Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 03:14
Behavioral task
behavioral1
Sample
jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
General
- Target jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe
- Size 6.3MB
- Sample260910-drah6aej41
- SHA256 63ffafb211ae6217bb6329ee21c8f06989ee8f149f7b3d5d34cb3cafddcc67a3
- MD5 887c0da445e6939217f0e5808132f0d9
- SHA1 5ede606190a234aa21795faecacad3cc8031e76d
- SHA512 8db47fd0b5546ae27f7935bc3a7c4eb4da8706e7e94667945ddc7e4ae40ea9f9c68ea80d6b5be0a02efd6f44e3f95b2cb8035fca7fad4680d9936fb01fe5ad0e
- SSDEEP 12288:VRWbxXtANrnepr+U/r9TgD65O1+dd3HHHSJMHHxXXmCvY1ETf7NIjK88iet:Vkbx6begsrNgGmG+Qf7Y8iet
- TLSH T1AB66129BB61C3F37CEEE487407809AD58918744F54F843155839EFFAAABC9370598B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/4604-0-0x0000000000400000-0x0000000000612000-memory.dmp upx behavioral1/memory/4604-2-0x0000000000400000-0x0000000000612000-memory.dmp upx behavioral1/memory/4604-4-0x0000000000400000-0x0000000000612000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4604 jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe 4604 jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe 4604 jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe 4604 jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Arial CD Ripper v1 9 0 WinAll KeyGen Only NeoX[.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4604