MalwareExploits 1 CVE

EternalPetya

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0144EternalBlue SMBv1 Remote Code ExecutionExploited in the wild

On June 27, 2017, multiple organizations – many in Europe – reported significant disruptions they are attributing to a variant of the Petya ransomware, which we are calling “EternalPetya”. | The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits, including the EternalBlue exploit used in the WannaCry attack from May 2017. Our analysis of the artifacts and network traffic at victim networks indicate that modified versions of the EternalBlue and EternalRomance SMB exploits were used, at least in part, to spread laterally.

via web archiveweb.archive.org

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence2

The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits...

T1195.002Compromise Software Supply ChainEvidence2

The initial infection vector for this campaign was a poisoned update for the MeDoc software suite, a software package used by many Ukrainian organizations.

Execution

4 techniques

T1047Windows Management InstrumentationEvidence2

However, much of the propagation is believed to have occurred by the malware’s use of WMI commands, MimiKatz, and PSExec.

T1053Scheduled Task/JobEvidence1

// -- Scheduled task $cmd06 = "schtasks " nocase ascii wide $cmd07 = "/Create /SC " nocase ascii wide $cmd08 = " /TN " nocase ascii wide $cmd09 = "at %02d:%02d %ws" nocase ascii wide

T1053.005Scheduled TaskEvidence1

YARA command strings include "schtasks ", "/Create /SC ", and subsequent reboot via "shutdown.exe /r /f"

T1569.002Service ExecutionEvidence1

"...the timing correlates to lateral movement via PSExec we observed in victim networks..." and "...propagation is believed to have occurred by the malware’s use of WMI commands, MimiKatz, and PSExec."

Persistence

3 techniques

T1053Scheduled Task/JobEvidence1

// -- Scheduled task $cmd06 = "schtasks " nocase ascii wide $cmd07 = "/Create /SC " nocase ascii wide $cmd08 = " /TN " nocase ascii wide $cmd09 = "at %02d:%02d %ws" nocase ascii wide

T1053.005Scheduled TaskEvidence1

YARA command strings include "schtasks ", "/Create /SC ", and subsequent reboot via "shutdown.exe /r /f"

T1078Valid AccountsEvidence2

The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits...

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

// -- Scheduled task $cmd06 = "schtasks " nocase ascii wide $cmd07 = "/Create /SC " nocase ascii wide $cmd08 = " /TN " nocase ascii wide $cmd09 = "at %02d:%02d %ws" nocase ascii wide

T1053.005Scheduled TaskEvidence1

YARA command strings include "schtasks ", "/Create /SC ", and subsequent reboot via "shutdown.exe /r /f"

T1078Valid AccountsEvidence2

The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits...

Stealth

4 techniques

T1070Indicator RemovalEvidence1

YARA command string: "fsutil usn deletejournal"

T1070.001Clear Windows Event LogsEvidence2

$cmd01 = "wevtutil cl Setup" ... $cmd04 = "wevtutil cl Application"

T1070.004File DeletionEvidence1

// COMMANDS // -- Clearing event logs & USNJrnl $cmd01 = "wevtutil cl Setup" ... $cmd05 = "fsutil usn deletejournal" ascii wide nocase

T1078Valid AccountsEvidence2

The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits...

Credential Access

1 technique

T1003OS Credential DumpingEvidence2

However, much of the propagation is believed to have occurred by the malware’s use of WMI commands, MimiKatz, and PSExec.

Lateral Movement

2 techniques

T1021.002SMB/Windows Admin SharesEvidence2

Our analysis of the artifacts and network traffic at victim networks indicate that modified versions of the EternalBlue and EternalRomance SMB exploits were used, at least in part, to spread laterally. | the timing correlates to lateral movement via PSExec we observed in victim networks starting around 10:12 UTC.

T1210Exploitation of Remote ServicesEvidence2

The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits, including the EternalBlue exploit used in the WannaCry attack from May 2017.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence1

Some referenced destructive malware families in the broader corpus include EternalPetya/Petya and ransomware-like impact tooling, though often in comparative reporting.

T1529System Shutdown/RebootEvidence1

$cmd10 = "shutdown.exe /r /f" nocase ascii wide

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

web archiveNews

Jun 27, 2017

Petya Destructive Malware Variant Spreading via Stolen Credentials and EternalBlue Exploit | FireEye Inc

Ransomware initially distributed through a compromised MeDoc software update system and then self-propagated laterally using stolen credentials, SMB exploits, WMI commands, MimiKatz, and PSExec.

malpediaNews

Feb 1, 2026

APT28 (Threat Actor)

APT44: Unearthing Sandworm VPNFilter BlackEnergy CaddyWiper EternalPetya HermeticWiper Industroyer INDUSTROYER2 Olympic Destroyer PartyTicket RoarBAT

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

EternalPetya

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0144EternalBlue SMBv1 Remote Code ExecutionExploited in the wild

via web archiveweb.archive.org

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence2

The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits...

T1195.002Compromise Software Supply ChainEvidence2

The initial infection vector for this campaign was a poisoned update for the MeDoc software suite, a software package used by many Ukrainian organizations.

Execution

4 techniques

T1047Windows Management InstrumentationEvidence2

However, much of the propagation is believed to have occurred by the malware’s use of WMI commands, MimiKatz, and PSExec.

T1053Scheduled Task/JobEvidence1

// -- Scheduled task $cmd06 = "schtasks " nocase ascii wide $cmd07 = "/Create /SC " nocase ascii wide $cmd08 = " /TN " nocase ascii wide $cmd09 = "at %02d:%02d %ws" nocase ascii wide

T1053.005Scheduled TaskEvidence1

YARA command strings include "schtasks ", "/Create /SC ", and subsequent reboot via "shutdown.exe /r /f"

T1569.002Service ExecutionEvidence1

Persistence

3 techniques

T1053Scheduled Task/JobEvidence1

// -- Scheduled task $cmd06 = "schtasks " nocase ascii wide $cmd07 = "/Create /SC " nocase ascii wide $cmd08 = " /TN " nocase ascii wide $cmd09 = "at %02d:%02d %ws" nocase ascii wide

T1053.005Scheduled TaskEvidence1

YARA command strings include "schtasks ", "/Create /SC ", and subsequent reboot via "shutdown.exe /r /f"

T1078Valid AccountsEvidence2

The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits...

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

// -- Scheduled task $cmd06 = "schtasks " nocase ascii wide $cmd07 = "/Create /SC " nocase ascii wide $cmd08 = " /TN " nocase ascii wide $cmd09 = "at %02d:%02d %ws" nocase ascii wide

T1053.005Scheduled TaskEvidence1

YARA command strings include "schtasks ", "/Create /SC ", and subsequent reboot via "shutdown.exe /r /f"

T1078Valid AccountsEvidence2

The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits...

Stealth

4 techniques

T1070Indicator RemovalEvidence1

YARA command string: "fsutil usn deletejournal"

T1070.001Clear Windows Event LogsEvidence2

$cmd01 = "wevtutil cl Setup" ... $cmd04 = "wevtutil cl Application"

T1070.004File DeletionEvidence1

// COMMANDS // -- Clearing event logs & USNJrnl $cmd01 = "wevtutil cl Setup" ... $cmd05 = "fsutil usn deletejournal" ascii wide nocase

T1078Valid AccountsEvidence2

The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits...

Credential Access

1 technique

T1003OS Credential DumpingEvidence2

However, much of the propagation is believed to have occurred by the malware’s use of WMI commands, MimiKatz, and PSExec.

Lateral Movement

2 techniques

T1021.002SMB/Windows Admin SharesEvidence2

T1210Exploitation of Remote ServicesEvidence2

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence1

Some referenced destructive malware families in the broader corpus include EternalPetya/Petya and ransomware-like impact tooling, though often in comparative reporting.

T1529System Shutdown/RebootEvidence1

$cmd10 = "shutdown.exe /r /f" nocase ascii wide

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

web archiveNews

Jun 27, 2017

Petya Destructive Malware Variant Spreading via Stolen Credentials and EternalBlue Exploit | FireEye Inc

Ransomware initially distributed through a compromised MeDoc software update system and then self-propagated laterally using stolen credentials, SMB exploits, WMI commands, MimiKatz, and PSExec.

malpediaNews

Feb 1, 2026

APT28 (Threat Actor)

APT44: Unearthing Sandworm VPNFilter BlackEnergy CaddyWiper EternalPetya HermeticWiper Industroyer INDUSTROYER2 Olympic Destroyer PartyTicket RoarBAT

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.