On June 27, 2017, a large-scale attack using a variant of the ransomware family known as GoldenEye/Petya or Petya affected much of the world.
In addition to encrypting files on the computer, this ransomware family is
In turn, if it has administrator permissions, it also encrypts the system boot sector by preventing access to the computer unless an access key that decrypts the system is entered. That key is assumed to be delivered once payment of the ransom has been made.
The sample creates a scheduled task to shut down the computer afterwards. Upon restarting the computer, Petya displays a fake window indicating that a disk problem is being solved.
Afterwards, it shows the window seeking the ransom:
These are the various methods of entry and propagation on compromised networks we have identified:
- An attack against the update mechanism of a third-party Ukrainian document management software product called
- ETERNALBLUE: This malware variant uses code that exploits the vulnerability published by Microsoft on March 14, described in the
- PSEXEC: Incorporates remote execution on the system using the PSEXEC command.
v8 = wsprintfW(a2, L"%s \\\\%s -accepteula -s ", v3, a3);
v9 = wsprintfW(&a2[v8], L"-d C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\%s\",#1 ", &v14) + v8;
- WMI: Incorporates remote execution on the system using the WMI command.
wbem\wmic.exe %s /node:"%ws" /user:"%ws" /password:"%ws" process call create "C:\Windows\System32\rundll32.exe \"C:\Windows\%s\" #1
Tips and RecommendationsAll our customers are protected against this attack. However, please ensure the following:
- Be cautious of documents contained in emails from untrusted senders.
- Keep your operating system up to date with the latest Microsoft updates available.
- In this case, as we have detected the use of ETERNALBLUE, we recommend that you make sure the following patch is installed on all computers across your network: https://technet.microsoft.com/en-us/
library / security/ ms17-010.aspx
- Install a Panda security product and keep it up to date.
- Keep a backup of your files.