wannacry | 050cc88b07bccf0429e709fbee0c11ce81c82ee90d91f1436b3cade9e8a36e27

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
050cc88b07bccf0429e709fbee0c11ce81c82ee90d91f1436b3cade9e8a36e27.dll
Size 5.0MB
Sample261026-v7ftjsfv6v
SHA256 050cc88b07bccf0429e709fbee0c11ce81c82ee90d91f1436b3cade9e8a36e27
MD5 74e71ea27fe4aa32f27c3c5130bf8204
SHA1 b43de79768d483188616b9c7f2a699f68e06dd01
SHA512 e632f014467d498f0fe637f343c8c908ccdc8f5483a713eed3009eb6e246bce3ec262adf3381100876f32268a616687fb47d3a4888bae369cbc7ccc72f30b3e0
SSDEEP 98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P5Ap2H:+DqPe1Cxcxk3ZAEUadO4H
TLSH
T145363358722CA1FCE1050DB804A7C95B73B33C696AFE5A0F9F808A670D53B5AEBD0741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3369) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2176	mssecsvc.exe
4564	mssecsvc.exe
5940	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1424	4924	rundll32.exe	89
PID 1424 wrote to memory of 2176	1424	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\050cc88b07bccf0429e709fbee0c11ce81c82ee90d91f1436b3cade9e8a36e27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\050cc88b07bccf0429e709fbee0c11ce81c82ee90d91f1436b3cade9e8a36e27.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2176
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:5940

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 821e15157e1d87fdbdef93134af8fb115befc5f909f7976714b1373a325a1f44
MD5 9073450e45569b45ce0350ae4eab74b6
SHA1 0d8b69247db548730270836837180e91c104accb
SHA512 5c2d99e54af397fa81066646f0a1a337d01d76894db233e7ce8fbe7a58b43e75ea26267030a06b78a58dc1301c6355a0ede82f8ad0b7e7229b46c5b0e4aa6f3f
SSDEEP 98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5Ap2HI:yDqPe1Cxcxk3ZAEUadO4HI
TLSH
T11C063358722CA1FCE1050DB804A7C95B73B33C696AFE5A0F9F808A771D53B5AABD0741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 f972e557476b44e0625c95c82d6a04e9fac8bb44497154d77ed8fc48cdb2034f
MD5 11b0534a1a9ddaab2510d82381ebfc92
SHA1 6804ea5c7645249344b12c0ab6f9a8526ad9e28c
SHA512 7433cca0f9489d1b9c1f03f869b454fc11a3d30eb8a0f4bf38ef6cafcaef90c58edb34f19f40da47ffe9a1aa751584e6b46df5fd4e8a201db2e1354c175cfcff
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P5Ap2Hj:QqPe1Cxcxk3ZAEUadO4Hj
TLSH
T144F533A8A132B7ACF2451DFC049BC99B368725B5BADF6A1BDBC045672C40E5E8FC01C5
MD5 SHA1 SHA512 SSDEEP TLSH