#SPLUNK TSTATS DRIVERS#
#SPLUNK TSTATS DRIVER#

Below is the code, how it uses ChangeServiceConfigW() API to change the status of its driver if it is not active. If it already exists but is not active, it will modify the service config of that kernel driver to DEMAND_START to start the service. If the service related to its driver does not exist it will just create and start a new service for it using CreateServiceW() and StartServiceW() API. First It will adjust its token privilege with 'SeLoadDriverPrivilege'. The way it loads its driver component is by creating a service entry for that file. This is done by modifying a registry as shown in the screenshot below: It also has some features where it disables the generation of crash dumps of the compromised host that serve as anti-forensic techniques. Then it will delete the compressed version afterwards. sys file extension) in C:windowssystem32Drivers. Interestingly during analysis, we found out that it drops both the compressed driver ( without file extension) and also the actual driver ( with. The screenshot below shows how it uses LZ API to decompress that to retrieve the actual driver binary file. The driver extracted from the rsrc section of this wiper is in LZW compressed (SZDD file format). Once the wiper parses the needed rsrc entry, and has a filename, It will locate the C:windowssystem32Drivers folder to drop its driver component. Then it will generate random characters based on the current process ID of its running process. Below is the summary table of the RSRC TYPE ID and the name of its rsrc entry for each driver.ĭriver for lower version OS (e.g XP) 圆4 bit architectureĭriver for lower version OS (e.g XP) x32 bit architecture

#SPLUNK TSTATS DRIVERS#

It will drop one of those drivers depending on the Windows version or OS architecture of the compromised host by using VerifyVersionW API. It contains 4 compressed drivers in its RSRCsection. This wiper will first adjust its token privileges with 'SeShutdownPrivilege' and 'SeBackupPrivilege' for later purposes like initiating shutdown or accessing files with high-security descriptor context. Here is a brief breakdown of HermeticWiper features and detections.ĭropping Driver Component Base on Windows Version (XP or above) The following diagram shows a visual flow of the observed attack vectors per tactic.Īs seen above malicious actors are gaining initial access by either compromising publicly exposed services or via spear phishing, following the establishment of persistence and privilege escalation via web shells or the use of schtasks, PowerShell payloads, and finally deploying additional payloads via certutil.exe or Powershell which include genuine wiper payloads and ransomware decoy binaries seeking to distract and delay defense and containment from defenders. We have collected information about the observed vectors in relation to HermeticWiper according to several security vendors including Symantec, ESET, Sentinel One. STRT has also released a new analytic story covering HermeticWiper itself. This payload is another destructive tool in the ongoing campaign which has included DDoS attacks, web defacements, MDM attacks, Microsoft SQL attacks and now two known as of yet destructive payloads.

Reported to have been deployed via Group Policy Object (Windows Active Directory Group Policy Object) Modifies 'GlobalFolderOptions' registry at file permission level (NTFS)Ĭhecks for FAT (Windows XP) and NTFS (Windows OS newer than XP using NTFS)Ĭorrupts (Destroys) MBR and NTFS file system Interacts with the system via signed driverĭisables crash dump functionality (Anti-Forensic) In addition to other commonly known wiper destructive features, HermeticWiper also presents the following unique behaviors: HermeticWiper introduces some unique features, applying destructive actions on compromised hosts. As stated in our previous threat advisory STRT-TA02 in regards to destructive software, past historical data suggests that for malicious actors to succeed in long-standing campaigns they must improve and add new ways of making their payloads stealthier, resistant, and damaging.

Splunk tstats