MALICIOUS — cc47c62f4d5bcc822047d79b90527bf66e30c294117c2d84337a87b124ae2db9.exe

MALICIOUS — cc47c62f4d5bcc822047d79b90527bf66e30c294117c2d84337a87b124ae2db9.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Wanna family. 7 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: cc47c62f4d5bcc822047d79b90527bf66e30c294117c2d84337a87b124ae2db9
SHA-1: adaf9a0cb95be1726727732e79fba2b15d386c03
MD5: ff1de6f4d4f35c0a43d425822d66376a
imphash: 0cdadfa1098d845dd3b4cf92625b5f04
ssdeep: 49152:jnZnsEMSPbcBVQej/NAARdhnvoAHBT/UzeKZS5:DtfPoBhzNAEdhvpHBTyR0
TLSH: T1B864239940B27383E3F5DE84ECA8CDFE4452EC8A74721ACD2505C96DA5E807B8CF1295
Submitted as: cc47c62f4d5bcc822047d79b90527bf66e30c294117c2d84337a87b124ae2db9.exe
File type: pe · Size: 5298176 bytes
Verdict: malicious (100/100) · Family: Wanna

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (7 of 53 engines)

ClamAV (daily): Win.Ransomware.Wanna-9769986-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Hash: abuse.ch ThreatFox: known-malicious-hash
Kaspersky (KVRT): Trojan.Win32.Eb.s
Microsoft Defender: Ransom:Win32/WannaCrypt!pz
Emsisoft (Emergency Kit): Exploit.CVE-2017-0147
Trellix Stinger (McAfee): Ransom!FF1DE6F4D4F3

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Wanna-9769986-0 (rule Win.Ransomware.Wanna-9769986-0) - engine signal, weight 0.90, confidence 0.95
Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8112) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

56 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

c5271a9ec01ecf6d9095b5e7d656996c72deb3a7091b7cd3a8c84decc547450b - c5271a9ec01ecf6d9095b5e7d656996c72deb3a7091b7cd3a8c84decc547450b

Embedded URLs

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Embedded domains

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
searchapp.bundleassets.example
www.msftconnecttest.com
www.bing.com
config.edge.skype.com
tas02.sls.update.microsoft.com
dns.msftncsi.com
to-do.microsoft.com
settings-win.data.microsoft.com
ctldl.windowsupdate.com
edge.microsoft.com
watson.events.data.microsoft.com
aps.prod.windows.com
g.live.com
ecs.office.com
www.msftncsi.com
fs.microsoft.com
self.events.data.microsoft.com
msedge.api.cdp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com

Embedded IP addresses

192.168.56.20

File paths

C:\%s\%s
C:\%s\qeriuwjhrf
d:\5
V:\Ge

More Wanna samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report