Procedure examples

HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.

HermeticWiper has used the name `postgressql.exe` to mask a malicious payload.

HermeticWiper has the ability to use scheduled tasks for execution.

HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.

HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.

HermeticWiper has the ability to overwrite its own file with random bites.

HermeticWiper can determine the OS version and bitness on a targeted host.

HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.

HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.

HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.

HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.

HermeticWiper can decompress and copy driver files using `LZCopy`.

HermeticWiper has the ability to deploy through an infected system's default domain policy.

HermeticWiper can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files(x86)`, `PerfLogs`, `Boot, System`, `Volume Information`, and `AppData` folders using `FSCTL_MOVE_FILE`. HermeticWiper can also overwrite symbolic links and big files in `My Documents` and on the Desktop with random bytes.

HermeticWiper has the ability to stop the Volume Shadow Copy service.

HermeticWiper can disable the VSS service on a compromised host using the service control manager.

HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.

HermeticWiper can initiate a system shutdown.

HermeticWiper can load drivers by creating a new service using the `CreateServiceW` API.

The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.

HermeticWiper has the ability to corrupt disk partitions and obtain raw disk access to destroy data.

HermeticWiper has the ability to corrupt disk partitions, damage the Master Boot Record (MBR), and overwrite the Master File Table (MFT) of all available physical drives.

HermeticWiper can create system services to aid in executing the payload.

HermeticWiper can enumerate physical drives on a targeted host.

HermeticWiper has the ability to set the `HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled` Registry key to `0` in order to disable crash dumps.

HermeticWiper can overwrite the `C:\Windows\System32\winevt\Logs` file on a targeted system.