d982d9140acab07b869ea21ea032f8ea424b8441685c73a4a300f1d6458f46be

Analysis

user interaction
yes
max time kernel
36s
max time network
41s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Riza All-in-One.exe
Size 284KB
Sample260728-arlpmsgp6w
SHA256 d982d9140acab07b869ea21ea032f8ea424b8441685c73a4a300f1d6458f46be
MD5 e227f271e5384a911e5cbb20561e38c9
SHA1 0f981a967a5f6c74ae3c1bd92e9bd32bc26b9ce1
SHA512 351b8c70767e518fd3b3882c75a4b23dc1ad5d2b9df2bec25f764b7c09e464a3f3a79da247cd39fb6e35d969365887d7d8e2f42b0d771d6cacedf0a3796bdaa4
SSDEEP 6144:ZGT3qTVt8hxP6rF/F7v1C11Hv0339C1JL5DVQwvOuJeL+UcDl1F/Nk9U:ZOM/xv1C11Hv0339C1JL5DVQwvOOeLsR
TLSH
T11154B68832A4F18FD8ABC97599B41CB4A67178B76317D20B585314ED9E1DB82CF183B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2096	cmd.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5844	Riza All-in-One.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 2096	5844	Riza All-in-One.exe	89
PID 2096 wrote to memory of 5544	2096	cmd.exe	91
PID 5544 wrote to memory of 3576	5544	net.exe	92
PID 2096 wrote to memory of 1196	2096	cmd.exe	93
PID 2096 wrote to memory of 4572	2096	cmd.exe	94
PID 2096 wrote to memory of 2924	2096	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\Riza All-in-One.exe
"C:\Users\Admin\AppData\Local\Temp\Riza All-in-One.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\RizaAllInOne\Disable-DeviceSecurity.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3576
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:1196
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    PID:4572
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d 0 /f
    3⤵
    PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Disable-DeviceSecurity.bat

Path C:\Users\Admin\AppData\Local\RizaAllInOne\Disable-DeviceSecurity.bat
Size 1KB
SHA256 a001ba3ead64e61ee78795309f0fec64b639f6ec5428ca6cb5b7d230319f6894
MD5 9a73c6c0bdfda49549fb6fd7cc7a9b11
SHA1 2f284cc64d0f9ccd608042f68ac37dca4e1d6af4
SHA512 c5f0708552d0a5b4b0cdc123afd7c99665a29505ab45cfdb0586c151071741cf65c9068a91cbc7a363f046054e3cd01a67ca3ae55a151cc41a5c76df3be55393
TLSH
T1A3216362326972769083C4276F39C522FF08F18B42002552312B71BC9CEB3C8A87EC7C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5844-8-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-10-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-3-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-4-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-5-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-6-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-7-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-0-0x00007FFB4C0CF000-0x00007FFB4C0D0000-memory.dmp

Download

memory/5844-2-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-11-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-9-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-12-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-13-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-14-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-15-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/5844-1-0x0000000000E40000-0x0000000000E8C000-memory.dmp

Download

memory/5844-23-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads