buer | 69377f70dc61fe37d51443a5ce8a312aa7b682c61574b8ff02fef4e9d798133a

General

Target

b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe
Size

300KB
MD5

b84cb1bf75e472973bed157bab410f04
SHA1

fe4d97e9fd68677ae1e1b459885b3979eabba445
SHA256

69377f70dc61fe37d51443a5ce8a312aa7b682c61574b8ff02fef4e9d798133a
SHA512

266128f62ef53d596196bed76ef94c9aef135f248a2c0a9b44a909bdff4613a048875d9a8debf7082e50eea29acb32891fd7edc535d085558a9250a5f402c9a8
SSDEEP

6144:IXTq8tcMqCZuCkGZGXOGrmtiwJpIS3tJ0dNaVcW+VoImI8EDQGXI/:38cMq8uepPrSNamDT98EdI

Score

10^/10

buer loader persistence

Malware Config

Extracted

Family

buer

C2

https://officewestunionbank.com/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

AutoReg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\e6f211810a8b22d27266\\AutoReg.exe\""	AutoReg.exe

Buer Loader 8 IoCs

Detects Buer loader in memory or disk.

loader

Processes:

resource	yara_rule
behavioral2/memory/2840-1-0x0000000000490000-0x0000000000590000-memory.dmp	buer
behavioral2/memory/2840-2-0x0000000000400000-0x000000000045C000-memory.dmp	buer
behavioral2/memory/2840-7-0x0000000040000000-0x000000004005D000-memory.dmp	buer
behavioral2/memory/3616-9-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer
behavioral2/memory/2840-11-0x0000000000400000-0x000000000045C000-memory.dmp	buer
behavioral2/memory/3616-12-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer
behavioral2/memory/2840-10-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer
behavioral2/memory/3616-13-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer

Executes dropped EXE 1 IoCs

Processes:

AutoReg.exe

pid process

3616 AutoReg.exe

pid	process
3616	AutoReg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AutoReg.exe

description	ioc	process
File opened (read-only)	\??\S:	AutoReg.exe
File opened (read-only)	\??\T:	AutoReg.exe
File opened (read-only)	\??\B:	AutoReg.exe
File opened (read-only)	\??\H:	AutoReg.exe
File opened (read-only)	\??\L:	AutoReg.exe
File opened (read-only)	\??\O:	AutoReg.exe
File opened (read-only)	\??\P:	AutoReg.exe
File opened (read-only)	\??\V:	AutoReg.exe
File opened (read-only)	\??\I:	AutoReg.exe
File opened (read-only)	\??\M:	AutoReg.exe
File opened (read-only)	\??\Q:	AutoReg.exe
File opened (read-only)	\??\R:	AutoReg.exe
File opened (read-only)	\??\U:	AutoReg.exe
File opened (read-only)	\??\X:	AutoReg.exe
File opened (read-only)	\??\Y:	AutoReg.exe
File opened (read-only)	\??\A:	AutoReg.exe
File opened (read-only)	\??\J:	AutoReg.exe
File opened (read-only)	\??\K:	AutoReg.exe
File opened (read-only)	\??\N:	AutoReg.exe
File opened (read-only)	\??\W:	AutoReg.exe
File opened (read-only)	\??\E:	AutoReg.exe
File opened (read-only)	\??\G:	AutoReg.exe
File opened (read-only)	\??\Z:	AutoReg.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3664 2840 WerFault.exe b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe

pid	pid_target	process	target process
3664	2840	WerFault.exe	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe

description	pid	process	target process
PID 2840 wrote to memory of 3616	2840	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe	AutoReg.exe
PID 2840 wrote to memory of 3616	2840	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe	AutoReg.exe
PID 2840 wrote to memory of 3616	2840	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe	AutoReg.exe

C:\Users\Admin\AppData\Local\Temp\b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\ProgramData\e6f211810a8b22d27266\AutoReg.exe
C:\ProgramData\e6f211810a8b22d27266\AutoReg.exe "C:\Users\Admin\AppData\Local\Temp\b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe" ensgJJ
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Enumerates connected drives
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 472
2⤵
- Program crash
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2840 -ip 2840
1⤵
PID:724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\e6f211810a8b22d27266\AutoReg.exe
Filesize
300KB

MD5
b84cb1bf75e472973bed157bab410f04

SHA1
fe4d97e9fd68677ae1e1b459885b3979eabba445

SHA256
69377f70dc61fe37d51443a5ce8a312aa7b682c61574b8ff02fef4e9d798133a

SHA512
266128f62ef53d596196bed76ef94c9aef135f248a2c0a9b44a909bdff4613a048875d9a8debf7082e50eea29acb32891fd7edc535d085558a9250a5f402c9a8

Download Submit
memory/2840-1-0x0000000000490000-0x0000000000590000-memory.dmp

Filesize
1024KB

Download
memory/2840-2-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2840-7-0x0000000040000000-0x000000004005D000-memory.dmp

Filesize
372KB

Download
memory/2840-11-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2840-10-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download
memory/3616-9-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download
memory/3616-12-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download
memory/3616-13-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads