wannacry | 5b4f44b3f4cf218b37c5dd83f2944edde2e64d6d730ddc1fd92800062158bc9f

Analysis

max time kernel
180s
max time network
181s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b4f44b3f4cf218b37c5dd83f2944edde2e64d6d730ddc1fd92800062158bc9f.dll
Size 5.0MB
Sample260427-y3ebpsht2v
SHA256 5b4f44b3f4cf218b37c5dd83f2944edde2e64d6d730ddc1fd92800062158bc9f
MD5 74b16d9cf7d09b4878401401a481223b
SHA1 5dd89148c34e778d7f3ac6cd0c86c591cecc851d
SHA512 272e8f41f116aa614ea3425ef5807d4f2a37243fb4738df335b90d6fedb7d1c071a83e06b40c66fce92c3abb4dce12061af4950154cd12c5210837114ecced4f
SSDEEP 12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+:SbLgddQhfdmMSirYbcMNgef0
TLSH
T1D836232A766C91FCC11A6234A0634936E6B77C6A22BD970F8B948B560D13350FFB4F47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (4195) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
3524	mssecsvc.exe
4272	mssecsvc.exe
3800	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4872	4560	rundll32.exe	80
PID 4872 wrote to memory of 3524	4872	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b4f44b3f4cf218b37c5dd83f2944edde2e64d6d730ddc1fd92800062158bc9f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b4f44b3f4cf218b37c5dd83f2944edde2e64d6d730ddc1fd92800062158bc9f.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3524
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3800

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 2cb8b0b71736d3150b7277a12494fb20d367dfb64fc1bfcd557f41d26e84ff6b
MD5 de72f56d5b8aa7b67fa0d59f63641c10
SHA1 6c216bd19557d82e5fce57c385bf3eb0e9f8bd67
SHA512 e1ffd80beedddd95b905f97049b8d89264cfba88f5c6e0670711403d3c13add6c3ff4dab0a2d091fc090c9ba8a8789b79c47d4ab286dbfd9648bef88dad42920
SSDEEP 12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+:2bLgddQhfdmMSirYbcMNgef0
TLSH
T155062329766C91FCC11A6234A0634936E6B77C6B22BD970F8B948B520D13750BFB4F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 f585a1057592c2bfd9ff7b45e17f891d111af9851295f580d2c5ee2a54b82139
MD5 af6a2000b43075a2e74b139dc319fc6b
SHA1 10fad4feb110ea3d245d54f2db91dc5e57aee901
SHA512 b390b3fc69fa3fec9be40450f0c9b22a6e1ffa5e508e06eeaabb93bd993897681e97d818a05f6e01eefbac0a760bfeb85ca59baa31b29bc0016c90cd1ab26d6d
SSDEEP 12288:nQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+:nQhfdmMSirYbcMNgef0
TLSH
T152F523B5B230777ED32B26757012907719A726F371DE271FCA9406829C08A28DFA56CF
MD5 SHA1 SHA512 SSDEEP TLSH