Qualys Hermetic Wiper March 2022

HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.

HermeticWiper can determine the OS version and bitness on a targeted host.

HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.

HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.

HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.

HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.

HermeticWiper has the ability to stop the Volume Shadow Copy service.

HermeticWiper can disable the VSS service on a compromised host using the service control manager.

HermeticWiper can initiate a system shutdown.

The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.

HermeticWiper has the ability to corrupt disk partitions, damage the Master Boot Record (MBR), and overwrite the Master File Table (MFT) of all available physical drives.

HermeticWiper can create system services to aid in executing the payload.

HermeticWiper can enumerate physical drives on a targeted host.

HermeticWiper has the ability to set the `HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled` Registry key to `0` in order to disable crash dumps.