Overview

overview

9

Static

static

7

HAZ_Chair.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HAZ_Chair.exe

  • Size

    3.6MB

  • Sample

    230209-sqk1tshd8z

  • MD5

    625b4a278ae90ce3ba9bd9a2f996d6d6

  • SHA1

    e5c3feab47f9232bbcce8e65f57c0358a6be49c7

  • SHA256

    5bd53a6b84cd68e9d9ea11519bba6a5cbd1ffe8e26a82543f717cfa3a2eb92a0

  • SHA512

    63db0c85dae5f3fb34d6343eac72120793e04a04228e2b2b9b265de6359894cbafc2a411991596b05bb0886799535b6b1abd1e0f67096cba5362de274996d979

  • SSDEEP

    98304:ywENcQ91+Oc2nar6XfFkuDljVFtDooWMfKiXl5Qu4AgPtHTnUZ:ZEeqUv2njX9vDZGHMDQxAgPtzU

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      HAZ_Chair.exe

    • Size

      3.6MB

    • MD5

      625b4a278ae90ce3ba9bd9a2f996d6d6

    • SHA1

      e5c3feab47f9232bbcce8e65f57c0358a6be49c7

    • SHA256

      5bd53a6b84cd68e9d9ea11519bba6a5cbd1ffe8e26a82543f717cfa3a2eb92a0

    • SHA512

      63db0c85dae5f3fb34d6343eac72120793e04a04228e2b2b9b265de6359894cbafc2a411991596b05bb0886799535b6b1abd1e0f67096cba5362de274996d979

    • SSDEEP

      98304:ywENcQ91+Oc2nar6XfFkuDljVFtDooWMfKiXl5Qu4AgPtHTnUZ:ZEeqUv2njX9vDZGHMDQxAgPtzU

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks