Technical Support

Need help?


Information on the ransomware Petya cyberattack

On June 27, 2017, a large-scale attack using a variant of the ransomware family known as GoldenEye/Petya or Petya affected much of the world.

In addition to encrypting files on the computer, this ransomware family is characterized by encrypting the MBR when it has permissions, thus blocking full access to the computer. This version of the malware is distributed as a DLL with an EXPORT, which is named with a parameter that changes with each sample to begin the encryption process on the computer. When it runs, it encrypts certain files on compromised system drives.

In turn, if it has administrator permissions, it also encrypts the system boot sector by preventing access to the computer unless an access key that decrypts the system is entered. That key is assumed to be delivered once payment of the ransom has been made.

The sample creates a scheduled task to shut down the computer afterwards. Upon restarting the computer, Petya displays a fake window indicating that a disk problem is being solved.

Afterwards, it shows the window seeking the ransom:

Infection vectors

These are the various methods of entry and propagation on compromised networks we have identified:

  • An attack against the update mechanism of a third-party Ukrainian document management software product called MeDoc.
  • ETERNALBLUE: This malware variant uses code that exploits the vulnerability published by Microsoft on March 14, described in the bulletin MS17-010
  • PSEXEC: Incorporates remote execution on the system using the PSEXEC command.

    v8 = wsprintfW(a2, L"%s \\\\%s -accepteula -s ", v3, a3);
    v9 = wsprintfW(&a2[v8], L"-d C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\%s\",#1 ", &v14) + v8;
  • WMI: Incorporates remote execution on the system using the WMI command.

    wbem\wmic.exe %s /node:"%ws" /user:"%ws" /password:"%ws" process call create "C:\Windows\System32\rundll32.exe \"C:\Windows\%s\" #1

Tips and Recommendations

All our customers are protected against this attack. However, please ensure the following:

  • Be cautious of documents contained in emails from untrusted senders.
  • Keep your operating system up to date with the latest Microsoft updates available.
  • In this case, as we have detected the use of ETERNALBLUE, we recommend that you make sure the following patch is installed on all computers across your network: library / security / ms17-010.aspx
  • Install a Panda security product and keep it up to date.
  • Keep a backup of your files.
Help nº- 20190925 1690 EN

Have you resolved your query with this article?

yes no

Thanks for your answer

Why didn't you find it helpful?

The instructions are too complex.
The instructions are too long.
The instructions don't work.
I'd rather have a video.
Other reasons.

Talk to a technician!


Business hours: Mondays-Fridays 9:00 to 18:00 CET

Outside business hours, please use the online form.



You’re about to visit our web page in English
Would you like to continue?

Yes, I want to visit the web page in English No, I want to visit the web page in

If this is not what you’re looking for,

Visit our Welcome Page!