Crowdstrike DriveSlayer February 2022

HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.

HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.

HermeticWiper has the ability to overwrite its own file with random bites.

HermeticWiper can determine the OS version and bitness on a targeted host.

HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.

HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.

HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.

HermeticWiper can decompress and copy driver files using `LZCopy`.

HermeticWiper can disable the VSS service on a compromised host using the service control manager.

HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.

HermeticWiper can load drivers by creating a new service using the `CreateServiceW` API.

The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.

HermeticWiper has the ability to corrupt disk partitions and obtain raw disk access to destroy data.

HermeticWiper has the ability to corrupt disk partitions, damage the Master Boot Record (MBR), and overwrite the Master File Table (MFT) of all available physical drives.

HermeticWiper can create system services to aid in executing the payload.

HermeticWiper can enumerate physical drives on a targeted host.

HermeticWiper has the ability to set the `HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled` Registry key to `0` in order to disable crash dumps.