MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fb6be3792d4ff46412327b950347c0b6039b01c03a32cc9d43e705f391d3f2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WannaCry

Vendor detections: 15

Intelligence 15 IOCs YARA 5 File information Comments

SHA256 hash:	9fb6be3792d4ff46412327b950347c0b6039b01c03a32cc9d43e705f391d3f2e
SHA3-384 hash:	c9912672896115706e970c8b8592930047f8a3181eb9a3e0360d77d50d15917207706f9e30c1a195443935e6f76fbc05
SHA1 hash:	0983a2029594235866da7fd32666e66e2f4cd442
MD5 hash:	87d661a6e941293775d4a5a818c28a44
humanhash:	hotel-violet-pizza-virginia
File name:	2023-04-17_87d661a6e941293775d4a5a818c28a44_wannacry
Download:	download sample
Signature	WannaCry Create hunting rule
File size:	6'729'728 bytes
First seen:	2023-04-18 09:07:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9ecee117164e0b870a53dd187cdd7174 (82 x WannaCry, 1 x Worm.Virut)
ssdeep	98304:NbqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:NbqPe1Cxcxk3ZAEUadzR8yc4
Threatray	1'032 similar samples on MalwareBazaar
TLSH	T1EC6633A4A22CF6FCE1151DF04453891BA7B73C6567BA4A1F8B8046A70D43F6FAFC0951
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	petikvx
Tags:	WannaCry

Intelligence

File Origin

# of uploads :

# of downloads :

296

Origin country :

Vendor Threat Intelligence

Malware family:

wannacry

ID:

File name:

2023-04-17_87d661a6e941293775d4a5a818c28a44_wannacry

Verdict:

Malicious activity

Analysis date:

2023-04-18 09:08:01 UTC

Tags:

ransomware wannacry trojan

Link:

https://app.any.run/tasks/d27a2664-6e00-4bf0-8430-a08592b5e9ad

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/382963/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a service

Launching a service

Searching for synchronization primitives

Sending a custom TCP request

Query of malicious DNS domain

Enabling autorun for a service

Forced shutdown of a system process

Sending an HTTP GET request to an infection source

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/80168/overview

Behaviour

MalwareBazaar

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cmd.exe filecoder greyware packed ransomware shell32.dll wanna wannacry wannacrypt wannacryptor worm

Link:

https://www.filescan.io/uploads/643e5df8b197bbdcf7dc43e5/reports/f2215f74-2597-49c2-b268-cd6074bb073c/overview

Verdict:

Malicious

Labled as:

CVE-2017-0147

Link:

https://www.hybrid-analysis.com/sample/9fb6be3792d4ff46412327b950347c0b6039b01c03a32cc9d43e705f391d3f2e

Malware family:

Mimikatz

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fc48a796-a92e-401a-9dc7-01ac2a19a8bd

Result

Threat name:

Wannacry

Detection:

malicious

Classification:

rans.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1215769

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Detected Wannacry Ransomware

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to download HTTP data from a sinkholed server

Yara detected Wannacry ransomware

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9fb6be3792d4ff46412327b950347c0b6039b01c03a32cc9d43e705f391d3f2e/

Threat name:

Win32.Ransomware.WannaCry

Status:

Malicious

First seen:

2023-04-16 16:09:23 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t63l4n4s2t7umqjde64vand4bnqdtma4aorszsouhzyf6oi5h4xa._file

Verdict:

malicious

WannaCry

36dde0acce43dac1e5baa8e4b121a96f9aa0315c4386a203f6ea4e56534c7859

WannaCry

38dee9dac68372b67ca358f8acce624c8d7f7c871a540cc43744eae196908a59

WannaCry

73882be52f021ab5e22df371a4ed3ff95e5e0c50cdb6a5126133833037fa5497

WannaCry

b95ce7cf432b0a9af6affc3637c377b7aea5da351b433513e4136f4741a43357

WannaCry

bb1611ffc0faf19c968b81c81f45490692be6a0ed26facc377790aae798e2271

WannaCry

c6ab2ae000b489854095e1cbc87e81835dea0075bc2d7830be8ec1196aeaa658

WannaCry

cb99a87b7aa2948a6229b949daad62ae9cbadef89969a8238b6f092de382edfa

WannaCry

d6a6375525eea8dd410d8dd6a98130f607b665e3ab7cd2824d84bdab5db66381

WannaCry

ec29f4db6e43c8bfad91f4d2910c6db42b975d33f7a51c69ea9e0dc9d400584f

WannaCry

+ 1'022 additional samples on MalwareBazaar

Result

Malware family:

wannacry

Score:

10/10

Tags:

family:wannacry ransomware worm

Link:

https://tria.ge/reports/230418-k3wzvsae77/

Behaviour

Modifies data under HKEY_USERS

Drops file in Windows directory

Drops file in System32 directory

Executes dropped EXE

Wannacry

Unpacked files

SH256 hash:

9fb6be3792d4ff46412327b950347c0b6039b01c03a32cc9d43e705f391d3f2e

MD5 hash:

87d661a6e941293775d4a5a818c28a44

SHA1 hash:

0983a2029594235866da7fd32666e66e2f4cd442

Link:

https://www.unpac.me/results/a2f9540d-1a8c-47a7-8bc8-dab063722d06/

Malware family:

WannaCry

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9fb6be3792d4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

SNC

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9fb6be3792d4ff46412327b950347c0b6039b01c03a32cc9d43e705f391d3f2e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	WannaCry_Ransomware Create hunting rule
Author:	Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:	Detects WannaCry Ransomware
Reference:	https://goo.gl/HG2j5T

Rule name:	Win32_Ransomware_WannaCry Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects WannaCry ransomware.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/382963/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample