New Ransomware "NotPetya"

1. A popular software in Ukraine called M.E.Doc had its software update process compromised, to direct execute a malicious DLL file to infect computers that performed software update.
2. By phishing e-mail which contained an attachment. When user opened the attachment, the CVE-017-0199 (Microsoft Office / WordPad Remote Code Execution Vulnerability w / Windows API) vulnerability was exploited and download a malware which eventually executed a malicious DLL file.

Regardless of the source of infection, the ransomware scanned victim's home or the office network. If it found other computers, will try to use the EternalBlue exploit tool to attack SMB vulnerability. The ransomware also tried to use PSExec and WMI management tools to command other managed computers to directly install the ransomware.

Following are the SHA256 hash values of the malicious DLL file:

027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745

64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1

<Source: Payload Security>

HKCERT has perpared a short movie to help you understand the threat of NotPetya ransomware and how to mitigate the risks:

If you want to protect yourself from this threat, follow these steps:

1. Apply latest security updates to Windows and other applications, especially MS17-010;
2. Minimize the number of users who have domain administrative rights to confine the scope and impacts of attacks, and use normal privilege account in daily operation;
3. Ensure the installation of anti-virus or Internet security software, and keep its signature updated;
4. Ensure personal firewall is turned on to block incoming SMB connections;
5. Regularly backup data and keep an offline copy; and
6. Do not open links and attachment in any suspicious emails.