Friday, 30 June 2017

The WannaCry-like ransomware attack against Ukraine via MEDoc preceding EternalPetya/NotPetya

This week, MalwareHunterTeam discovered next in a row ransomware clone after XData that targeted Ukrainian users presumably through MEDoc software updates this Monday (June 26, 2017) before EternalPetya/NotPetya was launched (June 27, 2017). The new ransomware is a .NET version of WannaCry. The ransomware has the ‘kill process to unlock file’ feature introduced for the first time by ransomware and a bug that reduces demolishing power allowing the cryptolocker to harm only network drives. Let us take a look under the hood.


The ransomware consists of three components:


Propagation


According to VirusTotal, one of the submission was from Medoc software folder, which means the WannaCry dropper was landed into the folder. One of the way it happened is being downloaded with MEDoc software updates.




Dropper

The dropper can be executed with the following command line parameters:

Parameter 1:
  • ‘-extract’ - extracts the encryptor ‘ed.exe’ from the ‘wc.exe’ resources
  • ‘-ed’ - encrypts files on drives. If ‘demo’ parameter is not specified as the second one, the encryptor generates a new RSA key pair and returns them in Base64 to the dropper.
  • ‘-dd’ - decrypts files on drives (the handler is not available for this parameter)


Parameter 2:
  • An RSA public key that will be used to encrypt a generated RSA private key
  • ‘demo’ - runs the cryptolocker in the demonstration mode with the hardcoded public and private RSA keys


Encryption


The files on fixed, removable, and network drives except the Windows folder with the following extensions are encrypted:


doc, docx, xls, xlsx, ppt, pptx, pst, ost, msg, eml, vsd, vsdx, txt, csv, rtf, 123, wks, wk1, pdf, dwg, onetoc2, snt, docb, docm, dot, dotm, dotx, xlsm, xlsb, xlw, xlt, xlm, xlc, xltx, xltm, pptm, pot, pps, ppsm, ppsx, ppam, potx, potm, edb, hwp, 602, sxi, sti, sldx, sldm, sldm, vdi, vmdk, vmx, gpg, aes, ARC, PAQ, bz2, tbk, bak, tar, tgz, gz, 7z, rar, zip, backup, iso, vcd, raw, cgm, tiff, nef, psd, ai, svg, djvu, m4u, m3u, mid, wma, flv, 3g2, mkv, 3gp, mp4, mov, avi, asf, mpeg, vob, mpg, wmv, fla, swf, wav, mp3, sh, class, jar, java, rb, asp, php, jsp, brd, sch, dch, dip, pl, vb, vbs, ps1, bat, cmd, js, asm, h, pas, cpp, c, cs, suo, sln, ldf, mdf, ibd, myi, myd, frm, odb, dbf, db, mdb, accdb, sql, sqlitedb, sqlite3, asc, lay6, lay, mml, sxm, otg, odg, uop, std, sxd, otp, odp, wb2, slk, dif, stc, sxc, ots, ods, 3dm, max, 3ds, uot, stw, sxw, ott, odt, pem, p12, csr, crt, key, pfx, der


To start drives encryption with generating a new RSA key pair, the dropper should be given the ‘-ed’ parameter.
First, the dropper start encryptor with ‘-delshadowcopies’ to delete shadow copies of files by running the following command:


"cmd.exe", "/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog –quiet"


Then, it has the encryptor tool generate a new RSA key pair sending the parameter ‘-genrsa’. The encryptor returns public and private keys to the dropper. The public key is used further to encrypt AES file keys. The private key is stored to the file ‘private_key_encrypted’ and encrypted using the master public RSA key sent as an argument to the dropper. The file is deleted, and the encrypted key is stored in the system registry:



The files to be encrypted are stored in the index files created on every drive:
<DRIVE_LETTER>_drive.index


The file encryption process looks like:


The cryptolocker encrypts and write to the file the data in the following order:
  1. Encrypted data using AES-256-CBC with no padding, the AES key is generated for every file.
  2. The AES key encrypted by the session RSA public key.
  3. The AES initialization vector encrypted by the session RSA public key.
  4. Signature ‘WNCRY’.




If the file is locked by a process, the encryptor kills the process using PsExec tool extracted from the dropper’s resources:


The list of exception processes that are not terminated:


lsm.exe, csrss.exe, dwm.exe, smss.exe, lsass.exe, wuauclt.exe, services.exe, svchost.exe, taskhost.exe, winlogon.exe, wininit.exe, conhost.exe, explorer.exe, spoolss.exe, spoolsv.exe, system.exe, avp.exe, avpui.exe, ekrn.exe, egui.exe, mfemmc.exe, mfefire.exe, mfevtps.exe, pefservice.exe, mcsvhost.exe, msascui.exe, msmpeng.exe, mpcmdrun.exe, avshadow.exe, avguard.exe, avgnt.exe


Among which we can see the Kaspersky and Avira antivirus processes.


The ransom note


Once files have been encrypted, the ransomware drops ‘@WanaDecryptor@.exe’ and ‘@Please_Read_Me@.txt’ in the folders with encrypted files with the instructions:




Also, WannaCry sets the following wallpaper:




However, because of code mistake in the file selection algorithm, it doesn’t encrypt files on fixed and removable drives, only on network drives.




A victim is allowed decrypting images for free.

C&C

The ransomware connects to the remote server in the Tor network to verify a payment transaction:
http://4gxdnocmhl2tzx3z.onion/?guid={0}&transId={1}&key={2}

Payment


The bitcoin address 13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyf has collected 0.5 Bitcoins made by five transactions 0.1 BTC each.


Conclusion

We consider this piece of ransomware more like a test attack before running the main cyberweapon EternalPetya/NotPetya. One of the possible goals is to verify a MEDoc delivery channel.

XData, .Net WannaCry, and EternalPetya are not 0-day attacks and could be easily prevented by following basic security rules and standards (STIG, NIST). Some of the recommendations are:
  • Limit access to sensitive data. For example, by using ACL
  • Provide a network segmentation. For example, an accounting department should be isolated in a separate network segment
  • Filter network traffic with IDS/IPS solutions including email and web traffic
  • And do not rely on an antivirus solution
  • Educate staff and organize drills to prevent them falling a victim of social engineering tricks
Contact us for security training and protecting your enterprise network against targeted attacks and ransomware.

13 comments:

  1. Remove ransomeware by the dialing Avast Support Phone Number. the technical support team help 24/7 hours to remove immediately simultaneously provide you instruction to maintain your device all the time.

    ReplyDelete
    Replies
    1. Hello Everybody,
      My name is Ahmad Asnul Brunei, I contacted Mr Osman Loan Firm for a business loan amount of $250,000, Then i was told about the step of approving my requested loan amount, after taking the risk again because i was so much desperate of setting up a business to my greatest surprise, the loan amount was credited to my bank account within 24 banking hours without any stress of getting my loan. I was surprise because i was first fall a victim of scam! If you are interested of securing any loan amount & you are located in any country, I'll advise you can contact Mr Osman Loan Firm via email osmanloanserves@gmail.com

      LOAN APPLICATION INFORMATION FORM
      First name......
      Middle name.....
      2) Gender:.........
      3) Loan Amount Needed:.........
      4) Loan Duration:.........
      5) Country:.........
      6) Home Address:.........
      7) Mobile Number:.........
      8) Email address..........
      9) Monthly Income:.....................
      10) Occupation:...........................
      11)Which site did you here about us.....................
      Thanks and Best Regards.
      Derek Email osmanloanserves@gmail.com



      Hello Everybody,
      My name is Ahmad Asnul Brunei, I contacted Mr Osman Loan Firm for a business loan amount of $250,000, Then i was told about the step of approving my requested loan amount, after taking the risk again because i was so much desperate of setting up a business to my greatest surprise, the loan amount was credited to my bank account within 24 banking hours without any stress of getting my loan. I was surprise because i was first fall a victim of scam! If you are interested of securing any loan amount & you are located in any country, I'll advise you can contact Mr Osman Loan Firm via email osmanloanserves@gmail.com

      LOAN APPLICATION INFORMATION FORM
      First name......
      Middle name.....
      2) Gender:.........
      3) Loan Amount Needed:.........
      4) Loan Duration:.........
      5) Country:.........
      6) Home Address:.........
      7) Mobile Number:.........
      8) Email address..........
      9) Monthly Income:.....................
      10) Occupation:...........................
      11)Which site did you here about us.....................
      Thanks and Best Regards.
      Derek Email osmanloanserves@gmail.com



      Hello Everybody,
      My name is Ahmad Asnul Brunei, I contacted Mr Osman Loan Firm for a business loan amount of $250,000, Then i was told about the step of approving my requested loan amount, after taking the risk again because i was so much desperate of setting up a business to my greatest surprise, the loan amount was credited to my bank account within 24 banking hours without any stress of getting my loan. I was surprise because i was first fall a victim of scam! If you are interested of securing any loan amount & you are located in any country, I'll advise you can contact Mr Osman Loan Firm via email osmanloanserves@gmail.com

      LOAN APPLICATION INFORMATION FORM
      First name......
      Middle name.....
      2) Gender:.........
      3) Loan Amount Needed:.........
      4) Loan Duration:.........
      5) Country:.........
      6) Home Address:.........
      7) Mobile Number:.........
      8) Email address..........
      9) Monthly Income:.....................
      10) Occupation:...........................
      11)Which site did you here about us.....................
      Thanks and Best Regards.
      Derek Email osmanloanserves@gmail.com

      Delete
    2. $$$ GENUINE LOAN WITH 3% INTEREST RATE APPLY NOW $$$.
      Do you need finance to start up your own business or expand your business, Do you need funds to pay off your debt? We give out loan to interested individuals and company's who are seeking loan with good faith. Are you seriously in need of an urgent loan contact us.
      Email: shadiraaliuloancompany1@gmail.com

      LOAN APPLICATION DETAILS.
      First Name:
      Last Name:
      Date Of Birth:
      Address:
      Sex:
      Phone No:
      City:
      Zip Code:
      State:
      Country:
      Nationality:
      Occupation:
      Monthly Income:
      Loan Amount:
      Loan Duration:
      Purpose of the loan:
      Email: shadiraaliuloancompany1@gmail.com


      $$$ GENUINE LOAN WITH 3% INTEREST RATE APPLY NOW $$$.
      Do you need finance to start up your own business or expand your business, Do you need funds to pay off your debt? We give out loan to interested individuals and company's who are seeking loan with good faith. Are you seriously in need of an urgent loan contact us.
      Email: shadiraaliuloancompany1@gmail.com

      LOAN APPLICATION DETAILS.
      First Name:
      Last Name:
      Date Of Birth:
      Address:
      Sex:
      Phone No:
      City:
      Zip Code:
      State:
      Country:
      Nationality:
      Occupation:
      Monthly Income:
      Loan Amount:
      Loan Duration:
      Purpose of the loan:
      Email: shadiraaliuloancompany1@gmail.com

      Delete

  2. LOAN OFFER APPLY NOW @ 3% INTEREST RATE APPLY NOW

    Do you need a Loan?
    Are you looking for Finance?
    Are you looking for a Loan to enlarge your business?
    I think you have come to the right place.
    We offer Loans atlow interest rate.
    Interested people should please contact us on
    For immediate response to your application, Kindly
    reply to this emails below only:
    creationfinance00@gmail.com

    Please, do provide us with the Following information if interested.
    LOAN APPLICATION INFORMATION FORM
    First name:
    Middle name:
    Date of birth (yyyy-mm-dd):
    Gender:
    Marital status:
    Total Amount Needed:
    Time Duration:
    Address:
    City:
    State/province:
    Zip/postal code:
    Country:
    Phone:
    Mobile/cellular:
    Monthly Income:
    Occupation:
    Which sites did you know about us.....
    creationfinance00@gmail.com
    whatsapp number+918448345782

    ReplyDelete
  3. Do you need Finance?
    Are you looking for Finance?
    Are you looking for a money to enlarge your business?
    We help individuals and companies to obtain loan for business
    expanding and to setup a new business ranging any amount. Get a loan at affordable interest rate of 3%, Do you need this cash/loan for business and to clear your bills? Then send us an email now for more information contact us now via Email:maxcreditfinance@googlemail.com

    ReplyDelete
  4. This is really a nice and informative, containing all information and also has a great impact on the new technology. Check it out here: тренинги в Украине

    ReplyDelete
  5. Hello Everybody,
    My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

    BORROWERS APPLICATION DETAILS


    1. Name Of Applicant in Full:……..
    2. Telephone Numbers:……….
    3. Address and Location:…….
    4. Amount in request………..
    5. Repayment Period:………..
    6. Purpose Of Loan………….
    7. country…………………
    8. phone…………………..
    9. occupation………………
    10.age/sex…………………
    11.Monthly Income…………..
    12.Email……………..

    Regards.
    Managements
    Email Kindly Contact: (urgentloan22@gmail.com)

    ReplyDelete
  6. My Brothers and Sister all over the world, I am Mrs Boo Wheat from Canada ; i was in need of loan some month ago. i needed a loan to open my restaurant and bar, when one of my long time business partner introduce me to this good and trustful loan lender DR PURVA PIUS that help me out with a loan, and is interest rate is very low , thank God today. I am now a successful business woman, and I became useful. In the life of others, I now hold a restaurant and bar. And about 30 workers, thank GOD for my life I am leaving well today a happy father with three kids, thanks to you DR PURVA PIUS Now I can take care of my lovely family, i can now pay my bill. I am now the bread winner of my family. If you are look for a trustful and reliable loan leader. You can Email him via,mail (urgentloan22@gmail.com) Please tell him Mrs Boo Wheat from Canada introduce you to him. THANKS

    ReplyDelete
  7. My name is Mrs. Monica Roland. I live in UK London and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of $250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of $250,000.00 U.S. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs. Monica Roland that refer you to him. Contact Mr. James Bone via email: (clintonnancy43@gmail.com)

    ReplyDelete

  8. OCEAN FINANCE GLOBAL INVESTMENT LOAN.


    Ocean Finance is a Private Loan Lending company and a co-operate financier for
    real estate and any kind of business financing.

    We also offer Loans to individuals, Firms and co-operate bodies at low
    interest rate of 3% percent, loan terms determinant,Loan amount between the sum of
    one thousand Dollars ($1,000.00) to ten million ($10,000.000.00 Dollars).

    We also Offer The Following Kind Of Loans

    * Personal Loan (Secure and Unsecured)
    * Business Loan (Secure and Unsecured)
    * Consolidation Loan
    * International Loan.
    * Refinance
    * Home Improvement
    * Investment Loan
    * Auto Loans
    * Debt Consolidation
    * Student Loan
    * Line of Credit
    -Low Down or Zero Money Financing Program Available

    FIRST INFORMATION NEEDED ARE:

    Full Name:
    Location:
    Age:
    Contact Phone numbers:
    Amount Needed/ Duration:

    E-mail: oceanfinance1993@gmail.com
    Tell:+447035905707

    THERE IS NOTHING TO LOSE BUT YOUR DEBT AND FINANCIAL PROBLEMS !!!
    Here to show you a better way to financial freedom !!!

    ReplyDelete
  9. Are you blacklisted? Struggling to get a personal loan? Has your application been DECLINED due to Low Credit Score? Over COMMITTED? Affordability? But you know you can afford this loan. Loans Approved in 12hours, you can email us at collinsguzmanfundings@gmail.com

    ReplyDelete
  10. AUDITION!! AUDITION!! AUDITION!! DO YOU WISH TO ACT PORN MOVIES .HERE IS AN OPPORTUNITY FOR YOU TO MAKE GOOD MONEY FROM WHAT YOU LOVE DOING, (WHERE YOU CAN EARN UP TO 2 MILLION FOR EVERY PORN NOVA MOVIES YOU ACT)
    NOTE CENTRES FOR
    AUDITIONING WILL BE SEND TO YOU AFTER YOUR REGISTRATION.FEE
    (USA) 100USD kngtblackhocxxx@gmail.com
    Other countries should contact
    the manager with his mail
    realafricans22@gmail.com whatsapp +2349075794295

    ReplyDelete
  11. Hello Everybody,
    My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

    ReplyDelete