GoldenEye/Petya Attack Spreads Rapidly, Recalling WannaCry

On June 27, 2017, a large-scale attack using a variant of the ransomware family known as GoldenEye affected much of the world.

In addition to encrypting files on the computer, this ransomware family is characterized by encrypting the MBR when it has permissions, thus blocking full access to the computer. The attack can almost be seen as a replica of the much-feared WannaCry attack that shook the world a little over a month ago.

This version of the malware is distributed as a DLL with an EXPORT, which is named with a parameter that changes with each sample to begin the encryption process on the computer.

When it runs, it encrypts certain files on compromised system drives. In turn, if it has administrator permissions, it also encrypts the system boot sector by preventing access to the computer unless an access key that decrypts the system is entered.

That key is assumed to be delivered once payment of the ransom has been made.

The sample creates a scheduled task to shut down the computer afterwards.

Upon restarting the computer, GoldenEye displays a fake window indicating that a disk problem is being solved.

Afterward, it shows the window seeking the ransom.


In this case, we’ve seen various methods of entry and propagation on compromised networks:

  • A file attached to an email sent to a user in Ukraine (a country gravely affected by the attack)
  • ETERNALBLUE: This malware variant uses code that exploits the vulnerability published by Microsoft on March 14, described in the bulletin MS17-010.
  • PSEXEC: Incorporates remote execution on the system using the PSEXEC command.
  • WMI: Incorporates remote execution on the system using the WMI command.

You can access further details on the attack in the technical report from PandaLabs.

List of related files



Tips and Recommendations

  • Be cautious of documents contained in emails from untrusted senders.
  • Keep your operating system up to date with the latest Microsoft updates available.
  • In this case, as we have detected the use of ETERNALBLUE, we recommend that you make sure the following patch is installed on all computers across your network: library / security / ms17-010.aspx

We will continue to provide detailed information on the attack.

The post GoldenEye/Petya Attack Spreads Rapidly, Recalling WannaCry appeared first on Panda Security Mediacenter.

Article Link: