Malware
malware:winlogon_exe
Malicious worm identified in the Olympic network that spread to other machines and wiped infected systems while using the name of a legitimate Windows process.
Malicious worm identified in the Olympic network that spread to other machines and wiped infected systems while using the name of a legitimate Windows process.
“they’re being wiped again by some piece of malware in their system. They are able to figure out that it’s this one malicious file called winlogon.exe.”
“this malicious winlogon.exe was a worm”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | SAME_AS | Olympic Destroyer | Explicit | 77 |
| incoming | INVOLVES | Olympic Destroyer | Explicit | 77 |
Olympic Destroyer INVOLVES winlogon.exe
The Olympic attack involved the malicious file winlogon.exe, which repeatedly wiped systems.
Explicit Confidence 99% · Andy Greenberg EP 77 Details
“they’re being wiped again by some piece of malware in their system. They are able to figure out that it’s this one malicious file called winlogon.exe.”
winlogon.exe SAME_AS Olympic Destroyer
Cisco Talos named the malicious winlogon.exe worm Olympic Destroyer.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“it was Talos that gave this worm a name; Olympic Destroyer.”