cbd790e5b7e48fcf43fffff5b02ad19986b28f643ef1a52208bd64489144cc11

Analysis

user interaction
yes
max time kernel
33s
max time network
35s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
riven.exe
Size 11.1MB
Sample260809-3p7tbafm3x
SHA256 cbd790e5b7e48fcf43fffff5b02ad19986b28f643ef1a52208bd64489144cc11
MD5 170e3bb8dcd180371a442fe77750651a
SHA1 838009474ba796144c98df1a906d3b396592337f
SHA512 69014b96c2eddb3e26f31516711754796ea655dba249cfe7af0bb02b2a0819e5e66b5b3957960a68363a78ad663003a808f0d43096004b33ea0a938305b020e0
SSDEEP 196608:0DLlhzRHWWpQTQw/0VnvaicErzEgQHL1nlw66clm1d:shhzRlFw/0xvaicczELs6Lc
TLSH
T136C633190DE20C15DF6487BE7CAE4C3A1796C3A2CFFCC09C994590877BB355B2AE8295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	riven.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	riven.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	2988	riven.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	riven.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	riven.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	riven.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	riven.exe

Executes dropped EXE 1 IoCs

pid	Process
4092	riven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	riven.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	riven.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2988	riven.exe
4092	riven.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4948	cmd.exe
2560	cmd.exe
3208	cmd.exe
4772	cmd.exe
2720	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3012	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5444	timeout.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3012	PING.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4772	2988	riven.exe	90
PID 4772 wrote to memory of 1912	4772	cmd.exe	91
PID 4772 wrote to memory of 4964	4772	cmd.exe	92
PID 4772 wrote to memory of 4416	4772	cmd.exe	93
PID 2988 wrote to memory of 2720	2988	riven.exe	94
PID 2720 wrote to memory of 3012	2720	cmd.exe	96
PID 2720 wrote to memory of 4092	2720	cmd.exe	97
PID 4092 wrote to memory of 4948	4092	riven.exe	99
PID 4948 wrote to memory of 2684	4948	cmd.exe	100
PID 4948 wrote to memory of 2660	4948	cmd.exe	101
PID 4948 wrote to memory of 5580	4948	cmd.exe	102
PID 4092 wrote to memory of 2560	4092	riven.exe	104
PID 2560 wrote to memory of 3208	2560	cmd.exe	105
PID 3208 wrote to memory of 5444	3208	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\riven.exe
"C:\Users\Admin\AppData\Local\Temp\riven.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\riven.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\riven.exe" MD5
    3⤵
    PID:1912
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4964
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ka_updater.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\riven.exe
    "C:\Users\Admin\AppData\Local\Temp\riven.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\riven.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Windows\system32\certutil.exe
        
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\riven.exe" MD5
        5⤵
        
        PID:2684
    - - C:\Windows\system32\find.exe
        
        find /i /v "md5"
        5⤵
        
        PID:2660
    - - C:\Windows\system32\find.exe
        
        find /i /v "certutil"
        5⤵
        
        PID:5580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Windows\system32\cmd.exe
        
        cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3208
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5
        6⤵
        Delays execution with timeout.exe
        
        PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ka_updater.bat

Path C:\Users\Admin\AppData\Local\Temp\ka_updater.bat
Size 348B
SHA256 e28650e6b4fe2ed83f2e6d628f99fb3d783221c6f26f758c67d89a94cf0414ce
MD5 a0ea8578534ed1c4273c19b4aa1f5606
SHA1 08bc0e48b9f98a90a3a9bae8902c79b2f0a38175
SHA512 24fc27de721a00eab0dccec4f65631aae2a1dad7cdd0ee43d902c325c6b683e8b0faf450d88b4ef18b5f7ab00972f556ff08f39778d04814c118aacb5ddf0821
TLSH
T18CE04F06828B8B5D0408663B47B7714DC4A5499D3B4D3750C760C82D26D280FF6CB781
MD5 SHA1 SHA512 TLSH

Submit Download

riven_updated.exe

Path C:\Users\Admin\AppData\Local\Temp\riven_updated.exe
Size 9.4MB
SHA256 bd02ac26db9c6501ecec53e3496f058425ac5389310e0974e78b5326ddeab071
MD5 844b69a3321a3a7a6365b28610063033
SHA1 a382e40c80c5e8349b6ed0a7b90fbcb6946b5065
SHA512 707b492db07757f2f922e50138fe3f8a19e330401cacdc3f2d199c2296ad400de7c71d4040a2b6f4982912f5530b9056c15bd8e87d4ed2241b9977acdcef0f7a
SSDEEP 196608:Icggm3Isl0uN+fNcUcSkcRpy1TiO2s1u0DHSAdg5vCk3lY/IkkHu:ygWIyrkfrcSxRE1rd14H6OY/IkkO
TLSH
T18BA63306554369F2E5CE86B1AAE8A10473C3779303DAF79C6DAF9CAB4C327007751BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2988-3-0x0000000140000000-0x0000000141BAC000-memory.dmp

Download

memory/2988-0-0x0000000140000000-0x0000000141BAC000-memory.dmp

Download

memory/2988-2-0x0000000140000000-0x0000000141BAC000-memory.dmp

Download

memory/2988-17-0x0000000140000000-0x0000000141BAC000-memory.dmp

Download

memory/2988-1-0x0000000140000000-0x0000000141BAC000-memory.dmp

Download

memory/4092-21-0x0000000140000000-0x000000014193D000-memory.dmp

Download

memory/4092-22-0x0000000140000000-0x000000014193D000-memory.dmp

Download

memory/4092-23-0x0000000140000000-0x000000014193D000-memory.dmp

Download

memory/4092-24-0x0000000140000000-0x000000014193D000-memory.dmp

Download

memory/4092-25-0x0000000140000000-0x000000014193D000-memory.dmp

Download

memory/4092-26-0x0000000140000000-0x000000014193D000-memory.dmp

Download

memory/4092-27-0x0000000140000000-0x000000014193D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads