Hello, welcome to the Tuesday, May 8th, 2018 edition of the Santernet Storm Center's Stormcast.

My name is Johannes Ulrich, and the I'm recording from Indianapolis, Indiana.

Attackers always try to get persistence on exploited systems, often by scheduling tasks.

Now, Xavier recently ran into a maladsemble that just that

by creating a job file that was then used in Windows to start a scheduled task. The job files

Windows uses to define these scheduled tasks are written in XML and you can parse them manually,

but that's of course tedious and not much fun.

So Xavier found a Python script written by Jamie Levy that does the boring task for you and

will spit out a summary of what particular job tries to accomplish.

And remember, double-ganging. This was a vulnerability, really a technique described late last year in December

that allows an attacker to essentially swap files that are loaded from NTFS volumes.

The trick here is that you do load a file into memory after it has been inspected, for example,

by antivirus, but you're actually loading a different file into memory, not the one that was inspected. So with this it's possible

to get malware to run that would otherwise be intercepted by anti-malware solutions.

Well, according to some reports, this technique has now been adapted by the CINAC ransomware

in order to bypass anti-malware. In addition, this version of Cynac

also makes it particularly difficult to reverse engineer it with a number of anti-reversing tricks.

One sort of interesting little side note here is, like most Malware, Sinak does delete a number of processes that it considers

either hurting its performance or potentially interfering with it. Well, typically, you can find in

Maler a list of all the names that this particular Malver tries to kill. In the case of Synac, it actually doesn't actually have a list of file names or process names it's trying to kill.

Instead, it just contains a list of hashes of processes that it tries to kill.

So this makes it, of course, more difficult to figure out what this version of

...