ThreatFox: WannaCryptor IOCs

Hunt Hypothesis

This hunt identifies known indicators of compromise associated with the WannaCryptor ransomware, which leverages the EternalBlue SMB exploit to achieve rapid lateral movement and encryption of files across the network. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect potential infections early, mitigating the risk of widespread data loss and service disruption before the ransomware can fully propagate.

IOC Summary

Malware Family: WannaCryptor Total IOCs: 18 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	a4bb6de1f82e9c8090d7837e0214a0962790a3f4	payload	2026-09-13	95%
md5_hash	b82bc571bf628d692482af7b38cd16aa	payload	2026-09-13	95%
sha256_hash	b436638170cdd9ceabe7d1049c26c6740887cda128aab9f4860957c90ea61420	payload	2026-09-13	95%
sha1_hash	722294909baebbbd2e61ace8eb42b89170ce084b	payload	2026-09-13	95%
md5_hash	6d1edb3a65fc022cfa90f9c00eb2629d	payload	2026-09-13	95%
sha256_hash	b4340ceb494626014fc86a0cd1c59bb0c0ccff460b1c3e6c03f6d6a54c7ea1f7	payload	2026-09-13	95%
md5_hash	bf37c9919b35a2dfb460dc07f2e03f90	payload	2026-09-13	95%
sha256_hash	c0dc629d5ef691bd5e086bbeab9bda1ec7317795119075b3a7b0162a8806a5eb	payload	2026-09-13	95%
sha1_hash	43e951b6979ab83deb90c00109d92d2af264cee8	payload	2026-09-13	95%
md5_hash	c9728efa849979820dd1172ac7b90776	payload	2026-09-13	95%
sha256_hash	c2575cfd4b69d58ff625346a1f10c30e006fc94fd24fcc131b47eb5f1e533f0e	payload	2026-09-13	95%
sha1_hash	d5a041733fb6edc3a97177c81a2a6e4ce76b1435	payload	2026-09-13	95%
sha256_hash	c2da9df79fc5442fc83eb97152e4ac1727df182ed8023b4ccff8ea4138e02918	payload	2026-09-13	95%
sha1_hash	1e44ce8e1eac0996fe0be1f7c2678598fd1654ca	payload	2026-09-13	95%
md5_hash	ecbe908227806271221254ce5dd73a09	payload	2026-09-13	95%
sha256_hash	cb70ad8eaba6aae7bb80244ae9cc265988841bcf120ed865af8091290490cf66	payload	2026-09-13	95%
sha1_hash	dc976f2e9eaa089b196e0fee615e0621bbdaa93b	payload	2026-09-13	95%
md5_hash	400d8e0397ae74edd5d3462c21cc82fd	payload	2026-09-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - WannaCryptor
let malicious_hashes = dynamic(["a4bb6de1f82e9c8090d7837e0214a0962790a3f4", "b82bc571bf628d692482af7b38cd16aa", "b436638170cdd9ceabe7d1049c26c6740887cda128aab9f4860957c90ea61420", "722294909baebbbd2e61ace8eb42b89170ce084b", "6d1edb3a65fc022cfa90f9c00eb2629d", "b4340ceb494626014fc86a0cd1c59bb0c0ccff460b1c3e6c03f6d6a54c7ea1f7", "bf37c9919b35a2dfb460dc07f2e03f90", "c0dc629d5ef691bd5e086bbeab9bda1ec7317795119075b3a7b0162a8806a5eb", "43e951b6979ab83deb90c00109d92d2af264cee8", "c9728efa849979820dd1172ac7b90776", "c2575cfd4b69d58ff625346a1f10c30e006fc94fd24fcc131b47eb5f1e533f0e", "d5a041733fb6edc3a97177c81a2a6e4ce76b1435", "c2da9df79fc5442fc83eb97152e4ac1727df182ed8023b4ccff8ea4138e02918", "1e44ce8e1eac0996fe0be1f7c2678598fd1654ca", "ecbe908227806271221254ce5dd73a09", "cb70ad8eaba6aae7bb80244ae9cc265988841bcf120ed865af8091290490cf66", "dc976f2e9eaa089b196e0fee615e0621bbdaa93b", "400d8e0397ae74edd5d3462c21cc82fd"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — WannaCryptor

False Positive Guidance

• Scenario: A legacy Windows Server 2012 R2 machine is being patched via a custom PowerShell script that explicitly sets the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters registry key to disable SMBv1, a common hardening step post-WannaCry. The script writes the specific registry value name and data that matches the IOC.

  • Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or pwsh.exe and the registry path ends in \LanmanWorkstation\Parameters, provided the parent process is launched by a known admin tool like PsExec.exe or WinRM.exe.

• Scenario: An IT administrator uses PsExec to remotely execute a batch file on a cluster of file servers to rename the lsass.exe service binary to lsass.bak as part of a credential dumping mitigation strategy. This action triggers the file rename IOC.

  • Filter/Exclusion: Exclude alerts where the source file is lsass.exe and the destination file is lsass.bak (or similar backup suffixes like .old, .bak), and the parent process is PsExec.exe or cmd.exe initiated by a service account.

• Scenario: A scheduled task named “WannaCry_Mitigation” runs daily on domain controllers to check for the presence of the C:\Windows\Temp\mssecsv.exe file (a known WannaCry drop location) and delete it if found. The creation or deletion of this specific file path triggers the file-based IOC.

  • Filter/Exclusion: Exclude alerts involving file operations on C:\Windows\Temp\mssecsv.exe where the parent process is cmd.exe or powershell.exe and the command line contains keywords