{"id":49758,"date":"2017-06-28T13:02:11","date_gmt":"2017-06-28T07:32:11","guid":{"rendered":"https:\/\/www.vskills.in\/certification\/blog\/?p=49758"},"modified":"2024-04-03T13:24:31","modified_gmt":"2024-04-03T07:54:31","slug":"petwrap-ransomware-analysis","status":"publish","type":"post","link":"https:\/\/www.vskills.in\/certification\/blog\/petwrap-ransomware-analysis\/","title":{"rendered":"Petwrap Ransomware Analysis"},"content":{"rendered":"

\"Petwrap<\/a><\/p>\n

Petwrap Ransomware Analysis<\/h3>\n

Petwrap ransomware or Petya\/NotPetya, is the recent new ransomware affecting computer networks.<\/p>\n

On the morning of June 27, 2017, a new ransomware outbreak\u2014similar to the recent WannaCry malware\u2014was discovered in the Ukraine. The malware quickly spread across Europe, affecting varied industries such as banks, government, retail, and power, among others.<\/p>\n

Although at first, it seemed that the ransomware was a variant of the Petya family, researchers have determined that they are not related, and have now named the malware \u201cNotPetya.\u201d This ransomware is potentially more devastating than WannaCry, as it does not require vulnerable, unpatched systems to spread on the local network.<\/p>\n

Petya \/ NotPetya Tools, Techniques, and Procedures (TTPs)<\/strong><\/p>\n

After infection on the initial victim, NotPetya enumerates all saved SMB credentials on the system and uses these credentials to log onto other machines on the local network. Because the ransomware uses existing SMB credentials to connect to the systems, even patched Windows machines are subject to infection.<\/p>\n

NotPetya can infect additional network systems in one of two ways:<\/p>\n