Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. The Guardian, a UK Newspaper reported an article that suggested the Olympic computer systems suffered technical issues during the opening ceremony. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec &amp; WMI to further move through the environment. Olympic Destroyer Workflow . Initial stage . The initial edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9 sample is a binary that, when executed, drops multiple files on to the victim host. Dropped Files . Browser Credential Stealer . Olympic Destroyer drops a browser credential stealer. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. The stealer attempts to obtain credentials from LSASS with a technique similar to that used by Mimikatz. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: "Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. Disruption is the clear objective in this type of attack and it leaves us confident in thinking that the actors behind this were after embarrassment of the Olympic committee during the opening ceremony