418f6ff813bbbbe5344b9f8fea28948259bcfd28d424f1354289f5071c85d6ca

Analysis

user interaction
yes
max time kernel
58s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AjarSys.exe
Size 5.8MB
Sample260822-s6sqlshp21
SHA256 418f6ff813bbbbe5344b9f8fea28948259bcfd28d424f1354289f5071c85d6ca
MD5 0816a1e816f9737a1fd3eaa7493aa075
SHA1 682405e63e3cfa28f955ea4eee2890b93fa6414d
SHA512 640000c30a3c1e8d05bc5383daa405303596b8694e11a17a04a77e3cf0688a887f35a7f8d38ffea89e8a3ba6e36e63c4b39285b83bfffa55e9fab5cc595484a8
SSDEEP 98304:wYOgp0AsZKigPWKQ/HVRBH9vYewem9lTTdxlN7/c3DgPY9rT6Bl1tF:wYL0rtC3Q/pdePbH7/0DIYNT6LbF
TLSH
T13A56338BFFD4C4B0C53649364E36E74644BC3A680B15CB1FA7998E3DA6353625310AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	AjarSys.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	AjarSystem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ASLib.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	OpenAll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	diskdestroyer.exe

Executes dropped EXE 8 IoCs

pid	Process
4948	AjarSystem.exe
2868	ASLib.exe
4784	OpenAll.exe
2500	Sound.exe
984	red.exe
316	error.exe
532	Noise.exe
1964	diskdestroyer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	mountvol.exe
File opened (read-only)	\??\B:	mountvol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1864	cmd.exe
4800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ASLib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpenAll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	red.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	error.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noise.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AjarSys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AjarSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sound.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diskdestroyer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4948	AjarSystem.exe
4784	OpenAll.exe
2500	Sound.exe
984	red.exe
316	error.exe
532	Noise.exe
1964	diskdestroyer.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 4948	3468	AjarSys.exe	85
PID 4948 wrote to memory of 1864	4948	AjarSystem.exe	87
PID 1864 wrote to memory of 2868	1864	cmd.exe	89
PID 2868 wrote to memory of 4784	2868	ASLib.exe	90
PID 4784 wrote to memory of 2500	4784	OpenAll.exe	91
PID 4784 wrote to memory of 984	4784	OpenAll.exe	92
PID 4784 wrote to memory of 316	4784	OpenAll.exe	93
PID 4784 wrote to memory of 532	4784	OpenAll.exe	95
PID 4784 wrote to memory of 1964	4784	OpenAll.exe	96
PID 1964 wrote to memory of 4800	1964	diskdestroyer.exe	97
PID 4800 wrote to memory of 3144	4800	cmd.exe	99
PID 4800 wrote to memory of 4336	4800	cmd.exe	100
PID 4800 wrote to memory of 376	4800	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\AjarSys.exe
"C:\Users\Admin\AppData\Local\Temp\AjarSys.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\AjarSystem.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\AjarSystem.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8519.tmp\851A.tmp\851B.bat C:\Users\Admin\AppData\Local\Temp\RarSFX0\AjarSystem.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\ASLib.exe
      ASLib.exe -p@$L1b -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\OpenAll.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OpenAll.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Sound.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sound.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\red.exe
        
        "C:\Users\Admin\AppData\Local\Temp\red.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\error.exe
        
        "C:\Users\Admin\AppData\Local\Temp\error.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Noise.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Noise.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\diskdestroyer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\diskdestroyer.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9AF3.tmp\9AF4.tmp\9AF5.bat C:\Users\Admin\AppData\Local\Temp\diskdestroyer.exe"
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\system32\mountvol.exe
        
        mountvol A:\ /D
        8⤵
        Enumerates connected drives
        
        PID:3144
        
        C:\Windows\system32\mountvol.exe
        
        mountvol B:\ /D
        8⤵
        Enumerates connected drives
        
        PID:4336
        
        C:\Windows\system32\mountvol.exe
        
        mountvol C:\ /D
        8⤵
        
        PID:376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a8 0x4f8
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

851B.bat

Path C:\Users\Admin\AppData\Local\Temp\8519.tmp\851A.tmp\851B.bat
Size 37B
SHA256 e7f18f87f25d9f2c0a8e51cdb7df01b57c4063f8cb14b16efadfa579243c80ea
MD5 9d38ca2f5b6b20698c106a71d78a39d3
SHA1 aaf3ee5b10303a599fc4bb5e18643e5f4bef9bc3
SHA512 a2a864aa734fbe52a75db72eda7a033189869e4ef414d63b200580674483aaa9780c9ad2d1c6f64424ab2271b54c6e861bc86148abb2845bed702052e4afa5c0
MD5 SHA1 SHA512

Submit Download

9AF5.bat

Path C:\Users\Admin\AppData\Local\Temp\9AF3.tmp\9AF4.tmp\9AF5.bat
Size 448B
SHA256 afd37a6263be867f11b20537c1457db478378f4250989ecc654ee531d09c1276
MD5 799bcbf06b30a24abca9d67a87aa7ce1
SHA1 775b9f11cd9ce520fa020a9ebf51ef0098ae6698
SHA512 2b9515c200defb3567d03cbde1bda90ef1e82f2b2fe6fa18b460ce7b8a9f60599491c664b67c2012813d2d1ebf009fdee7e90e77b264f54e15c194900e9b85cf
TLSH
T1BEF07B907C324201A7E5282B3FCDA64463F4E10B1812008432C924F700B30A92004F0E
MD5 SHA1 SHA512 TLSH

Submit Download

Noise.exe

Path C:\Users\Admin\AppData\Local\Temp\Noise.exe
Size 2.5MB
SHA256 0068636924e7c0d0074d594f94156b3a3428e7a6dad72ffdb24202f34fa14dab
MD5 8fc1142d14d3f202041454f02443cf86
SHA1 d00220ab94b0305ee0fe5319d1cfa6229e99885e
SHA512 3c50fcc51fd31e7243e305d447ef40c1e3cb6b47212b41e0a940d004d788b463764abb4f19f6f9b6ea902a9ef4e9dd6cd9ac8e922b43d4f5def295bde2cc2807
SSDEEP 49152:PDujsahQlswJJStO96wAKjA/iit4u/vbL4YH33oXHUX8:P6jsa6v8QgootZTTH3Y
TLSH
T1EEC51222F2B14437E2672A7C8D5B566CD87BBE10393998862BE52C4C5F3C3C1746B297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAll.exe

Path C:\Users\Admin\AppData\Local\Temp\OpenAll.exe
Size 359KB
SHA256 495428cf3b39c9dc80641fcbc8739e56ccfe37604968a68c595666a7684ce3aa
MD5 2f0f0fe2ccee8ac13fb5c7d259a5f002
SHA1 f04097d8fd83f709df8691c40216c80f79e18981
SHA512 aba50b51c3e0839feb9b885cc1a87db61a2aa0fc46ff704ba89e5ca32e4c15fed584fadd2c4f8b47bcb627570256e05796146c06f18a43be9d17fc70fd739f1d
SSDEEP 6144:W7zJVFEO7rdGlh4sQstC/JiUxasJgLdmhrSyhy/xegMW4x6YYBKaulAq41Fl:CJ/EO7rAlys39oa42dmUeTW4x6YtBAqG
TLSH
T161747D33F6D15437C263263C9D9F56A89C3ABE003E28684A2BE91D4D4F397C13969397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASLib.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ASLib.exe
Size 5.7MB
SHA256 adf652e07642597466a7c60bb512d9f6ec927f0e217a76e8625123974982a525
MD5 f32ca324c5efd03baa77d02a2d6c93e1
SHA1 0904821bfc023a8970240f31fd1bacb06dedd961
SHA512 31a7ddfb463d5c5d94d66bf84b2f55a7b87caddc433e4ac71d9fe8b43098b56172b170c4bff84ca3641aa2466576d7499ad6742aa98de66cb9a87b9d7caab0f8
SSDEEP 98304:cGhOeQzfF9zMK3QT3guq2QDp54qx1J0qUI4HHOF2tXLsQwCK292k9Q77vnhIFVR+:cE3QD3+3guq2Ej1JHUI4nOFIXzCuxQT7
TLSH
T14D563302B94843FBCD535D701B1B5EC1E0F8BFEDDF189E559B981B9F0AE51A0B220896
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AjarSystem.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AjarSystem.exe
Size 87KB
SHA256 fb796ea1d7c377fa8e3630ceb0b10479a738ef23bdaa6fde5c980c04c6e5d027
MD5 39952a00847a65cb5b192c28e81445ee
SHA1 e650da31ee60842483a37c7b761b5372add7fbe1
SHA512 e851486624fc1df056f88b229fe6f5129a1bb5218d374ff65b93178b246e610a1f5d065cf6e379c37c21fb0f8f47d75f7d80802c0d94a777149197bdd89f498b
SSDEEP 1536:j7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfuxB:/q6+ouCpk2mpcWJ0r+QNTBfu3
TLSH
T175936C45F3D242F7EAF10A3100A6712FA73666249724E8DBC34C3D829953AD59A7C3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sound.exe

Path C:\Users\Admin\AppData\Local\Temp\Sound.exe
Size 359KB
SHA256 b8f43fc7ac936cac21fe4ee2046e3fecdc69e503994fb8ca4fd26282c075e3ea
MD5 7bfc8ab77270809d4ab9932ddee9086a
SHA1 8461ed3470bd8d71cb2c5375c9bb3a77c5787cbc
SHA512 9a2a9a9a61b221730924e10a969d3489d0de49029b6d5a199bdd9eaf3a43ccf897537f98ed72655a06be54ea18c9a8dcbf8bf8d1656cc433b4d8dee9aad852d8
SSDEEP 6144:C7zJVFEO7rdGlh4sQstC/JiomhiGM80JCMlTe06z0aPawSoQBqa5lAq4SYdRl:2J/EO7rAlys39Cj80x6zlawSotgAq4XJ
TLSH
T1D1746D33F6D15437C2632A789D5F52A89C39BE003E28A84A2BE91D4D4F397C13979397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diskdestroyer.exe

Path C:\Users\Admin\AppData\Local\Temp\diskdestroyer.exe
Size 87KB
SHA256 abf949f60c1a2f377b534f8cca248a274a30455905fc3d2f5859b05bd2ab5c3d
MD5 c41817af1c8343debfad342ac6502ab8
SHA1 af79a175cadecee91e1299ba737874337d9dd590
SHA512 d45a292f389fcc4ac746516746c566ffc24f948ada370b0806c1df92b3ff1050a8b68efd5554a5db6164d28e46d8816649e24785b8a0dc8c3f5ce118d54b51c3
SSDEEP 1536:T7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfBxa:Pq6+ouCpk2mpcWJ0r+QNTBfBM
TLSH
T1A5937C45F3D241F7EAE10A3100A6712FE73966249724E8DBC34C3D829953AD59A7C3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error.exe

Path C:\Users\Admin\AppData\Local\Temp\error.exe
Size 48KB
SHA256 30f79f9e19e590b6fa4caf9a492b748cbffbffa96b763323228e3a420e0ae163
MD5 4a62a62dbde30e8489771c68a72d46d7
SHA1 e9a2659468f9f326b2821edfc84bbe22d6dde64e
SHA512 d8221d1de1fa01afa6830e74944d69e39f0249fdfd9211e3806ac484fb93862fc5d04049472c18fb80afadf95439c953e0f3602c5f162b61871627cf47f6b6f6
SSDEEP 768:qwTRqAfxgPnHhtnys3ztx9zEfFz65Gjb7R6y:fFfxihtnyyZx+txjb
TLSH
T18F2382D0BDA89CA7FA51533E84F7D662663DF5D04A53CB43AB30BA350B53A923CC1246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

red.exe

Path C:\Users\Admin\AppData\Local\Temp\red.exe
Size 50KB
SHA256 ebb449f07966c7d638dfe56b349706a1e7b38bafc0ba419625223cb7f91f3031
MD5 1a1bff7d50b030c8fef04cf3690ea9db
SHA1 76e45523c9630af83f0be68e5ca2fd3b2e2201c6
SHA512 8a87cab8669fdc21c98973aea068951c1d6b70996298e29ce3f49e90aac5ad99b25ffa42623a630cc3255cafc73fd4f8f61029d3af7de5554c2e21c6e3994859
SSDEEP 768:pBCRvug6nHhtnys3ztA6dF69q1fVf47ROU:pB93htnyyZAeF/2
TLSH
T1583380D0BDA89CD7EA51533E84FBD222663DF1D04A53CB43AB30BA350B53A923CC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snd.wav

Path C:\Users\Admin\AppData\Local\Temp\snd.wav
Size 5.0MB
SHA256 fd9cf1cb662429674008ab18ab0e84ac62aa7daa8dca0efb5df66d0e2b862935
MD5 6ec4b2cf3c320af5ab766a0816560a50
SHA1 304138a303969f55de0e77bce78ff613ed4f708c
SHA512 8ddd3df7fb56349034e3cee289589e301dfd3ae312501994a08dc0d4139de0422f68c99c7efecc1da43831f78337a82e8a41580990dd531194691d5d74938be7
SSDEEP 49152:s2+EJ719NxMLkDhOSt26RAylNUvSkkIrFla+uNglNus95BeAw/:BJ7jTMgISt2qjNUqMFla+agvuI3e/
TLSH
T189369E13A853790F69D6B9384133DE0C7DDB33445DC240AB2334CE6D697EA4A32EBA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/316-54-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/532-59-0x0000000000400000-0x0000000000686000-memory.dmp

Download

memory/532-55-0x0000000000400000-0x0000000000686000-memory.dmp

Download

memory/532-63-0x0000000000400000-0x0000000000686000-memory.dmp

Download

memory/532-67-0x0000000000400000-0x0000000000686000-memory.dmp

Download

memory/532-71-0x0000000000400000-0x0000000000686000-memory.dmp

Download

memory/984-53-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2500-52-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4784-50-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4948-11-0x0000000000417000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads