Petya-Like Ransomware Reloaded
« Back to Blog

Petya-Like Ransomware Reloaded

By Cylance Threat Guidance Team

Overview 

The Petya-like ransomware that has been prominent in headlines over the past few hours has been rapidly propagating in-the-wild since mid-afternoon (UTC) on June 27. The malware uses the same SMB exploit as WannaCry (EternalBlue/DoublePulsar) in order to spread remotely, and in addition, leverages both PsExec and WMIC in order to spread laterally within corporate environments.

The multitude of spreading mechanisms ensures this ransomware is far more versatile in propagating than WannaCry, with the ability to infect remote systems patched against the MS17-010 vulnerability. Importantly, this attack lacks a remote kill switch that significantly limited the impact and spread of WannaCry.

N̶o̶t̶e̶:̶ ̶t̶h̶e̶r̶e̶ ̶i̶s̶ ̶s̶o̶m̶e̶ ̶d̶i̶s̶c̶u̶s̶s̶i̶o̶n̶ ̶a̶b̶o̶u̶t̶ ̶w̶h̶e̶t̶h̶e̶r̶ ̶t̶h̶i̶s̶ ̶m̶a̶l̶w̶a̶r̶e̶ ̶s̶h̶o̶u̶l̶d̶,̶ ̶i̶n̶ ̶f̶a̶c̶t̶,̶ ̶e̶v̶e̶n̶ ̶b̶e̶ ̶c̶o̶n̶s̶i̶d̶e̶r̶e̶d̶ ̶r̶a̶n̶s̶o̶m̶w̶a̶r̶e̶,̶ ̶r̶a̶t̶h̶e̶r̶ ̶t̶h̶a̶n̶ ̶a̶ ̶w̶i̶p̶e̶r̶.̶ ̶W̶e̶ ̶a̶r̶e̶ ̶c̶o̶n̶t̶i̶n̶u̶i̶n̶g̶ ̶t̶o̶ ̶r̶e̶s̶e̶a̶r̶c̶h̶ ̶i̶n̶ ̶t̶h̶i̶s̶ ̶a̶r̶e̶a̶.  UPDATE: 07/06/17: After further research, we have concluded that the primary intention of “Petya-like” was in fact to cause data-loss, by encrypting files with an irretrievable key and performing irreversible damage to critical areas of the filesystem. We’ll be posting an additional technical blog with our new findings early next week, and we’ve uncovered quite a bit of unexpected behavior from this Petya-like ransomware. 

Delivery, Propagation and Behavior

There is widespread speculation on the initial attack vector, including a compromised update package for a Ukrainian financial software and a phishing attack. Microsoft confirmed a direct link to the updater process and a few of the active infections. The documents in the supposed email phishing attack can be traced to a gist started in response to the ransomware attack. We’ve analyzed the documents and they are not related.

Regardless of the attack vector, the malware is in the wild and we have confirmed that it contains multiple mechanisms to propagate. The malware will attempt to enumerate subnets configured via DHCP, scan those networks and then attack the found hosts with a number of techniques.

The malware includes SMB exploits uncovered in the Shadow Brokers dump similar to the WannaCry worm. In addition, the malware will attempt to steal credentials from the infected machine and use standard techniques to remotely logon to hosts found on the subnet. What this means is that as machines move from corporate networks, to home networks, to public, shared networks, there will be multiple ways this malware can jump from one machine to another.

The ransomware itself arrives as a Win32 DLL file named perfc.dat, which is 353.9KB in size and is launched via rundll32.exe. The DLL purports to have been compiled on 2017/06/18, and is signed using a fake Microsoft certificate that fails to validate:

Figure 1. Invalid Signature of Ransomware

Once active, the ransomware performs several installation steps, including enabling various privileges (SeDebugPrivilege, SeTcbPrivilege, SeShutdownPrivilege), enumerating running processes, reading itself into heap memory and creating a new running instance. From there, it attempts to create a file named perfc under the Windows directory, and will terminate if the file already exists (the so called “vaccine”).

During the installation phase, the malware checks for the following active processes:

•̶ ̶ ̶ ̶a̶v̶p̶.̶e̶x̶e̶̶
•̶ ̶ ̶ ̶c̶C̶S̶v̶c̶h̶s̶t̶.̶e̶x̶e̶̶
•̶ ̶ ̶ ̶N̶S̶.̶e̶x̶e̶

UPDATE 7/6/17:
• avp.exe (Kaspersky)
• ccSvcHst.exe (Symantec Enterprise)
• NS.exe (Norton Security)

Figure 2. AV Process Detection

 ̶I̶f̶ ̶i̶t̶ ̶d̶i̶s̶c̶o̶v̶e̶r̶s̶ ̶a̶v̶p̶.̶e̶x̶e̶ ̶p̶r̶e̶s̶e̶n̶t̶ ̶o̶n̶ ̶a̶ ̶s̶y̶s̶t̶e̶m̶,̶ ̶i̶t̶ ̶w̶i̶l̶l̶ ̶f̶o̶r̶g̶o̶ ̶i̶n̶f̶e̶c̶t̶i̶o̶n̶ ̶o̶f̶ ̶t̶h̶e̶ ̶M̶B̶R̶. UPDATE 7/6/17: If it discovers avp.exe active on the system, it will forgo infection of the MBR and instead wipe the first 10 sectors of the hard drive, rendering the system unbootable. If either of the other processes are found, it will forgo network propagation.

Next the ransomware schedules a task, designed to reboot the system after a random amount of time has elapsed (ten minutes or more):

Figure 3. Create Shutdown Service

In order to facilitate lateral movement via WMIC and PsExec, the malware is bundled with two password dumpers (for both 32/64-bit architectures) that it drops to disk (as a .tmp file under %TEMP%) and then executes. Credentials are harvested from lsass.exe, and fed back to the parent process via a named pipe. Afterwards, it enumerates subnets defined on the DHCP server via the DhcpEnumSubnets() API, and then uses the response to scan each subnet by attempting to connect to ports 139 and 445 (TCP). If it gains a successful connection, it will attempt to copy itself to a remote share on the system:


Figure 4. Copying Itself to admin$ Share

Once copied, it will then use any harvested credentials in conjunction with PsExec (dropped as dllhost.dat under either %WINDOWS% or %COMMONAPPDATA%) or WMIC to remotely execute. In addition, the malware will also attempt to spread laterally to systems using the EternalBlue (confirmed) and EternalRomance (we have not confirmed this but has been noted by others; we will continue our research here) exploits:


Figure 5. Spreading via SMB Utilizing EternalBlue Exploit

Figure 6. Spreading via WMIC

The ransomware then proceeds to drop additional components and install itself in the Master Boot Record (MBR), prior to launching a thread to encrypt files on all fixed drives. Encryption is performed using a random 128-bit AES key, which is subsequently encrypted with the attackers 2048-bit RSA public key prior to being stored. Files are overwritten directly and not replaced with a new file extension, and the following extensions are targeted:

.3ds .7z .accdb .ai .asp .aspx .avhd .back .bak .c .cfg .conf .cpp .cs .ctl .dbf .disk .djvu .doc .docx .dwg .eml .fdb .gz .h .hdd .kdbx .mail .mdb .msg .nrg .ora .ost .ova .ovf .pdf .php .pmf .ppt .pptx .pst .pvi .py .pyc .rar .rtf .sln .sql .tar .vbox .vbs .vcb .vdi .vfd .vmc .vmdk .vmsd .vmx .vsdx .vsv .work .xls .xlsx .xvd .zip

Finally, the malware wipes the Setup, System, Security and Application event logs and deletes the NTFS USN change journal, prior to the system rebooting.

Once the system reboots the following ransom note is displayed:

Send your Bitcoin wallet ID and personal installation key to e-mail 
1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX
Ooops, your important files are encrypted.
If you see this text, then your files are no longer accessible, because
they have been encrypted. Perhaps you are busy looking for a way to recover
your files, but don't waste your time. Nobody can recover your files without
our decryption service.
We guarantee that you can recover all your files safely and easily.
All you need to do is submit the payment and purchase the decryption key.
Please follow the instructions:
Send $300 worth of Bitcoin to following address:
 


Figure 7. Encryption Screen


Figure 8. Ransom Screen

Conclusion

While inspired by WannaCry and Petya, the consensus is that the malware payload contains enough unique features to say that it’s a new malware strain, unlike those that came before it.

The malware uses several of the techniques used by previous ransomware variants including the SMB exploit seen in the WannaCry outbreak and the MBR infection technique used by Petya. In addition, we’ve observed the malware attempting to spread with an embedded version of PSExec and also by remotely invoking WMIC.

Our Threat Guidance team will continue researching this Petya-like ransomware and provide further technical detail in the coming days.

If you use our endpoint protection product CylancePROTECT®, you were already protected from this attack. You can watch CylancePROTECT in action blocking this ransomware here. If you don't have CylancePROTECT, contact us to learn how our AI-driven solution can predict and prevent unknown and emerging threats.

Indicators of Compromise (IoCs)

SHA-256 Hashes:

027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 (Ransomware)
64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1 (Ransomware)
02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f (x86 Password dumper)
eae9771e2eeb7ea3c6059485da39e77b8c0c369232f01334954fbac1c186c998 (x64 Password dumper)
f8dbabdfa03068130c277ce49c60e35c029ff29d9e3c74c362521f3fb02670d5 (PsExec)

Miscellaneous:

About the Cylance Threat Guidance Team

The Cylance Threat Guidance team examines malware and suspected malware to better identify its abilities, function and attack vectors. Threat Guidance is on the frontline of information security and often deeply examines malicious software, which puts them in a unique position to discuss never-seen-before threats.

Tags: