Part 3 of a four-part series on wiper malware analyzes how input/output controls (IOCTLs) and related Windows kernel interfaces are weaponized to gather disk information, manage disk volumes, and destroy data. It highlights IOCTLs used by DriveSlayer and other families to locate MFT/MBR, lock/unmount volumes, and overwrite sectors, with CrowdStrike Falcon’s monitoring and detection context. #DriveSlayer #Petya
Keypoints
- IOCTLs are used to obtain information about volumes or disks and to perform actions like locking, unmounting, and wiping.
- DriveSlayer differentiates itself by using an extensive list of IOCTLs to achieve its goals, including information gathering and destructive actions.
- Volume locking and unmounting are employed after wiping to hinder recovery, using FSCTL_LOCK_VOLUME and FSCTL_DISMOUNT_VOLUME.
- Destruction often begins with removing the boot signature by using IOCTL_DISK_DELETE_DRIVE_LAYOUT to force formatting from sector 0.
- Overwriting disk clusters is performed by obtaining a bitmap of used clusters and then writing random data over those clusters.
- Data fragmentation and file relocation are used to complicate recovery, using FSCTL_GET_RETRIEVAL_POINTERS and FSCTL_MOVE_FILE.
- Wipers also enumerate files and their raw disk locations via NTFS-related IOCTLs to queue files for wiping, supported by GetNTFS volume/file data calls.
- CrowdStrike Falcon provides continuous monitoring and detection of these wiper techniques through on-sensor and cloud ML, IOAs, and TTP-related intelligence.
MITRE Techniques
- [T1082] System Information Discovery – DriveSlayer uses IOCTL_DISK_GET_DRIVE_GEOMETRY_EX and IOCTL_DISK_GET_DRIVE_GEOMETRY_EX to obtain information about partitions and geometry of a drive, helping locate MFTs/MBRs for wiping. – “DriveSlayer is using the IOCTL_DISK_GET_DRIVE_LAYOUT_EX and IOCTL_DISK_GET_DRIVE_GEOMETRY_EX IOCTLs to obtain information about the partitions and geometry of a drive. This helps the wiper to determine the location of the MFTs and MBRs in order for them to be scheduled for wiping.”
- [T1083] File and Directory Discovery – Wipers determine existing files by parsing the MFT rather than walking directories. – “Wipers like DriveSlayer will attempt to determine existing files by parsing the MFT rather than walking the directories and files recursively.”
- [T1485] Data Destruction – Overwriting disk sectors and boot/MBR destruction – “Destroying All Disk Contents” and “IOCTL_DISK_DELETE_DRIVE_LAYOUT that removes the boot signature from the master boot record, so that the disk will be formatted from sector zero to the end of the disk.”
- [T1485] Data Destruction – Volume lock/unmount to hinder recovery – “FSCTL_LOCK_VOLUME and FSCTL_DISMOUNT_VOLUME IO control codes … for locking and dismounting the volume.”
- [T1485] Data Destruction – Overwriting and fragmentation of data – “Overwriting occupied clusters with randomly generated data” and “DriveSlayer will use this bitmap to overwrite occupied clusters with randomly generated data.”
- [T1485] Data Destruction – Data fragmentation and file relocation – “FSCTL_GET_RETRIEVAL_POINTERS” and “FSCTL_MOVE_FILE” used to fragment and relocate data on disk.
- [T1083] File and Directory Discovery (supporting detail) – File iteration and NTFS file record data used to queue files for wiping – “The wiper continues by relocating virtual clusters using the FSCTL_MOVE_FILE IOCTL” and “Gathers file record information via FSCTL_GET_NTFS_FILE_RECORD.”
Indicators of Compromise
- [Hash] Apostle – 6fb07a9855edc862e59145aed973de9d459a6f45f17a8e779b95d4c55502dcce, 19dbed996b1a814658bef433bad62b03e5c59c2bf2351b793d1a5d4a5216d27e
- [Hash] CaddyWiper – a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea
- [Hash] Destover – e2ecec43da974db02f624ecadc94baf1d21fd1a5c4990c15863bb9929f781a0a
- [Hash] Dustman – f07b0c79a8c88a5760847226af277cf34ab5508394a58820db4db5a8d0340fc7
- [Hash] IsaacWiper – 13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033, 7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0
- [Hash] Petya – 0f732bc1ed57a052fecd19ad98428eb8cc42e6a53af86d465b004994342a2366, fd67136d8138fb71c8e9677f75e8b02f6734d72f66b065fc609ae2b3180a1cbf, 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c
- [Hash] Shamoon – e2ecec43da974db02f624ecadc94baf1d21fd1a5c4990c15863bb9929f781a0a, c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a, 7dad0b3b3b7dd72490d3f56f0a0b1403844bb05ce2499ef98a28684fbccc07b4, 8e9681d9dbfb4c564c44e3315c8efb7f7d6919aa28fcf967750a03875e216c79, f9d94c5de86aa170384f1e2e71d95ec373536899cb7985633d3ecfdb67af0f72, 4f02a9fcd2deb3936ede8ff009bd08662bdb1f365c0f4a78b3757a98c2f40400
Read more: https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/