�<�,$si�ٜ3�j�A�����_��n���q�&�<T���%I�ű��.�H�~��`�ClPm�x� Y~��C�v$9�X� �֢�����)K˖��(!��Fmǖ�n���pp_B�,�b�����ۆ�4a��y�>h���)��P��HD�N�oIl7�R: �_�f� �.s�0�R��&|O +Ն�� �R+���^h�b�ah�����q��+ls�#��ك��R�gv�bH�N�i7L�L�t�|8B~���8�U)����� ���4��Y��}��Vg�s$�lKmk0}~?hF ���Ӏ��)��C�;JX[������x�SzR�4��d���g�1�땬����"��ߕ�M�B����uz����h �O�ԟ�Qk �N������au��[N02p~�|mtT��6��41�x���#��B�3�k��[��+�Ř����R��熺�8rs�9�+^�d~;���̋��<�69�����%�Y0Z��1�W}^C6�����]Ա������D�N�S=�˒4�\�4�^wI�!���l�P�t7S�#<����;Ԓ�5����'�5��O����(�Uh7+j5�b̻m g�����'<ۅ��BqO�^����5�)���٘Xp�e � W� �V{l`��|��l�����/6W��Cy��� ��5* ޡ)~�����W�.�"�8,�c hP���K��p�;r�2B;���'�7c��IS��1���@�GY=��P�q�/݅��8<}���|+�����S��G������Ƹq�.��y�Ue]>[� =?�`�T}�]���p�v��Hŕ�y$N����$V':1���w� "��?�P�:�<iM��j3T�=���"����OI� g,���Y'�"��,�����Zt��e�����'e<��>H���I�v��<0?�:���0��⭦�����t�i� V��u3:���"ɿ&,���Ev�}�/�7����`�-{�j@�~j��y����x���oҿ·�lRX���������K4�}Z��Э�e{�����5�|��=�A,8t����a�*ˉ�0������x���|��>�H5�����������lQ�[�76��U�my�&AW�'� �o���M��,�~[���>�f��w�0�� ̖�5��n�C�ٙ?t�2͐Z����|����̅����� ����_�;�@0����9�s�9i�b`���Xx$4�ody�ݡ~�[���F��� �"8�����ś�Y����f��:`9t�E�#����0���Qr';M��n��?H�H���8v$�}��( 0�?�鬗�l����D���@yvƏ;�*.��9��>�ՉpŹ�<C����aC�Z;�sz2U�1����|�i�ܮ���!���ZJ��}r�������J��b#�����_��b��&$�>�z�ڍ�#"�N!`p�_�r!2�X��*�T�^�-s⛽�+e��j��l�|��A�C� 1�iٸ���B��s �s\=6cfl�"�֤�����&)?�?�A�ϕ��ˇ�n�����^TmxJ�1�LXA�pv��Xs*Ì;u�Ca�h����!n�,o~�2|��%u������$��B]n2l!���u\�P�=jl <�Oa�k���Q�RH�C����?ۭLJ- ��_���v�o�Vl� L&����L�.��J� ���л�#Q�_���,�Qvov��9���������[���s8�>�����@"H9{�5FT@zɯg��1�i��l(�����������ڛc��&�kC&x�q�9�4*_K�#Vռ��@�#��4����WeE�J9�&�j5w�Wj��·��u:���ĵ���"�قo�ukG{Pb�J���S;U^v����4��N@��C���ȁ8tƊ�U�T������E�����8첹�X�tAW�e������㸚���[fZ�~�*Ӊ%�,��̈́��^֚d�y�ls�M�o�/2����j����� U&�2G��{�}ج�5��&�p��9v�������ra �7h�ɝ]�@e]��H;��6��;:\���*�p�ހ���;;�T��Dg����.�#�c7_��� ��#>SUoF{vv� ��l� g1<F�O�4�kث˞�RO�s�2�M����x��q��>s*H��RKguN��*�oX����U7|��mk#�j�O����)���4W���i~2�5����@�\��l��� �*OO����Nxյ�#}d��ک���iM��p>��|��`�VYHr�s ISAy���0~X����mbH�nIby�h�����g ��Y��e��K1�>K�����;,~u�E=M� �5��\��k�y5���S��`"a��Z����J='�䢥�흍`\7y6��7��x4�-F������I�5�٘Q� �F��XW��ŵr��t�PY �]��sK>(|�"���������xZ6ϵ���������_�U�a��I�R�E���sL�6�j7A!LV��X|�.�@�8)�ǃu��$�����x�]�?"��?�@@W������Y��t"�u��EƩ���?��s|���6�4OJ2���t]��B�9_}B` @�.)�7g�����\�xt�s �� 5\���Tl���u��ǐr��n�$Z��\��4f�N����3��'���H0 zKU�o[�#�����Y�t�����%���x�Q��Ï����s�B��,�U'�����dN����@*L1�2�<�opO<�����r+��:S@��:�b1���T|�(3���fٿ����_C�:ه��<���,�#����S<iH^��p/��dkC��i˶φX��O��6����W�i���$�����)���L`!O����&�mmUw�����u��/�Ƣ�A�����8~�&�o�0�H� s�=��*� �g�,�������������u������Wj�K�ׂe�4o^������q�����}�י 1FA�!�W��y��A�� a���"��k#��� S�!��dE�f��i t���Fk
Static task
static1
Behavioral task
behavioral1
Sample
taskhostw.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
taskhostw.exe
Resource
win10v2004-20240221-en
General
-
Target
TZX.zip
-
Size
6.8MB
-
MD5
f550157d21905ae53e9b3fa3d94a0372
-
SHA1
c2a04ba19a41cd38604806a2e3cf4290d0d29b41
-
SHA256
be2185d326a3b74b9003c47832a8f0be490f1865d9f7b08e608e75f51be8b796
-
SHA512
2a66c33524744aedf2afb772e34f6d676529138b48ecb762757a438329d9e6d7dd13ad6f2a92fc44353b3e156f11909714722d7f9ea32cdb8f5aeedb7bd545e2
-
SSDEEP
196608:Nz+9FP62cNMcDfD1piFj8+yl5LIc2pbxS3f1lHKvTYY9bABnt:NzIFig0d3lmrS3f1lqEY9bApt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/taskhostw.exe
Files
-
TZX.zip.zip
-
taskhostw.exe.exe windows:6 windows x64 arch:x64
dcf807b2d3e5d586e34b3fef5ddff514
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDevice
ntdll
RtlCaptureContext
ws2_32
getsockopt
crypt32
CertFreeCertificateChain
advapi32
CryptHashData
kernel32
LoadLibraryExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoSetProxyBlanket
oleaut32
SysAllocString
imm32
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 669KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tzx0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tzx1 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ