Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

7

disord.ggb...es.exe

windows10-1703-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    disord.ggblazeservices.exe

  • Size

    4.1MB

  • Sample

    240220-t7n99acb68

  • MD5

    85d7a8a5d446341fa3744cd96b93a402

  • SHA1

    214a65405a2a900abd298cf8fa035a61177f6975

  • SHA256

    c0ea624651d9b10ab4137ddeb1e2656f0aeef35f46395e64bddc62f30dd9381c

  • SHA512

    60903a4cb6d46151a7a037eb26123ef675c13b99a53463f4a5a057784d9f49e77b4055f2b17e14578b4e7573f0939dab31c1a17b9bddd1e83e74382f84291b4e

  • SSDEEP

    98304:ygzb1LsmWo7sZPZLTm2hxLkjYnUwIx+Xccyx+:337s/fhxwj1WV

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      disord.ggblazeservices.exe

    • Size

      4.1MB

    • MD5

      85d7a8a5d446341fa3744cd96b93a402

    • SHA1

      214a65405a2a900abd298cf8fa035a61177f6975

    • SHA256

      c0ea624651d9b10ab4137ddeb1e2656f0aeef35f46395e64bddc62f30dd9381c

    • SHA512

      60903a4cb6d46151a7a037eb26123ef675c13b99a53463f4a5a057784d9f49e77b4055f2b17e14578b4e7573f0939dab31c1a17b9bddd1e83e74382f84291b4e

    • SSDEEP

      98304:ygzb1LsmWo7sZPZLTm2hxLkjYnUwIx+Xccyx+:337s/fhxwj1WV

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks