Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 17:51
General
- Target Buffer.exe
- Size 145KB
- Sample261027-we4wcaeb86
- SHA256 900a13797e78ccff23d59b8e2f0d1088e438aa05ba1904335d26141c65c22f2b
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Buffer.exe"C:\Users\Admin\AppData\Local\Temp\Buffer.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Query /TN "Buffer_Admin" /XML ONE2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Buffer.exe"C:\Users\Admin\AppData\Local\Temp\Buffer.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1616-0-0x00000151B2DE0000-0x00000151B2E0A000-memory.dmp
memory/1616-1-0x00000151B4CF0000-0x00000151B4D00000-memory.dmp
memory/1616-2-0x00000151B4CF0000-0x00000151B4D00000-memory.dmp
memory/1616-3-0x00000151CEF70000-0x00000151CF02A000-memory.dmp
memory/1616-4-0x00000151B4CF0000-0x00000151B4D00000-memory.dmp
memory/1616-6-0x00000151D3950000-0x00000151D39A0000-memory.dmp
memory/1616-9-0x00000151CF0B0000-0x00000151CF0E8000-memory.dmp
memory/1616-10-0x00000151CF080000-0x00000151CF08E000-memory.dmp
memory/1616-11-0x00000151B4CF0000-0x00000151B4D00000-memory.dmp
memory/1616-12-0x00000151B4CF0000-0x00000151B4D00000-memory.dmp
memory/1616-13-0x00000151CECE0000-0x00000151CEEAE000-memory.dmp
memory/4052-7-0x0000018BB4B80000-0x0000018BB4B90000-memory.dmp