Cisco Ukraine Wipers January 2022

WhisperGate can Base64 encode strings, store downloaded files in reverse byte order, and use the Eazfuscator tool to obfuscate its third stage.

WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.

WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.

WhisperGate can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.

WhisperGate can delete tools from a compromised host after execution.

WhisperGate can locate files based on hardcoded file extensions.

WhisperGate can download additional payloads hosted on a Discord channel.

WhisperGate can download additional stages of malware from a Discord CDN channel.

WhisperGate has used the `ExitWindowsEx` to flush file buffers to disk and stop running processes and other API calls.

The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via `%TEMP%\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run`.

WhisperGate can enumerate connected remote logical drives.

WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.

WhisperGate can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.

WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.

WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.

WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets.

WhisperGate can overwrite the Master Book Record (MBR) on victim systems with a malicious 16-bit bootloader.

WhisperGate has the ability to enumerate fixed logical drives on a targeted system.

WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.