| File name: | desktopcal-setup-v2.exe |
| Full analysis: | https://app.any.run/tasks/7c725cdc-4a74-4d4b-bbc7-6df7e74d8048 |
| Verdict: | Malicious activity |
| Analysis date: | January 10, 2020, 17:10:10 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | B7915DB71C55C63F32A8CE19990A943D |
| SHA1: | 643FE7B03417A42BEBA81DF712A122750657C4C3 |
| SHA256: | 279ED86B3F6A21651FC459062E631AACA32FDBC8D2B0A5B09F20D56D54484E19 |
| SSDEEP: | 98304:CHHMFvwk5lU8FWXMKZxpYjy+Xh6MRiqg+0duZuRSMva1YxKgob4B:CnMFvvwXnxilhnRis0m8SMql4 |
MALICIOUS
Loads dropped or rewritten executable
- desktopcal-setup-v2.exe (PID: 2728)
- desktopcal.exe (PID: 1936)
- desktopcal.exe (PID: 2776)
- desktopcal.exe (PID: 4088)
- desktopcal.exe (PID: 184)
- dkupdate.exe (PID: 3804)
- explorer.exe (PID: 352)
Changes the autorun value in the registry
- desktopcal-setup-v2.exe (PID: 2728)
- desktopcal.exe (PID: 184)
Application was dropped or rewritten from another process
- desktopcal.exe (PID: 2776)
- desktopcal.exe (PID: 1936)
- desktopcal.exe (PID: 184)
- desktopcal.exe (PID: 4088)
- dkupdate.exe (PID: 3804)
SUSPICIOUS
Executable content was dropped or overwritten
- desktopcal-setup-v2.exe (PID: 2728)
Creates files in the user directory
- desktopcal.exe (PID: 2776)
- desktopcal.exe (PID: 184)
- desktopcal-setup-v2.exe (PID: 2728)
- desktopcal.exe (PID: 1936)
- dkupdate.exe (PID: 3804)
- desktopcal.exe (PID: 4088)
Creates a software uninstall entry
- desktopcal-setup-v2.exe (PID: 2728)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2010:04:10 14:19:31+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 25600 |
| InitializedDataSize: | 431104 |
| UninitializedDataSize: | 16896 |
| EntryPoint: | 0x354b |
| OSVersion: | 5 |
| ImageVersion: | 6 |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.3.62.4721 |
| ProductVersionNumber: | 2.3.62.4721 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | ASCII |
| Comments: | http://rd.desktopcal.com/?id=1000&fp=client&cver=2.3.62.4721 |
| CompanyName: | DesktopCal |
| FileDescription: | Desktop Calendar Installer |
| FileVersion: | 2.3.62.4721 |
| LegalCopyright: | Copyright (C) 2011-2017 Beijing Cloud Story Inc. |
| LegalTrademarks: | DesktopCal |
| ProductName: | DesktopCal |
| ProductVersion: | 2.3.62.4721 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 10-Apr-2010 12:19:31 |
| Detected languages: |
|
| Comments: | http://rd.desktopcal.com/?id=1000&fp=client&cver=2.3.62.4721 |
| CompanyName: | DesktopCal |
| FileDescription: | Desktop Calendar Installer |
| FileVersion: | 2.3.62.4721 |
| LegalCopyright: | Copyright (C) 2011-2017 Beijing Cloud Story Inc. |
| LegalTrademarks: | DesktopCal |
| ProductName: | DesktopCal |
| ProductVersion: | 2.3.62.4721 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000E0 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 10-Apr-2010 12:19:31 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x000063A2 | 0x00006400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.48045 |
.rdata | 0x00008000 | 0x000018F2 | 0x00001A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.88829 |
.data | 0x0000A000 | 0x0006669C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.42988 |
.ndata | 0x00071000 | 0x000D1000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00142000 | 0x00009530 | 0x00009600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.03421 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.22444 | 955 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 5.2667 | 4264 | UNKNOWN | English - United States | RT_ICON |
3 | 5.31911 | 3752 | UNKNOWN | English - United States | RT_ICON |
4 | 5.1078 | 2440 | UNKNOWN | English - United States | RT_ICON |
5 | 5.86909 | 2216 | UNKNOWN | English - United States | RT_ICON |
6 | 5.33696 | 1736 | UNKNOWN | English - United States | RT_ICON |
7 | 3.9657 | 1640 | UNKNOWN | English - United States | RT_ICON |
8 | 3.69096 | 1384 | UNKNOWN | English - United States | RT_ICON |
9 | 5.28495 | 1128 | UNKNOWN | English - United States | RT_ICON |
10 | 4.10612 | 744 | UNKNOWN | English - United States | RT_ICON |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll |
ole32.dll |
Total processes
40
Monitored processes
7
Malicious processes
7
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 184 | "C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe" -savestart | C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe | desktopcal-setup-v2.exe | ||||||||||||
User: admin Company: Beijing Cloud Story Inc. Integrity Level: MEDIUM Description: Desktop Calendar Exit code: 0 Version: 2.3.62.4721 Modules
| |||||||||||||||
| 352 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | — | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1936 | "C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe" -savelang.usa | C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe | — | desktopcal-setup-v2.exe | |||||||||||
User: admin Company: Beijing Cloud Story Inc. Integrity Level: MEDIUM Description: Desktop Calendar Exit code: 0 Version: 2.3.62.4721 Modules
| |||||||||||||||
| 2728 | "C:\Users\admin\AppData\Local\Temp\desktopcal-setup-v2.exe" | C:\Users\admin\AppData\Local\Temp\desktopcal-setup-v2.exe | explorer.exe | ||||||||||||
User: admin Company: DesktopCal Integrity Level: MEDIUM Description: Desktop Calendar Installer Exit code: 0 Version: 2.3.62.4721 Modules
| |||||||||||||||
| 2776 | "C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe" -recoverwpfor1x | C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe | — | desktopcal-setup-v2.exe | |||||||||||
User: admin Company: Beijing Cloud Story Inc. Integrity Level: MEDIUM Description: Desktop Calendar Exit code: 0 Version: 2.3.62.4721 Modules
| |||||||||||||||
| 3804 | C:\Users\admin\AppData\Roaming\DesktopCal\dkupdate.exe | C:\Users\admin\AppData\Roaming\DesktopCal\dkupdate.exe | desktopcal.exe | ||||||||||||
User: admin Company: Beijing Cloud Story Inc. Integrity Level: MEDIUM Description: dkupdate Module Exit code: 0 Version: 2.3.62.4721 Modules
| |||||||||||||||
| 4088 | C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe | C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe | desktopcal-setup-v2.exe | ||||||||||||
User: admin Company: Beijing Cloud Story Inc. Integrity Level: MEDIUM Description: Desktop Calendar Exit code: 0 Version: 2.3.62.4721 Modules
| |||||||||||||||
Total events
1 318
Read events
1 276
Write events
41
Delete events
1
Modification events
| (PID) Process: | (184) desktopcal.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | DesktopCal |
Value: C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe | |||
| (PID) Process: | (2728) desktopcal-setup-v2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\DesktopCal |
| Operation: | write | Name: | DisplayName |
Value: Desktop Calendar 2.3.62.4721 | |||
| (PID) Process: | (2728) desktopcal-setup-v2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\DesktopCal |
| Operation: | write | Name: | UninstallString |
Value: "C:\Users\admin\AppData\Roaming\DesktopCal\uninst.exe" | |||
| (PID) Process: | (2728) desktopcal-setup-v2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\DesktopCal |
| Operation: | write | Name: | DisplayIcon |
Value: "C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe" | |||
| (PID) Process: | (2728) desktopcal-setup-v2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\DesktopCal |
| Operation: | write | Name: | InstallLocation |
Value: C:\Users\admin\AppData\Roaming\DesktopCal | |||
| (PID) Process: | (2728) desktopcal-setup-v2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\DesktopCal |
| Operation: | write | Name: | Publisher |
Value: DesktopCal | |||
| (PID) Process: | (2728) desktopcal-setup-v2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\DesktopCal |
| Operation: | write | Name: | HelpLink |
Value: http://rd.desktopcal.com/?id=1000&fp=client&cver=2.3.62.4721 | |||
| (PID) Process: | (2728) desktopcal-setup-v2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\DesktopCal |
| Operation: | write | Name: | DisplayVersion |
Value: 2.3.62.4721 | |||
| (PID) Process: | (2728) desktopcal-setup-v2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | DesktopCal |
Value: C:\Users\admin\AppData\Roaming\DesktopCal\desktopcal.exe | |||
| (PID) Process: | (352) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count |
| Operation: | write | Name: | P:\Hfref\nqzva\NccQngn\Ybpny\Grzc\qrfxgbcpny-frghc-i2.rkr |
Value: 0000000000000000000000003C8D0000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000 | |||
Executable files
27
Suspicious files
62
Text files
56
Unknown types
14
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkcuninstall.dll | executable | |
MD5:— | SHA256:— | |||
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkc_onlangbutton.png | image | |
MD5:D078A58CE933D4EFC88014BCFD9B47A7 | SHA256:F12BEB7C0709DDC541267F2962228593E1143946879EADB4DCD21C931DCBCD68 | |||
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkc_background.png | image | |
MD5:3290E10E1D9CEED213C8ADC67BE33118 | SHA256:29F1526AB6DE02DBE685D395826B9E705693B638F5C60763D6A138699440F70A | |||
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkc_bottom.png | image | |
MD5:A18FEBC34532BA13DED046BD86C4E77B | SHA256:87F2C76B25EF79F227731316491F30780BC8377C6565AD7B3DE85AF19F8E8893 | |||
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkc_bottom_complete.png | image | |
MD5:8F1E8403BEEB684CD798CB0B2DE480AE | SHA256:62358CA5450A51902222BC9888ADDFBDF7267C0C4AFB9B4C852A9EAFA58B84C2 | |||
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkc_onkeyuninstall_cancel.png | image | |
MD5:9850CD6E0A2A0BD62BB31296B8868719 | SHA256:0620BA0669B5756B8FCBDB01940CA6DF9ADC0727FB2604FA804072BE317A82FB | |||
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkc_progress_background.png | image | |
MD5:77DDC9798C74F5DEBEE958EADD592303 | SHA256:D92BC8A2123022539236E343E2B551BABDC878AD85B046EEA7C82BC379F72E9C | |||
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkc_onkeyfinish.png | image | |
MD5:507349B38FA5A9E65F63F9F5DA0AD7EE | SHA256:3A8B03E4B4E08DD16EB65E8BE544B7E6697CD8F32CB15D993BBA80599751454A | |||
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkc_onkeybutton.png | image | |
MD5:9C633CB36DE320FFEEE20C3982D8EAEF | SHA256:6C8A10E0808A787B83B86A3483218732324F82A48E06A7B1774E1F461FF734F4 | |||
| 2728 | desktopcal-setup-v2.exe | C:\Users\admin\AppData\Local\Temp\dkc_onseldirbutton.png | image | |
MD5:4F5C17D2A372CACAE60DC9C8F7282375 | SHA256:E1B713EED415DCE2020A56CA65235BF70B824781699AD75B5412E038167A9EA6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
4
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4088 | desktopcal.exe | GET | 200 | 47.75.152.183:80 | http://cc.service.desktopcal.com/api/days | US | text | 2.14 Kb | suspicious |
3804 | dkupdate.exe | GET | 200 | 47.75.152.183:80 | http://update.desktopcal.com/updateinfo.xml?debug=0&t=3816875&ver=2.3.62.4721&lang=usa&os=7&key=&tn= | US | xml | 330 b | suspicious |
4088 | desktopcal.exe | GET | 200 | 47.75.152.183:80 | http://install.desktopcal.com/desktopcal/2.3.62.4721/usa/7/?uid=C_0-D_QM00001-M_5254004A04AF-V_C4BA3647-T_F0_1578676265&login=0&vip=0&tn=&ec=0 | US | text | 4 b | suspicious |
4088 | desktopcal.exe | GET | 200 | 47.75.152.183:80 | http://update2.desktopcal.com/config?os=6.1&ver=2.3.62.4721&iev=8.0&dwb=iexplore.exe&lang=usa&uid=C_0-D_QM00001-M_5254004A04AF-V_C4BA3647-T_F0_1578676265&v=0&login=0&tn=&rcmd=&ec=0&t=3822656 | US | text | 1.66 Kb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3804 | dkupdate.exe | 47.75.152.183:80 | update.desktopcal.com | — | US | suspicious |
4088 | desktopcal.exe | 47.75.152.183:80 | update.desktopcal.com | — | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
update.desktopcal.com |
| suspicious |
install.desktopcal.com |
| suspicious |
cc.service.desktopcal.com |
| suspicious |
update2.desktopcal.com |
| suspicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4088 | desktopcal.exe | Potential Corporate Privacy Violation | ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System |
4088 | desktopcal.exe | Potential Corporate Privacy Violation | ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. |
4088 | desktopcal.exe | Potential Corporate Privacy Violation | ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System |
4088 | desktopcal.exe | Potential Corporate Privacy Violation | ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. |
4088 | desktopcal.exe | Potential Corporate Privacy Violation | ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System |