"���:��»��?�(!�Y绎�C��������֤��Fe�d8��������'�쁢dx�0[;>�;C&���"�K혝� ;�G�!�6 �_=�8 [�xW p@�i��!?�`���x)pv[l?���g��2S�i�e����'ƂR�&�bZ������b����$ksX�c%Y�5E�3y.�����O=���L oQK���R DÖ3�vlu�÷�V3�mZ;�6��˾]�+]��j^V�.f# �*Vp'!QR$ƅ?����q*F���{k�ƯD&Q.�>pbeQ�sØ��b���J��������Ĝ��v��{�}*�$ �N�@0�8���5�&�-�3�=w(�f��tw L{Al�݆ӱ8/&����x��d�9��H�A#��0k�~�oƐ0����R���צ��&����"Ȝ��3��Q�L0|�EH��c���nm�C���=W�t]ݟaWу&��O�X�[���ۈ�O���Z6&4��c ��rA�� R��~�Q9���i5��ꉤ]��QE�l`h��or�a�n��\EΨ.NX<�����B�(�MZ)C��a+��0��\��n2E�)_,�oL0D�9#�h��:/}v��=� c��^ԙ���m���+��8�p���?�����%�0EIK���F�af�?z?>��P��ڮEg5�5��T�'�E�H�<�<�=pM��}(!f� �}vc$#�"�(,}�!Q�9�P��R���P�����nK���f�)��#�h�GQ���D}���"�߲yQwm�A'��yw�j|��eP�ɉ�A�eX�<�cO�'�05Dޖ�S���<nA� vy���..6$,0N�0��p�=�����{��4p��@u��>���U��x�S�Q�q5.X�GZ9̷+J������$��}���B�v���PO�B{�hF�Fc��2pd((�s1�H��ST��6���<�½r���+��{���� ��C�j7P-w���*�Kɥ�Q�%��kY�\����]���!7aWp���=,N#�{*���|�|)�0��b��$��+�����c�n��1?*=�|�7�0+elF��%�1�x�x�'��?x1h%ol�`�� �&8���{/�݈�l��[���0~�*ԋpל��;�a�3;���q�Z[���;ʨ�@h�@��%�a$��]� ��0�!̈�XuRw����S؏���R�ddG]�m?b�r���;�T���[O�MMG+��L����2I�p�SEJVL���ނ��@�8XJ.{sQmk-؏�by��ʜk�9��T��Y�CH���&����y��AO7��t�{KNK�Ljj���� ~(W/��G�歭�l9���� �\"��6���ՠݍ�O�qݢ��,r���ຜ��h�~|s�:���~�_�á���X/J}��;K͏��4��S�6W�Tܱ�l�=E,��Jr� Ւ�{������ֲ�,��}����c��!q��D�� ^d��i�l_�i��M �H�۪X����ڬ[B��������'�KL��y�.!Q1; �LS�������R����O�@�2�o3 7�l,>��υa�0� l���դ�9:Ւ���;�fB>:� �[���� ��yU����hmFqD�x���Xp2���]Tʹ��J7y��Z-������D�����'����I������hO?9��2N���U���+�;~/���(�W�r�E���MSf��Hڿ�fB��� <Yv���5�M�y�кH�4쩊|�̇3Ս���,�������}��(��.϶���!����� mj$�^V��8#3�T��_j���=����Z�V`�'� �7D7^/O�櫎�F|�Z����d�����{KT]��W^�� ����a`w+@�y{'r�3~�>��[fz��䕨n��_�L�������9f�<��P�Q��Eט_��T�O�Hۘ��;��=!�}.�ak_F��T���gIsޛb^�x/��e �'�L��I;yM����r� Q���ϖV�(N$�����?f@ǚ�8f����������oa�g���e�>߃�)�4�g�mFɪD��~��H��v�վ0J2 ��}�F9B{�^ߵ�"uG�?���ח��1s�� IT�Q����bۢ�}�\�w���Ț��zRZ���[�7��g��m��ur�cЛ��"Fy>�B͵���Xu��������U���@��FՅ������T��Z��^�f�X-[���8x��_;i^�z[�R������4��}0m����o��)��&}�S���Q^���2E���s=n�nWt��T��fH�����㪲�����0Eg���ɣN�i��T� E9�+�mt�A�M6�P��<gTD��gim�D^��[;\2�k�O���6 ǙX�*̫t@�Vy����Xe��b T<����jن�&�f��H����<�Y�>�H�}�sW��_���~l����� y\T����G+l��d>�Y��J*�gm{��%�#X��fK�@S'��>�m�����3�'�ݺz���^��G�iV]k�3(�-B@^��\�!��Ό��� �w׳�J�y�H����֖+�Xh�w?�-���/�nB֏���~!�[�f�ss�����MM���mc�x��/Tސ{3�)t�-�<Yw��{b� ���tg�Z��'Ę�=��Ó��ռ+����%8���zIw~b|�SYީ���s(f�I�&U$'����-�=g� 1���0���& <���%��z����>�%��`����hӧ��B�5?}���$�d�1����d���P��1��3�6T]m��\A7 '�^cBޓb�Ā�1�"�F��O��7�Q�2S���ʸ�r����h��ĀF>�����.h��@[ȵ�z#�Aop|Yi��i�d(PuW���ȥ�J�Ak� ��[�jf��̐'���&�˒d�f�A��DI�/��PDK�D�v�3�v*�%���K$�~OF�ݏ�q�xB6yC=�DǣuM���oAj����_��7�YƐ������Jn����3�,0�N[��eW}z�*r^ ;/\:�MX6��*��x��y
Behavioral task
behavioral1
Sample
Project_Haze.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Project_Haze.exe
Resource
win10v2004-20230220-en
General
-
Target
Project_Haze.exe
-
Size
5.1MB
-
MD5
97727c5d1123943968166625996c5ac9
-
SHA1
40e09f68d1b08aad50df2025313a1cb121353d09
-
SHA256
d789f646be4363369266c9291cbd8490de28b31d8ace380cf0144ec2c84950c2
-
SHA512
8d1243fc030e675b7175a335d55b9cb9f1803d7b8cab129946c54ff8cd9a59ab75a4566a3c82111a3ae9729b0262fb5c3896905659584854e18298aa5ca63b00
-
SSDEEP
98304:MGo94QW1t/achUHieTwqzaDtkoXkOraAH5mcMRiBHxdgIl:MGo6KceHie9MDk0ac5mcGg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Project_Haze.exe
Files
-
Project_Haze.exe.exe windows x64
b3b8f2dfdab44775e03ab08ddbdbb850
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FormatMessageA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetForegroundWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
ntdll
VerSetConditionMask
normaliz
IdnToAscii
wldap32
ord32
crypt32
CertCloseStore
ws2_32
getpeername
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-stdio-l1-1-0
fgets
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlink
advapi32
AddAccessAllowedAce
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ