c0ea624651d9b10ab4137ddeb1e2656f0aeef35f46395e64bddc62f30dd9381c

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	disord.ggblazeservices.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	disord.ggblazeservices.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	disord.ggblazeservices.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	disord.ggblazeservices.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1820-0-0x0000000140000000-0x0000000140AA6000-memory.dmp	themida
behavioral1/memory/1820-1-0x0000000140000000-0x0000000140AA6000-memory.dmp	themida
behavioral1/memory/1820-3-0x0000000140000000-0x0000000140AA6000-memory.dmp	themida
behavioral1/memory/1820-4-0x0000000140000000-0x0000000140AA6000-memory.dmp	themida
behavioral1/memory/1820-15-0x0000000140000000-0x0000000140AA6000-memory.dmp	themida
behavioral1/memory/1820-21-0x0000000140000000-0x0000000140AA6000-memory.dmp	themida
behavioral1/memory/1820-50-0x0000000140000000-0x0000000140AA6000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	disord.ggblazeservices.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 52 IoCs

pid	Process
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	disord.ggblazeservices.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe
1820	disord.ggblazeservices.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1820	disord.ggblazeservices.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1820	disord.ggblazeservices.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 3616	1820	disord.ggblazeservices.exe	74
PID 1820 wrote to memory of 3616	1820	disord.ggblazeservices.exe	74
PID 1820 wrote to memory of 4992	1820	disord.ggblazeservices.exe	75
PID 1820 wrote to memory of 4992	1820	disord.ggblazeservices.exe	75
PID 3616 wrote to memory of 4740	3616	cmd.exe	76
PID 3616 wrote to memory of 4740	3616	cmd.exe	76
PID 3616 wrote to memory of 4400	3616	cmd.exe	78
PID 3616 wrote to memory of 4400	3616	cmd.exe	78
PID 3616 wrote to memory of 5064	3616	cmd.exe	77
PID 3616 wrote to memory of 5064	3616	cmd.exe	77
PID 1820 wrote to memory of 4552	1820	disord.ggblazeservices.exe	79
PID 1820 wrote to memory of 4552	1820	disord.ggblazeservices.exe	79
PID 1820 wrote to memory of 1464	1820	disord.ggblazeservices.exe	80
PID 1820 wrote to memory of 1464	1820	disord.ggblazeservices.exe	80
PID 1820 wrote to memory of 1672	1820	disord.ggblazeservices.exe	81
PID 1820 wrote to memory of 1672	1820	disord.ggblazeservices.exe	81
PID 1820 wrote to memory of 5012	1820	disord.ggblazeservices.exe	82
PID 1820 wrote to memory of 5012	1820	disord.ggblazeservices.exe	82
PID 1820 wrote to memory of 2328	1820	disord.ggblazeservices.exe	83
PID 1820 wrote to memory of 2328	1820	disord.ggblazeservices.exe	83
PID 1820 wrote to memory of 4632	1820	disord.ggblazeservices.exe	84
PID 1820 wrote to memory of 4632	1820	disord.ggblazeservices.exe	84
PID 1820 wrote to memory of 3368	1820	disord.ggblazeservices.exe	85
PID 1820 wrote to memory of 3368	1820	disord.ggblazeservices.exe	85
PID 1820 wrote to memory of 1612	1820	disord.ggblazeservices.exe	86
PID 1820 wrote to memory of 1612	1820	disord.ggblazeservices.exe	86
PID 1820 wrote to memory of 4784	1820	disord.ggblazeservices.exe	87
PID 1820 wrote to memory of 4784	1820	disord.ggblazeservices.exe	87
PID 1820 wrote to memory of 1860	1820	disord.ggblazeservices.exe	88
PID 1820 wrote to memory of 1860	1820	disord.ggblazeservices.exe	88
PID 1820 wrote to memory of 3332	1820	disord.ggblazeservices.exe	89
PID 1820 wrote to memory of 3332	1820	disord.ggblazeservices.exe	89
PID 1820 wrote to memory of 4252	1820	disord.ggblazeservices.exe	90
PID 1820 wrote to memory of 4252	1820	disord.ggblazeservices.exe	90
PID 1820 wrote to memory of 4476	1820	disord.ggblazeservices.exe	91
PID 1820 wrote to memory of 4476	1820	disord.ggblazeservices.exe	91
PID 1820 wrote to memory of 4216	1820	disord.ggblazeservices.exe	92
PID 1820 wrote to memory of 4216	1820	disord.ggblazeservices.exe	92
PID 1820 wrote to memory of 4376	1820	disord.ggblazeservices.exe	93
PID 1820 wrote to memory of 4376	1820	disord.ggblazeservices.exe	93

C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
"C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe" MD5
    3⤵
    PID:4740
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5064
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4400
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:4992
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:4552
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:4632
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:1612
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:4784
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:1860
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:3332
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:4476
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:4216
- C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe
  "C:\Users\Admin\AppData\Local\Temp\disord.ggblazeservices.exe"
  2⤵
  PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion