HermeticWiper is a data wiper: malware that destroys data on Windows computers. MITRE ATT&CK says it has been used since at least early 2022, mainly against Ukraine, with some activity in Latvia and Lithuania. CISA says researchers disclosed on 23 February 2022 that it was deployed against Ukrainian organizations and that it manipulates the master boot record, which causes boot failure. See also the Poland energy sector attacks incident page, the Olympic Destroyer malware page and the CaddyWiper malware page.
What Will You Find in This HermeticWiper Report?
Learn Technical Method of Operation Details
The technical details of the HermeticWiper malware, and its abilities, infection methodologies, and more. The report will show many points about the malware’s technical details, IoCs, etc.
Gain Knowledge About Future Attacks
By understanding the malware, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic.
What Does the HermeticWiper Report Cover?
The report is titled HermeticWiper Technical Analysis Report. It is 24 pages long, was released on 07.03.2022 and carries the report ID HWAR07032022. It was written by the Threat Intelligence Team. It looks at one sample on Windows 10 64-bit and follows what the malware does step by step.
Background and the Name
The overview says the malware was detected on thousands of devices in Ukraine. It is named HermeticWiper after the digital certificate it holds, issued to Hermetica Digital Ltd and valid from 2021. The report says malware signed with this certificate is no longer seen.
Key Technical Findings
- Payloads: the sample holds four driver payloads in its resource section: DRV_X64, DRV_X86, DRV_XP_X64 and DRV_XP_X86. It picks one by checking the operating system version.
- Driver and service: it writes a random four-character file to C:\Windows\System32\drivers, unpacks it, and installs it as a kernel driver service.
- Recovery blocked: it disables and stops the Volume Shadow Copy service and sets the CrashDumpEnabled registry value from 7 to 0.
- Cleanup: it deletes the registry key of its own driver service. The report reads this as an effort to hide.
- Privileges: it enables SeBackupPrivilege, SeShutdownPrivilege and SeLoadDriverPrivilege.
- Disk discovery: it checks physical drives numbered 0 to 100 and searches folders such as System Volume Information and the Windows event log folder.
- Overwrite: it waits about 20 minutes, then starts a thread that overwrites the disk in a WriteFile loop.
Detection Material
The last pages hold four tables of file hashes, covering the payloads, extracted files and other HermeticWiper executables. They also include two YARA rules. The conclusion recommends acting on these indicators with security devices and the YARA rule.
Who Is It for?
Malware analysts, incident responders and detection engineers will get the most from it. The report itself says it is about the malware’s features, functions and payloads, so it is a technical read.