MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 427c05a71e319854d7e14101eae7bf57f08301b232fd113b3a9e0ce00ac9e9a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WannaCry

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	427c05a71e319854d7e14101eae7bf57f08301b232fd113b3a9e0ce00ac9e9a9
SHA3-384 hash:	d385bfe2df7c2015f357b87f6e9c883bcd812ed48341e29cc90193ab676b419908bd844168ffa315fdb3406e175ced99
SHA1 hash:	4a035f3176571d7ec1dd50b1352fca9f272b71c6
MD5 hash:	9f6f93a56be80483af2ae081b1c5877f
humanhash:	magazine-moon-charlie-snake
File name:	202305179f6f93a56be80483af2ae081b1c5877fwannacry
Download:	download sample
Signature	WannaCry Create hunting rule
File size:	6'729'728 bytes
First seen:	2023-05-18 13:47:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9ecee117164e0b870a53dd187cdd7174 (82 x WannaCry, 1 x Worm.Virut)
ssdeep	49152:ontQqMSPbcBVQeK1INR9SqTdX1HkQo6SAA:Y2qPoBhK1aR9SUDk36SA
TLSH	T1E266F601D1E51AA0DAF25EF726BADB10833A6E45C95BA66E1221510F0C77F0CDDE6F2C
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	JaffaCakes118
Tags:	WannaCry

Intelligence

File Origin

# of uploads :

# of downloads :

314

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

202305179f6f93a56be80483af2ae081b1c5877fwannacry

Verdict:

No threats detected

Analysis date:

2023-05-18 18:23:00 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2b9ff72f-14d6-48fd-a381-0db40bbb5cf1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a service

Launching a service

Searching for synchronization primitives

Sending a custom TCP request

Enabling autorun for a service

Forced shutdown of a system process

Enabling autorun by creating a file

Gathering data

Verdict:

Malicious

Labled as:

CVE-2017-0147

Link:

https://www.hybrid-analysis.com/sample/427c05a71e319854d7e14101eae7bf57f08301b232fd113b3a9e0ce00ac9e9a9

Malware family:

Mimikatz

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bf5037db-c3d5-4f28-86b2-6c1f596eeff7

Result

Threat name:

Wannacry

Detection:

malicious

Classification:

rans.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1236661

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected Wannacry Ransomware

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Wannacry ransomware

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/427c05a71e319854d7e14101eae7bf57f08301b232fd113b3a9e0ce00ac9e9a9/

Threat name:

Win32.Ransomware.WannaCry

Status:

Malicious

First seen:

2023-05-16 15:55:31 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ij6aljy6ggmfjv7biea6vz57k7yigansgl6rcoz2tygoacwj5guq._file

Result

Malware family:

wannacry

Score:

10/10

Tags:

family:wannacry ransomware worm

Link:

https://tria.ge/reports/230518-q38xbabf38/

Behaviour

Modifies data under HKEY_USERS

Drops file in Windows directory

Drops file in System32 directory

Executes dropped EXE

Wannacry

Unpacked files

SH256 hash:

427c05a71e319854d7e14101eae7bf57f08301b232fd113b3a9e0ce00ac9e9a9

MD5 hash:

9f6f93a56be80483af2ae081b1c5877f

SHA1 hash:

4a035f3176571d7ec1dd50b1352fca9f272b71c6

Link:

https://www.unpac.me/results/e4f7ae6a-9de7-4a37-8eaa-a653008a3b5d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/427c05a71e319854d7e14101eae7bf57f08301b232fd113b3a9e0ce00ac9e9a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	WannaCry_Ransomware Create hunting rule
Author:	Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:	Detects WannaCry Ransomware
Reference:	https://goo.gl/HG2j5T

Rule name:	Win32_Ransomware_WannaCry Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects WannaCry ransomware.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample