Detecting HermeticWiper
Tags
attack-pattern: Data Exploits - T1587.004 Exploits - T1588.005 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Regsvr32 - T1218.010 Rundll32 - T1218.011 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 New Service - T1050 Powershell - T1086 Regsvr32 - T1117 Rundll32 - T1085
Show in Graph
Common Information
Type Value
UUID e23abee3-f366-4842-953b-ee2081043ecb
Fingerprint b51f885fa964e481
Analysis status DONE
Considered CTI value 0
Text language
Published March 10, 2022, 9:50 a.m.
Added to db Sept. 26, 2022, 9:34 a.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline Detecting HermeticWiper
Title Detecting HermeticWiper
Detected Hints/Tags/Attributes 70/1/8
Source URLs
Redirection Url
Details Source https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html
URL Provider
Details Provider Source level domain
Details splunk.com www.splunk.com
Attributes
Details Type #Events CTI Value
Details Domain 22 
research.splunk.com
Details File 226 
certutil.exe
Details File 9 
read_me.html
Details File 5 
endpoint.reg
Details File 6 
registry.reg
Details File 2125 
cmd.exe
Details File 1018 
rundll32.exe
Details File 95 
wevtutil.exe