Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2022 20:22
Behavioral task
behavioral1
Sample
318b972f1fb82f4aeda8e87c0bd5ddd0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
318b972f1fb82f4aeda8e87c0bd5ddd0.exe
Resource
win10v2004-20220812-en
General
-
Target
318b972f1fb82f4aeda8e87c0bd5ddd0.exe
-
Size
114KB
-
MD5
318b972f1fb82f4aeda8e87c0bd5ddd0
-
SHA1
3b6d33a5d83e1647dd9ec9fd2bb5789717f448a6
-
SHA256
811122d2e28ab312d1ac572a9f01b536d692dc7a616603bd0e64976e9b21d55b
-
SHA512
2f7631a88416958c5dd877887ac62046926f916396c30cf809ba89057be64b60f9c49bf6e7cfbfde54274d67f4254a2212597e6749dfa27503bc822c38544203
-
SSDEEP
1536:HFkQITufwkfWDurilmw9BgjKu1sPPxaS4jqY:HWQITufwkeDxlPwV16PkS4jqY
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3504-132-0x0000000000740000-0x000000000075F000-memory.dmp family_hermeticwiper -
HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3908 3504 WerFault.exe 318b972f1fb82f4aeda8e87c0bd5ddd0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\318b972f1fb82f4aeda8e87c0bd5ddd0.exe"C:\Users\Admin\AppData\Local\Temp\318b972f1fb82f4aeda8e87c0bd5ddd0.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 3642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3504 -ip 35041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3504-132-0x0000000000740000-0x000000000075F000-memory.dmpFilesize
124KB