Haze Setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Haze Setup.exe
Size 12.7MB
Sample260825-vnfpfaaa94
SHA256 1f0a835d37932f8e6074237bac599013d2b78ffb0763ea5dde94a0910f6f09c7
MD5 af2e947fd58ad037da7a8ea697be5f81
SHA1 5ea35d887e4875d8943bae16569c0e24bc368d22
SHA512 0b7a5cd74ea41a5450f1548e8f314f27a22eecf6d0474c229e5e5b1f09e391f755ce12c33147eee5874c8ef3274fcd51d9dec69dcef46a1100e2b319f356ab11
SSDEEP 393216:u/DaglzNBGQfgkU2idaYJ/befXpl++14dD:CaENwQ/uagiXH1
TLSH
T1C6D62351BA6B95ACD45AC4B0C3464B635E2170CB0B2AB9EF518842383FBEBF15F3C615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Haze Setup.exe

File Explorer

Haze Setup.exe

.exe 12.7MB

Haze Setup.exe

IMPHASH 9406ddd35239265ed212fac71820e491
SHA256 1f0a835d37932f8e6074237bac599013d2b78ffb0763ea5dde94a0910f6f09c7
MD5 af2e947fd58ad037da7a8ea697be5f81
SHA1 5ea35d887e4875d8943bae16569c0e24bc368d22
SHA512 0b7a5cd74ea41a5450f1548e8f314f27a22eecf6d0474c229e5e5b1f09e391f755ce12c33147eee5874c8ef3274fcd51d9dec69dcef46a1100e2b319f356ab11
SSDEEP 393216:u/DaglzNBGQfgkU2idaYJ/befXpl++14dD:CaENwQ/uagiXH1
TLSH
T1C6D62351BA6B95ACD45AC4B0C3464B635E2170CB0B2AB9EF518842383FBEBF15F3C615
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

884064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

haze_setup.pdb

ntdll

NtReadFile RtlNtStatusToDosError NtOpenFile NtWriteFile RtlGetVersion

kernel32

GetExitCodeProcess GetCurrentProcessId lstrlenW GetSystemTimePreciseAsFileTime MoveFileExW GetCurrentThreadId ReleaseSRWLockExclusive TerminateProcess QueryFullProcessImageNameW AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW Process32NextW SwitchToThread GetSystemTimeAsFileTime FindClose WaitForSingleObject GetUserDefaultUILanguage LCIDToLocaleName CreateMutexA CompareStringOrdinal SetThreadStackGuarantee GetCurrentThread SetLastError WriteConsoleW RtlLookupFunctionEntry SleepEx FindFirstFileExW CopyFileExW FormatMessageW GetModuleFileNameW ExitProcess GetFullPathNameW GetTempPathW HeapAlloc SetFileInformationByHandle FindNextFileW GetFileInformationByHandle GetFileInformationByHandleEx OpenProcess GetFinalPathNameByHandleW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetCurrentProcess DuplicateHandle MultiByteToWideChar SetWaitableTimer WaitForSingleObjectEx LoadLibraryA ReleaseMutex WideCharToMultiByte GetConsoleOutputCP GetConsoleMode GetStdHandle SetUnhandledExceptionFilter CreateProcessW HeapReAlloc CreateDirectoryW CreateFileW CreateThread CreateNamedPipeW Process32FirstW FreeEnvironmentStringsW GetEnvironmentStringsW ReadFileEx WriteFileEx RtlVirtualUnwind RtlCaptureContext QueryPerformanceFrequency GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW AddVectoredExceptionHandler QueryPerformanceCounter CreateWaitableTimerExW HeapFree GetProcessHeap GetProcAddress GetModuleHandleA GetLastError CloseHandle Sleep LoadLibraryExA DeleteFileW InitializeSListHead OutputDebugStringA OutputDebugStringW LoadLibraryExW FreeLibrary CreateToolhelp32Snapshot GetModuleHandleW LoadLibraryW

oleaut32

SetErrorInfo SysFreeString SysStringLen GetErrorInfo

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

GetDC IsProcessDPIAware SetFocus GetActiveWindow SystemParametersInfoA SetPropW GetMenu DestroyIcon RegisterWindowMessageA MsgWaitForMultipleObjectsEx EnumChildWindows DispatchMessageA GetMessageA GetKeyboardState GetWindowRect GetKeyboardLayout SetWindowDisplayAffinity SendMessageW RegisterTouchWindow IsWindow CreateWindowExW AdjustWindowRectEx MonitorFromPoint EnumDisplayMonitors RegisterClassExW GetAsyncKeyState MessageBoxW ToUnicodeEx SetWindowLongW ShowWindow GetSystemMenu GetKeyState MapVirtualKeyExW LoadCursorW EnableMenuItem GetWindowLongPtrW SendInput SetForegroundWindow GetForegroundWindow InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW IsIconic GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData GetMonitorInfoW MonitorFromWindow GetCursorPos SetCursor GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FillRect GetWindow MonitorFromRect ClientToScreen GetClientRect GetWindowLongW ScreenToClient ShowCursor DefWindowProcW RedrawWindow SetWindowLongPtrW PostThreadMessageW PostMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetClipCursor ClipCursor RegisterRawInputDevices

comctl32

RemoveWindowSubclass SetWindowSubclass DefSubclassProc

ole32

CoInitializeEx CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoUninitialize CoTaskMemFree RegisterDragDrop RevokeDragDrop OleInitialize

shell32

SHGetKnownFolderPath DragFinish DragQueryFileW SHCreateItemFromParsingName SHAppBarMessage

gdi32

DeleteObject CreateRectRgn CreateSolidBrush GetDeviceCaps

shlwapi

SHCreateMemStream

advapi32

RegDeleteTreeW RegCloseKey RegOpenKeyExW RegDeleteKeyExW RegQueryValueExW RegGetValueW RegSetValueExW EventUnregister EventWriteTransfer EventSetInformation RegCreateKeyExW EventRegister

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

bcryptprimitives

ProcessPrng

vcruntime140

__std_exception_destroy __current_exception_context __current_exception __C_specific_handler _purecall memcpy __CxxFrameHandler3 memcmp __std_exception_copy memmove wcsrchr memset _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

floor trunc roundf __setusermatherr round

api-ms-win-crt-string-l1-1-0

wcslen wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit exit _initterm_e _initterm _get_initial_narrow_environment _c_exit _initialize_narrow_environment _configure_narrow_argv terminate _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit __p___argc _exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc