PsExec dates back to 2001 and while its name (these days, at least) could imply an association with PowerShell, that is not the case. Through this we can also see why their usage is preferable to exploits such as EternalBlue for more skilled attackers. To understand how, we need to appreciate what these tools actually do. As a result, when combined with valid credentials and malicious intent they can be used to do a large amount of damage.

The use of these tools is of note because they are both legitimate administrative tools in use across almost all Windows environments (indeed, WMIC has been pre-installed in all versions of Windows from 2000 onwards). That leaves us with the rather less discussed (and less glamorous) PsExec and WMIC approaches to spreading.

While this behaviour was apparently limited to the local network (unlike WannaCry it didn’t attempt to spread itself to external, Internet addresses) it had multiple methods of completing this goal.Īssuming that all of the systems on an affected network are patched and up-to-date, propagation via EternalBlue shouldn’t be viable. The excitement in Petya stemmed from its ability to self-propagate. Why, how, and when, doe many things disclose'Īs with WannaCry, the what and where parts of the analysis have been thoroughly covered by this point, albeit with some tug-of-war over semantics: whether the malware was released in an unfinished state or what a piece of malware incapable – at least under certain circumstances – of restoring a victim’s files should be called are matters of speculation and debate.Īny answers to who and why are similarly speculative until a smoking gun can be found: the former is attribution and the latter is inextricably tied to attribution. 'Who, what, and where, by what helpe, and by whose:

Psexec