wannacry | cfe1829b62a2bc4291f3ca74a7f1e8646fd00be34451f340275a77b566ea5838

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cfe1829b62a2bc4291f3ca74a7f1e8646fd00be34451f340275a77b566ea5838.dll
Size 5.0MB
Sample261002-glht5azdlb
SHA256 cfe1829b62a2bc4291f3ca74a7f1e8646fd00be34451f340275a77b566ea5838
MD5 2e3903e7bd8af72a61bc542d30cfa96a
SHA1 ed39b50fdab1d864e1cefdce56cd4764b4414bfd
SHA512 0b9e4e3b71eec92ea212c67bee702e6883fb908a53b4034cfd63be96f1c98725f61f22efae0c0f3e7ef2b42fc76afd9040fa08e3a13ce14b51265b151976d358
SSDEEP 98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9qy3:d8qPe1Cxcxk3ZAEUa4
TLSH
T1DC36122B52B95065E38B8B38C8614B1297337D10D2F5923E077E791E1F72B764BACB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3369) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2780	mssecsvc.exe
3560	mssecsvc.exe
1716	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 5880	2612	rundll32.exe	88
PID 5880 wrote to memory of 2780	5880	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe1829b62a2bc4291f3ca74a7f1e8646fd00be34451f340275a77b566ea5838.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe1829b62a2bc4291f3ca74a7f1e8646fd00be34451f340275a77b566ea5838.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2780
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1716

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 6daf569bbe37b54f11a67c4241a985a253aa0b375dcfa0823a751dd494b36977
MD5 20fbdf662d37a09fc2e393837137462d
SHA1 afefa34465c872ba687145082654cc96037b1030
SHA512 70e2091a42ad7a285ef60befbef60d727ccaf4922e74e1f76adca65076d25d987b1aceb193ff434bc8baf47f76db80335c01b7958282bd4e445b6e5fe9cebaad
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9qy3:Z8qPe1Cxcxk3ZAEUa4
TLSH
T13706122B52B95065E38B8B38C8614B1297337D10E1F5923E077E791E1F72B764BACB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 6ca53fea339e0bd1d2fff30069aa660e5ed61b9ecdd42235914d9a4041a59747
MD5 9ea974520e461961fbf360503e4823b9
SHA1 7c28f74bb861120b17f9421dd4626cc4625378d9
SHA512 c83cadd8627212045ebeeebed5f5ad5fc5d26dfff4cd13f8e3e269d010cde73bf44c8aa71c7b8dc077326052cb80877413886486671a4b2ff223b5670a249196
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9qqSy3:QqPoBhz1aRxcSUDk36SAEdhvxWa9qy3
TLSH
T176F5122B52B65165E3DB8F38C8618B4257227E10E1F5A23D033E791E1F72B364B9CB52
MD5 SHA1 SHA512 SSDEEP TLSH