172ddc96b3e826090906d71b6bf735b0708ee8b47512
MD5 da3b7ff9b13e0b6e4ec84d9aa5e79f7d
SHA1 8ec10389f76ac704a46f0a068e4b55101abacf46
SHA512 65defb58ce8c0680c587863b663cb821ed0ac9dad5f463d220e56a4f38d10e408d23863b22932a70ab9d6f8c4f72b5da3b06bfbe03d198970d6422694df9909b
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:QqPe1Cxcxk3ZAEUadzR8yc4
TLSH
T1F5F533F4E225B7ACF2550EF50456C59B3A9724A1BBEF1E2ADAC005AB1C44F6F8FC0581
MD5 SHA1 SHA512 SSDEEP TLSH