## 4 Results
### NotPetya  
As shown in Figure 15, the strategic approach against NotPetya-like malware prioritizes security in the application and control layers through automated patch management, real-time monitoring, and data backup systems. By regularly updating software and monitoring for anomalies, this multi-layered defense reduces data vulnerability and ensures rapid recovery, reinforcing system stability against destructive malware. Within the control layer, NotPetya disrupted or manipulated commands in the SCADA and SIS systems, leading to operational failures in energy infrastructure. The prolonged recovery process caused extended system downtime, underscoring the devastating impact. NotPetya highlights the critical need to protect both the application and control layers across energy and other industries. Figure 14: Triton attack pathways and security defense strategies. Defensive measures for NotPetya begin with securing the initial spread of malicious documents at the application layer. The malware utilizes various stages to gather data, create new data objects, and manipulate system files destructively. At its final stage, NotPetya causes irreversible damage to critical data, impacting both the application and control layers. In the technical analysis, NotPetya leverages functions within the shell32.dllmodule, a key component of the Windows OS responsible for file operations and user interface elements, to execute and propagate its malicious payload rapidly. Using analysis tools such as OilyDbg and IDA, researchers identified how NotPetya exploited functions such as SHGetAttributesFromDataObject, SHCreateDataObject, and SHAssocEnumHandlers to manipulate file operations and spread quickly. These functions allowed the malware to bypass user interface protections, enabling it to execute file tasks and propagate without user awareness. Samples of NotPetya malware were obtained from Hybrid Analysis, providing further insights into its behavior and confirming how NotPetya used shell32.dll to execute commands and alter file attributes effectively, facilitating its rapid spread across networks. As shown in Figure 16, the highlighted functions in shell32.dll, including SHGetAttributesFromDataObject, SHCreateDataObject, and SHAssocEnumHandlers, illustrate how NotPetya manipulates file operations and system processes to achieve rapid propagation and execute destructive actions. the SHGetAttributesFromDataObject function allows applications to retrieve specific attributes from data objects, which can be exploited by malware like NotPetya to gather critical information on files and system objects, aiding in targeting and manipulation. SHCreateDataObject creates data objects to store information for shell operations, which NotPetya could leverage to initiate unauthorized actions on files or user interface elements. SHAssocEnumHandlers enumerates file association handlers, potentially enabling the malware to manipulate or override default system handlers for file types, thus facilitating unauthorized access and control over file operations. Through detailed analysis, it was evident that NotPetya leverages these functions to spread quickly within systems and execute destructive actions. This understanding contributed to developing targeted defense strategies against these specific attack vectors. To mitigate similar attacks, it is essential to establish strong incident management and disaster recovery plans tailored specifically for the energy industry, which will help minimize potential damage in the event of an attack on critical infrastructure. proactive threat detection using AI-based anomaly detection systems is recommended to monitor file operation patterns and detect unusual activity involving shell32.dll functions, enabling  
Figure 15: NotPetya cyberattack flowchart. early identification of malicious actions. Enhanced system resilience can be achieved by integrating real-time file activity monitoring to detect and prevent unauthorized manipulation of the user interface or file operations.