# Ukraine: Analysis of the new disk-wiping malware (HermeticWiper) **[cluster25.io/2022/02/24/ukraine-analysis-of-the-new-disk-wiping-malware/](https://cluster25.io/2022/02/24/ukraine-analysis-of-the-new-disk-wiping-malware/)** February 24, 2022 [APT Cluster25 todayFebruary 24, 2022](https://cluster25.io/category/general/apt/) Very recently a new type of destructive malware named by the security community “HermeticWiper” was used to attack organizations and entities in Ukraine shortly before Russia began military operations against the same country. HermeticWiper is an executable file signed with a likely stolen certificate issued to Hermetica Digital Ltd. It has been reported by researchers at ESET on 2022/02/23 ## Insights We analyzed the file identified by the following SHA256 hash : **1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591** ----- On the basis of some evidences extracted from the analyzed samples, it is possible to hypothesize that the preparation and the development phases of this piece of malware (and may be the military operation that soon followed its spread) had been going on for some months already. Technically speaking the first actions carried out when executed are aimed at opening its current process using the GetCurrentProcess API and at accessing the token with the **OpenProcessToken.** Immediately after it adjusts the token privileges using the AdjustTokenPrivileges to add the **SeShutdownPrivilege and SeBackupPrivilege.** It proceeds by dynamically resolving Wow64DisableWow64FsRedirection, **Wow64RevertWow64FsRedirection, IsWow64Process from kernel32.dll library using the** **GetModuleHandle and the GetProcAddress API’s.** OS version is verified through IsWow64Process and VerifyVersionInfoW API’s. Based on the OS version load 1 of the 4 resources as shown following: The resources contain ms-compressed copies of the empntdrv.sys from EaseUS driver suite used in the next subroutines to access physical drives and getting partition information. This adds an obfuscation layer to the current wiper since a lot of functionality are accessed through the DeviceIoControl API (calling the specific IOCTLs). After that, the resource is loaded and decompressed. Next, the **SYSTEM\CurrentControlSet\Control\CrashControl** ----- registry key is opened to disable the CrashDump feature (enabled by default in Windows). In particular, the DWORD CrashDumpEnabled value is changed from 1 to 0. Subsequently, a new pipe called \\\\.\\EPMNTDRV\\ is created and the decompressed driver is saved in the **C:\Windows\System32\drivers\njdr.sys** directory (the filename is computed at runtime using randomness). To ensure the driver execution the process token is modified again to add the **SeLoadDriverPrivilege permission and a new service is created using the CreateServiceW** API. Instead, if the service already exists, the ChangeServiceConfigW API is used to force the execution of the service with the SERVICE_DEMAND_START flag. Finally, the **StartServiceW API is used to start the service pointing to the utility driver.** After some sleep, the reg key **SYSTEM\\CurrentControlSet\\services\\** and the driver file stored on the filesystem are deleted. ----- Subsequently, the vss service (shadow copies service) is opened and the **ChangeServiceConfigW API is used to set the flags SERVICE_DISABLED and** **SERVICE_CONTROL_STOP.** Afterwards, the system physical drivers are enumerated multiple times with a counter from 1 to 100. For each found physical drive, the \\.\EPMNTDRV\ is called with the appropriate device number using the DeviceIoControl API. Then, for each driver found, the malware starts a bit swapping routine to corrupt the Master **Boot Record (MBR) for every physical drive.** The corruption is a little different between FAT and NTFS partitions. ----- For the NTFS partitions, the malware parses the Master File Table (MFT) before calling the bit swapping routine. The bit swapping routine is supported with the usage of cryptographic context API’s (like **CryptoAcquireContext), the generation of random bytes to corrupt the partition and the** usage of DeviceIoControl with the just-created service to access the physical drives. Further functionality refers also to the encryption of specific MFT fields ($bitmap and **$logfile) or NTFS streams like $DATA, $I30 or $INDEX_ALLOCATION with some** references to “ntuser”. After the corruption subroutines, the malware enumerates also common folders but currently still not totally clear why as the wiping activities are already been operated. Anyway, the folder are the following: 1. My Documents 2. Desktop 3. AppData 4. Windows Event Logs (C:\\Windows\\System32\winevt\\Logs) At the end this piece of malware waits for different sleeping treads and initialize a system shutdown destroying the victim system. ## Conclusions ----- **HermeticWiper is a new type of destructive malware, significantly different from** **WhisperGate, the previous wiper used against targets in Ukraine. Destructive attacks** perpetrated through pieces of malware of this type are focused on making essential services and critical infrastructures unavailable. In this case, HermeticWiper probably works in support of Russian military operations. ## Detection YARA 1 rule UNC1222_HermeticWiper_23433_10001 { meta: date = “2022-02-23” description = “Detects HermeticWiper variants by internal strings” author = “Cluster25” tlp = “white” hash1 = “0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da” hash2 = “1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591” strings: $ = “tdrv.pdb” fullword ascii $ = “\\\\.\\EPMNTDRV\\%u” fullword wide $ = “PhysicalDrive%u” fullword wide $ = “Hermetica Digital Ltd” condition: (uint16(0) == 0x5a4d and all of them) } YARA 2 import “pe” rule UNC1222_HermeticWiper_23433_10002 { meta: date = “2022-02-23” description = “Detects HermeticWiper variants by internal strings” hash1 = “0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da” hash2 = “1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591” tlp = “white” strings: $p1 = “$INDEX_ALLOCATION” wide $p2 = “$I30” wide $p3 = “$DATA” wide $p4 = “$logfile” wide $p5 = “$bitmap” wide ----- $s1 = PhysicalDrive%u wide $s2 = “EPMNTDRV” wide $s3 = “SYSVOL” wide $s4 = “SYSTEM\\CurrentControlSet\\Control\\CrashControl” wide $s5 = “CrashDumpEnabled” wide $s6 = “NTFS” ascii $s7 = “FAT” ascii $s8 = “OpenSCManager” ascii $s9 = “SeBackupPrivilege” wide $s10 = “SeLoadDriverPrivilege” wide $s11 = “RCDATA” wide // LookupPrivilegeValueW routine $r1 = { 85 35 2C 50 40 00 C7 84 ?? ?? ?? ?? 77 00 6E 00 C7 84 ?? ?? ?? ?? 50 00 72 00 8D 43 04 50 8D 44 24 44 50 6A 00 FF D6 8D 43 10 50 68 A8 55 40 00 6A 00 FF D6 6A 00 6A 00 6A 00 53 C7 03 02 00 00 00 6A 00 } // AdjustTokenPrivileges routine $r2 = { C7 43 0C 02 00 00 00 C7 43 18 02 00 00 00 FF 74 24 24 FF 15 28 50 40 00 FF D7 85 C0 75 0F } // OpenSCManagerW (DatabaseName: “ServicesActive”) routine $r3 = { 68 ?? 3f 00 0f 00 68 ?? 80 55 44 00 33 f6 56 ff 15 24 50 40 00 89 44 24 10 85 C0 75 06 } // OpenServiceW (ServiceName: “vss”) routine $r4 = { 68 ?? 58 40 00 50 FF 15 20 50 40 00 8B D8 85 DB 75 0C } // ChangeServiceConfigW routine $r5 = { 6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 6A FF 6A 04 6A 10 53 FF 15 14 50 40 00 85 C0 75 04 } // CreateThread/CreateEventW and InitializeShutdownW routine $r6 = { 8B 35 ?? ?? ?? ?? 8D 44 ?? ?? 6A 00 6A 00 50 68 ?? ?? 40 00 6A 00 6A 00 89 7C ?? ?? FF D6 6A 00 6A 00 6A 01 6A 00 89 44 ?? ?? FF 15 ?? ?? ?? ?? 6A 00 6A 00 89 44 ?? ?? 8D 44 ?? ?? 50 68 D0 34 40 00 6A 00 6A 00 FF D6 8B 3D D4 ?? ?? ?? 6B D8 85 DB 74 0A } condition: uint16(0)==0x5a4d and pe.imports(“lz32.dll”) and filesize < 200KB and (2 of ($p*) and (all of ($s*) or (6 of ($s*) and any of ($r*)) or 4 of ($r*))) } Written by: [Cluster25](https://cluster25.io/author/cluster25/) Tagged as: [HermeticWiper,](https://cluster25.io/tag/hermeticwiper/) [Wiper,](https://cluster25.io/tag/wiper/) [Ukraine,](https://cluster25.io/tag/ukraine/) [CyberWar,](https://cluster25.io/tag/cyberwar/) [Malware.](https://cluster25.io/tag/malware/) -----