Petya Ransomware Spreading Via EternalBlue ExploitOn June 27, 2017, multiple organizations – many in Europe – reported
href="https://www.theguardian.com/world/2017/jun/27/petya-ransomware-attack-strikes-companies-across-europe">significant
disruptions they are attributing to Petya ransomware. Based on
initial information, this variant of the Petya ransomware may be
spreading via the href="https://www.fireeye.com/blog/threat-research/2017/05/smb-exploited-wannacry-use-of-eternalblue.html">EternalBlue
exploit used in the href="https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html">WannaCry
attack from last month.
Trusted sources and open-source reporting have suggested that the
initial infection vector for this campaign was a href="http://www.zdnet.com/article/six-quick-facts-june-global-ransomware-cyberattack/">poisoned
update for the MeDoc software suite, a software package used by
many Ukrainian organizations. The timing of a MeDoc software update,
which occurred on June 27, is consistent with initial reporting of the
ransomware attack, and the timing correlates to lateral movement via
PSExec we observed in victim networks starting around 10:12 UTC.
Additionally, the MeDoc website currently displays a warning message
in Russian stating: "On our servers is occurring a virus attack.
Our apologies for the temporary inconvenience!"
Our initial analysis of the artifacts and network traffic at victim
networks indicate that a modified version of the EternalBlue SMB
exploit was used, at least in part, to spread laterally along with WMI
commands, MimiKatz, and PSExec to propagate other systems. Analysis of
the artifacts associated with this campaign is still ongoing and we
will update this blog as new information come available.
FireEye has confirmed the following two samples related to this attack:
- 71b6a493388e7d0b40c83ce903bc6b04
- e285b6ce047015943e685e6638bd837e
FireEye has mobilized a Community Protection Event and is continuing
to investigate these reports and the threat activity involved in these
disruptive incidents. FireEye as a Service (FaaS) is actively engaged
in monitoring customer environments.
While FireEye detection leverages behavioral analysis of malicious
techniques, our team has created a YARA rule to assist organizations
in retroactively searching their environments for this malware, as
well as detecting future activity. Our team has focused on the
malicious attacker techniques that are core to the operation of the
malware: SMB drive usage, ransom demand language, the underlying
functions and APIs, and the system utilities used for lateral
movement. The thresholds can be modified in the condition section that follows.
rule FE_CPE_MS17_010_RANSOMWARE
{
meta:version="1.1"
//filetype="PE"
author=" href="mailto:Ian.Ahl@fireeye.com">Ian.Ahl@fireeye.com
@TekDefense, href="mailto:Nicholas.Carr@mandiant.com">Nicholas.Carr@mandiant.com
@ItsReallyNick"
date="2017-06-27"
description="Probable PETYA ransomware using ETERNALBLUE,
WMIC, PsExec"
strings:
// DRIVE
USAGE
$dmap01 = "\\\\.\\PhysicalDrive"
nocase ascii wide
$dmap02 =
"\\\\.\\PhysicalDrive0" nocase ascii wide
$dmap03 = "\\\\.\\C:" nocase ascii wide
$dmap04 = "TERMSRV" nocase ascii wide
$dmap05 = "\\admin$" nocase ascii wide
$dmap06 = "GetLogicalDrives" nocase ascii wide
$dmap07 = "GetDriveTypeW" nocase ascii
wide // RANSOMNOTE
$msg01 =
"WARNING: DO NOT TURN OFF YOUR PC!" nocase ascii
wide
$msg02 = "IF YOU ABORT THIS
PROCESS" nocase ascii wide
$msg03 =
"DESTROY ALL OF YOUR DATA!" nocase ascii wide
$msg04 = "PLEASE ENSURE THAT YOUR POWER CABLE IS
PLUGGED" nocase ascii wide
$msg05 =
"your important files are encrypted" ascii
wide
$msg06 = "Your personal installation
key" nocase ascii wide
$msg07 = "worth
of Bitcoin to following address" nocase ascii wide
$msg08 = "CHKDSK is repairing sector" nocase
ascii wide
$msg09 = "Repairing file system on
" nocase ascii wide
$msg10 = "Bitcoin
wallet ID" nocase ascii wide
$msg11 =
" href="mailto:wowsmith123456@posteo.net">wowsmith123456@posteo.net"
nocase ascii wide
$msg12 =
"1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" nocase ascii
wide
$msg_pcre = /(en|de)crypt(ion|ed\.)/
// FUNCTIONALITY, APIS
$functions01 =
"need dictionary" nocase ascii wide
$functions02 = "comspec" nocase ascii wide
$functions03 = "OpenProcessToken" nocase ascii
wide
$functions04 = "CloseHandle" nocase
ascii wide
$functions05 =
"EnterCriticalSection" nocase ascii wide
$functions06 = "ExitProcess" nocase ascii wide
$functions07 = "GetCurrentProcess" nocase
ascii wide
$functions08 =
"GetProcAddress" nocase ascii wide
$functions09 = "LeaveCriticalSection" nocase ascii
wide
$functions10 =
"MultiByteToWideChar" nocase ascii wide
$functions11 = "WideCharToMultiByte" nocase ascii
wide
$functions12 = "WriteFile" nocase
ascii wide
$functions13 =
"CoTaskMemFree" nocase ascii wide
$functions14 = "NamedPipe" nocase ascii wide
$functions15 = "Sleep" nocase ascii wide //
imported, not in strings // COMMANDS
// -- Clearing event logs & USNJrnl
$cmd01 = "wevtutil cl Setup" ascii wide nocase
$cmd02 = "wevtutil cl System" ascii wide
nocase
$cmd03 = "wevtutil cl Security"
ascii wide nocase
$cmd04 = "wevtutil cl
Application" ascii wide nocase
$cmd05 =
"fsutil usn deletejournal" ascii wide nocase
// -- Scheduled task
$cmd06 = "schtasks
" nocase ascii wide
$cmd07 = "/Create
/SC " nocase ascii wide
$cmd08 = " /TN
" nocase ascii wide
$cmd09 = "at
%02d:%02d %ws" nocase ascii wide
$cmd10 =
"shutdown.exe /r /f" nocase ascii wide
// -- Sysinternals/PsExec and WMIC
$cmd11 =
"-accepteula -s" nocase ascii wide
$cmd12 = "wmic"
$cmd13 =
"/node:" nocase ascii wide
$cmd14 =
"process call create" nocase ascii wide
condition:
// (uint16(0) == 0x5A4D)
3 of ($dmap*)
and 2 of ($msg*)
and 9
of ($functions*)
and 7 of ($cmd*)
}
|
FireEye has read reports that the malware is spread by an email lure
containing a malicious Office document attachment or links to infected
documents exploiting CVE-2017-0199. We are confident that this
document is unrelated to the current outbreak of activity, and we have
seen no other indicators that CVE-2017-0199 is related. While FireEye
detects these campaigns, we have not observed any correlation with
known victims of the Petya attacks.
Implications
This activity highlights the importance of organizations securing
their systems against the EternalBlue exploit and ransomware
infections. href="https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/">Microsoft
has provided a guide for securing Windows systems against the
EternalBlue exploit in the context of the WannaCry ransomware. A
robust back-up strategy, network segmentation and air gapping where
appropriate, and other defenses against ransomware can help
organizations defend against ransomware distribution operations and
quickly remediate infections.
Source:
Petya Ransomware Spreading Via EternalBlue Exploit
