Thread by @juanandres_gs

Looking into new #wiper malware in #Ukraine– #EarlyTriage

https://twitter.com/threatintel/status/1496578746014437376

Pretty small piece of code, all things considered.

The file is digitally signed, presumably with a stolen certificate though I don't see other files signed with this yet.

Early on it calls a common named pipe– \\EPMNTDRV\

Likely abusing legitimate drivers, saved as resources in the file. Pulling those now.

RCDATA_DRV_X64 a952e288a1ead66490b3275a807f52e5
RCDATA_DRV_X86 231b3385ac17e41c5bb1b1fcb59599c4
RCDATA_DRV_XP_X64 095a1678021b034903c85dd5acb447ad
RCDATA_DRV_XP_X86 eb845b7a16ed82bd248e395d9852f467

Btw, same UA submitter uploaded another file with similar name. guessing encrypted something–
virustotal.com/gui/file/8aaf5…

I defer to @silascutler who is ahead of me on reversing :)

@silascutler Resources are ms compressed. Before I have to bang my head against a wall, @silascutler comes in with the save :)

@silascutler The drivers are multiple bitness versions of EaseUS Partition Master

Our friends at @ESETresearch with added context vvv

https://twitter.com/ESETresearch/status/1496581912940396551

Looks like ESET has another sample not yet on VT–
912342F1C840A42F6B74132F8A7C4FFE7D40FB77

Oh man... here's some context–

https://twitter.com/DI_Ukraine/status/1496582931787231234

Guessing this is the victim according to that DI_Ukraine tweet

A very surface comment on the functioning malware– abusing a legitimate driver for wiping is a classic from Lazarus Destover and Shamoon, but this is a different driver. Don't draw attribution conclusions from that, more of a shared TTP to get past permission issues.

Redundant loading drivers based on OS version info and bitness (GetLastError != ERROR_OLD_WIN_VERSION, I think)

Modifying CrashControl regkey, CrashDumpEnabled key to 0
docs.microsoft.com/en-us/windows/…

Btw, regarding that victim tweet above (Titan)– it's speculation. Running with scissors here. Sounds like @ESETresearch might know some victim orgs though :)

https://twitter.com/ESETresearch/status/1496581914769207298

Aaaand my hotspot dropped. Working on it

We are back!

Enumerating PhysicalDrives up to 100...

Looks like it's opening the beginning of those drives and doing some crypto there. Tbh, it's beyond my quick analysis abilities – anyone looking at 0x401EEA ?

Wow.. they're being thorough..

I have to admit that there's a surprising amount of thorough cleanup after this. Any chance this is a cleanup op more than just a wiper?

Ok.. this isn't a bullshit wiper like the last time.

This thing is meant to be devastating.

If you're wondering how this is happening...

https://twitter.com/MigoKed/status/1496598151259738123?s=20&t=SCDzYRiZzQiaCzvbGHth1g

Ok, folks, we're clearly missing the *MOST* important part of all of this. Seeing as neither @threatintel nor @ESETresearch have named this monster, let's call this #HermeticWiper

@threatintel @ESETresearch Oh my god, you guys... the embedded icon.. is a gift box with a bow... #NoBullshit #HermeticWiper

@threatintel @ESETresearch As @JusticeRage @NateBeachW @CYINT_dude and @MigoKed pointed out to me, this icon is relatively common (actually 40K samples in VT w it). So let's just take it as a fun quirk.