wannacry | c7d130e2f86db778f8a2b4e380a64cf2631917984e6e9e09770625244450d8fe

Analysis

max time kernel
180s
max time network
181s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7d130e2f86db778f8a2b4e380a64cf2631917984e6e9e09770625244450d8fe.dll
Size 5.0MB
Sample260428-dze4lsds61
SHA256 c7d130e2f86db778f8a2b4e380a64cf2631917984e6e9e09770625244450d8fe
MD5 91d3ef8049ddd0570c93b297e96b1611
SHA1 fa7cca889a545c91eea2783f3b898e02e53f3622
SHA512 e6ed7f6aad30f36a32d4bd4454b4ee04ea4bcb63363a6ef42c8745ca4f82f3ba0f3f33a58d60f7f4cac4ddd5097624b0a51ea7a1a357930da5a0e6025682068e
SSDEEP 49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:+DqPoBhz1aRxcSUDk36SA
TLSH
T187363901D2E41A60EAF25EF6267ADB10433A7E46D95BA66E1221504F0C77F1CDDE2F2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (4173) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
1252	mssecsvc.exe
1132	mssecsvc.exe
484	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2964	3672	rundll32.exe	79
PID 2964 wrote to memory of 1252	2964	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7d130e2f86db778f8a2b4e380a64cf2631917984e6e9e09770625244450d8fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7d130e2f86db778f8a2b4e380a64cf2631917984e6e9e09770625244450d8fe.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1252
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:484

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 ac11adbf8a6e01017574a4652b8204ee6648a781ab0c09769a0a3062f13b7ad7
MD5 59f28af8778a2e1dc49521f488ba30f4
SHA1 28eb67c147109b21d1cda613bb38d60f0b509e9c
SHA512 b3681df37219a532bf4f646e82e4d6f8a2666f95ee63df9cab18ed9b25549d08c56901ff18ea8850db4d34ecd9abdc1f30db836e2165388f032a5467e73b6361
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:yDqPoBhz1aRxcSUDk36SA
TLSH
T1ED063901D2E41A60EAF25EF6267ADB10433A7E46D95BA66E1221504F0C77F1CDDE2F2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 276ad23af251ed615bf2f0102b897cb9503d763363cf70ad187d660af71f0179
MD5 d58aac80039667c4622288d3b626e63e
SHA1 6842a7454a00b0f393b1dedbc52b7f9e88804088
SHA512 039fcdf92ea441e4eee633f0c683e971a8225af663d20d99cc1c5de639e8df928653466db92d233596a0dafc11c2cd557eb330f6daeb8dd55ce256df9027bec8
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAU:QqPoBhz1aRxcSUDk36SAz
TLSH
T1C3F52801D2E41A60EAF25EF6267ADB10433A7E46D95BA66E1221504F0C77F1CDDE2F2C
MD5 SHA1 SHA512 SSDEEP TLSH