NotPetya uses the EternalBlue vulnerability (WannaCry technique) that infects computers using SMBv1. It also uses Windows WMIC and PSExec processes. If the WannaCry vulnerability is patched on your system, it uses PsExec or LSADUMP and the Windows Management Interface to spread. The ransomware is capable of attacking and infecting all Windows systems. It overwrites the Master Boot Record and on reboot, infects the computer blocking access to it. Once it hacks your computer, it demands a ransom amount of $300 in Bitcoin. If your computer reboots and you see this ‘false check disk’ message, power off immediately!
This is the NotPetya encryption process taking place. If you power off immediately or do not power on, your data will remain safe. If the encryption process is allowed to continue, you will lose your data to theis ransomware! There are however some basic precautions you can take, and they are: More details about how this ransomware operates can be found on Cybereason.com.
NotPetya Ransomware Vaccination
Cybereason Principal Security Researcher Amit Serper tweeted that he has discovered a vaccination that stops NotPetya ransomware in its tracks.
To activate the vaccination mechanism you have to create a file named perfc, with no extension and place it in the C:\Windows\ folder. When NotPetya ransomware runs, it searches for this file in the C:\Windows\ folder, and if it is found, it ceases its operation. UPDATE: Eset recommends that you create three blank files with the following filenames and extensions: Ransomware attacks are on the rise, and all computers users need to take some basic precautions to secure their systems. One can also consider some free anti-ransomware software like RansomFree as an additional security layer. You might want to also check out CyberGhost Immunizer.
