splunk-security_content/docs/_stories/hermetic_wiper.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Hermetic Wiper	2022-03-02	true		Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint Exploitation

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2022-03-02
• Author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk
• ID: b7511c2e-9a10-11ec-99e3-acde48001122

Narrative

Hermetic Wiper is destructive malware operation found by Sentinel One targeting multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction.

Detections

Name	Technique	Type
CMD Carry Out String Command Parameter	Windows Command Shell, Command and Scripting Interpreter	Hunting
Executable File Written in Administrative SMB Share	Remote Services, SMB/Windows Admin Shares	TTP
Executables Or Script Creation In Suspicious Path	Masquerading	TTP
Regsvr32 Silent and Install Param Dll Loading	Signed Binary Proxy Execution, Regsvr32	Anomaly
Suspicious Process File Path	Create or Modify System Process	TTP
Windows Disable Memory Crash Dump	Data Destruction	TTP
Windows File Without Extension In Critical Folder	Data Destruction	TTP
Windows Modify Show Compress Color And Info Tip Registry	Modify Registry	TTP
Windows Raw Access To Disk Volume Partition	Disk Structure Wipe, Disk Wipe	Anomaly
Windows Raw Access To Master Boot Record Drive	Disk Structure Wipe, Disk Wipe	TTP

Reference

• https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
• https://www.cisa.gov/uscert/ncas/alerts/aa22-057a

source | version: 1