ThreatFox: WannaCryptor IOCs

Hunt Hypothesis

This hunt detects adversary behavior where WannaCryptor ransomware actively scans for known Indicators of Compromise (IOCs) to identify encrypted file artifacts or malicious network signatures within the environment. A SOC team should proactively hunt for these signals in Azure Sentinel because early detection of this high-severity threat family allows for immediate containment before widespread data encryption and operational disruption occur.

IOC Summary

Malware Family: WannaCryptor Total IOCs: 42 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`2b0e4a9a122db7e489d927f526f21dbd775c42e3`	payload	2026-07-25	95%
md5_hash	`41faa6070b56ee395b5f811008213b03`	payload	2026-07-25	95%
md5_hash	`687136a7d7e1c1e201913a6168e047ac`	payload	2026-07-25	95%
sha256_hash	`1ba28ed44b1be838f303f53c5388cf1b007212798d50bb3e82932cfc06d7f6dc`	payload	2026-07-25	95%
sha256_hash	`44acb3159fd6e085d3fce3991211912252edbe24c2a1b94b04d55431edab2630`	payload	2026-07-25	95%
sha1_hash	`77bd23afbfc26ea16c6507263fc881d4eed4cb84`	payload	2026-07-25	95%
sha256_hash	`4f4f30d07cc0ed90a92e39b637da4dc99aa76f36cff2362d4d907d77a2465ee5`	payload	2026-07-25	95%
sha1_hash	`546db363bcc9266c133b8363c62103b7a2f1940b`	payload	2026-07-25	95%
md5_hash	`a554260842be80f9fddffcb47f203d43`	payload	2026-07-25	95%
md5_hash	`f7a9be6e4140bb14d916bd73f0868aad`	payload	2026-07-25	95%
sha256_hash	`6925fdec115ca580da0c37cf3804ec6252d1210a4af5acc205bf695aa8d0e0e9`	payload	2026-07-25	95%
sha1_hash	`6ed8767b85a5ddf99b4e7ac4fbc7e50c6db44027`	payload	2026-07-25	95%
sha1_hash	`c480d041069d0c65ffd75eba89ce1135c7b91ff5`	payload	2026-07-25	95%
md5_hash	`b8d3dfe5aff8f0c8955038c174e70195`	payload	2026-07-25	95%
sha256_hash	`7949631d3490ed9fb6b63aff678f7b203df719fe75e671ea16975c6b873010dd`	payload	2026-07-25	95%
sha1_hash	`7a4a94471e49b12f6482b9f64fdd0cc4982dc431`	payload	2026-07-25	95%
md5_hash	`88789a1cc82d672509fc1ce33dff1fe8`	payload	2026-07-25	95%
md5_hash	`5323cf5c653ed0d88b92e934d1c7aff6`	payload	2026-07-25	95%
sha256_hash	`9eacc45bc8c6a2e4954e116d9cd8add64f89e14d1c7d6c1c0027ba6d93c6086a`	payload	2026-07-25	95%
sha256_hash	`bb313ea63402edd0fac30bad39a56e2405bee5b4f07013b09af72ef6c382a731`	payload	2026-07-25	95%
sha1_hash	`660a2ebad18d856bdf89830628f46a1a5a3c0fcf`	payload	2026-07-25	95%
md5_hash	`9ef42799d880c522be09618a03a7b9e6`	payload	2026-07-25	95%
sha256_hash	`b08f921c92a29a0a8449ee27d6860597d7a34baf8d609ca7dbcb06c32d5b2f80`	payload	2026-07-25	95%
sha1_hash	`d7b54e708ddbbf0954a1cccf95d4e8b80dda3150`	payload	2026-07-25	95%
md5_hash	`a71ebf9fd2b7e1969f15e73c9c6eda6e`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - WannaCryptor
let malicious_hashes = dynamic(["2b0e4a9a122db7e489d927f526f21dbd775c42e3", "41faa6070b56ee395b5f811008213b03", "687136a7d7e1c1e201913a6168e047ac", "1ba28ed44b1be838f303f53c5388cf1b007212798d50bb3e82932cfc06d7f6dc", "44acb3159fd6e085d3fce3991211912252edbe24c2a1b94b04d55431edab2630", "77bd23afbfc26ea16c6507263fc881d4eed4cb84", "4f4f30d07cc0ed90a92e39b637da4dc99aa76f36cff2362d4d907d77a2465ee5", "546db363bcc9266c133b8363c62103b7a2f1940b", "a554260842be80f9fddffcb47f203d43", "f7a9be6e4140bb14d916bd73f0868aad", "6925fdec115ca580da0c37cf3804ec6252d1210a4af5acc205bf695aa8d0e0e9", "6ed8767b85a5ddf99b4e7ac4fbc7e50c6db44027", "c480d041069d0c65ffd75eba89ce1135c7b91ff5", "b8d3dfe5aff8f0c8955038c174e70195", "7949631d3490ed9fb6b63aff678f7b203df719fe75e671ea16975c6b873010dd", "7a4a94471e49b12f6482b9f64fdd0cc4982dc431", "88789a1cc82d672509fc1ce33dff1fe8", "5323cf5c653ed0d88b92e934d1c7aff6", "9eacc45bc8c6a2e4954e116d9cd8add64f89e14d1c7d6c1c0027ba6d93c6086a", "bb313ea63402edd0fac30bad39a56e2405bee5b4f07013b09af72ef6c382a731", "660a2ebad18d856bdf89830628f46a1a5a3c0fcf", "9ef42799d880c522be09618a03a7b9e6", "b08f921c92a29a0a8449ee27d6860597d7a34baf8d609ca7dbcb06c32d5b2f80", "d7b54e708ddbbf0954a1cccf95d4e8b80dda3150", "a71ebf9fd2b7e1969f15e73c9c6eda6e", "bae3dd2745c3822b1bc6b869f10bf56167195452dd65104d76f5089537ab6fc2", "b78cac8f8e3b4df820e23868f7bba7c969368307", "e2c42eb4661a0c6c9ff46d7138bf20419a128854", "ebcf21be8b00200b2ffba93aa86ab6d4", "c48e3a289464eec1e638c36ec12996e1c3e71d4b0c098baf94f89086c2ac69d7", "c674994e24fe2c51bc8c4c0dc76ae844f0b16e54870602302b75497a417a2557", "c2b01d8a9346db93666bbe24e313a229afd229f2", "e6a5add76044236710a699d28da24437", "cd62ae8b73fe8129e2912975108f4e9881b872a5e0219c880721c2107bfd4058", "0efa9b13c5c572b41788ad56b12a23afec4a54d1", "9115bd384681bae8ad1fda391f0f3235", "e3b01f8ad177a686c1bbb03243dbb7b67eb71039", "f829810332b993b28f0a3f40cda8c589", "d15749f77571b9aeb35c82944783d149b45ef7a55a51fd36244be74a9d66c291", "4a7de34a1f9f8409114172f4292d3b871e31fcfd", "0e95388031bc357808ae5c06bd70640b", "d58ce6cac24a1c453f868afc0d2bc3e3cc32f430bd0c93be395f76c7de2d2fd8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — WannaCryptor

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: WannaCryptor IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Antivirus or Backup Scans Triggering File Encryption Events
- Context: Enterprise backup agents (e.g., Veeam, Commvault) or AV engines (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often scan and temporarily lock/encrypt large volumes of files during off-hours. If the rule monitors specific file extension changes or encryption process hashes associated with WannaCryptor, these routine operations can mimic ransomware behavior.
- Suggested Filter: Exclude processes running under known service accounts (e.g., NT SERVICE\VeeamTransportService, SYSTEM) and filter out events where the parent process is a recognized backup/AV executable (e.g., vcagent.exe, MsMpEng.exe).
Scenario: IT Admin Performing Bulk File Migration or Archiving
- Context: System administrators frequently use PowerShell scripts or tools like Robocopy to migrate data between servers, which may involve compressing files with .7z or .zip extensions that overlap with WannaCryptor’s encrypted file signatures. Additionally, admins might manually run encryption tools (e.g., GPG) on sensitive datasets.
- Suggested Filter: Create an exclusion for events originating from specific administrative workstations (identified by hostname regex ^ADM-) or user accounts belonging to the “IT_Operations” AD group during business hours (08:00–17:00).
Scenario: Automated Development Build and Deployment Pipelines
- Context: CI/CD pipelines using tools like Jenkins, GitLab Runners, or Azure DevOps often compile code and package artifacts. These processes frequently generate temporary encrypted archives or modify file permissions