This blog post is authored by Warren Mercer and Paul Rascagneres. Ben Baker and Matthew Molyett contributed to thi=
s post.
Update 2/13 08:30 We have updated the information regarding t= he use of stolen credentials
Update 2/12 12:00: We have updated the d= estructor section with action taken against mapped file shares
Summary
The Winter Olympics this year is being held in Py= eongchang, South Korea. The Guardian, a UK Newspaper reported an article that suggested the O= lympic computer systems suffered technical issues during the opening ceremo= ny. Officials at the games confirmed some technical issues to non-critical = systems and they completed recovery within around 12 hours. Sunday 11th Feb= ruary the Olympic games officials = confirmed a cyber attack occurred but did not comment or speculate furt= her.
Talos have identified the samples, with moderate confidence, use= d in this attack. The infection vector is currently unknown as we continue = to investigate. The samples identified, however, are not from adversaries l= ooking for information from the games but instead they are aimed to disrupt= the games. The samples analysed appear to perform only destructive functio= nality. There does not appear to be any exfiltration of data. Analysis show= s that actors are again favouring legitimate pieces of software as PsExec f= unctionality is identified within the sample. The destructive nature of thi= s malware aims to render the machine unusable by deleting shadow copies, ev= ent logs and trying to use PsExec & WMI to further move through the env= ironment. This is something we have witnessed previously with BadRabbit and Nyetya.
Olympic Destroyer Workflow
=
Initial stage
The initial edb1ff2521f= b4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9 sample is a binary th= at, when executed, drops multiple files on to the victim host. These files = are embedded as resources (obfuscated). These files are named using randoml= y generated file names, however, the hashes of the file when written to dis= k is the same during our analysis on multiple instances. Currently we are n= ot aware of the initial infection vector used. This could have been deliver= ed in a multitude of ways as it is simply a binary file.
Two of the d= ropped files (the stealing modules) are executed with 2 arguments: 123 and = a named pipe. The named pipe is used as a communication channel between the= initial stage and the dropped executable.The technique was used during Bad= Rabbit & Nyetya.
The initial stage is responsible for propagation= . The network discovery is performed using two techniques:
- By ch= ecking the ARP table with the Windows API GetIPNetTable;
- By WMI (us= ing WQL) with the following request: "SELECT ds_cn FROM ds_computer". This = request attempts to list all the systems within the current environment/dir= ectory. The network propagation is performed using PsExec and WMI (via the = Win32_Process class). Here is the code executed remotely:
The purpose is to copy the initial stage to the remot= e system in %ProgramData%\%COMPUTERNAME%.exe and to execute it via a VBScri= pt.
To perform the lateral movement, the malware needs credentials, i= t uses 2 stealers described in the next section:
The credentials have not been hardcoded into the binary by the attack= ers themselves. The malware dynamically updates this list after using the p= assword stealers. A new version of the binary is generated with the newly d= iscovered credentials. This new binary will be used on the new infected sys= tems via the propagation. This feature explains why we discovered several s= amples with different sets of credentials that were collected from previous= ly infected systems.
As you can see, the domain attempted to be used = is related to Pyeongchang 2018. We identified 44 individual accounts in the= binary.
Dropped Files
Browser Credential Stealer
Olympic Destroyer= drops a browser credential stealer. The final payload is embedded in an ob= fuscated resource. To be executed, the sample must have 2 arguments as ment= ioned previously. The stealer supports: Internet Explorer, Firefox and Chro= me. The malware parses the registry and it queries the sqlite file in order= to retrieve stored credentials. SQLite is embedded in the sample:
System Credential= Stealer
In additional to the browsers credential stealer, Olympic = Destroyer drops and executes a system stealer. The stealer attempts to obta= in credentials from LSASS with a technique similar to that used by Mimikatz= . Here is the output format parsed by the initial stage:
Destructor
The destructive porti= on of this malware starts during initial execution on the victim machine. T= he initial malware execution results in multiple files written to disk, as = discussed. Following this, the malware then continues on it's path by begin= ning the malicious destruction element. By leveraging cmd.exe from the host= the malware first deletes all possible shadow copies on the system using v= ssadmin:
C:\Windows\system32\cmd.exe /c c:\Windows\system32\v=
ssadmin.exe delete shadows /all /quietNext, again leveragin= g cmd.exe execution on the host we can see the author using wbadmin.exe, fo= r those not familiar with wbadmin, this is the replacement for ntbackup on modern operating syst= ems.
C:\Windows\system32\cmd.exe /c wbadmin.exe delete catalo=
g -quietThis step is executed to ensure that file recovery = is not trivial - WBAdmin can be used to recover individual files, folders a= nd also whole drives so this would be a very convenient tool for a sysadmin= to use in order to aid recovery.
The next step the attacker takes in= this destructive path is to, again leverage cmd.exe, but this time use bcd= edit, a tool used for boot config data information, to ensure that the Wind= ows recovery console does not attempt to repair anything on the host.
The attacker has now attempted to ensure that recovery is ex=
tremely difficult for any impacted hosts and to further cover their tracks =
the deletion of the System & Security windows event log is performed, t=
his will be used to try and make any analysis more difficult. Wipi=
ng all available methods of recovery shows this attacker had no intention o=
f leaving the machine useable. The purpose of this malware is to perform de=
struction of the host, leave the computer system offline, and wipe remote d=
ata. Additionally, the destroyer disables a=
ll the services on the system: The malware =
uses the ChangeServiceConfigW API to change the start type to 4 which means=
: "Disabled: Specifies that the service should not be started." Addit=
ionally, the malware lists mapped file shares and for each share, it will w=
ipe the writable files (using either uninitialized data or 0x00 depending o=
f the file size). Finally after modifying all the system configuration, the=
destroyer shutdowns the compromised system. Additionally, the Olympic Destroyer drops the legiti=
mate, digitally signed, PsExec file in order to perform lateral movement by=
using this legitimate tool from Microsoft. This is another example of an a=
ttacker leveraging legitimate tools within their arsenal. Using legitimate =
tools like PsExec will save the adversary time from writing their own tooli=
ng. A free alternative they can wrap up within their own malware is a much =
easier option in this instance. During destructive attacks like this there often has to be a thought given=
to the nature of the attack. Disruption is the clear objective in this typ=
e of attack and it leaves us confident in thinking that the actors behind t=
his were after embarrassment of the Olympic committee during the opening ce=
remony. Disruption of services included the Olympic website being off=
line, meaning individuals could not print their tickets. The opening ceremo=
ny reporting was degraded due to WiFi failing for reporters on site. =
The malware delivery mechanism is currently unknown which means the infecti=
on vector could be a multitude of options, but, if the attacker already had=
access to the environment, this attack could have been carried out remotel=
y. This would allow the actors to specifically pinpoint the moment of the o=
pening ceremony and would allow them to control their time of impact. Additional ways our customers can detect=
and block this threat are listed below. =
Advanced Malware Protection (AMP) is ideally suited to pre=
vent the execution of the malware used by these threat actors. CWS or WSA web scanning prevents access=
to malicious websites and detects malware used in these attacks. Email Security can block malicious emails sent by thr=
eat actors as part of their campaign. Network Security appliances suc=
h asNGFW,NGIPS, andMeraki MX can detect malicio=
us activity associated with this threat. AMP =
Threat Grid helps identify malicious binaries and build protection into=
all Cisco Security products. Umbrella, our secure internet gateway (SIG), blocks users from connect=
ing to malicious domains, IPs, and URLs, whether users are on or off the co=
rporate network. Open Source Snort Subscriber Rule Set customers can =
stay up to date by downloading the latest rule pack available for purchase =
on Snort.org. Olympic Destroyer: edb1ff2521fb4bf748111f92786d260d40407a=
2e8463dcd24bb09f908ee13eb9 Browser Stealer: 19ab44a1343db19741b0e0b06=
bacce55990b6c8f789815daaf3476e0cc30ebea (unpacked: ab5bf79274b6583a00be2032=
56a4eacfa30a37bc889b5493da9456e2d5885c7f ) System Stealer: f188abc33d=
351c2254d794b525c5a8b79ea78acd3050cd8d27d3ecfc568c2936 (unpacked a7d6dcdf5c=
a2c426cc6c447cff76834d97bc1fdff2cd14bad0b7c2817408c334 ) Destroyer: a=
e9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85 Psexe=
c (legit): 3337e3875b05e0bfba69ab926532e3f179e8cfbf162ebb60ce58a0281437a7ef=
Additional Olympic Destroyer: D934CB8D0EADB93F8A57A9B8853C5DB2=
18D5DB78C16A35F374E413884D915016C:\Windows\system32\cmd.exe /c bcdedit.exe /set {default} bootstat=
uspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no<=
/code>C:\Windows\system32\cmd.exe /c wevtutil.exe cl System
C:\Windows\system32\cmd.exe /c wevtutil.exe cl Security=
Legitimate File
Conclusion
IOCs
EDB1FF2521FB4BF748111F92786D260D40407A=
2E8463DCD24BB09F908EE13EB9
3E27B6B287F0B9F7E85BFE18901D961110AE969D58B4=
4AF15B1D75BE749022C2
28858CC6E05225F7D156D1C6A21ED11188777FA0A752CB7B56=
038D79A88627CC