From ATMs to Chernobyl, the latest ransomware campaign using a variant of the well-known Petya is sweeping through everything not nailed down. Dozens of researchers around the world have begun studying how it works, and although they haven't found a kill switch like with WannaCry, there is a small resource that prevents its installation. Basically, Petya checks for the presence of a specific file to determine whether the computer has already been infected. By recreating that file, we get a temporary vaccine.
One detail we mentioned in our last article is that the Petya campaign (or "NotPetya", depending on the source) seems more focused on causing damage than on making money. By attacking the MBR and MFT of the hard drive instead of encrypting individual files, the chances of restoring data are much lower, and its developers perhaps never intended to allow that. Given the delicate situation between Ukraine (where the attack may have originated) and Russia, the idea of a covert cyberattack disguised as a ransomware campaign is not so far-fetched. No matter how hard the initial impact, one thing remains: experts only need a few hours to create a basic defense barrier. This was much more effective with WannaCry because discovering its kill switch stopped the ransomware, but in the case of Petya-NotPetya, what they found is a vaccine.
According to researcher Amit Serper, the ransomware checks for the presence of a file inside the Windows folder before starting the infection: perfc.dll. On the other hand, Dave Kennedy of TrustedSec indicated that the file in question is perfc.dat. Beyond these differences, the code simply checks for “perfc.*”, meaning any file named perfc, with or without an extension, satisfies that condition. We still don't know why the ransomware performs this check. It's likely a remnant of the original Petya to prevent it from infecting a computer twice, or maybe the creators of the new campaign placed it to protect their own infrastructure. Either way, we can use it.
There are several methods to create the perfc file, but the most popular so far is to use copies of Notepad and rename it. Here at NeoTeo, we'll do it the old-fashioned way: with the system console. The first step is to open cmd.exe with administrator privileges (right-click to see the option). Then, enter cd.. to go to the Windows directory, and once there, type “copy notepad.exe perfc”, without the quotes. The rest just involves opening File Explorer, going to the Windows folder, locating the recently created perfc file, opening its properties (again, right-click), and enabling the read-only attribute (Windows will ask for additional permission at this step). If you wish, you can repeat the process with perfc.dat and perfc.dll. The latest data says it's not strictly necessary, but at the end of the day, it's temporary. All those with access to Petya's code have to do is remove or modify this function and start the cycle again...
Source: ZDNet
