wannacry | ad6f141195ebdbbf571f52d39c7481b05bda9350116383ce9c6f6ec8fb30813d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad6f141195ebdbbf571f52d39c7481b05bda9350116383ce9c6f6ec8fb30813d.dll
Size 5.0MB
Sample261027-by8cnazzht
SHA256 ad6f141195ebdbbf571f52d39c7481b05bda9350116383ce9c6f6ec8fb30813d
MD5 4f8ca2e556219e530beebd66135016b4
SHA1 68fdf05e1f2fc5ca1666c0544a05c400310b1ebd
SHA512 cca1fb1b842f8d745ff89494a0b231b9012cb81e9d2310df2cffa08a3adaba315f2eb10723589a2d104968ae518c9d21dd08c32b8e283e156d26e70ba82c0cdb
SSDEEP 49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9wAH:d8qPoBhz1aRxcSUDk36SAEdhvxWa9BH
TLSH
T1E3363358717C92BCE1450DB804A7CA57B7B33C5967FEAA0F9B4086360C53F5AAFD4A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3370) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2992	mssecsvc.exe
4784	mssecsvc.exe
4752	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5032	4612	rundll32.exe	89
PID 5032 wrote to memory of 2992	5032	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad6f141195ebdbbf571f52d39c7481b05bda9350116383ce9c6f6ec8fb30813d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad6f141195ebdbbf571f52d39c7481b05bda9350116383ce9c6f6ec8fb30813d.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2992
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4752

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 1c1dac9c49cddb95400342bae8b73ceac5c0c61a1b11a5e2b7e6b73b89cb40da
MD5 1f7927f56bb9f080efc3be1c14ecaec6
SHA1 388f8de9899ab370a45f9eb02a090364c38b22bb
SHA512 75bd4aa1aefd5d25a4f28c33658ab06642c2f36af779759ea0dd4d5c6ba681b24e87e1549682ba9ef02e23bd49c2ad506ad28e3ccdc03957c3456cfa0e16cfe2
SSDEEP 49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9wAHI:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9BHI
TLSH
T1AC063358717C92BCE1450DB804A7CA57B3B73C6966FEAA0F9B4086360C53F59AFD4B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 b0d21cdcf845a32d4377336a03072a344289c95211f37f7976db810e9a5d0490
MD5 9e628c827e5640caf07d6959f64d0618
SHA1 0799c65d5c256dbac5ee724e5300c60702155edf
SHA512 9216c226c1b6c001c74cfe50abdfd7e2f27f298e2092550404738deea670c2c4cb9df1019378a8dd80ab0ac2422fa775269ad6d9c55777ecea6826722c947f76
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9wAHj:QqPoBhz1aRxcSUDk36SAEdhvxWa9BHj
TLSH
T1CFF533A8B132B7BCF3450DFC059BC997369729A5BADF6A1BDB8005661C50F1E8FC0185
MD5 SHA1 SHA512 SSDEEP TLSH