ThreatFox: WannaCryptor IOCs

Hunt Hypothesis

This detection rule identifies WannaCryptor ransomware activity by monitoring for indicators of compromise such as phishing email interactions and exploitation of unpatched systems that lead to file encryption events. Proactively hunting for these behaviors in Azure Sentinel is critical because early identification of stolen credentials or vulnerability exploits allows the SOC team to isolate affected endpoints before widespread data loss occurs, thereby minimizing operational disruption and ransom demands.

IOC Summary

Malware Family: WannaCryptor Total IOCs: 26 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	2b0e4a9a122db7e489d927f526f21dbd775c42e3	payload	2026-07-25	95%
md5_hash	41faa6070b56ee395b5f811008213b03	payload	2026-07-25	95%
md5_hash	687136a7d7e1c1e201913a6168e047ac	payload	2026-07-25	95%
sha256_hash	1ba28ed44b1be838f303f53c5388cf1b007212798d50bb3e82932cfc06d7f6dc	payload	2026-07-25	95%
sha256_hash	44acb3159fd6e085d3fce3991211912252edbe24c2a1b94b04d55431edab2630	payload	2026-07-25	95%
sha1_hash	77bd23afbfc26ea16c6507263fc881d4eed4cb84	payload	2026-07-25	95%
sha256_hash	4f4f30d07cc0ed90a92e39b637da4dc99aa76f36cff2362d4d907d77a2465ee5	payload	2026-07-25	95%
sha1_hash	546db363bcc9266c133b8363c62103b7a2f1940b	payload	2026-07-25	95%
md5_hash	a554260842be80f9fddffcb47f203d43	payload	2026-07-25	95%
md5_hash	f7a9be6e4140bb14d916bd73f0868aad	payload	2026-07-25	95%
sha256_hash	6925fdec115ca580da0c37cf3804ec6252d1210a4af5acc205bf695aa8d0e0e9	payload	2026-07-25	95%
sha1_hash	6ed8767b85a5ddf99b4e7ac4fbc7e50c6db44027	payload	2026-07-25	95%
sha1_hash	c480d041069d0c65ffd75eba89ce1135c7b91ff5	payload	2026-07-25	95%
md5_hash	b8d3dfe5aff8f0c8955038c174e70195	payload	2026-07-25	95%
sha256_hash	7949631d3490ed9fb6b63aff678f7b203df719fe75e671ea16975c6b873010dd	payload	2026-07-25	95%
sha1_hash	7a4a94471e49b12f6482b9f64fdd0cc4982dc431	payload	2026-07-25	95%
md5_hash	88789a1cc82d672509fc1ce33dff1fe8	payload	2026-07-25	95%
md5_hash	5323cf5c653ed0d88b92e934d1c7aff6	payload	2026-07-25	95%
sha256_hash	9eacc45bc8c6a2e4954e116d9cd8add64f89e14d1c7d6c1c0027ba6d93c6086a	payload	2026-07-25	95%
sha256_hash	bb313ea63402edd0fac30bad39a56e2405bee5b4f07013b09af72ef6c382a731	payload	2026-07-25	95%
sha1_hash	660a2ebad18d856bdf89830628f46a1a5a3c0fcf	payload	2026-07-25	95%
md5_hash	9ef42799d880c522be09618a03a7b9e6	payload	2026-07-25	95%
sha256_hash	b08f921c92a29a0a8449ee27d6860597d7a34baf8d609ca7dbcb06c32d5b2f80	payload	2026-07-25	95%
sha1_hash	d7b54e708ddbbf0954a1cccf95d4e8b80dda3150	payload	2026-07-25	95%
md5_hash	a71ebf9fd2b7e1969f15e73c9c6eda6e	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - WannaCryptor
let malicious_hashes = dynamic(["2b0e4a9a122db7e489d927f526f21dbd775c42e3", "41faa6070b56ee395b5f811008213b03", "687136a7d7e1c1e201913a6168e047ac", "1ba28ed44b1be838f303f53c5388cf1b007212798d50bb3e82932cfc06d7f6dc", "44acb3159fd6e085d3fce3991211912252edbe24c2a1b94b04d55431edab2630", "77bd23afbfc26ea16c6507263fc881d4eed4cb84", "4f4f30d07cc0ed90a92e39b637da4dc99aa76f36cff2362d4d907d77a2465ee5", "546db363bcc9266c133b8363c62103b7a2f1940b", "a554260842be80f9fddffcb47f203d43", "f7a9be6e4140bb14d916bd73f0868aad", "6925fdec115ca580da0c37cf3804ec6252d1210a4af5acc205bf695aa8d0e0e9", "6ed8767b85a5ddf99b4e7ac4fbc7e50c6db44027", "c480d041069d0c65ffd75eba89ce1135c7b91ff5", "b8d3dfe5aff8f0c8955038c174e70195", "7949631d3490ed9fb6b63aff678f7b203df719fe75e671ea16975c6b873010dd", "7a4a94471e49b12f6482b9f64fdd0cc4982dc431", "88789a1cc82d672509fc1ce33dff1fe8", "5323cf5c653ed0d88b92e934d1c7aff6", "9eacc45bc8c6a2e4954e116d9cd8add64f89e14d1c7d6c1c0027ba6d93c6086a", "bb313ea63402edd0fac30bad39a56e2405bee5b4f07013b09af72ef6c382a731", "660a2ebad18d856bdf89830628f46a1a5a3c0fcf", "9ef42799d880c522be09618a03a7b9e6", "b08f921c92a29a0a8449ee27d6860597d7a34baf8d609ca7dbcb06c32d5b2f80", "d7b54e708ddbbf0954a1cccf95d4e8b80dda3150", "a71ebf9fd2b7e1969f15e73c9c6eda6e", "bae3dd2745c3822b1bc6b869f10bf56167195452dd65104d76f5089537ab6fc2"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — WannaCryptor

False Positive Guidance

False Positive Scenarios for “ThreatFox: WannaCryptor IOCs” Rule

• Scenario 1: Automated Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites like Microsoft Defender for Endpoint or CrowdStrike Falcon frequently download and install new definition updates. These processes often generate network traffic to specific vendor update servers that match the IOCs (IP addresses or domains) associated with WannaCryptor’s command-and-control infrastructure, triggering a false alert due to overlapping reputation data.
  • Suggested Filter/Exclusion: Create an exclusion for outbound connections originating from the C:\Program Files\Microsoft Defender Antivirus\ directory (or specific CrowdStrike process paths) connecting to known vendor update domains (e.g., *.microsoft.com, *.crowdstrike.com). Additionally, whitelist the specific IP ranges used by these vendors in the detection logic.

• Scenario 2: Scheduled Backup Jobs via Ransomware-Resistant Tools

  • Context: Legitimate backup solutions such as Veeam Backup & Replication or Rubrik often execute scheduled jobs that involve heavy file I/O and network transmission to offsite repositories. If the backup server’s IP address or the specific ports used for data replication overlap with WannaCryptor’s known IOCs, the rule may misinterpret these high-volume legitimate transfers as ransomware encryption activity.
  • Suggested Filter/Exclusion: Exclude traffic generated by the Veeam.Backup.Service.exe process (and equivalent Rubrik agents) from the detection scope. Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00–04:00 UTC) where these backup jobs are historically scheduled.

• Scenario 3: Legacy Application Patching via WSUS or SCCM

  • Context: In environments utilizing **