Extracted

• • Target

    a81d104e7bb627a4d3a0f0b823e17581_JaffaCakes118

  • Size

    384KB

  • MD5

    a81d104e7bb627a4d3a0f0b823e17581

  • SHA1

    ddc6f577463ff140e525cf7f4a4f083406acd1f4

  • SHA256

    17147bfbf7936c807449340f3cbcaf49f16e905d8f768b16f8c2e628bf49a894

  • SHA512

    18bc43f92dd794655a26529634f3683d183c2b130b4ced99a276f389c0e3f3c6f03763c5681ec4c80744dda0699d63919d25333f56295729733a2b09b5283b32

  • SSDEEP

    6144:ad+I/yqyVBiwIbAVWxWGHGJEFMi9B3FPVNM+zZDGJBq6TIKVxUg4MlEs2dfYp:0yqyRIEVwWGHGJEii9B3p8+zBGJBpDVS

  Score

  10^/10

  buerexecutionloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2