Procedure examples

Shamoon queries several Registry keys to identify hard disk partitions to overwrite.

Shamoon obtains the target's IP address and local network segment.

Shamoon scans the C-class subnet of the IPs on the victim's interfaces.

Shamoon accesses network share(s), enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware.

Shamoon contains base64-encoded strings.

Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."

Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.

Shamoon can change the modified time for files to evade forensic detection.

Shamoon has used HTTP for C2.

If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.

Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.

Shamoon can download an executable to run on the victim.

Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.

Shamoon obtains the system time and will only activate if it is greater than a preset date.

Shamoon can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.

Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.

Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.

Shamoon has an operational mode for encrypting data instead of overwriting it.

Shamoon will reboot the infected system once the wiping functionality has been completed.

Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services.

Shamoon attempts to disable UAC remote restrictions by modifying the Registry.

Shamoon has been seen overwriting features of disk structure such as the MBR.

Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.

Shamoon attempts to copy itself to remote machines on the network.