MALICIOUS — 8ec6066000f5585d6fefbc1d5a30fa094ac9893456dbf4085fec81e6b71cef3b.exe

MALICIOUS — 8ec6066000f5585d6fefbc1d5a30fa094ac9893456dbf4085fec81e6b71cef3b.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Wanna family. 7 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8ec6066000f5585d6fefbc1d5a30fa094ac9893456dbf4085fec81e6b71cef3b
SHA-1: 0f9a253afc55a8ebbd29a70c43d0e3cd668920f4
MD5: 9aed790a18f214b04619837cd71546d3
imphash: 0cdadfa1098d845dd3b4cf92625b5f04
ssdeep: 24576:jbLgBbLgurgQhfdmMSirYbcMNgef0QeQjG/:jnsnsQqMSPbcBVQej/
TLSH: T1616422A545A77382E3F4DE80BC78CDFE8403E89874B62BD85506CA9D25E803F9CB6154
Submitted as: 8ec6066000f5585d6fefbc1d5a30fa094ac9893456dbf4085fec81e6b71cef3b.exe
File type: pe · Size: 5298176 bytes
Verdict: malicious (100/100) · Family: Wanna

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (7 of 53 engines)

ClamAV (daily): Win.Ransomware.Wanna-9769986-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Hash: abuse.ch ThreatFox: known-malicious-hash
Microsoft Defender: Ransom:Win32/WannaCrypt!pz
Emsisoft (Emergency Kit): Exploit.CVE-2017-0147
Kaspersky (KVRT): Trojan.Win32.Eb.s
Trellix Stinger (McAfee): Ransom!9AED790A18F2

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Wanna-9769986-0 (rule Win.Ransomware.Wanna-9769986-0) - engine signal, weight 0.90, confidence 0.95
Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7976) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Ransom:Win32/WannaCrypt!pz (rule Ransom:Win32/WannaCrypt!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Exploit.CVE-2017-0147 (rule Exploit.CVE-2017-0147) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

54 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

b7d59b3e6a2c73ce71ecb817ca8383d0bf0b558345f20399e1b944c9aabc3b94 - b7d59b3e6a2c73ce71ecb817ca8383d0bf0b558345f20399e1b944c9aabc3b94

Embedded URLs

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Embedded domains

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
www.msftconnecttest.com
dns.msftncsi.com
config.edge.skype.com
www.bing.com
edge.microsoft.com
aps.prod.windows.com
watson.events.data.microsoft.com
g.live.com
ecs.office.com
www.msftncsi.com
fs.microsoft.com
self.events.data.microsoft.com
msedge.api.cdp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com

Embedded IP addresses

192.168.56.20

File paths

C:\%s\%s
C:\%s\qeriuwjhrf

More Wanna samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report