#OPEN RANSOMWHERE SOFTWARE#
#OPEN RANSOMWHERE WINDOWS#

Petya is initially executed via rundll32.exe using the following command: If found, Petya will not use the EternalBlue and EternalRomance exploits to spread. Petya checks for the presence of the following processes which are used by Norton products and Symantec Endpoint Protection:

SMB exploits: It attempts to spread using variations of the EternalBlue and EternalRomance exploits.

#OPEN RANSOMWHERE WINDOWS#

It is then executed remotely using either PsExec or the Windows Management Instrumentation Command-line (WMIC) tool. Execution across network shares: It attempts to spread to the target computers by copying itself to \admin$ using the acquired credentials.Petya uses two primary methods to spread across networks: Drops and executes a 32bit or 64bit credential dumper.Gathers user names and passwords from Windows Credential Manager.It uses two methods to gather credentials: The list of user names and passwords is stored in memory. Once the list of target computers has been identified, Petya builds out a list of user names and passwords it can use to spread to those targets. All resources in the Windows Credential Manager (including Remote Desktop Terminal Services computers).All server and workstation resources in Network Neighborhood.All computers you have a current open network connection with.All IP addresses within the subnet as defined by the subnet mask if ports 445/139 are open.

All DHCP clients of the DHCP server if ports 445/139 are open.All IP addresses and DHCP servers of all network adaptors.Petya builds a list of IP addresses to spread to, which includes primarily addresses on the local area network (LAN) but also remote IPs. It does this by building a list of target computers and using two methods to spread to those computers. Petya is a worm, meaning it has the ability to self-propagate.

MEDoc is widely used in Ukraine, indicating that organizations in that country were the primary target.Īfter gaining an initial foothold, Petya then uses a variety of methods to spread across corporate networks.

#OPEN RANSOMWHERE SOFTWARE#

Symantec has confirmed that MEDoc, a tax and accounting software package, is used for the initial insertion of Petya into corporate networks.

Open ransomwhere