Pierluigi Paganini September 18, 2017

I’m proud to share with you the first report produced by Z-Lab, the Malware Lab launched by the company CSE CybSec. Enjoy the Analysis Report NotPetya.

As most of you already know I have officially presented my new Co a couple of months ago, CybSec Enterprise is its name and we already started to work on strategic projects that we will reveal soon … meantime I apologize for the website that is still under construction.

We have already launched a malware Lab, let’s call it Z-Lab, composed of a group of skilled researchers and lead by Eng. Antonio Pirozzi.

It’s a pleasure for me to share with you one of the first analysis that we have recently conducted on the NotPetya Ransomware.

We have dissected the ransomware and discovered interesting details that are included in our report.

Below the abstract, the detailed report is available for free on our website.

Abstract

Due to the lack of updates performed by users on their machines, many threats spread out exploiting well-known vulnerabilities. This is what happened with the propagation of the NotPetya Ransomware, which infected a lot of users mostly in East Europe. This malware uses a famous exploit developed by NSA, Eternalblue, allowed by a vulnerability (MS17-010; CVE-2017-0143) in the Windows implementation of SMB protocol. The above-mentioned exploit was leaked in April 2017 and was used the first time with another malware, WannaCry, which caused more damage than NotPetya.

NotPetya’s could be confused with Petya ransomware (spread out in 2016) because of its behavior after the system reboot, but actually not because NotPetya is much more complex than the other one. In fact, Petya’s most known characteristic is the enciphering of the Windows MBR and MFT, instead, NotPetya propagates itself in the network as a worm.

In the above figure, we have a scheme of the malware’s behavior. We can see that the first phase is the searching of a file representing a kill-switch, to avoid infecting machines already compromised. Next steps are referred to the actual infection, synthesized below:

• Take disk control
• Replace the original MBR with its own
• Schedule reboot after an hour
• Crypt user files and concurrently spread itself using Eternalblue exploit

After the reboot, the next step is the fake CHKDSK routine, very similar to Petya, where the malware enciphers the MFT. After that, we no longer have the characteristic Petya skull, but directly the screen with the ransom note, including the e-mail address of the malware writer and the relative Bitcoin address for the ransom payment.

You can download the full ZLAB Malware Analysis Report at the following URL:

http://csecybsec.com/download/zlab/NotPetya-report.pdf

About the author: Antonio Pirozzi

Principal Malware Scientist and Senior Threat Researcher for CSE CybSec Enterprise spa

Actually, he holds more than 10 Infosec International Certification, from SANS, EC-Council and Department of Homeland Security.
His experience goes beyond the classical Computer Security landscape, he worked on numerous projects on GSM Security, Critical Infrastructure Security,  Blockchain Malware, composition malware, malware evasion.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – NotPetya, malware)

[adrotate banner=”12″]