hermeticwiper | cc1952ae11b76aaef6158e4a9bc75cdd90f365e47a5388766bb4ccba70f6a8f3 | Triage

Analysis

max time kernel
28s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-08-2022 20:22

Sharing

Report Analysis Logs

General

Target

6e4ff974c258619c66aba8cd048c4bb2.exe
Size

114KB
MD5

6e4ff974c258619c66aba8cd048c4bb2
SHA1

01000a2ee732bc8284fd1704a60fcd3086a957b3
SHA256

cc1952ae11b76aaef6158e4a9bc75cdd90f365e47a5388766bb4ccba70f6a8f3
SHA512

affee57f94b0f6a793212e0a09279c3ac1482611693b35a08770e227ee1eb87fae49e9a61f8e2633d6c6eb41f8718f96e75dffb570806d310d098fcffbe8ef85
SSDEEP

1536:HFkQITufwkfWJurilmw9BgjKu1sPPxaS4jqY:HWQITufwkeJxlPwV16PkS4jqY

Score

10^/10

hermeticwiper wiper

Malware Config

Signatures

Detect HermeticWiper 1 IoCs

Detect HermeticWiper Payload.

resource	yara_rule
behavioral1/memory/900-55-0x0000000001280000-0x000000000129F000-memory.dmp	family_hermeticwiper

HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
wiper hermeticwiper

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	900	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 972	900	6e4ff974c258619c66aba8cd048c4bb2.exe	27
PID 900 wrote to memory of 972	900	6e4ff974c258619c66aba8cd048c4bb2.exe	27
PID 900 wrote to memory of 972	900	6e4ff974c258619c66aba8cd048c4bb2.exe	27
PID 900 wrote to memory of 972	900	6e4ff974c258619c66aba8cd048c4bb2.exe	27

C:\Users\Admin\AppData\Local\Temp\6e4ff974c258619c66aba8cd048c4bb2.exe
"C:\Users\Admin\AppData\Local\Temp\6e4ff974c258619c66aba8cd048c4bb2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 116
  2⤵
  - Program crash
  PID:972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x0000000001280000-0x000000000129F000-memory.dmp

Filesize
124KB

Download