Petya weren't expecting this: Ransomware takes systems hostage across the globe

Update: This post was updated on June 28, 2017. A follow-up blog, “A ‘Wiper’ in Ransomware Clothing: Global Attacks Intended for Destruction Versus Financial Gain” was published June 29.

The malware, being referred to as a Petya variant, has impacted systems in 65 countries, one initial infection vector has been traced, by Microsoft, to the MEDoc updater process. And there are some reports that the creators of the malware meant to destroy data not just hold it ransom.

Today IBM X-Force analysts determined that the credentials used with PsExec and WMIC for lateral movement were obtained using Mimikatz. To help stop lateral movement a new recommendation has been added to the recommendations at the end of this post.

Once the malware is loaded on a machine it encrypts the MBR (master boot record) and schedules a reboot. During the reboot a fake CHKDSK screen is displayed. After the fake CHKDSK run is finished, the system is again restarted and the following ransom message is shown:

Additional technical details from Mark Yason of the IBM X-Force Research team:

• The malware arrives as a DLL on infected systems. It exports an unnamed function (ordinal 1) which runs its main code.
• Upon execution, the malware copies its code into a newly allocated memory and continues execution from there. The malware then deletes itself (the malware DLL) from the file system.
• The malware checks if the file C:\Windows\%DllNameWithoutExtension% exists, if it does, it terminates itself, otherwise, it creates the said file to mark that it is was executed on the system.
  • %DllNameWithoutExtension% is the name of the malware DLL without the extension. For example, if the name of the malware DLL is “perfc.dat”, the file C:\Windows\perfc is checked.

• The malware propagates to target machines by exploiting the EternalBlue vulnerability.
• Upon successful exploitation of a target machine, the malware will be dropped as “%WINDIR%\%MalwareDllName% and will be executed by lsass.exe using the following command:

• The malware also propagates via the ADMIN$ share of target machines.
• To be able to connect to the ADMIN$ share of target machines, the malware drops and executes a logon credential dumper tool to a temporary file and then executes it. It communicates with the credential dumper tool via a pipe named “\\.\pipe\%RandomGUID%” where it will receive the dumped credentials.
• The malware also drops the PsExec tool that it will use for executing its dropped copy on remote machines. The dropped PsExec tool will have the name “%WINDIR%\dllhost.dat” or “%ProgramData%\dllhost.dat”.
• The malware attempts to connect to the ADMIN$ share of target machines using the dumped credentials. If the connection is successful, the malware will drop a copy of itself as “\\%TargetMachine%\admin$\%MalwareDllName%” which corresponds to “%WINDIR%\%MalwareDllName%” in the target machine.
• Once dropped in the target machine, the malware will attempt to execute its dropped copy by using PsExec:

If PsExec failed, the malware will attempt to use the WMIC tool to execute its dropped copy:

• Block ADMIN$ with GPO to stop lateral movement via WMI and PSEXEC.

Original article published June 27, 2017.

Early on Tuesday, June 27, reports began to circulate that organizations in the Ukraine and elsewhere in Europe were suffering ransomware attacks. It quickly became clear that this Petya attack could equal or surpass the May WannaCry attack.

WannaCry’s spread was so successful because it was powered by a flaw in Windows, and although Microsoft had released a patch to fix the flaw, many companies didn’t apply it before the outbreak. Luckily, companies outside of the initial attack zone of the EU were able to get their systems patched to prevent greater international impact.

Unfortunately, the authors of this variant of ransomware have learned from the past. The current outbreak of Petya ransomware can be spread to unpatched systems via the same exploit as WannaCry, but it can also achieve lateral movement to infect patched systems on connected networks using Windows Management Instrumentation Command-line (WMIC) and PsExec, a remote command tool from Microsoft.

Most outlets are reporting the ransomware as Petya, however at least one security company believes it is a copycat and not a true Petya variant. At this time, IBM X-Force has identified at least three samples we believe are updated Petya variants.

Petya ransomware first appeared in 2016. It is unique in the ransomware space because it encrypts the master boot record (MBR) and master file table (MFT) on infected hosts. One of Petya’s more unique aspects is that it can work even if a system is offline. It does not require a live connection to a command-and-control (C&C) server.

In this recent outbreak, it appears that the current Petya payload is being distributed using the same EternalBlue exploit that was part of the so-called Shadow Brokers leaks that powered the spread of WannaCry. As in the WannaCry outbreak, this malware is modular.