Palo Alto Shamoon Nov 2016

Shamoon queries several Registry keys to identify hard disk partitions to overwrite.

Shamoon obtains the target's IP address and local network segment.

Shamoon contains base64-encoded strings.

Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."

Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.

Shamoon has used HTTP for C2.

Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.

Shamoon can download an executable to run on the victim.

Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.

Shamoon obtains the system time and will only activate if it is greater than a preset date.

RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.

Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.

Shamoon has an operational mode for encrypting data instead of overwriting it.

Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services.

Shamoon attempts to disable UAC remote restrictions by modifying the Registry.

RawDisk was used in Shamoon to help overwrite components of disk structure like the MBR and disk partitions.

Shamoon has been seen overwriting features of disk structure such as the MBR.

Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.

Shamoon attempts to copy itself to remote machines on the network.