Patchfirst

NotPetya Technical Analysis – A Triple Threat: File Encryption, MFT Encryption, Credential Theft

crowdstrike.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution

Read the original ↗

CVEs this report names

1 CVE
  1. CVE-2017-0144Microsoft SMBv1 Remote Code Execution Vulnerability
    Microsoft · SMBv1KEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services3 reports
    99.2%Top 0.06%
    86.9priority

Where it names them

CVE-2017-0144
It spreads to Microsoft Windows machines using several propagation methods, including the EternalBlue exploit for the CVE-2017-0144 vulnerability in the SMB service.
Original (opens in a new tab) ↗

Techniques drawn from this report

1 link, in kill-chain order

Lateral Movement Exploitation of Remote Services T1210 for CVE-2017-0144

AI mapping from the description

It spreads to Microsoft Windows machines using several propagation methods, including the EternalBlue exploit for the CVE-2017-0144 vulnerability in the SMB service. This is the same vulnerability Microsoft reported on in MS17-010, which was exploited so successfully in the recent WannaCry ransomware outbreak.
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close