Hermetic Wiper

A wiper malware that was first seen Q12022. It damages the master boot record making the device unable to boot the operating system. Then the HermeticWiper continues to wipe all the partitions, not just the primary. The malware also enumerates common folders (‘My Documents,’ ‘Desktop,’ ‘AppData’), references the registry (‘ntuser’), and Windows Event Logs. It also modifies several registry keys, including setting the SYSTEM\CurrentControlSet\Control\CrashControl CrashDumpEnabled key to 0, effectively disabling crash dumps before the abused driver’s execution starts. It then waits on sleeping threads before initiating a system shutdown to launch its destructive process. This was first seen in the cyber attacks by Russia on Ukraine