MALICIOUS — Win32.Wannacry.exe

MALICIOUS — Win32.Wannacry.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Cryptolocker family. 7 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 55504677f82981962d85495231695d3a92aa0b31ec35a957bd9cbbef618658e3
SHA-1: 2027a053de21bd5c783c3f823ed1d36966780ed4
MD5: 30fe2f9a048d7a734c8d9233f64810ba
imphash: 2e5708ae5fed0403e8117c645fb23e5b
ssdeep: 49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:+DqPoBhz1aRxcSUDk36SAEdhvxWa9
TLSH: T16A6433A705B73352F3E4DFE07C69ECFE05018459F0351ACAA805D79D66E803B58BA891
Submitted as: Win32.Wannacry.exe
File type: pe · Size: 5267459 bytes
Verdict: malicious (100/100) · Family: Cryptolocker

Detections (7 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): {MD5}bin.ransomware.wanna.7492.UNOFFICIAL
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Cyble Vision: Cyble Vision: WannaCry
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Ransom:Win32/Cryptolocker!dha
Emsisoft (Emergency Kit): Exploit.CVE-2017-0147.15

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged {MD5}bin.ransomware.wanna.7492.UNOFFICIAL (rule {MD5}bin.ransomware.wanna.7492.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
Cyble Vision flagged Cyble Vision: WannaCry (rule Cyble Vision: WannaCry) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Ransom:Win32/Cryptolocker!dha (rule Ransom:Win32/Cryptolocker!dha) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Exploit.CVE-2017-0147.15 (rule Exploit.CVE-2017-0147.15) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com, http://www.search.ask.com/web?q=kontrakan+rumah+dekat+unair+kampus+c&apn_dtid=%5EBND406%5EYY%5EID&apn_ptnrs=%5EAG6&apn_uid=5945204265534554&atb=sysid%3D406%3Aappid%3D645%3Auid%3D2c832be1330c7e33%3Auc2%3D125%3Atypekbn%3Da13203%3Asrc%3Dcrb%3Ao%3DAPN10645%3Atg%3D&d=406-645&gct=ds&lang=en&o=APN10645&p2=%5EAG6%5EBND406%5EYY%5EID&shad=s_0043&tpr=2&ts=1502964506859, http://www.search.ask.com/web?apn_dtid=%5EBND406%5EYY%5EID&apn_ptnrs=%5EAG6&apn_uid=5945204265534554&atb=sysid%3D406%3Aappid%3D645%3Auid%3Dd87a0504773f8e21%3Auc2%3D125%3Atypekbn%3Da13203%3Asrc%3Dcrb%3Ao%3DAPN10645%3Atg%3D&d=406-645&gct=ds&lang=en&o=APN10645&p2=%5EAG6%5EBND406%5EYY%5EID&page=1&shad=s_0043&q=JUAL+TEROPONG+MALAM+NIGHT+VISION+BUSHNELL+MURAH&tpr=5&ots=1503503371536 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
https://accounts.google.co.id/accounts/SetSID?ssdc=1&sidt=ALWU2ctYAye7O0juMarlm532QIoi%2Bwr8tN%2BBPbrmQ/hmm96G6E8KJHUOc3MNBLmTzZF%2BexkidLilKKZhN13/fkQOCVcg%2Bbcok5xAK7sWG5Lxoux3dU/iFtv%2BYQmldSmiFoT1JcPwRTzbYSdbXZNhiYAe/%2BdXuLLI0l4Hab6NW/sHcnzFhWbbpVYVG7gunnyurnoZMEtuC57OKqYRQrySPyawX32ieY4CYXWkQ79UIjU78ZAouWsXClcqLyI1RNNry0Q%2B0rAQwB4P&continue=https://mail.google.com/mail/?auth%3DIQWcD5bS6dHIPAdUnr7YE63CdXsU6o5SpbVnn18jpNaZObI1Qi9iherHmuW9dmXac2L75A.%26authuser%3D1
http://www.search.ask.com/web?q=kontrakan+rumah+dekat+unair+kampus+c&apn_dtid=%5EBND406%5EYY%5EID&apn_ptnrs=%5EAG6&apn_uid=5945204265534554&atb=sysid%3D406%3Aappid%3D645%3Auid%3D2c832be1330c7e33%3Auc2%3D125%3Atypekbn%3Da13203%3Asrc%3Dcrb%3Ao%3DAPN10645%3Atg%3D&d=406-645&gct=ds&lang=en&o=APN10645&p2=%5EAG6%5EBND406%5EYY%5EID&shad=s_0043&tpr=2&ts=1502964506859
http://www.search.ask.com/web?apn_dtid=%5EBND406%5EYY%5EID&apn_ptnrs=%5EAG6&apn_uid=5945204265534554&atb=sysid%3D406%3Aappid%3D645%3Auid%3Dd87a0504773f8e21%3Auc2%3D125%3Atypekbn%3Da13203%3Asrc%3Dcrb%3Ao%3DAPN10645%3Atg%3D&d=406-645&gct=ds&lang=en&o=APN10645&p2=%5EAG6%5EBND406%5EYY%5EID&page=1&shad=s_0043&q=JUAL+TEROPONG+MALAM+NIGHT+VISION+BUSHNELL+MURAH&tpr=5&ots=1503503371536
http://www.search.ask.com/web?apn_dtid=%5EBND406%5EYY%5EID&apn_ptnrs=%5EAG6&apn_uid=5945204265534554&atb=sysid%3D406%3Aappid%3D645%3Auid%3D2c832be1330c7e33%3Auc2%3D125%3Atypekbn%3Da13203%3Asrc%3Dcrb%3Ao%3DAPN10645%3Atg%3D&d=406-645&gct=ds&lang=en&o=APN10645&p2=%5EAG6%5EBND406%5EYY%5EID&page=1&shad=s_0043&q=Kontrakan+Kost+di+Sutorejo+Surabaya&tpr=5&ots=1502965151886
http://www.sciencedirect.com/science/article/pii/S2352250X17301884/pdfft?md5=7092ee52e266c820645f45d927dd1a51&pid=1-s2.0-S2352250X17301884-main.pdf
http://wireless.unair.ac.id/login?dst=http%3A%2F%2Fdts.search.ask.com%2Fsr%3Fsrc%3Dcrb%26gct%3Dds%26appid%3D645%26systemid%3D406%26v%3Da13203-125%26apn%5Fuid%3D5945204265534554%26apn%5Fdtid%3DBND406%26o%3DAPN10645%26apn%5Fptnrs%3DAG6%26q%3Dyahoomail

Embedded domains

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
t.ua
mail.google.com
www.search.ask.com
www.sciencedirect.com
accounts.google.co.id
wireless.unair.ac.id
aefd.nelreports.net

Embedded IP addresses

192.168.56.20

File paths

C:\%s\%s
C:\%s\qeriuwjhrf
d:\5
V:\Ge

More Cryptolocker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report