hermeticwiper | 811122d2e28ab312d1ac572a9f01b536d692dc7a616603bd0e64976e9b21d55b | Triage

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2022 20:22

Sharing

Report Analysis Logs

General

Target

318b972f1fb82f4aeda8e87c0bd5ddd0.exe
Size

114KB
MD5

318b972f1fb82f4aeda8e87c0bd5ddd0
SHA1

3b6d33a5d83e1647dd9ec9fd2bb5789717f448a6
SHA256

811122d2e28ab312d1ac572a9f01b536d692dc7a616603bd0e64976e9b21d55b
SHA512

2f7631a88416958c5dd877887ac62046926f916396c30cf809ba89057be64b60f9c49bf6e7cfbfde54274d67f4254a2212597e6749dfa27503bc822c38544203
SSDEEP

1536:HFkQITufwkfWDurilmw9BgjKu1sPPxaS4jqY:HWQITufwkeDxlPwV16PkS4jqY

Score

10^/10

hermeticwiper wiper

Malware Config

Signatures

Detect HermeticWiper 1 IoCs

Detect HermeticWiper Payload.

resource	yara_rule
behavioral2/memory/3504-132-0x0000000000740000-0x000000000075F000-memory.dmp	family_hermeticwiper

HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
wiper hermeticwiper

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3908	3504	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\318b972f1fb82f4aeda8e87c0bd5ddd0.exe
"C:\Users\Admin\AppData\Local\Temp\318b972f1fb82f4aeda8e87c0bd5ddd0.exe"
1⤵
PID:3504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 364
  2⤵
  - Program crash
  PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3504 -ip 3504
1⤵
PID:4272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3504-132-0x0000000000740000-0x000000000075F000-memory.dmp

Filesize
124KB

Download