wannacry | ccaab59629b9c5bc785a157a2b5ab7e9259a350c282c92796908bf7351ffbc48

Analysis

max time kernel
180s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccaab59629b9c5bc785a157a2b5ab7e9259a350c282c92796908bf7351ffbc48.dll
Size 5.0MB
Sample260428-eellbsdt6x
SHA256 ccaab59629b9c5bc785a157a2b5ab7e9259a350c282c92796908bf7351ffbc48
MD5 6207b75cae51b6f73891a014863845b4
SHA1 1dd4d7c6f27a270ce235e0abce79622f3243905d
SHA512 c71a7d5fca728024264d9df035670e33689d72452eb66d7ac4bccb3ff18114e01e901c2762954d21c43c9ac1bcb600048e26c758f0d9d30e743070afe7047d74
SSDEEP 12288:yebLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXF5:zbLgddQhfdmMSirYbcMNgef0QeQjG
TLSH
T14336235A766C91FCC10B62B4A46749269BB73C5A31BDA60F8B508B520C13790FF78F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (4205) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
5868	mssecsvc.exe
732	mssecsvc.exe
4508	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4640	1540	rundll32.exe	84
PID 4640 wrote to memory of 5868	4640	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccaab59629b9c5bc785a157a2b5ab7e9259a350c282c92796908bf7351ffbc48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccaab59629b9c5bc785a157a2b5ab7e9259a350c282c92796908bf7351ffbc48.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5868
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4508

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 b8ac5e9d171ffc94b64e1ba1e6a952851bda55871dbeeee27f4ba357aef0e926
MD5 5730194fd743aa72c764450a77805895
SHA1 916900434714c6625beeced4588f3593ff0ca0bb
SHA512 dd0178c2328729d2dc4b6f4bc392e228753a72c91dc32f7ad4b0ac524bb7577cc6c7c478fd5e813c81237a72b870c93a4f9c58922cf3388c19c03ea27f3a5300
SSDEEP 12288:GebLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXF5:XbLgddQhfdmMSirYbcMNgef0QeQjG
TLSH
T14A062259766C91FCC10B62B4A4678926DBB73C5A31BDA60F8B50CB520C13790FF68B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 02010f6c7e48a931acf84ce1815ba3e2c6d696af4f8cfbc6a9ac3ab6d4c4f272
MD5 6411ed1a208635ace0b20906c69fc007
SHA1 c4f27f8c14bd4a6ffddb16a277fd0f3d7f71d55a
SHA512 30bc8e1b5ad2334c68548307755a19c2f896d579d6b1c39f5e9bf8fd75a629ec0a081cdb24fe20016ba355b3282338636f92f89668ec6296f98b42134138b458
SSDEEP 12288:nQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFGe:nQhfdmMSirYbcMNgef0QeQjG
TLSH
T11AF523A9B53173BDD31B25F9741684570AA62EE270DE371BC98006829C05F68FF986CE
MD5 SHA1 SHA512 SSDEEP TLSH