"name":"HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine",
"content":"# HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine\r\n\r\n Juan Andr\u00e9s Guerrero-Saade / February 23, 2022\r\n\r\n## Executive Summary\r\n\r\n * On February 23rd, the threat intelligence community began observing a new wiper malware sample circulating in Ukrainian organizations.\r\n * Our analysis shows a signed driver is being used to deploy a wiper that erases Windows devices, after deleting shadow copies and manipulating MBR after rebooting.\r\n * This blog includes the technical details of the wiper, dubbed @[tag](HermeticWiper), and includes IOCs to allow organizations to stay protected from this attack.\r\n * This sample is actively being used against Ukrainian organizations, and this blog will be updated as more information becomes available.\r\n * @[tag](SentinelOne) customers are protected from this threat, no action is needed.\r\n \r\n ## Background\r\n\r\n On February 23rd, our friends at @[tag](Symantec) and @[tag](ESET) research tweeted hashes associated with a wiper attack in Ukraine, including one which is not publicly available as of this writing.\r\n\r\n We started analyzing this new wiper malware, calling it \u2018@[tag](HermeticWiper)\u2019 in reference to the digital certificate used to sign the sample. The digital certificate is issued under the company name \u2018Hermetica Digital Ltd\u2019 and valid as of April 2021. At this time, we haven\u2019t seen any legitimate files signed with this certificate. It\u2019s possible that the attackers used a shell company or appropriated a defunct company to issue this digital certificate.\r\n\r\n @[tag](HermeticWiper) Digital Signature This is an early effort to analyze the first available sample of @[tag](HermeticWiper). We recognize that the situation on the ground in Ukraine is evolving rapidly and hope that we can contribute our small part to the collective analysis effort.\r\n\r\n ## Technical Analysis\r\n\r\n At first glance, @[tag](HermeticWiper) appears to be a custom-written application with very few standard functions. The malware sample is 114KBs in size and roughly 70% of that is composed of resources. The developers are using a tried and tested technique of wiper malware, abusing a benign partition management driver, in order to carry out the more damaging components of their attacks. Both the @[tag](misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Lazarus Group - G0032\") (Destover) and @[tag](misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT33 - G0064\")(Shamoon)tookadvantageofEldosRawdiskinordertogetdirectuserlandaccesstothefilesystemwithoutcallingWindowsAPIs.@[tag](HermeticWiper)usesasimilartechniquebyabusingadifferentdriver,@[attribute](85ca7a94-fcfb-4097-affc-0b102ae4dff5).\r\n\r\n@[tag](HermeticWiper)resourcescontainingEaseUSPartitionManagerdriversThecopiesofthedriverarems-compressedresources.ThemalwaredeploysoneofthesedependingontheOSversion,bitness,andSysWow64redirection.\r\n\r\nEaseUSdriverresourceselectionThebenignEaseUSdriverisabusedtodoafairshareoftheheavy-liftingwhenitcomestoaccessingPhysicalDrivesdirectlyaswellasgettingpartitioninformation.Thisaddstothedifficultyofanalyzing@[tag](HermeticWiper),asalotoffunctionalityisdeferredtoDeviceIoControlcallswithspecificIOCTLs.\r\n\r\n##MBRandPartitionCorruption\r\n\r\n@[tag](HermeticWiper)enumeratesarangeofPhysicalDrivesmultipletimes,from0-100.ForeachPhysicalDrive,the\\\\.\\EPMNTDRV\\deviceiscalledforadevicenumber.\r\n\r\nThemalwarethenfocusesoncorruptingthefirst512bytes,theMasterBootRecord(MBR)foreveryPhysicalDrive.Whilethatshouldbeenoughforthedevicenottobootagain,@[tag](HermeticWiper)proceedstoenumeratethepartitionsforallpossibledrives.\r\n\r\nTheythendifferentiatebetweenFATandNTFSpartitions.InthecaseofaFATpartition,themalwarecallsthesame\u2018bitfiddler\u2019tocorruptthepartition.ForNTFS,the@[tag](HermeticWiper)
