File name:

E-Tax setup.zip

Full analysis: https://app.any.run/tasks/80c0b20b-fecc-4ec2-8b73-6b2bbc0cd52a
Verdict: Malicious activity
Analysis date: July 02, 2025, 03:09:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

72C5FEF7C5F073869A7D6BEBE6C36C71

SHA1:

38B3E057DD2EA03631614D06F9B13F45DE6773F9

SHA256:

5D0C05A6CB533345F490C2B0DF0D23396417EA2BA3BCE422AD7DF1794F0334EB

SSDEEP:

49152:SsDLfaR3ASZlizZUZkunWTcjY05wAE/leYMJzUDMr44JaDpsobPrKZNWbcYWYoJ4:SCLfuASjitUaunaz02AE/UYM6Mr4CaDh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4192)

    • Create files in the Startup directory

      • setup.exe (PID: 4920)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup.exe (PID: 4920)
      • Setup1.exe (PID: 6852)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4192)
      • setup.exe (PID: 4920)
      • Setup1.exe (PID: 6852)

    • Starts a Microsoft application from unusual location

      • setup.exe (PID: 3944)
      • setup.exe (PID: 4920)

    • Creates/Modifies COM task schedule object

      • setup.exe (PID: 4920)
      • Setup1.exe (PID: 6852)

    • Creates a software uninstall entry

      • Setup1.exe (PID: 6852)

    • Creates file in the systems drive root

      • Setup1.exe (PID: 6852)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4192)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4192)
      • setup.exe (PID: 4920)
      • Setup1.exe (PID: 6852)

    • Checks supported languages

      • setup.exe (PID: 4920)
      • Setup1.exe (PID: 6852)

    • Reads the computer name

      • setup.exe (PID: 4920)
      • Setup1.exe (PID: 6852)

    • Manual execution by a user

      • setup.exe (PID: 3944)
      • setup.exe (PID: 4920)

    • Create files in a temporary directory

      • setup.exe (PID: 4920)
      • Setup1.exe (PID: 6852)

    • Creates files or folders in the user directory

      • setup.exe (PID: 4920)
      • Setup1.exe (PID: 6852)

    • Launching a file from the Startup directory

      • setup.exe (PID: 4920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:03:04 17:13:48
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: E-Tax setup/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe setup.exe no specs setup.exe setup1.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3944"C:\Users\admin\Desktop\setup.exe" C:\Users\admin\Desktop\setup.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Setup Bootstrap for Visual Basic Setup Toolkit
Exit code:
3221226540
Version:
6.00.8169
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4024C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4192"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\E-Tax setup.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4920"C:\Users\admin\Desktop\setup.exe" C:\Users\admin\Desktop\setup.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Bootstrap for Visual Basic Setup Toolkit
Exit code:
0
Version:
6.00.8169
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6852Setup1.exe "C:\Users\admin\Desktop\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"C:\Windows\Setup1.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic 6.0 Setup Toolkit
Exit code:
0
Version:
6.00.8171
Modules
Images
c:\windows\setup1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
2 743
Read events
2 626
Write events
95
Delete events
22

Modification events

(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\E-Tax setup.zip
(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(4192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
32
Suspicious files
5
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
4192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4192.8073\E-Tax setup\iFileV1.0.CABcompressed
MD5:01FB885A816D1FF85EECF6A19CD3FAF8
SHA256:5B70D0F3F45C7F37D88AFD7B01708499EA784BEB748FEBC3C4A09DDCC844A065
4920setup.exeC:\Users\admin\AppData\Local\Temp\msftqws.pdw\olepro32.dllexecutable
MD5:B48D3193DD1474DCBCC32BF4779AC698
SHA256:54D7EE1E4B43D2590B3B9B4A412717BFECFCCE46F9DDA68DBA4695F135FAA7B5
4920setup.exeC:\Users\admin\AppData\Local\Temp\msftqws.pdw\COMCAT.DLLexecutable
MD5:3B180DA2B50B954A55FE37AFBA58D428
SHA256:96D04CDFAF4F4D7B8722B139A15074975D4C244302F78034B7BE65DF1A92FD03
4920setup.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ST6UNST Uninstaller.LNKbinary
MD5:2F4732E0F79A658B865EDF820B33EC58
SHA256:C60465CC9653F99B8E33B23B708746F73BA3419299BD38841E4FE2446B72E98F
4920setup.exeC:\Users\admin\AppData\Local\Temp\msftqws.pdw\stdole2.tlbexecutable
MD5:0857394E30DE11CA0CD9497E310D6469
SHA256:E2B26B1AD2D439DDED0799D195CA918A03CCF22146690577E2704F871C098426
4920setup.exeC:\Users\admin\AppData\Local\Temp\msftqws.pdw\st6unst.exeexecutable
MD5:996F83E516552CA3B51445BB994A6D38
SHA256:7E60C894A8CEAD6880FD3ED040504D02304A0B961304E40741340E31F5FA973D
4192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4192.8073\E-Tax setup\SETUP.LSTtext
MD5:C505F3C252046E067407FC8B0617939D
SHA256:4AF269806D34DBD13B39B19C8F9BC28BADB4C077EBDB9C0DBD48FCA31346C060
4920setup.exeC:\Users\admin\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLLexecutable
MD5:CFF867572B44212B01B711C1FA009537
SHA256:DF6E2F111773ADEC3B33DCB0B31E2A4D21EF7D51740706335F411E2C999C0E6B
4920setup.exeC:\Users\admin\AppData\Local\Temp\msftqws.pdw\asycfilt.dllexecutable
MD5:0BC326CD99125724987CEEC7405496B6
SHA256:E701CB227DAA19C9B91ECF9975A12351BC4D73454B894695A6C5F74F65B9B77A
4920setup.exeC:\Windows\temp.000executable
MD5:996F83E516552CA3B51445BB994A6D38
SHA256:7E60C894A8CEAD6880FD3ED040504D02304A0B961304E40741340E31F5FA973D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6492
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2716
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2716
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5528
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
6492
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6492
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.1
  • 20.190.159.68
  • 20.190.159.131
  • 40.126.31.71
  • 40.126.31.73
  • 40.126.31.128
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
setup.exe
Close
setup.exe
Ending BRC
setup.exe
Ending BRC
setup.exe
Close
setup.exe
Ending BRC
setup.exe
Close
setup.exe
Close
setup.exe
Ending BRC
setup.exe
Close
setup.exe
Ending BRC
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
E-Tax setup.zip