hermeticwiper | 9e3f2ba8ae13ff79afca0409f01722ee267656cffec025b072c5e68aa728e039 | Triage

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2022 20:23

Sharing

Report Analysis Logs

General

Target

933ba58d475ac553de2d58afbba9e272.exe
Size

114KB
MD5

933ba58d475ac553de2d58afbba9e272
SHA1

41deeed3204bd68b6a8d4deea8729b93338dedf9
SHA256

9e3f2ba8ae13ff79afca0409f01722ee267656cffec025b072c5e68aa728e039
SHA512

b0255df183c39340b3b91f69bd15d678e6d8ecad5e36fb0b032ae2dc18e2f35e2a4716720abd521e1ee2ca1b77c5fda8da146843ad79806ce65ad2dde0b33948
SSDEEP

1536:iruRPmNmWDurilmw9BgjKu1sPPxaS4jqY:iruRPmtDxlPwV16PkS4jqY

Score

10^/10

hermeticwiper wiper

Malware Config

Signatures

Detect HermeticWiper 2 IoCs

Detect HermeticWiper Payload.

resource	yara_rule
behavioral2/memory/2092-132-0x0000000000510000-0x000000000052F000-memory.dmp	family_hermeticwiper
behavioral2/memory/2092-133-0x0000000000510000-0x000000000052F000-memory.dmp	family_hermeticwiper

HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
wiper hermeticwiper

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3516	2092	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\933ba58d475ac553de2d58afbba9e272.exe
"C:\Users\Admin\AppData\Local\Temp\933ba58d475ac553de2d58afbba9e272.exe"
1⤵
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 364
  2⤵
  - Program crash
  PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2092 -ip 2092
1⤵
PID:260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-132-0x0000000000510000-0x000000000052F000-memory.dmp

Filesize
124KB

Download
memory/2092-133-0x0000000000510000-0x000000000052F000-memory.dmp

Filesize
124KB

Download