wannacry | 115886e6f0f66f3add24bd9c1950f2d63c82d0ef7c79a2cb7c7e3e35100b1d32

Analysis

max time kernel
180s
max time network
186s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
115886e6f0f66f3add24bd9c1950f2d63c82d0ef7c79a2cb7c7e3e35100b1d32.dll
Size 5.0MB
Sample260427-rbvfaac15v
SHA256 115886e6f0f66f3add24bd9c1950f2d63c82d0ef7c79a2cb7c7e3e35100b1d32
MD5 6b43e7d41a918aec563f6926e63d81d3
SHA1 b7f6dad51bf9ccc50fb9a472df740ecdbf6efa12
SHA512 e6bddb2e76d10939ecc14308fbe65d2ee4c1e3ead331d5151cd27a9a89b683b707dc281775d05553c932c51c236ff7115904e18b89db2ad22fbc0176d814a244
SSDEEP 98304:+DqPoBhz1aRxcSUDk36StAvzUs6Q5GksluAQLeFo:+DqPe1Cxcxk3ZSXd5r6
TLSH
T1F23605838007156CE46DCA71C2ED1BA0C92B5EA57A6CB08D6F17BA4A27F31D3F596D03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2990) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
3152	mssecsvc.exe
5216	mssecsvc.exe
5248	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 1212	4284	rundll32.exe	80
PID 1212 wrote to memory of 3152	1212	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\115886e6f0f66f3add24bd9c1950f2d63c82d0ef7c79a2cb7c7e3e35100b1d32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\115886e6f0f66f3add24bd9c1950f2d63c82d0ef7c79a2cb7c7e3e35100b1d32.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3152
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:5248

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 49c1200a10fc03afffdf6e04a0bbf6a31f2319304eeaf7ffd5844ee28ba477bc
MD5 d119d7e8a9fb53a6228f9ad959dc1f12
SHA1 698d1d8e717b0cbc91716c59d85ea7d97a2a5ecf
SHA512 94b19f5d9334eed687c42f50e457e18025d760e1dc7b87dfb0e1e8b9ffd8849e95623eb5083137f9ddf6d7d0b58f593313952f37d0bd36f2a9f6c244f4c6ad5b
SSDEEP 98304:yDqPoBhz1aRxcSUDk36StAvzUs6Q5GksluAQLeFoT:yDqPe1Cxcxk3ZSXd5r6Q
TLSH
T15F0605838007156CE46DCA71C2ED1BA0C92B5EA57A6CB08D6F17BA4A27F31D3F596D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 2829822cc7fb64654567f8a7db0e43a18b24c0fd4eb9e73d176abe381151b390
MD5 1c4b377910af34653ed1f0e26b1322a9
SHA1 12eae265039c267aaba7864d234666b2641adf35
SHA512 a6455d0d8d70750054dff2858a25354533f1a5d6bcefb5e79424a3395207d0767a07209da2f4d3c14ec8f29f7db72682408a89340aa71137f001435937151342
SSDEEP 98304:QqPoBhz1aRxcSUDk36StAvzUs6Q5GksluAQLeFom:QqPe1Cxcxk3ZSXd5r6h
TLSH
T168F5F483C007156CA46DCA61C2ED1BA0C92B5EB57A6CB09D6F13BA4A27F31D3F596D03
MD5 SHA1 SHA512 SSDEEP TLSH