Talos Olympic Destroyer 2018

Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.

Olympic Destroyer uses API calls to enumerate the infected system's ARP table.

Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.

Olympic Destroyer uses PsExec to interact with the ADMIN$ network share to execute commands on remote systems.

Olympic Destroyer uses WMI to help propagate itself across a network.

Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.

Olympic Destroyer overwrites files locally and on remote shares.

Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.

Olympic Destroyer uses the native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.

Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.

Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.

Olympic Destroyer utilizes PsExec to help propagate itself across a network.

Olympic Destroyer attempts to copy itself to remote machines on the network.

Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.