Petwrap / NotPetya Ransomware Encrypts Victim Data

A new variant of ransomware known as Petwrap / Petrwrap / Petya / NotPetya / Nyetya is spreading quickly. HKCERT was aware that it is widespread overseas. The different name indicate the industry is debating if the ransomware is directly related to another known ransomware Petya.

It incorporated the attack method from the WannaCry ransomware targeting SMB v1.0 vulnerability. It was reported that the ransomware used phishing email to spread. Once infected, the machine will spread via local network before it encrypts data on local machine.

Because the filenames are not changed and it reboots and shows the ransom notice one hour after infection, computers in local LAN might have been attacked when the victim discovered the infection.

Attack Vector:

• EthernalBlue - the same exploit used by WannaCry.
• Psexec - a legitimate Windows administration tool.
• WMI - Windows Management Instrumentation, a legitimate Windows component.

Note: The vulnerability is being exploited to spread the ransomware attack.

Impacts:

• Encrypt the masterboot record (MBR) on victims’ computers.
• Infected system will reboot after an hour. Since the MBR has been damaged, the system will display a ransom note instead of booting properly
• Data will be unrecoverable due to encryption by ransomware.
• Try to attack other computers in the local network.