1. Overview of NotPetya Ransomware

What is NotPetya?

NotPetya is a destructive wiper malware disguised as ransomware, first observed in June 2017. Although it appeared to be a variant of the Petya ransomware family, it was not designed to allow recovery of data, even if the ransom was paid.

🔴 Key Point: NotPetya is not true ransomware — it is a cyber weapon intended to cause maximum damage.

Attribution & Motivation

• Widely attributed to state-sponsored attackers
• Primary target: Ukraine
• Secondary impact: Global collateral damage
• Motivation: Disruption and destruction, not financial gain

Major Victims

• Maersk (shipping giant)
• Merck
• FedEx (TNT Express)
• Rosneft
• Ukrainian banks, airports, media

💰 Estimated damages: $10+ billion globally

2. Infection Vector & Initial Access

Primary Infection Method

Supply Chain Attack

• Compromised M.E.Doc (Ukrainian accounting software)
• Malware delivered via legitimate software updates

Secondary Infection Methods

Once inside a network, NotPetya spread rapidly using:

1. EternalBlue exploit (MS17-010)
2. EternalRomance exploit
3. Credential harvesting
   • Used Mimikatz-like techniques
4. Lateral movement
   • PsExec
   • Windows Management Instrumentation (WMI)

3. Technical Operation of NotPetya

Step-by-Step Attack Chain

Step 1: Execution

• Malware executed via compromised update
• Drops malicious payload into system directories

Step 2: Credential Harvesting

• Extracts credentials from:
  • LSASS memory
• Enables lateral movement even on patched systems

Step 3: Lateral Movement

• Uses stolen credentials to spread via:
  • SMB
  • PsExec
  • WMI
• Exploits unpatched SMB vulnerabilities

Step 4: Disk Overwrite (Destruction Phase)

• Overwrites the Master Boot Record (MBR)
• Schedules system reboot
• On reboot:
  • Displays fake CHKDSK screen
  • Encrypts Master File Table (MFT)

🚨 Critical: Encryption key is destroyed → data is unrecoverable

Step 5: Fake Ransom Demand

• Displays ransom note demanding $300 in Bitcoin
• Uses a single hardcoded Bitcoin wallet
• Contact email was shut down → payment impossible

4. Incident Response (IR) – Full Lifecycle

Phase 1: Preparation

Before an incident occurs

Key Actions:

• Patch management (especially SMB vulnerabilities)
• Network segmentation
• Disable SMBv1
• Least privilege enforcement
• Offline backups
• Incident Response Plan (IRP)
• EDR and SIEM deployment

Phase 2: Identification

Detect and confirm the incident

Indicators:

• Sudden mass reboots
• Fake CHKDSK screens
• MBR corruption
• SMB traffic spikes
• PsExec activity
• Antivirus alerts for Petya/NotPetya

Tools:

• SIEM alerts
• EDR telemetry
• Network IDS
• System logs

Phase 3: Containment

Limit spread immediately

Short-Term Containment:

• Disconnect infected machines from network
• Disable SMB traffic (ports 445, 139)
• Block PsExec and WMI
• Isolate compromised VLANs

Long-Term Containment:

• Reset all credentials
• Disable compromised accounts
• Patch all systems

Phase 4: Eradication

Remove malware completely

Actions:

• Reimage infected systems (recommended)
• Remove malicious scheduled tasks
• Delete malware binaries
• Remove persistence mechanisms
• Patch MS17-010
• Remove compromised software (e.g., M.E.Doc)

🚫 Decryption is not possible

Phase 5: Recovery

Restore business operations

Steps:

• Restore systems from clean backups
• Validate system integrity
• Monitor for reinfection
• Gradually reconnect to network
• Verify backups were not compromised

Phase 6: Lessons Learned

Post-incident review

Questions to Address:

• How did initial access occur?
• Why was lateral movement successful?
• Were backups effective?
• Were alerts timely?

Improvements:

• Stronger segmentation
• Faster patch cycles
• Better supply chain vetting
• Improved monitoring

5. Indicators of Compromise (IOCs)

File Hashes (Examples)

⚠️ Note: Hashes may vary by sample

SHA-256

71b6a493388e7d0b40c83ce903bc6b04d1c97c1c7f3d8e6c08c77f7a1c43c7b0

Filenames

perfc.dat

perfc.dll

perfc

Registry Keys

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\perfc

Network Indicators

IP Addresses (Historical)

95.141.115.108

5.199.104.215

Domains

me-doc[.]com[.]ua

Email Indicator

[email protected]

(Used for ransom communication – later disabled)

Bitcoin Wallet

1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX

Behavioral IOCs

• Unauthorized PsExec execution
• LSASS memory access
• Scheduled reboot via:
• shutdown /r /f
• Modification of MBR
• Fake CHKDSK screen on reboot

7. Key Takeaways

• NotPetya was cyber sabotage, not ransomware
• Supply-chain attacks can bypass perimeter defenses
• Credential theft enables devastating lateral movement
• Offline backups and segmentation are critical
• Incident Response speed determines damage scope

SOC Detection Rules

Sigma Rule – NotPetya Behavior

title: NotPetya Lateral Movement and Disk Destruction

id: a7f2c2b1-9b8f-4f2d-8a11-notpetya001

status: stable

description: Detects NotPetya-style lateral movement and reboot scheduling

author: SOC Team

logsource:

product: windows

service: security

detection:

selection_psexec:

EventID: 4688

NewProcessName|contains: ‘psexec’

selection_shutdown:

CommandLine|contains: ‘shutdown /r /f’

condition: selection_psexec or selection_shutdown

level: critical

 Splunk Detection Query

index=windows EventCode=4688

| search (Process_Name=”*psexec*” OR CommandLine=”*shutdown /r /f*”)

| stats count by Computer, User, Process_Name, CommandLine

 Microsoft Sentinel / KQL Query

SecurityEvent

| where EventID == 4688

| where Process has “psexec” or CommandLine has “shutdown /r /f”

| project TimeGenerated, Computer, Account, Process, CommandLine

 Credential Dumping Detection (LSASS Access)

Sigma

title: LSASS Credential Dumping Attempt

logsource:

product: windows

service: security

detection:

selection:

EventID: 4656

ObjectName|contains: ‘lsass.exe’

condition: selection

level: high