File name:

download.i-tax.cn

Full analysis: https://app.any.run/tasks/4b6de598-ce0d-49c8-96f5-f1a6114244f4
Verdict: Malicious activity
Analysis date: December 02, 2024, 08:25:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

5378F9C94BC010CD9D2A3888B2C60D9D

SHA1:

67CCC67941F8BDD5C4B389C8D8B3D0E1C143363E

SHA256:

271046B7770CFEBF8AD4965F54F3E1EC0E6A23CAD431DF8E9D111128B0109F4D

SSDEEP:

98304:76WN6HZ9jnLCHvrMtmuHGtnA2lb8J+oNEzRZBA2VlR8oFTZ7xFWdOBoBShDi/heC:1igVweA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 6372)
      • download.i-tax.cn.exe (PID: 4280)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • download.i-tax.cn.exe (PID: 4280)

    • Executes as Windows Service

      • WindowsUKService.exe (PID: 6448)

  • INFO

    • Manual execution by a user

      • WindowsUKService.exe (PID: 5096)
      • WindowsUKService.exe (PID: 5872)
      • notepad.exe (PID: 6692)
      • notepad.exe (PID: 7140)
      • WindowsUKService.exe (PID: 3832)

    • Checks supported languages

      • download.i-tax.cn.exe (PID: 4280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 22:50:52+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x30fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
20
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start download.i-tax.cn.exe sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs windowsukservice.exe no specs sc.exe no specs conhost.exe no specs rundll32.exe no specs notepad.exe no specs windowsukservice.exe windowsukservice.exe no specs windowsukservice.exe notepad.exe no specs download.i-tax.cn.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2940sc stop WindowsUKServiceC:\Windows\SysWOW64\sc.exe—download.i-tax.cn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3832"C:\Program Files (x86)\WindowsUK\WindowsUKService.exe" C:\Program Files (x86)\WindowsUK\WindowsUKService.exe
explorer.exe
User:
admin
Company:
TODO: <公司名>
Integrity Level:
HIGH
Description:
TODO: <文件说明>
Exit code:
0
Version:
2024.11.25.2
Modules
Images
c:\program files (x86)\windowsuk\windowsukservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4076"C:\Users\admin\AppData\Local\Temp\download.i-tax.cn.exe" C:\Users\admin\AppData\Local\Temp\download.i-tax.cn.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\download.i-tax.cn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4280"C:\Users\admin\AppData\Local\Temp\download.i-tax.cn.exe" C:\Users\admin\AppData\Local\Temp\download.i-tax.cn.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\download.i-tax.cn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5036sc create WindowsUKService binPath= "C:\Program Files (x86)\WindowsUK\WindowsUKService.exe"C:\Windows\SysWOW64\sc.exe—download.i-tax.cn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5096"C:\Program Files (x86)\WindowsUK\WindowsUKService.exe" C:\Program Files (x86)\WindowsUK\WindowsUKService.exe
explorer.exe
User:
admin
Company:
TODO: <公司名>
Integrity Level:
HIGH
Description:
TODO: <文件说明>
Exit code:
0
Version:
2024.11.25.2
Modules
Images
c:\program files (x86)\windowsuk\windowsukservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5872"C:\Program Files (x86)\WindowsUK\WindowsUKService.exe" C:\Program Files (x86)\WindowsUK\WindowsUKService.exe—explorer.exe
User:
admin
Company:
TODO: <公司名>
Integrity Level:
MEDIUM
Description:
TODO: <文件说明>
Exit code:
3221226540
Version:
2024.11.25.2
Modules
Images
c:\program files (x86)\windowsuk\windowsukservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6284sc failure WindowsUKService reset= 30 actions= restart/5000C:\Windows\SysWOW64\sc.exe—download.i-tax.cn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
582
Read events
582
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6448WindowsUKService.exeC:\Program Files (x86)\WindowsUK\ILog.logtext
MD5:9B202EA87CB521E694FD8F02F983382B
SHA256:F9BDCE7CCC46F7E1E673F1C45A5C1FA237626E4FD95F183E9A6C5C035CD10070
4280download.i-tax.cn.exeC:\Program Files (x86)\WindowsUK\Bus3.dllexecutable
MD5:1592181F3471DE324248EB8E9E30830A
SHA256:FCA20E9F8A6467BD61D2656F4854F8D85BE17C85251258FB8FDD4A64CE8B39F2
4280download.i-tax.cn.exeC:\Program Files (x86)\WindowsUK\WindowsUKService.exeexecutable
MD5:B651D55BE6F74096B6E93799068E678D
SHA256:C599FC01264DF904DFE6525960F35DF8D4BD193BD3AB89CEDAEBC9F27B72BB2E
4280download.i-tax.cn.exeC:\Program Files (x86)\WindowsUK\LibcurlDLL.dllexecutable
MD5:49A892D1181A7F1D35603D97DAC3D388
SHA256:17C66E913950A0CF03C11F5A12E90B4678BCE30D705EDAACD9F8AF0ECBCB46F9
4280download.i-tax.cn.exeC:\Users\admin\AppData\Local\Temp\nsd5354.tmp\nsExec.dllexecutable
MD5:ACC2B699EDFEA5BF5AAE45ABA3A41E96
SHA256:168A974EAA3F588D759DB3F47C1A9FDC3494BA1FA1A73A84E5E3B2A4D58ABD7E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
313 b
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
4164
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
NL
binary
408 b
whitelisted
4164
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
NL
binary
418 b
whitelisted
6164
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3040
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.142:443
www.bing.com
Akamai International B.V.
GB
whitelisted
1176
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 95.101.149.131
whitelisted
www.bing.com
  • 2.23.209.142
  • 2.23.209.149
  • 2.23.209.143
  • 2.23.209.153
  • 2.23.209.150
  • 2.23.209.144
  • 2.23.209.140
  • 2.23.209.141
  • 2.23.209.137
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.72
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
download.i-tax.cn