How to protect PC or server from Ramsomware Attack .

Ransomware is a form of malicious software (or malware) that, once it’s taken over your computer, threatens you with harm, usually by denying you access to your data. The attacker demands a ransom from the victim, promising — not always truthfully — to restore access to the data upon payment. 

Users are shown instructions for how to pay a fee to get the decryption key. The costs can range from a few hundred dollars to thousands, payable to cybercriminals in Bitcoin.

Infection Flow

As previously mentioned, this ransomware’s initial entry into the system involves the use of the PsExec tool, an official Microsoft utility used to run processes on remote systems. It also uses the EternalBlue exploit–previously used in the WannaCry attack–that targets a vulnerability in Server Message Block (SMB) v1. Once on a system, this Petya variant uses the rundll32.exe process to run itself. The actual encryption is then carried out by a file named perfc.dat, located in the Windows folder.

This ransomware then adds a scheduled task, which reboots the system after at least an hour. Meanwhile, the Master Boot Record (MBR) is also modified so that the encryptor will carry out the encryption and the appropriate ransom note will be displayed. A fake CHKDSK notice is initially displayed; this is when the encryption is actually carried out. Unusually for ransomware, it does not change the extensions of any encrypted files. More than 60+ file extensions are targeted for encryption; it is worth noting that the file extensions targeted are focused on file types used in enterprise settings; images and video files (targeted by other ransomware attacks) are notably absent.

Aside from the use of the EternalBlue exploit, there are other similarities to WannaCry. Like that attack, this Petya variant’s ransom process is relatively simple: it also uses a hardcoded Bitcoin address, making decryption a much more labor-intensive process on the part of the attackers. This is in contrast to earlier Petya attacks, which had a more developed UI for this process. Each user is asked to pay US$300. As of this time, approximately US$7,500 had been paid into the Bitcoin address. As in all ransomware attacks, we advice against paying the ransom–this is particularly true in this case, as the email account mentioned in the ransom note is no longer active.

PsExec and Windows Management Information Command-line (WMIC)

Petya cleverly uses legitimate Windows processes PsExec and Windows Management Information Command-line, which is an interface that simplifies the use of Windows Management Instrumentation (WMI).

Once Petya is dropped, it will drop psexec.exe as dllhost.dat on the target machine. The malware also drops a copy of itself to \\remote machine name\admin$\malware filename. It then executes the dropped copy by using dllhost.dat locally (which is the file name of the PSExec tool) with the following parameters:

dllhost.dat \\remote machine name -accepteula -s -d C:\Windows\System32\rundll32 “C:\Windows\malware filename”,#1 random number minimum 10 enumerated credentials

The format of enumerated credentials is as follows:

“un1:pw1” “un2:pw2” “un3:pw3” … “unN:pwN”

If this is unsuccessful, Petya will then use WMIC.EXE to execute the file in the remote machine:

%System%\wbem\wmic.exe /node:”node” /user:”user name” /password:”password” process call create “C:\Windows\System32\rundll32 \”C:\Windows\malware filename\” #1 random number minimum 10enumerated credentials”

Petya will use PSExec or WMIC to spread the malware to other systems within the local network. If this portion of the infection chain does not work, only then will Petya exploit the EternalBlue vulnerability.

Information Extraction Method

We discovered that this Petya variant uses an advanced method to extract information from the infected system. It makes use of a customized Mimikatz—a legitimate security tool—to extract usernames and passwords. The 32-bit and 64-bit Mimikatz executables are encrypted and stored in the resource section of the ransomware. The extraction method runs when the main malware process opens a pipe, which is used by the custom Mimikatz to write its results. These results are then read by the main malware process. As mentioned earlier, Petya is able to spread to other systems within the local network by using this extracted information.

Disk Modification Procedure

Before encryption, Petya will first modify the MBR as part of its process. Initially, the sector after the Volume Boot Record (VBR) is written with code (0xBAADF00D), rendering the system unbootable.

It also accesses the following sectors:

Sectors 0 to 18 (disk offset 0 to 25FFh) are overwritten with its own boot program. 
Sector 32 (disk offset 4000h to 41FFh) is written with some structured random data. 
Sector 33 (disk offset 4200h to 43FFh) is filled with 07h.

The original MBR is encrypted:

Sector 34 (disk offset 4400h to 45FFh) is written with the XOR-encrypted original MBR.

If the above process fails, it will overwrite sectors 0-9 with code (0xBAADF00D),

How to prevent ransomware

  • Keep your operating system patched and up-to-date to ensure you have fewer vulnerabilities to exploit and Patch with MS17-10

 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010

  • Don’t install software or give it administrative privileges unless you know exactly what it is and what it does.
  • Install antivirus software, which detects malicious programs like ransomware as they arrive, and whitelisting software, which prevents unauthorized applications from executing in the first place.
  • And, of course, back up your files, frequently and automatically! That won’t stop a malware attack, but it can make the damage caused by one much less significant.
  • Disable or Block SMBv1 – this is a temporary measure to stop the propagation, but does not remediate the threat. If is needed to enable SMBv1 than always enable SMBv2.
  • Block Port 445 and 139 from Firewall.
  • Restrict accounts with administrator group access.
  • Disable remote desktop access. If it is needed than select different user which is not easily guess with strong password.

Best Windows 11 antivirus tools

  1. Avast Antivirus Business 18.6 and 18.8
  2. Bitdefender Endpoint Security 6.6
  3. Bitdefender Endpoint Security Elite 6.6
  4. F-Secure PSB Computer Protection 18.14 and 18.17
  5. Kaspersky Endpoint Security 11.0
  6. Kaspersky Small Office Security 6
  7. McAfee Endpoint Security 10.6
  8. Microsoft Windows Defender Antivirus 4.18
  9. Symantec Endpoint Protection 14.2
  10. Symantec Endpoint Protection Cloud 22.15
  11. Trend Micro Office Scan 12.0

61 comments

  1. I needed to create you the tiny remark just to give thanks once again about the precious advice you have featured on this website. It’s quite surprisingly open-handed of you to convey unreservedly all many of us would’ve sold as an ebook in order to make some cash for their own end, specifically now that you could have tried it if you considered necessary. Those tips also served to become easy way to fully grasp someone else have the same fervor similar to my personal own to know the truth a little more on the topic of this matter. I think there are a lot more pleasurable opportunities up front for individuals who check out your website.

  2. I as well as my pals appeared to be checking out the great secrets located on the website then instantly got a horrible feeling I never expressed respect to you for those tips. All the guys were as a consequence thrilled to see all of them and now have unquestionably been taking advantage of them. We appreciate you truly being indeed considerate and for making a decision on this sort of magnificent subject areas millions of individuals are really needing to learn about. Our sincere apologies for not expressing gratitude to you sooner.

  3. I actually wanted to send a remark to be able to thank you for all the marvelous recommendations you are writing on this website. My time-consuming internet search has at the end of the day been compensated with awesome suggestions to talk about with my neighbours. I ‘d admit that most of us site visitors actually are unquestionably endowed to live in a very good network with many special people with very helpful methods. I feel truly privileged to have come across your weblog and look forward to many more fabulous moments reading here. Thanks a lot once again for all the details.

  4. I and my buddies happened to be viewing the best ideas found on the blog and then the sudden came up with an awful feeling I never thanked the web site owner for those strategies. All the young men are already as a result excited to learn them and already have clearly been making the most of those things. Appreciate your really being considerably accommodating as well as for finding some remarkable tips most people are really wanting to be informed on. My very own sincere apologies for not saying thanks to you sooner.

  5. I enjoy you because of each of your effort on this web page. Betty really likes making time for internet research and it’s easy to see why. Almost all learn all of the dynamic tactic you convey good suggestions via your website and therefore increase participation from some other people about this content and my princess is without a doubt studying a lot. Take advantage of the remaining portion of the new year. Your doing a fantastic job.

  6. A lot of thanks for your own labor on this web site. My niece really loves going through investigations and it’s easy to see why. A number of us hear all concerning the lively form you create simple guides via the blog and in addition encourage participation from people about this concept and our favorite girl is always learning a lot of things. Take advantage of the rest of the year. You’re doing a remarkable job.

  7. I just want to say I am just newbie to blogging and really savored your blog. Most likely I’m want to bookmark your site . You actually have beneficial articles. Thank you for sharing your webpage.

Leave a Reply

Your email address will not be published. Required fields are marked *