wannacry | 740aa601fb4a83fd2b2dbd4f3bea3aaaa4ed40b5dddbf1c8f2ad629a528408ce

Analysis

max time kernel
180s
max time network
181s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
740aa601fb4a83fd2b2dbd4f3bea3aaaa4ed40b5dddbf1c8f2ad629a528408ce.dll
Size 5.0MB
Sample260427-2b18yaav3v
SHA256 740aa601fb4a83fd2b2dbd4f3bea3aaaa4ed40b5dddbf1c8f2ad629a528408ce
MD5 7c21d2ad87c267fb16cd49c78b4a1ec2
SHA1 b0295c17bc83cb111932b27c1aaef783cbe1e3a1
SHA512 96b3dfaa40d9131967c5fe89c56ebda658f87cdff1e28d9809df42d31556e162a35e89232d2359a52d5956fd871598ef44f0e92ce2fe472510dd530ba1b15f05
SSDEEP 6144:yE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbBLIwYQuy8DLq1eNVDvM:yvbLgPlu+QhMbaIMu7L5NVE
TLSH
T16836F11A67ACC1BCC41A4131A4634A7AEBB7BC595278970F4B58CB650E63390BFB4F07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3606) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
5152	mssecsvc.exe
3676	mssecsvc.exe
3572	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 2912	3984	rundll32.exe	80
PID 2912 wrote to memory of 5152	2912	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\740aa601fb4a83fd2b2dbd4f3bea3aaaa4ed40b5dddbf1c8f2ad629a528408ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\740aa601fb4a83fd2b2dbd4f3bea3aaaa4ed40b5dddbf1c8f2ad629a528408ce.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5152
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3572

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 6bbc83bb6affbdc996384627e545c802be91c53dbe167371eb4bf54c6dd5e8da
MD5 81576f5031aa15c23ce7e861ee96066a
SHA1 6e961c17812ef3de1680e6855e8599e0b2a46b01
SHA512 6e45abe1abed4b86e2c3c18a42f2ea48b55086b3bf4d666a0b0f45d103a88fb11fdb64f73aee68388325bc2f9ac7119deb767a5c58e68bd07f03f61cab69335e
SSDEEP 6144:GE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbBLIwYQuy8DLq1eNVDvM:GvbLgPlu+QhMbaIMu7L5NVE
TLSH
T1EE06F11A666CC1BCC41A4131A4634A7AEBB7BC5952789B0F4B58CF650E63390BFB4F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 963e977ff7071639954641d52f578d4f6be94a9a8a0e8ecfacb5eed45eac7446
MD5 dc892b639e256155bac8095a5ccc7369
SHA1 f16216a3608887e02212c3ea9d6a1d7d0d4ba31c
SHA512 d72f8a13ae3869ff6f60cfb0a8f7fb37182c851ee4aba0717dcaf461442eaefd3a58fbd88cb041c6bc857422b55725acdede139979208460f1e258010d4304d8
SSDEEP 3072:BozecK+7hMV9qbUwLIeZYQWOihj4syMKecm/FZqc3XGetyLOkUJTfTg4bvAX:W2QhMV9qbBLIwYQuy8DLq1eNVDvM
TLSH
T102F50266A330E33EE57700767401A6BB1BE696B1A1ED6F0BD54C4A855C04A58CFF0B8F
MD5 SHA1 SHA512 SSDEEP TLSH