破坏型Wiper恶意程序分析

---
name: wiper-analysis
description: >
  Analyze destructive wiper malware including HermeticWiper, WhisperGate,
  CaddyWiper, Shamoon, NotPetya, AcidRain, and IsaacWiper. Covers
  distinguishing wipers from ransomware, MBR/VBR destruction techniques,
  file overwrite patterns, driver abuse for raw disk access, propagation
  mechanisms, timeline reconstruction, and geopolitical attribution context.
  Use when analyzing malware designed to destroy data rather than hold it
  for ransom.
---

# Wiper Analysis

Analyze destructive malware designed to permanently destroy data, disrupt
operations, or render systems unbootable. Wipers differ from ransomware
in having no recovery mechanism.

## Prerequisites

- **Python 3.10+**: `pefile`, `yara-python`, `struct`
- **Tools**: Ghidra/IDA Pro, x64dbg, HxD/hex editor, Process Monitor
- **Disk tools**: FTK Imager, dd, xxd for raw disk analysis
- **Environment**: Isolated VM with snapshots — wipers are destructive by design

## Step-by-Step Instructions

### Step 1: Distinguish Wiper from Ransomware

Confirm the sample is a wiper, not ransomware with a broken decryption mechanism.

**Run wiper assessment:**
```bash
python3 scripts/wiper_analyzer.py --sample suspicious.exe --mode identify --output wiper_id.json
```

**Key differences:**
| Characteristic | Ransomware | Wiper |
|----------------|-----------|-------|
| Recovery mechanism | Encryption with key escrow | None — data is destroyed |
| C2 for keys | Sends keys to C2 server | No key exchange needed |
| Ransom note | Always present | May have fake ransom note |
| File modification | Encrypted (recoverable) | Overwritten/zeroed (permanent) |
| MBR/VBR | Sometimes encrypted | Overwritten or zeroed |
| Payment infrastructure | Bitcoin/Monero wallets | None or fake wallets |
| Speed | Encrypts carefully | Destroys as fast as possible |

**Check for wiper indicators:**
```bash
# Look for raw disk access
strings suspicious.exe | grep -iE "(PhysicalDrive|\\\\\.\\\\|DeviceIoControl|IOCTL_DISK)"

# Look for MBR/VBR manipulation
strings suspicious.exe | grep -iE "(MBR|VBR|BootSector|sector 0|LBA 0)"

# Look for secure delete / overwrite patterns
strings suspicious.exe | grep -iE "(CreateFile.*GENERIC_WRITE|WriteFile|NtWriteFile|ZeroMemory)"

# Check for service installation (for raw disk access)
strings suspicious.exe | grep -iE "(CreateService|StartService|\.sys|driver)"
```

### Step 2: Analyze Disk Destruction Techniques

Understand how the wiper destroys data at the disk level.

**Disk analysis:**
```bash
python3 scripts/wiper_analyzer.py --sample suspicious.exe --mode disk-destruction --output disk_analysis.json
```

**MBR/VBR overwrite analysis:**
```bash
# If you have a disk image from a wiped system
xxd -l 512 disk_image.raw  # First 512 bytes = MBR
xxd -s 512 -l 512 disk_image.raw  # VBR area

# Check what was written
python3 -c "
data = open('disk_image.raw', 'rb').read(512)
if data == b'\x00' * 512:
    print('MBR zeroed')
elif len(set(data)) == 1:
    print(f'MBR overwritten with 0x{data[0]:02x}')
else:
    print('MBR contains custom data (possible fake bootloader message)')
"
```

**Wiper disk techniques by family:**
| Family | MBR Technique | File Technique |
|--------|--------------|----------------|
| HermeticWiper | Corrupts MBR via EaseUS driver | Overwrites with random data |
| WhisperGate | Overwrites MBR with fake ransom note | Corrupts file headers via Discord CDN |
| CaddyWiper | Zeroes MBR and partition table | Zeroes files with 0x00 |
| Shamoon | Overwrites MBR with burning flag image | Overwrites files with JPEG/random data |
| NotPetya | Encrypts MFT (unrecoverable) | Encrypts files with no recovery |
| AcidRain | Overwrites device firmware | Wipes /dev/mtd* and /dev/block/* |
| IsaacWiper | N/A | Overwrites with random data |

### Step 3: Analyze File Destruction Methods

Understand how individual files are destroyed.

**File destruction analysis:**
```bash
python3 scripts/wiper_analyzer.py --sample suspicious.exe --mode file-destruction --output file_analysis.json
```

**Common overwrite patterns:**
```bash
# Monitor file writes in dynamic analysis
# Use Process Monitor with filters:
#   Process Name = wiper.exe
#   Operation = WriteFile
#   Detail contains "Offset: 0"  (writing from file beginning)
```

**File targeting logic:**
```bash
# Check which files/extensions are targeted
strings suspicious.exe | grep -iE "\.(doc|xls|pdf|jpg|png|sql|mdb|zip|bak|vmdk)"

# Check for directory exclusion (some wipers skip Windows directory)
strings suspicious.exe | grep -iE "(Windows|Program Files|System32)"
```

**Overwrite patterns observed in the wild:**
| Pattern | Description | Recovery |
|---------|-------------|----------|
| Zero fill | Overwrite with 0x00 | Impossible |
| Random data | Overwrite with PRNG output | Impossible |
| Fixed byte | Overwrite with single byte (0xCC, 0xAA) | Impossible |
| Header corruption | Only destroy first N bytes | Partial recovery possible |
| Multi-pass | Gutmann-style multiple overwrites | Impossible |
| Truncation | Set file size to 0 | Recovery via carving sometimes possible |

### Step 4: Identify Driver Abuse

Many wipers use legitimate signed drivers for raw disk access.

**Driver analysis:**
```bash
python3 scripts/wiper_analyzer.py --sample suspicious.exe --mode driver --output driver_analysis.json
```

**Known abused drivers:**
| Driver | Legitimate Purpose | Abused By |
|--------|-------------------|-----------|
| EaseUS (epmntdrv.sys) | Partition manager | HermeticWiper |
| ElRawDisk (elrawdsk.sys) | Raw disk access tool | Shamoon |
| Micro-Star (RTCore64.sys) | MSI Afterburner | Various wipers |
| GMER (gmer64.sys) | Anti-rootkit tool | Various |
| Process Explorer driver | Sysinternals | Process killing |

**Check for embedded drivers:**
```bash
# Look for embedded driver binaries
binwalk suspicious.exe | grep -i "driver\|\.sys\|certificate"

# Check for driver installation
strings suspicious.exe | grep -iE "(NtLoadDriver|ZwLoadDriver|CreateService.*SERVICE_KERNEL_DRIVER)"
```

**BYOVD (Bring Your Own Vulnerable Driver) analysis:**
```bash
# Extract the embedded driver
binwalk -e suspicious.exe
# Check the driver's digital signature
sigcheck.exe extracted_driver.sys
# Verify against LOLDrivers database
# https://www.loldrivers.io/
```

### Step 5: Analyze Propagation Mechanisms

Determine how the wiper spreads across the network.

**Propagation analysis:**
```bash
python3 scripts/wiper_analyzer.py --sample suspicious.exe --mode propagation --output spread_analysis.json
```

**Common propagation methods:**
| Method | Indicators | Families |
|--------|-----------|----------|
| SMB/PsExec | NetShareEnum, ADMIN$, CreateService | Shamoon, NotPetya |
| WMI | Win32_Process, WbemLocator | NotPetya, CaddyWiper |
| GPO abuse | Group Policy, SYSVOL | HermeticWiper (via HermeticWizard) |
| Credential theft | Mimikatz, LSASS dump | NotPetya, Shamoon |
| EternalBlue | MS17-010, SMBv1 | NotPetya |

```bash
# Check for network propagation strings
strings suspicious.exe | grep -iE "(NetShareEnum|WNetOpenEnum|ADMIN\$|IPC\$|psexec)"
strings suspicious.exe | grep -iE "(WbemLocator|Win32_Process|ExecMethod)"
strings suspicious.exe | grep -iE "(mimikatz|sekurlsa|credman|lsadump)"
```

### Step 6: Reconstruct the Attack Timeline

Build a timeline of the wiper's deployment and execution.

**Timeline analysis:**
```bash
python3 scripts/wiper_analyzer.py --sample suspicious.exe --mode timeline --output timeline.json
```

**Timeline elements to document:**
1. **Initial access**: How did the attacker enter the network?
2. **Lateral movement**: How did they spread to critical systems?
3. **Staging**: Were wiper components pre-positioned? (Check file creation dates)
4. **Execution trigger**: Time-based? Command-based? Manual?
5. **Destruction sequence**: MBR first or files first? Simultaneous?
6. **Anti-recovery actions**: Shadow copy deletion? Backup destruction?

**Check for time-based triggers:**
```bash
# Look for date/time checks
strings suspicious.exe | grep -iE "(\d{4}-\d{2}-\d{2}|GetLocalTime|GetSystemTime|timer)"

# Check PE timestamp (may indicate compilation date)
python3 -c "
import pefile, datetime, sys
pe = pefile.PE(sys.argv[1])
ts = pe.FILE_HEADER.TimeDateStamp
print(f'PE timestamp: {datetime.datetime.utcfromtimestamp(ts)} UTC')
" suspicious.exe
```

### Step 7: Assess Anti-Recovery Techniques

Document what the wiper does to prevent data recovery.

**Anti-recovery analysis:**
```bash
python3 scripts/wiper_analyzer.py --sample suspicious.exe --mode anti-recovery --output recovery_analysis.json
```

**Common anti-recovery actions:**
```bash
# Check for shadow copy deletion
strings suspicious.exe | grep -iE "(vssadmin|wmic.*shadowcopy|bcdedit|wbadmin)"

# Check for backup destruction
strings suspicious.exe | grep -iE "(delete catalog|recoveryenabled|bootstatuspolicy)"

# Check for event log clearing
strings suspicious.exe | grep -iE "(wevtutil|Clear-EventLog|ClearEventLog)"

# Check for secure delete of wiper itself
strings suspicious.exe | grep -iE "(SelfDelete|DeleteFile.*argv|MoveFileEx.*DELAY)"
```

### Step 8: Assess Geopolitical Context and Attribution

Wipers are frequently state-sponsored — assess the broader context.

**Attribution indicators (handle with caution):**
- PE compilation timestamps and timezone artifacts
- Language resources in PE (code page, string table language)
- Code overlap with known APT tooling
- Targeting specificity (country, sector, organization)
- Deployment timing relative to geopolitical events
- Infrastructure overlap with known threat actor campaigns

**Notable campaigns:**
| Wiper | Attribution | Context |
|-------|-----------|---------|
| Shamoon | APT33 (Iran) | Saudi Aramco attacks |
| NotPetya | Sandworm (Russia) | Ukraine/global supply chain |
| HermeticWiper | Russia-linked | Ukraine 2022 invasion |
| WhisperGate | Russia-linked | Ukraine 2022 pre-invasion |
| AcidRain | Russia-linked | Viasat satellite modems |

## Output Format

```json
{
  "family": "HermeticWiper",
  "confidence": "high",
  "type": "wiper",
  "is_ransomware": false,
  "disk_destruction": {
    "mbr_overwrite": true,
    "partition_table_destroyed": true,
    "method": "EaseUS driver for raw disk access"
  },
  "file_destruction": {
    "method": "random_data_overwrite",
    "targeted_extensions": ["*"],
    "excluded_directories": ["Windows"],
    "multi_pass": false
  },
  "driver_abuse": {
    "driver": "epmntdrv.sys",
    "type": "EaseUS partition manager driver",
    "signed": true,
    "embedded": true
  },
  "propagation": {
    "method": "GPO via HermeticWizard",
    "smb": true,
    "wmi": true
  },
  "anti_recovery": {
    "shadow_copies_deleted": true,
    "event_logs_cleared": true,
    "self_delete": true
  },
  "timeline": {
    "compilation_time": "2021-12-28T00:00:00Z",
    "deployment_time": "2022-02-23T16:00:00Z",
    "execution_time": "2022-02-23T16:10:00Z"
  },
  "iocs": {
    "hashes": {},
    "driver_hashes": {},
    "mutexes": [],
    "file_paths": []
  },
  "mitre_attack": ["T1561.002", "T1561.001", "T1485", "T1490", "T1014"]
}
```

## Tips

- **Always use snapshots** — wipers will destroy your analysis VM if executed
- Wipers often masquerade as ransomware (WhisperGate had a fake ransom note)
- Check for time bombs — some wipers activate at a specific date/time
- BYOVD is increasingly common; check embedded resources for signed drivers
- NotPetya appeared as ransomware (Petya variant) but had intentionally broken decryption
- AcidRain targeted Linux-based IoT/satellite devices — wipers aren't Windows-only
- Compilation timestamps can be faked; don't rely on them alone for attribution
- Many wipers delete themselves after execution — capture a copy early
- Disk forensics may reveal the overwrite pattern even after destruction
- State-sponsored wipers often have high code quality and sophisticated deployment