{"id":75612,"date":"2017-06-27T23:57:32","date_gmt":"2017-06-28T06:57:32","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/?p=75612"},"modified":"2025-12-10T11:47:22","modified_gmt":"2025-12-10T19:47:22","slug":"new-ransomware-old-techniques-petya-adds-worm-capabilities","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2017\/06\/27\/new-ransomware-old-techniques-petya-adds-worm-capabilities\/","title":{"rendered":"New ransomware, old techniques: Petya adds worm capabilities"},"content":{"rendered":"\n
\n
\n

On June 27, 2017 reports of a ransomware<\/a> infection began spreading across Europe. We saw the first infections in Ukraine, where more than 12,500 machines encountered the threat. We then observed infections in another 64 countries, including Belgium, Brazil, Germany, Russia, and the United States.<\/p>\n\n\n\n

(Note: We have published a follow-up blog entry on this ransomware attack. We have new findings from our continued investigation, as well as platform mitigation and protection information: Windows 10 platform resilience against the Petya ransomware attack<\/a>.)<\/em><\/p>\n<\/div>\n\n\n\n

\n
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.<\/em>

Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017<\/strong><\/a><\/em>
\u00a0<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n<\/div>\n\n\n\n

The new ransomware has worm capabilities, which allows it to move laterally across infected networks. Based on our investigation, this new ransomware shares similar codes and is a new variant of Ransom:Win32\/Petya<\/a>. This new strain of ransomware, however, is more sophisticated.<\/p>\n\n\n\n

To protect our customers, we released cloud-delivered protection updates and made updates to our signature definition packages shortly after. These updates were automatically delivered to all Microsoft free antimalware products, including Windows Defender Antivirus<\/a> and Microsoft Security Essentials. You can download the latest version of these files manually at the Malware Protection Center<\/a>.<\/p>\n\n\n\n

Windows Defender Advanced Threat Protection (Windows Defender ATP<\/a>) automatically detects behaviors used by this new ransomware variant without any updates. To test how Windows Defender ATP can help your organization detect, investigate, and respond to advanced attacks, sign up for a free trial<\/a><\/strong>.<\/p>\n\n\n\n

Delivery and installation<\/h2>\n\n\n\n

Initial infection appears to involve a software supply-chain threat involving the Ukrainian company M.E.Doc, which develops tax accounting software, MEDoc. Although this vector was speculated at length by news media and security researchers\u2014including Ukraine\u2019s own Cyber Police\u2014there was only circumstantial evidence for this vector. Microsoft now has evidence that a few active infections of the ransomware initially started from the legitimate MEDoc updater process. As we highlighted previously, software supply chain attacks<\/a> are a recent dangerous trend with attackers, and it requires advanced defense.<\/p>\n\n\n\n

We observed telemetry showing the MEDoc software updater process (EzVit.exe)<\/em> executing a malicious command-line matching this exact attack pattern on Tuesday, June 27 around 10:30 a.m. GMT.<\/p>\n\n\n\n

The execution chain leading to the ransomware installation is represented in the diagram below and essentially confirms that EzVit.exe<\/em> process from MEDoc, for unknown reasons, at some moment executed the following command-line:<\/p>\n\n\n\n

C:\\\\Windows\\\\system32\\\\rundll32.exe\\” \\”C:\\\\ProgramData\\\\perfc.dat\\”,#1 30<\/em><\/p>\n\n\n\n

The same update vector was also mentioned by the Ukraine Cyber Police in a public list of indicators of compromise (IOCs) , which includes the MEDoc updater.<\/p>\n\n\n\n

A single ransomware, multiple lateral movement techniques<\/h2>\n\n\n\n

Given this new ransomware’s added lateral movement capabilities it only takes a single infected machine to affect a network. The ransomware spreading functionality is composed of multiple methods responsible for:<\/p>\n\n\n\n