Diskwriter

Overview

Trojan:Win32/Diskwriter is a highly critical heuristic classification for malware designed to bypass the Windows file system (NTFS/FAT) and interact directly with the raw sectors of a hard drive. This classification encompasses some of the most destructive threats in the cyber landscape, including destructive Disk Wipers (like NotPetya or Shamoon) and advanced Bootkits.

Understanding Diskwriter
To the victim, a Diskwriter infection results in a completely unbootable system, often displaying a 'Missing Operating System' error or a fake ransom note at the BIOS/UEFI level. For incident responders, a Diskwriter alert is a catastrophic event. It indicates that malware has obtained high-level privileges and is actively destroying data or subverting the fundamental boot sequence of the machine. The goal is either pure sabotage (wipers) or extreme, undetectable persistence (bootkits).

Execution and Destructive Mechanics
Diskwriters are typically deployed in the final stages of a targeted attack or via destructive worms. Upon execution, the malware must elevate privileges to `SYSTEM` or obtain raw disk access rights. Once obtained, it uses APIs like `CreateFile` (pointing to physical drives like `\\.\PhysicalDrive0`) to bypass the OS file system protections (`T1561.002`). Wiper variants will intentionally overwrite the Master Boot Record (MBR), the GUID Partition Table (GPT), or the Master File Table (MFT) with garbage data, rendering the drive unreadable (`T1561.001`). Bootkit variants will overwrite the MBR/VBR with malicious code, ensuring the malware loads into memory before the Windows kernel even starts (`T1542.003`), providing ultimate stealth.

Indicators of Compromise & Impact
The impact is total loss of system availability and often permanent data destruction. EDR platforms must immediately alert on any non-system process attempting to open a handle to a raw physical drive (`\\.\PhysicalDriveX`). Because the OS is usually rendered unbootable, forensic analysis must be conducted offline by mounting the drive in a write-blocked forensic workstation to determine if data recovery is possible or if the MFT was completely destroyed.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DISKWRITER {
    meta:
        description = "Detects Diskwriter (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "diskwriter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Diskwriter Activity
id: 0a45a8e8db59ac292e3c3da68b279501
status: experimental
description: Detects generic indicators of the diskwriter malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*diskwriter*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. If a Diskwriter alert is triggered while the machine is still running, PULL THE POWER PLUG IMMEDIATELY (Hard Shutdown) to halt the wiping process and preserve whatever data is left.
2. Do NOT attempt to reboot the machine normally, as the boot sequence itself may be corrupted or weaponized.
3. Remove the hard drive and image it using a hardware write-blocker for offline forensic analysis and potential data carving/recovery.
4. Initiate the enterprise disaster recovery plan, assuming the data on the drive is permanently lost.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not perform a graceful shutdown if active disk wiping is detected; a hard power-off is the only way to interrupt the raw write commands.
2. Avoid assuming a standard backup restoration will fix a bootkit; the drive must be completely wiped (zeroed) and repartitioned to eradicate the MBR infection.

References & External Analysis

• Search "diskwriter" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Luminorat
• Remoxec
• Sinowal
• A8P9Eklc
• Vbcryptent

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/diskwriter.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.