wannacry | f80173f1bc4ee4dcc91c1ade1bdccd066d31b0fb41464c7ee07fee43c9780773

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f80173f1bc4ee4dcc91c1ade1bdccd066d31b0fb41464c7ee07fee43c9780773.dll
Size 5.0MB
Sample261102-jpchmaat3r
SHA256 f80173f1bc4ee4dcc91c1ade1bdccd066d31b0fb41464c7ee07fee43c9780773
MD5 05f3e1aa5c2ed0309b9925a7fdd4e7be
SHA1 306af23c79542e2ac1428c7c74b516786f67c1ef
SHA512 53c5b48dfa80088192c4c4d483b317c512b6021c25436a6700f1d5bd820c7146a1e1ee59a4e281fca14c58ed9e8684bdc41187c63a3607aa1e320d39bee2ea90
SSDEEP 24576:JbLgdeQhfdmMSirYbcMNgef0QeQjGOaR7jrAeotsJdqjqjNB0BDlHBYKxE:JnjQqMSPbcBVQejxtHrqGJBED
TLSH
T1C8369D18BBC4C466C4CFF2B5D0A30B953A3D5958DBB427637A01BE38D5F77A48A192C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3319) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2644	mssecsvc.exe
3316	mssecsvc.exe
3920	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 5656	756	rundll32.exe	89
PID 5656 wrote to memory of 2644	5656	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f80173f1bc4ee4dcc91c1ade1bdccd066d31b0fb41464c7ee07fee43c9780773.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f80173f1bc4ee4dcc91c1ade1bdccd066d31b0fb41464c7ee07fee43c9780773.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2644
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3920

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 055a91000bd0e6b58b7fd1963b0f2cd25cdf7f65de71dc328d33df724eea158b
MD5 d41dcc487f9923e39c1866539fc5215c
SHA1 8054ff16deb626a38ef3d50eb9d45a3be59d27a3
SHA512 a5c9989780de4bbe7851a6ec12a3bdcf4837e2e4ae54fc1fa28a832274a0d8f2979cd70b39df5acfb47651399f29776a5093eff0f78abd951b23a9cb6dfd37e2
SSDEEP 24576:VbLgdeQhfdmMSirYbcMNgef0QeQjGOaR7jrAeotsJdqjqjNB0BDlHBYKxE:VnjQqMSPbcBVQejxtHrqGJBED
TLSH
T1AB069D18BBC4C466C4CFF2B5D0A30B953A3D5958DBB427637A01BE38D5F77A48A192C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 489ddf14aedc840593ab73e3107051e853f7b0587f7abc336ad73bc0275606d0
MD5 71fc947bf90b8e438ac2af84d9c08b32
SHA1 80109301533b47fc0fe7c5ac6a2bb5ce0097bfe6
SHA512 7ab76a92671eeddd4993d59fc083158dbfa8e2356b8d5b21343336c0f87707a3e3e4d0422cf9143b3cb1f9fe2f24bb861f7776caf629af85e60cee4975376957
SSDEEP 24576:nQhfdmMSirYbcMNgef0QeQjGOaR7jrAeotsJdqjqjNB0BDlHBYKxES:nQqMSPbcBVQejxtHrqGJBED/
TLSH
T196F58D18BBC4C566C4CFF2B5E0A30B953A3D5558DBB427637902BE38D1F77A48A192C2
MD5 SHA1 SHA512 SSDEEP TLSH