wannacry | f7dd3debf228aff0e0d73741d535db12358ff0120e8775ded3e28e82136140c2

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/03/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f7dd3debf228aff0e0d73741d535db12358ff0120e8775ded3e28e82136140c2.dll
Size 5.0MB
Sample260312-aappzafv3n
SHA256 f7dd3debf228aff0e0d73741d535db12358ff0120e8775ded3e28e82136140c2
MD5 c67d51d83bc01572ca8c16a844dd7c72
SHA1 74e4c5db2cbc4a0e79c616730eda937cb4739045
SHA512 328c12810890b2a2fd7d0c84526c59e78cee17b08e13e47a1961a5913a181527b8df9c949905c15bd430825a6a1c11c7097fd2b8aef91be379b650d8eac35f70
SSDEEP 49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEa:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P5
TLSH
T1963633A8713CD6BCE1051DB40463C96AA7733C6566FE6E0F8B5086661D03B6FBBD0B42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (2668) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
3548	mssecsvc.exe
2472	mssecsvc.exe
3156	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1728	2840	rundll32.exe	79
PID 1728 wrote to memory of 3548	1728	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7dd3debf228aff0e0d73741d535db12358ff0120e8775ded3e28e82136140c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7dd3debf228aff0e0d73741d535db12358ff0120e8775ded3e28e82136140c2.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3548
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3156

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 34bb42b42142837e67020770f7c0af895ebc21077d522667d8c36478ba3b3ba5
MD5 e26b2f85a9d4f5635c651a7b05c7d0b8
SHA1 d2a4dc91c928c3dfa9126ed28273b315320e8619
SHA512 0b154708aaf5973202ba41c3f52bdecb6b0f832467f8629ef3b7e83c6eb54bb6a4391d7b82e446157a59a87bb606ba2bb750623b050d64fe89410ed859425a09
SSDEEP 49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEa:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5
TLSH
T12F0633A8713CD6BCE1051DB40463C96AA7733C6566FE6E0F8B5086661D03B6FBBD0B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 5806c0b18eb4ee10b6906e16a9920e0336fe4bfbb52293a21f846234c306cc8e
MD5 7f1a2fc2485a6ca8cb5fbb0adb945127
SHA1 05e7bb3d1265a9b91e9a9c47b85804a07662e201
SHA512 5b730bf7d2c7b7fac75266b67a38810abc56b9aaca7e286c31c533432d54235b4fc8efe96cab7ed5aba7a9979edca3120c39fb42023bfc79469de62878da7d84
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEa:QqPoBhz1aRxcSUDk36SAEdhvxWa9P5
TLSH
T125F533F8B131B76CF3461DF80466C4AB265635B1AAEF7E1BDB8005A62D00F6F9BC0585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1728-3-0x0000000000D00000-0x0000000000D25000-memory.dmp

Download

memory/3548-5-0x0000000001130000-0x0000000001155000-memory.dmp

Download

memory/3548-11-0x0000000001130000-0x0000000001155000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads