Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 10:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Scar.onbq.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Scar.onbq.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Scar.onbq.exe
- Size 110KB
- Sample261014-mk32katscx
- SHA256 dceada25a470e73f7aad0477c994f022bce1e1656b0312df83dd8dc28569459f
- MD5 234d2ec7c1434eed5b42c664f7ec098b
- SHA1 80ce929047b91f10ab18c16558c2c52929ec26f9
- SHA512 3ada409865fc88a207a82ee4bbaf66ef0d1f4295f7a7a58245a147e08602a36362b0974abd5f92668c857f37f839ebf17803367c234490821ebec9bf3d4e4b54
- SSDEEP 3072:R2n/9JXynvszEZ9e9Zd2tnbrIp5R5cfrAntLL:RY9Qvsoo9/cfrA
- TLSH T10DB35C13B2E38873D275997C8C2662B4D57ABD203C2D246AB6E41F4D6E7C2D368583C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_Trojan.Win32.Scar.onbq.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_Trojan.Win32.Scar.onbq.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Scar.onbq.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 4092 Process not Found 2892 Process not Found 6120 Process not Found 5972 Process not Found 800 Process not Found 5052 Process not Found 5568 Process not Found 3184 Process not Found 4408 Process not Found 2488 Process not Found 5872 Process not Found 4148 Process not Found 3280 Process not Found 3212 Process not Found 5580 Process not Found 3240 Process not Found 2408 Process not Found 3892 Process not Found 2080 Process not Found 5160 Process not Found 4580 Process not Found 5980 Process not Found 5864 Process not Found 2584 Process not Found 6080 Process not Found 5152 Process not Found 2592 Process not Found 1052 Process not Found 1016 Process not Found 1232 Process not Found 4152 Process not Found 4736 Process not Found 5740 Process not Found 3376 Process not Found 4920 Process not Found 4280 Process not Found 3576 Process not Found 1576 Process not Found 4840 Process not Found 3236 Process not Found 1388 Process not Found 2804 Process not Found 2200 Process not Found 5784 Process not Found 4340 Process not Found 4480 Process not Found 2908 Process not Found 2520 Process not Found 4420 Process not Found 3168 Process not Found 4216 Process not Found 832 Process not Found 2668 Process not Found 4168 Process not Found 3092 Process not Found 3056 Process not Found 1348 Process not Found 4348 Process not Found 4456 Process not Found 4508 Process not Found 2116 Process not Found 2972 Process not Found 1216 Process not Found 760 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3324 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Scar.onbq.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Scar.onbq.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2420
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a22055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1180
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:5572