Extracted

• • Target

    ac8348dd8319365d4857b1e20715c6da_JaffaCakes118

  • Size

    259KB

  • MD5

    ac8348dd8319365d4857b1e20715c6da

  • SHA1

    5c5b1008a7a96015f2588fd60ddc0b4739f74fb5

  • SHA256

    a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0

  • SHA512

    eed7640b28d4b023cd4c252ed812820221aca61f969ca2e6d5f59aad5532fae07d17401272dd36a3c49641136fa8a95d1e1d801076deb8eac97222f506f0ac86

  • SSDEEP

    6144:nQ6ixI8UKltZMbvRrUjZMlbHHOLGqJ/89GEgr/KLUygLMh:Q6ie8UKl7M7RA1MRn5t9wrSLbK

  Score

  10^/10

  buerexecutionloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2