# Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER

HERMETICWIPER, signed with a revoked Hermetica Digital cert, abuses EaseUS epmntdrv.sys to raw-write random data over boot sectors and files, bricking Ukrainian systems.

- Payout: Real-world hack
- Severity: high
- Program: Hermetica Digital
- Analysis by: Daniel Stepanic, Mark Mager, Remco Sprooten, Jake King, Andrew Pease
- Disclosed: 2022-09-09
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper
- Tags: area:os domain:desktop impact:data-leak impact:dos impact:integrity kind:incident platform:threat-intel sev:high tech:windows technique:reverse-engineering vuln:misconfiguration

**Target:** Windows kernel driver (epmntdrv.sys) and user-mode wiper binary
**Root cause:** Wiper is digitally signed by Hermetica Digital Ltd. (Cyprus) and embeds 4 legitimate EaseUS Partition Manager drivers compressed with mscompress; the loaded driver proxies raw disk sector read/write from user mode, bypassing OS security.
**Steps:**
1. Signed HERMETICWIPER binary executes and decompresses embedded EaseUS driver (epmntdrv.sys).
2. Creates a kernel-mode service loading the driver; driver creates `\Device\EPMNTDRV` and a user-mode symlink.
3. User mode calls `DeviceIoControl` with `IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS` (0x560000) to locate the boot volume's physical disk.
4. Enumerates partitions via `GetDiskFreeSpaceW` (bytes/sector, sectors/cluster).
5. Overwrites NTFS/FAT boot sector and random file offsets with `CryptGenRandom` output using `FSCTL_GET_RETRIEVAL_POINTERS` and `FSCTL_MOVE_FILE` IOCTLs.
6. Queues targets (driver, malware process, first cluster of up to 100 partitions, System Volume Information, extra assets if not a DC) and shreds via async threads writing random buffers at disk addresses.
7. Accesses files via `::$INDEX_ALLOCATION` suffix to bypass ACLs; sets `ShowCompColor`/`ShowInfoTip` to 0 to hide coloring.
8. On crash/restart the system cannot boot and data is unrecoverable.
**How found:** Malware analysis of the sample: noticed valid signature by Hermetica Digital Ltd., embedded mscompress-compressed EaseUS drivers, kernel service creation, and DeviceIoControl/IOCTL usage indicating raw disk access.
**Exploitation:** Deployed against hundreds of Ukrainian systems (per ESET); signed binary loads the abused EaseUS driver to gain raw disk write, then overwrites boot sectors and file data with random bytes, rendering disks unbootable and data unrecoverable.
**Insight:** Legitimately signed partition/disk drivers (EaseUS epmntdrv.sys, Eldos RawDisk) are reusable BYOVD primitives for raw sector writes; check embedded compressed driver resources and IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS/FSCTL_MOVE_FILE usage as wiper indicators.

## Proof of concept (copied exactly from the original report)

**ShredTarget struct definition**

```
struct ctf::ShredTarget
{
ctf::ShredTarget *p_next;
ctf::ShredTarget *p_prev;
ctf::FilePart *p_parts;
int disk_number;
uint8_t *p_random_filled_buffer;
int p_random_filled_buffer_size;
};
```

**FilePart struct definition**

```
struct ctf::FilePart
{
ctf::FilePart *p_next;
ctf::FilePart *p_prev;
uint64_t start_address;
uint64_t size;
};
```