Hello, welcome to the Monday, August 2, 2021 edition of the Sandstone Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida. About to travel, so recording this a little bit early and remember that we have the contest going.

So before I announce any of my August locations, you may want to get your entry in.

Xavier ran into some interesting malware that actually used a registry file in order to trick the user into executing the malware. Registry files

themselves are not executable really, but what they can do is they can modify registry keys,

including like in this example, the Run Once key, that will then execute the actual code. In this case, it's a PowerShell script

that will download and execute additional Malware. Also sort of interesting here, the actual

malware is hosted on the Discord. CDN Discord, of course, is yet another chat application. And all of these applications, of course, have some kind of file storage. And that's what's being abused here. Now, why don't we see more malware that takes advantage of this trick? After all, dot rec files are not often flagged as malicious. Well, if you click on it,

you will get a fairly prominent warning that what you're going to do is you're going to

change the registry and busy or ask to confirm that that's what you actually want to do.

So that may scare users sufficiently to not necessarily allow it.

And we've got some interesting details from James Forshaw at Google regarding

vulnerability that affected Windows systems that had exchange installed.

These issues were fixed with the July update,

but there are some interesting details here that you should be aware of. So first of all,

the main problem here is when you installed Exchange on a system, Exchange did modify the

Active Directory schema with a ton of additional

classes, which essentially allowed any user to create accounts and more essentially compromising the

domain. So the vulnerability was patched. The reason I want to mention it is that these changes to the

active directory schema, they're not undone if you're uninstalling exchange. So if you installed

exchange on a system, maybe experimented with it, then later you removed exchange again. That's exactly when you may have problems.

You may not consider that patch is really important,

but definitely make sure that all systems are fixed,

...