wannacry | cf3831262e37ffc62d2cae2c1fdad314cc41d075233dd079aff6b7c6418d563e

Analysis

max time kernel
180s
max time network
181s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf3831262e37ffc62d2cae2c1fdad314cc41d075233dd079aff6b7c6418d563e.dll
Size 5.0MB
Sample260428-er9tpadt81
SHA256 cf3831262e37ffc62d2cae2c1fdad314cc41d075233dd079aff6b7c6418d563e
MD5 0b9f2e1ea54d67bd9697f2ef61b38bd3
SHA1 629a9796e7a29cb2bd1092d85905b7bfa92b4c3e
SHA512 9a8d7ed228e710dcae58570eca53cf4bade05b1d9238620f1798c2ebc952ed387633df82aeb42c4a5cad1fc7a1d98d5c8feced065e96634b9916ee3423ad56b8
SSDEEP 24576:SbLgddQhfdmMSirYbcMNgef0QeQjGVVXmiHkQg6eX6SASk+RdhA:SnAQqMSPbcBVQejnX1HkQo6SAARdh
TLSH
T133362365B63CD5FCC10A10B864674522B7B33C9A22FE560FCF908A571D13B64FAA4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (4189) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2024	mssecsvc.exe
5028	mssecsvc.exe
2876	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2704	3312	rundll32.exe	80
PID 2704 wrote to memory of 2024	2704	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf3831262e37ffc62d2cae2c1fdad314cc41d075233dd079aff6b7c6418d563e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf3831262e37ffc62d2cae2c1fdad314cc41d075233dd079aff6b7c6418d563e.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2024
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2876

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 d4af3866982f616a61438fabff8e34ffb167dc282350c8e8f4f86dac177fccd5
MD5 8557ea911004f63271614d3a3b6651ff
SHA1 514b806b334484ee49f3b867f6da3f67b63d96d0
SHA512 117ca9f8118d04b26819d397fb2e0af161598735a2f2333d42ceb926476ba655ec96ccd70a636ce2663f2fd23972ea362f5c2f32cee47d219b4a8fa0ef9d6f6c
SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjGVVXmiHkQg6eX6SASk+RdhA:2nAQqMSPbcBVQejnX1HkQo6SAARdh
TLSH
T114062355B63CD5FCC10A60B864674522B7B33C9A22FE560FCF908A571D13B60FAA4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 383966195cf633ec634ef94aa766654188bc81908ae7463ace28413386e86252
MD5 730a218a1a8b6b5bd89b7b89ff166c7b
SHA1 6f2e2c6b82712e3406b57b64f90962b88d87aff7
SHA512 94c712f0b2753c9a55ab300f2470309c807c81680e968f9d19860803e3d7f6e3288a7b5d2fbfbedc6fd3516b6f7e0471646aaab6b5e2c37e96c1542c1ebdae4b
SSDEEP 24576:nQhfdmMSirYbcMNgef0QeQjGVVXmiHkQg6eX6SASk+RdhA:nQqMSPbcBVQejnX1HkQo6SAARdh
TLSH
T156F523A4F130A7BDD31A18FD246A80633BA725A265DF271BDF9045472C04F68EF946CE
MD5 SHA1 SHA512 SSDEEP TLSH