{
  "Event": {
    "analysis": "0",
    "date": "2022-02-24",
    "extends_uuid": "56cb2bd3-5525-46bd-a454-ea895a5b4d0d",
    "info": "HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine",
    "publish_timestamp": "1664880606",
    "published": true,
    "threat_level_id": "1",
    "timestamp": "1664880605",
    "uuid": "b9b6dcfa-0b11-40dc-9bf4-9a36a2c1a046",
    "Orgc": {
      "name": "Centre for Cyber security Belgium",
      "uuid": "5cf66e53-b5f8-43e7-be9a-49880a3b4631"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:target-information=\"Ukraine\""
      },
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\""
      },
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:mitre-attack-pattern=\"Disk Structure Wipe - T1561.002\""
      },
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:mitre-attack-pattern=\"Signed Binary Proxy Execution - T1218\""
      },
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:mitre-attack-pattern=\"Group Policy Modification - T1484.001\""
      },
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\""
      },
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#054300",
        "name": "admiralty-scale:source-reliability=\"a\""
      },
      {
        "colour": "#0eb100",
        "name": "admiralty-scale:information-credibility=\"1\""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645686071",
        "to_ids": true,
        "type": "md5",
        "uuid": "de0bd41d-ffac-4e5a-8ffd-63c0ba4c6979",
        "value": "231b3385ac17e41c5bb1b1fcb59599c4"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645686071",
        "to_ids": true,
        "type": "md5",
        "uuid": "dc288e70-bf4b-46cc-84aa-515e39f3b433",
        "value": "095a1678021b034903c85dd5acb447ad"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645686071",
        "to_ids": true,
        "type": "md5",
        "uuid": "e499240c-bfd1-4e5b-a70b-244c11d69053",
        "value": "eb845b7a16ed82bd248e395d9852f467"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645688022",
        "to_ids": false,
        "type": "link",
        "uuid": "194c007c-eb84-4987-ae29-4dca3b02db47",
        "value": "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Effectively disables crash dumps before the abused driver's execution starts",
        "deleted": false,
        "disable_correlation": true,
        "timestamp": "1645688123",
        "to_ids": false,
        "type": "regkey|value",
        "uuid": "8c55aae8-9ee3-4488-93e8-ee3998518fce",
        "value": "SYSTEM\\CurrentControlSet\\Control\\CrashControl CrashDumpEnabled|0"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645688459",
        "to_ids": true,
        "type": "filename",
        "uuid": "85ca7a94-fcfb-4097-affc-0b102ae4dff5",
        "value": "empntdrv.sys"
      }
    ],
    "Object": [
      {
        "comment": "912342f1c840a42f6b74132f8a7c4ffe7d40fb77: Enriched via the virustotal module",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "4",
        "timestamp": "1645687145",
        "uuid": "d611f80f-3015-4e5a-ba28-a4219aae2114",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "permalink",
            "timestamp": "1645687142",
            "to_ids": false,
            "type": "link",
            "uuid": "df316954-b61d-436a-8804-d2f38a368eeb",
            "value": "https://www.virustotal.com/gui/file/0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da/detection/f-0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da-1645685791"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1645687145",
            "to_ids": false,
            "type": "text",
            "uuid": "8becd4d8-0f4c-429a-a3d4-9e33ac8f55c5",
            "value": "8/71"
          }
        ]
      },
      {
        "comment": "912342f1c840a42f6b74132f8a7c4ffe7d40fb77: Enriched via the virustotal module",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2022-02-24T06:35:51+00:00",
        "last_seen": "2022-02-24T06:35:51+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "24",
        "timestamp": "1645687295",
        "uuid": "f6a02b6b-91df-4a01-9115-798e59bc7023",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "f6a02b6b-91df-4a01-9115-798e59bc7023",
            "referenced_uuid": "d611f80f-3015-4e5a-ba28-a4219aae2114",
            "relationship_type": "analysed-with",
            "timestamp": "1664880605",
            "uuid": "dcd014f8-ccb2-4885-8563-6f2799ffd2a2"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1645687295",
            "to_ids": true,
            "type": "md5",
            "uuid": "ec4a3df5-9479-4468-a990-a3f97ff69a1b",
            "value": "84ba0197920fd3e2b7dfa719fee09d2f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1645687295",
            "to_ids": true,
            "type": "sha1",
            "uuid": "27637845-3dbd-4454-ad6c-51b7d05e22e9",
            "value": "912342f1c840a42f6b74132f8a7c4ffe7d40fb77"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1645687295",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2b89b426-8ae3-483c-8a10-46acc4b9a441",
            "value": "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
          }
        ]
      },
      {
        "comment": "61b25d11392172e587d8da3045812a66c3385451: Enriched via the virustotal module",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "4",
        "timestamp": "1645687548",
        "uuid": "d9a1332e-3511-4417-97c8-f30621513106",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "permalink",
            "timestamp": "1645687548",
            "to_ids": false,
            "type": "link",
            "uuid": "bafabadb-48ca-48a7-b192-ed30a1ffc57c",
            "value": "https://www.virustotal.com/gui/file/1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591/detection/f-1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591-1645686225"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1645687545",
            "to_ids": false,
            "type": "text",
            "uuid": "fecf0286-1c32-478d-93e3-507253b34c26",
            "value": "28/71"
          }
        ]
      },
      {
        "comment": "61b25d11392172e587d8da3045812a66c3385451: Enriched via the virustotal module",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "24",
        "timestamp": "1645687557",
        "uuid": "df7db285-8f67-49a0-a570-360c55604d2c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1645687557",
            "to_ids": true,
            "type": "md5",
            "uuid": "b5d4be4e-d2cf-479b-90bf-6ad348b213dd",
            "value": "3f4a16b29f2f0532b7ce3e7656799125"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1645687554",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6f40134d-c3f6-45b0-bea8-10bcb3b68b1e",
            "value": "61b25d11392172e587d8da3045812a66c3385451"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1645687551",
            "to_ids": true,
            "type": "sha256",
            "uuid": "127e284e-9f47-46f6-a14d-118e7e59309a",
            "value": "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "24",
        "timestamp": "1645687512",
        "uuid": "6e410e9b-426b-49ce-a8b9-4efdf1656f24",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1645687512",
            "to_ids": true,
            "type": "md5",
            "uuid": "104e8a29-d087-4540-bcaa-ee455e21a157",
            "value": "a952e288a1ead66490b3275a807f52e5"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "5",
        "timestamp": "1645688599",
        "uuid": "c908378a-8f2a-49e1-b592-306424bd139b",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1645688599",
            "to_ids": false,
            "type": "comment",
            "uuid": "f596d739-c866-436a-9f94-f0694db7a401",
            "value": "HermeticWiper - broad hunting rule"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "context",
            "timestamp": "1645688599",
            "to_ids": false,
            "type": "text",
            "uuid": "d47e6fda-a832-4855-8c6f-f2d3dc912138",
            "value": "disk"
          },
          {
            "category": "Payload installation",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara",
            "timestamp": "1645688599",
            "to_ids": true,
            "type": "yara",
            "uuid": "87bdab8d-c1f2-4996-86b6-b0c9ef9536eb",
            "value": "rule MAL_HERMETIC_WIPER {\r\n    meta:\r\n      desc = \"HermeticWiper - broad hunting rule\"\r\n      author = \"Friends @ SentinelLabs\"\r\n      version = \"1.0\"\r\n      last_modified = \"02.23.2022\"\r\n      hash = \"1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591\"\r\n    strings:\r\n        $string1 = \"DRV_XP_X64\" wide ascii nocase\r\n        $string2 = \"EPMNTDRV\\\\%u\" wide ascii nocase\r\n        $string3 = \"PhysicalDrive%u\" wide ascii nocase\r\n        $cert1 = \"Hermetica Digital Ltd\" wide ascii nocase\r\n    condition:\r\n      uint16(0) == 0x5A4D and\r\n      all of them\r\n}"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1645688599",
            "to_ids": false,
            "type": "text",
            "uuid": "045e7288-a031-4613-bd58-6b839f4fd53a",
            "value": "MAL_HERMETIC_WIPER"
          }
        ]
      }
    ]
  }
}