According to Microsoft , the Petya (also referred to as NotPetya/ExPetr) Ransomware attack started its initial infection through a compromise at the Ukrainian company M.E.Doc, a developer of tax accounting software. We took a closer look and did a full analysis using VMRay Analyzer.
Figure 1: Petya upload with ‘#1’ command line argument If we forget this argument, the “rundll32.exe” calls the standard EntryPoint in the “Petya.dll”. This works, but the VTI (VMRay Threat Identifier) Score will be low because the malware author of Petya 2017 leaves this function empty. Which means nothing happens, and therefore no score.
Figure 2: Petya’s VTI Score 100/100 The first line in the VTI Information section of the report confirms what we see in the screenshots: a complete new boot-screen with the infamous Petya look.
Petya 2017 Analysis
In the first step, Petya retrieves a list of all running processes and builds a hash for each. Then Petya will decide what configuration to run on if there is a match out of the three fixed hashes. It searches for the hashes
Figure 3: Petya searching for hashes The first hash 0x2E214B44 could be reconstructed to the string “avp.exe”. This process is a part of Kaspersky Security software. If this process is running the Petya ransomware will destroy the master boot record (Figure 4). Otherwise, the master boot record is overwritten with the new Petya bootloader.
Figure 4: Destroying of master boot record if process runs Petya The other two hashes couldn’t be reconstructed so far, but there is functionality. If one of the hashes were found, Petya does not try to spread itself using the SMB exploit EternalBlue. After this setup, Petya starts its main task: infect, encrypt and clean up.
Infection
Petya uses several different tactics to infect other machines. One is to drop and run a credential dumping tool. This strategy leverages a common behavior of users logging into accounts using local admin privileges with sessions running on multiple machines. The credentials stolen by Petya are likely to provide the same level of access to other machines.
Figure 5: Using the WMIC tools to execute the copies remotely If the WMIC tool does not work it attempts remote execution with the PSEXEC tool which is dropped as “dllhost.dat” (Figure 6).
Figure 6: PSEXEC tool dropped as “dllhost.dat”. The other option to spread itself is via the EternalBlue exploit (Figure 7).
Figure 7: Another option of spreading itself through EternalBlue exploit Encryption
In parallel with the infection tactics, Petya starts its encryption routine. To get a quick overview, we look into the function logfile and search for a well-known suffix, like ”.png” (Figure 8), because we think the ransomware will search for it. As expected, we find a part of the encryption routine.
Figure 8: Searching for .png file in the function logfile Now we can read out all suffixes, Petya is looking for:
If we scroll to the end of the function logfile “FindFistFileW / FindNextFileW”- loop, we reach the encryption part for these files (Figure 9).
Figure 9: “FindFistFileW / FindNextFileW”- loop in the Function Logfile We notice that the encryption does not use the API function “WriteFile”. Instead, it uses “MapViewOfFile” / “UnmapViewOfFile”, which allows the encryption of the files directly. But with this technique, the encrypted files do not get a new suffix. All files are encrypted with the same AES key. The AES key is encrypted by the malware author’s public RSA key. As a result, the encrypted AES key is written into the README.txt (Figure 10). These techniques were uncovered searching through the function logfile. The keys are securely generated.
Preparing Reboot
Looking at the “Monitored Processes” section of the “Overview” section of Analysis Report we can see the encryption is running two other processes started in independent instances of a command line “cmd.exe”.
wevtutil cl Setup &
schtasks /Create /SC once /TN “” /TR
Figure 11: Fake Disk Tool After some time, the fake repairing is completed and the next state of the Petya bootloader runs (Figure 12).
Figure 12: Petya bootloader running The text shown below is mostly the same as the “README.txt”, but the “personal installation key” is different:
Ooops, your important files are encrypted.
Conclusion
The new Petya ransomware is not really a ransomware, but more of a wiper. This is because it changes the master boot record (MBR) without backup and shows a random useless “personal installation key”. The e-mail address “wowsmith123456@posteo.net” was instantly banned from the mail provider. And looking at the Bitcoin account shows that only a few payments were transacted (Figure 14).
Figure 14: Bitcoin/Email Information – Petya 2017 The 3.99029155 BTC is worth about $10,000 – a trivial amount for a ransomware scheme. The invalid email address along with the Bitcoin inconsistencies indicate that Petya was engineered for destructive intentions rather than for financial gain. Security researcher Nicholas Weaver at the International Computer Science Institute told Krebs on Security , “I’m willing to say with at least moderate confidence that this was a deliberate, malicious, destructive attack or perhaps a test disguised as ransomware,” Weaver said. “The best way to put it is that Petya’s payment infrastructure is a fecal theater.”
For a deeper look at Petya, access our full analysis report .
