Loading malware…
Petya is a Windows ransomware family first observed in March 2016. It modifies the Master Boot Record to execute a malicious bootloader before the operating system starts. Following a forced reboot, it displays a counterfeit CHKDSK operation while encrypting the NTFS Master File Table, making the filesystem inaccessible and preventing normal system use. It subsequently displays a skull-themed ransom screen and demands payment for a decryption key. Petya was also advertised through a ransomware-as-a-service affiliate program in 2016.
Petya is distinct from NotPetya, the destructive malware responsible for the June 2017 outbreak that was initially reported under the Petya name. Although both use malicious boot code and Master File Table encryption, NotPetya introduced credential-based and SMB-exploit propagation and behaved as destructive malware rather than conventional recoverable ransomware. NotPetya's Russian military attribution and propagation mechanisms should not be attributed to the original Petya family.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
hackers used a self-developed modification of Petya ransomware named PetrWrap.
This is a follow-up from our previous diary about today's ransomware attacks using the new Petya variant... Petya is a ransomware family that works by modifying the infected Windows system's Master Boot Record (MBR).
While the world is holding its breath, wondering where notorious cybercriminal groups like Lazarus or Telebots will strike next with another destructive malware such as WannaCryptor or Petya...
When Petya spread for the first time in March 2016... After a reboot the Master File Tabel (MFT) is encrypted... The evident similarity to Petya caused many researchers to name the new threat "Petya", too. But first doubts emerged soon, which are reflected in names like NotPetya, Nyetya, or Petna.
56 distinct techniques documented for this family, organized by ATT&CK tactic.
It seems to also be finding passwords on each infected computer and using those to spread as well.
So far, all theories regarding the spread of ExPetr/Petya point into two directions: Distribution via trojanized updates to MeDoc users Distribution via waterhole attacks in Ukrainian news websites (one case known)
The only confirmed initial infections comes through a malicious software update for a Ukrainian tax accounting software called MeDoc.
The initial infection vector for this campaign was a poisoned update for the MeDoc software suite, a software package used by many Ukrainian organizations.
The people spreading Petya attack their potential victims by sending spam messages containing links that download a ZIP archive.
There have been reports of malicious Word documents using the CVE-2017-0199 vulnerability being used as the initial infection vector for this ransomware attack.
The people spreading Petya attack their potential victims by sending spam messages containing links that download a ZIP archive.
If Petya finds valid credentials, it will use either PsExec or WMIC to infect other computers connected to the LAN... Lateral movements (remote WMI): "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\perfc.dat\\\" #1"
Commans lines: schtasks /Create /SC once /TN "" /TR "<system folder>\shutdown.exe /r /f" /ST <time>
Creates a scheduled task file to induce a reboot at a specified time. Creates it using schtasks
There have been reports of malicious Word documents using the CVE-2017-0199 vulnerability being used as the initial infection vector for this ransomware attack.
A Petya Trojan infection begins with the launch of the malicious executable file.
名前付きパイプによるプロセス間通信にてパスワードを奪取
“…and PSEXEC. This allows the ransomware to impact machines that otherwise would not be vulnerable…”
Commans lines: schtasks /Create /SC once /TN "" /TR "<system folder>\shutdown.exe /r /f" /ST <time>
Creates a scheduled task file to induce a reboot at a specified time. Creates it using schtasks
It seems to also be finding passwords on each infected computer and using those to spread as well.
This article demonstrates how boot-level malware like Petya can manipulate disk structures at a very early stage of the system boot process... take control of the system before the operating system even loads.
IDA Pro has a feature of cooperating with Bochs virtual machine that enables users to analyze code executed before an operating system is booted up.
OpenPetya is an educational project designed to study how bootkits and low-level ransomware operate internally.
PsExecと自身を送り込んだうえでPsExecを利用して自身をリモート実行します。
Commans lines: schtasks /Create /SC once /TN "" /TR "<system folder>\shutdown.exe /r /f" /ST <time>
Creates a scheduled task file to induce a reboot at a specified time. Creates it using schtasks
DoublePulsarを介してlsass.exeにインメモリでDLLインジェクションを行います。
It seems to also be finding passwords on each infected computer and using those to spread as well.
PsExecの利用については、DuplicateTokenExを使用しユーザーのトークンを複製
PsExecと自身を送り込んだうえでPsExecを利用して自身をリモート実行します。
If the user launches the malicious executable file Petya, Windows will show the standard UAC request for privilege escalation.
First, there is a request asking a user to elevate the application’s privileges... if it is not, then the it tries to run it’s new copy with higher privileges (using runas command). If this attempt failed, Mischa is dropped.
The dropper is simple and doesn’t contain any anti-debugging tricks, but it is very strongly obfuscated with a ton of junk code instructions and also uses self modifying methods.
The samples of the Trojan that Kaspersky Lab received for analysis are, just like most other malware samples, protected with a customized packer.
加えて、このDLLには有効でないMicrosoftのデジタル署名が付加されています。この点についてもデジタル署名が付与されているだけ(有効かどうかを確認しない)で安全とみなす製品、人の目を逃れるためと考えられます。
DoublePulsarを介してlsass.exeにインメモリでDLLインジェクションを行います。
The ransomware also erases the EventLog on infected machines.
イベントログの削除
It seems to also be finding passwords on each infected computer and using those to spread as well.
PsExecの利用については、DuplicateTokenExを使用しユーザーのトークンを複製
The dropper includes the XORed payload, which contains Petya’s bootloader and the Mischa module... In the first step, the Petya bootloader and the Mischa module are decrypted, using a simple 1-byte XOR algorithm.
つまり、このマルウェアが動作するには、正規プロセスであるRundll32.exe等のDLLを呼び出すホストプロセスの存在が必須となります。
After decrypting the payloads, an environment check is performed in order to choose which one of them will be installed. The process token... is used for choosing which installation path to follow next. Dropper comes with a list of Anti-Malware products, which presence is checked before the payload is deployed.
This article demonstrates how boot-level malware like Petya can manipulate disk structures at a very early stage of the system boot process... take control of the system before the operating system even loads.
IDA Pro has a feature of cooperating with Bochs virtual machine that enables users to analyze code executed before an operating system is booted up.
OpenPetya is an educational project designed to study how bootkits and low-level ransomware operate internally.
Mischa.dlll is injected to conhost.exe and deployed as a remote thread... Again we can see a DLL using ReflectiveLoader... This technique allows to produce a DLL that can be easily injected into another process.
First, the installer (OpenPetya.exe) backs up the original MBR and stores it in sector 63. It then overwrites the original boot sectors with the custom MBR and stage-2 bootloader binaries.
Uses wevtutil.exe to clear Setup, System, Security, and Application logs
It also contains a lightweight version of Mimikatz. It is used to dump valid credentials from memory... After initial infection, the ransomware will drop a tool in the %temp% folder, of what seems to be a lightweight version of Mimikatz... The tools are used to steal valid credentials to spread to other hosts in the network.
In addition to using dumping credentials, it also uses a Windows function called “CredEnumerateW” to find credentials in the local credential store.
ネットワーク情報の取得(NetBIOSから列挙)
My infected Windows hosts immediately generated TCP traffic on port 445 and did ARP requests for local network hosts.
The payload checks which privileges it has via the GetTokenInformation API function... The OS version verification is performed using an interesting method via the API functions VerSetConditionMask and VerifyVersionInfoW... The verification of the installed AV product is done by searching folder names inside “Program Files” or “Program Files (x86)” and comparing the results with the hardcoded list.
The verification of the installed AV product is done by searching folder names inside “Program Files” or “Program Files (x86)”... The folder search is carried out using the GetFileAttributesA API function... Mischa avoids the following directories...
it scans the drive to see if it is a multi-boot system to find additional volumes/partitions to try and encrypt their files as well.
It will scan for admin$ shares and connect to shares available for it to access.
After decrypting the payloads, an environment check is performed in order to choose which one of them will be installed. The process token... is used for choosing which installation path to follow next. Dropper comes with a list of Anti-Malware products, which presence is checked before the payload is deployed.
If Petya finds valid credentials, it will use either PsExec or WMIC to infect other computers connected to the LAN.
“The groups using ransomware in their targeted attacks usually try to find vulnerable servers or servers with unprotected RDP access.”
There are also indications of other propagation mechanisms that rely on insecurely configured network shares. | Based on an analysis in our labs, we have confirmed that the ETERNALBLUE exploit is one of the propagation vectors.
The ransomware can also perform lateral movement by using two exploits that came with the ShadowBrokers dump in April, called ETERNALBLUE and ETERNALROMANCE. These tools exploit vulnerabilities in SMBv1 (CVE-2017-0144 and CVE-2017-0145).
After penetrating an organization’s network the threat actors used the PsExec tool to install ransomware on all endpoints and servers in the organization.
Petya and Mischa can also work offline, meaning they don’t need to communicate back to their C&C servers, something other ransomware needs to do in order to download the encryption key.
the malware sample we’ve analyzed also contains the PsExec utility from Sysinternals
we have observed attempts by the malware to connect to network shares via the WebDAV protocol.
Experts point to "aggressive" features of the malware that make it impossible to retrieve key files... security firm Comae described the variant as a "wiper" rather than straight-forward ransomware.
“Petya, NotPetya, and OpenPetya use MBR to execute their custom bootloaders, display a fake CHKDSK process, and encrypt the Master File Table (MFT).”
“encrypts the Master File Table (MFT) and forces a reboot, at which point the node will prompt the end user to pay the ransom.”
The “unprecedented” June 27 attack started in Ukraine -- hitting government computer networks and websites of banks, major industrial enterprises, the postal service, Kyiv's international airport, and its subway system -- before spreading to other countries and international companies around the world.
NotPetya NtRaiseHardError、InitiateSystemshutdownExW、ExitWindowsExの順で試行 shutdownコマンドのタスクスケジュールの生成
MBR破壊型ワームランサムウェア... NotPetyaはMBRの書き込みの際... DeviceIoControl関数を利用してMBRの位置を取得、SetFilePointerExで先頭に移動し、書き込む
The ransomware encrypts files on disk and overwrite the MBR (Master Boot Record) if it has the necessary privileges... If the ransomware has sufficient privileges it will try to overwrite the MBR, preventing the operating system from loading after reboot.
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
92 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.