wannacry | 6b465dc7cc21ba92d848425f8eabae3dc9f72d873d92a7b18639fd79814c7b1b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92d7549c8cf73bc0f29cea5ba8991560.dll
Size 5.0MB
Sample260802-aeka2sak4w
SHA256 6b465dc7cc21ba92d848425f8eabae3dc9f72d873d92a7b18639fd79814c7b1b
MD5 92d7549c8cf73bc0f29cea5ba8991560
SHA1 84385c351cdf4cef52b816d5864431f29c615db3
SHA512 387f07de5817540ee8151755956e7e27c0004137843ffd83a202277b2d839586235870d83e8afbc9fb3b0651b3a7d12179360313cfe0b64d7493a9d7ac383ebb
SSDEEP 24576:RbLguEQhfdmMSirYbcMNgef0QeQjG/D8kI:RnUQqMSPbcBVQej/
TLSH
T1B636235A757CA1FCC10A6375B4778A2692B73C5A22BD9B0F9B548B220C03760FF64B53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2319) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 2 IoCs

pid	Process
4456	mssecsvr.exe
3408	mssecsvr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4604	2776	rundll32.exe	89
PID 4604 wrote to memory of 4456	4604	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d7549c8cf73bc0f29cea5ba8991560.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d7549c8cf73bc0f29cea5ba8991560.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4456

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 2def95c994038cab02760cfa2bf4b1ab21b409344cc93ecb6ad182a6e36f2c62
MD5 a523f5840fa38efdf6d8f035104c194b
SHA1 a42ebe3e24483b5c5d56f7e63109811dece1e2d3
SHA512 134d10cd858359a916f77adbc5fb8536e88942d1cbf33ee490544f7c7ed6e4abc89d094f2b2c7b93b4707076a76fc7f76517ed767c97bb0472aa5937c3234581
SSDEEP 24576:QbLguEQhfdmMSirYbcMNgef0QeQjG/D8kI:QnUQqMSPbcBVQej/
TLSH
T151B5235A756CA1FCC10A7375B4778A2692B73C5A21BD9B0F9B548B220C03760FFA4B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download