download: | /Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Spyware/butterflyondesktop.exe |
Full analysis: | https://app.any.run/tasks/f2787adb-1ab5-4f47-8ceb-9905cc3977cb |
Verdict: | Malicious activity |
Analysis date: | October 27, 2024, 15:49:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections |
MD5: | 1535AA21451192109B86BE9BCC7C4345 |
SHA1: | 1AF211C686C4D4BF0239ED6620358A19691CF88C |
SHA256: | 4641AF6A0071E11E13AD3B1CD950E01300542C2B9EFB6AE92FFECEDDE974A4A6 |
SSDEEP: | 49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ |
.exe | | | Inno Setup installer (77.7) |
---|---|---|
.exe | | | Win32 Executable Delphi generic (10) |
.dll | | | Win32 Dynamic Link Library (generic) (4.6) |
.exe | | | Win32 Executable (generic) (3.1) |
.exe | | | Win16/32 Executable Delphi generic (1.4) |
ProductVersion: | |
---|---|
ProductName: | Butterfly on Desktop |
LegalCopyright: | |
FileVersion: | |
FileDescription: | Butterfly on Desktop Setup |
CompanyName: | Drive Software Company |
Comments: | This installation was built with Inno Setup. |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 0.0.0.0 |
FileVersionNumber: | 0.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | 6 |
OSVersion: | 1 |
EntryPoint: | 0x9c40 |
UninitializedDataSize: | - |
InitializedDataSize: | 17920 |
CodeSize: | 37888 |
LinkerVersion: | 2.25 |
PEType: | PE32 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
TimeStamp: | 1992:06:19 22:22:17+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2380 | "C:\Users\admin\AppData\Local\Temp\butterflyondesktop.exe" | C:\Users\admin\AppData\Local\Temp\butterflyondesktop.exe | explorer.exe | ||||||||||||
User: admin Company: Drive Software Company Integrity Level: MEDIUM Description: Butterfly on Desktop Setup Exit code: 0 Version: Modules
| |||||||||||||||
3212 | "C:\Users\admin\AppData\Local\Temp\is-7EV8S.tmp\butterflyondesktop.tmp" /SL5="$270218,2719719,54272,C:\Users\admin\AppData\Local\Temp\butterflyondesktop.exe" | C:\Users\admin\AppData\Local\Temp\is-7EV8S.tmp\butterflyondesktop.tmp | — | butterflyondesktop.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
3700 | "C:\Users\admin\AppData\Local\Temp\butterflyondesktop.exe" /SPAWNWND=$1B01E2 /NOTIFYWND=$270218 | C:\Users\admin\AppData\Local\Temp\butterflyondesktop.exe | butterflyondesktop.tmp | ||||||||||||
User: admin Company: Drive Software Company Integrity Level: HIGH Description: Butterfly on Desktop Setup Exit code: 0 Version: Modules
| |||||||||||||||
2220 | "C:\Users\admin\AppData\Local\Temp\is-0SNV9.tmp\butterflyondesktop.tmp" /SL5="$1A01D0,2719719,54272,C:\Users\admin\AppData\Local\Temp\butterflyondesktop.exe" /SPAWNWND=$1B01E2 /NOTIFYWND=$270218 | C:\Users\admin\AppData\Local\Temp\is-0SNV9.tmp\butterflyondesktop.tmp | butterflyondesktop.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
3172 | "C:\Program Files\Butterfly on Desktop\ButterflyOnDesktop.exe" | C:\Program Files\Butterfly on Desktop\ButterflyOnDesktop.exe | butterflyondesktop.tmp | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
2728 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | butterflyondesktop.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
1920 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xdc,0x6e7ef598,0x6e7ef5a8,0x6e7ef5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
1572 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1212 --field-trial-handle=1328,i,6131305339807360035,16536885562011621540,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
2560 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1328,i,6131305339807360035,16536885562011621540,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
3504 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --enable-features=msMicrosoftRootStoreUsed --flag-switches-end --do-not-de-elevate http://freedesktopsoft.com/butterflyondesktoplike.html | C:\Program Files\Microsoft\Edge\Application\msedge.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
|
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | ButterflyOnDesktop |
Value: | |||
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1 |
Operation: | write | Name: | Inno Setup: Setup Version |
Value: 5.4.2 (a) | |||
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1 |
Operation: | write | Name: | Inno Setup: App Path |
Value: C:\Program Files\Butterfly on Desktop | |||
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1 |
Operation: | write | Name: | InstallLocation |
Value: C:\Program Files\Butterfly on Desktop\ | |||
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1 |
Operation: | write | Name: | Inno Setup: Icon Group |
Value: Butterfly on Desktop | |||
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1 |
Operation: | write | Name: | Inno Setup: User |
Value: admin | |||
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1 |
Operation: | write | Name: | Inno Setup: Selected Tasks |
Value: | |||
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1 |
Operation: | write | Name: | Inno Setup: Deselected Tasks |
Value: butterflyondesktop | |||
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1 |
Operation: | write | Name: | Inno Setup: Language |
Value: eng | |||
(PID) Process: | (2220) butterflyondesktop.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1 |
Operation: | write | Name: | DisplayName |
Value: Butterfly on Desktop 1.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1920 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma | binary | |
MD5:C612E96CBFAC63232FC2062E15600FB1 | SHA256:DB3C05D5EC0B6719A73E7F0BE84BCE9342772DA70567E7CE08CF6573480B38FF | |||
2220 | butterflyondesktop.tmp | C:\Users\admin\AppData\Local\Temp\is-UDC6M.tmp\_isetup\_RegDLL.tmp | executable | |
MD5:0EE914C6F0BB93996C75941E1AD629C6 | SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2 | |||
2380 | butterflyondesktop.exe | C:\Users\admin\AppData\Local\Temp\is-7EV8S.tmp\butterflyondesktop.tmp | executable | |
MD5:C765336F0DCF4EFDCC2101EED67CD30C | SHA256:C5177FDC6031728E10141745CD69EDBC91C92D14411A2DEC6E8E8CAA4F74AB28 | |||
2728 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat | binary | |
MD5:04971D41DD7153DBC85E5C69CB344FE2 | SHA256:CBA076CE5E11A5D183814B8F4DAC266FAFD9CFC9E94F4BE28600BF9B35134157 | |||
2220 | butterflyondesktop.tmp | C:\Program Files\Butterfly on Desktop\is-BADEQ.tmp | executable | |
MD5:81AAB57E0EF37DDFF02D0106CED6B91E | SHA256:A70F9E100DDDB177F68EE7339B327A20CD9289FAE09DCDCE3DBCBC3E86756287 | |||
2220 | butterflyondesktop.tmp | C:\Program Files\Butterfly on Desktop\license.txt | text | |
MD5:F68621DA9CCBE320AEBB5807C6F733CB | SHA256:0479A712A54ADA76EAF0BC5F3B57C764880D1540CBE266724D35C4DCBF40E4E2 | |||
2220 | butterflyondesktop.tmp | C:\Program Files\Butterfly on Desktop\ButterflyOnDesktop.exe | executable | |
MD5:81AAB57E0EF37DDFF02D0106CED6B91E | SHA256:A70F9E100DDDB177F68EE7339B327A20CD9289FAE09DCDCE3DBCBC3E86756287 | |||
2220 | butterflyondesktop.tmp | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Butterfly on Desktop\Uninstall Butterfly on Desktop.lnk | binary | |
MD5:49073509B46A8092D396064B801C80DD | SHA256:4E78337EE99314D7BD9C7B38D2EDBBE767F2EA79A512071816FD711E512B569F | |||
2220 | butterflyondesktop.tmp | C:\Program Files\Butterfly on Desktop\unins000.dat | binary | |
MD5:8B0CE96E9C99FBFEF96A3AFFABEDF9DA | SHA256:40A63D8BB5A9018F97B2C418836444E8AA9B5C9D233E0952D191D58FDB121281 | |||
2220 | butterflyondesktop.tmp | C:\Program Files\Butterfly on Desktop\is-AHAS7.tmp | text | |
MD5:F68621DA9CCBE320AEBB5807C6F733CB | SHA256:0479A712A54ADA76EAF0BC5F3B57C764880D1540CBE266724D35C4DCBF40E4E2 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2784 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/superman_likeus.gif | unknown | — | — | malicious |
2784 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/main.css | unknown | — | — | malicious |
— | — | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/menubackgroundside2.jpg | unknown | — | — | malicious |
2784 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/bodybackground.png | unknown | — | — | malicious |
2784 | msedge.exe | GET | — | 78.46.117.95:80 | http://freedesktopsoft.com/images/banner3.jpg | unknown | — | — | malicious |
2784 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/slider/slider.css | unknown | — | — | malicious |
— | — | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/superman_likeus.gif | unknown | — | — | malicious |
2784 | msedge.exe | GET | 200 | 142.250.181.238:80 | http://www.google-analytics.com/ga.js | unknown | — | — | whitelisted |
2784 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/superman1.png | unknown | — | — | malicious |
2784 | msedge.exe | GET | — | 142.250.181.238:80 | http://www.google-analytics.com/ga.js | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
2564 | svchost.exe | 239.255.255.250:3702 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2784 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3504 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2784 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2784 | msedge.exe | 78.46.117.95:80 | freedesktopsoft.com | Hetzner Online GmbH | DE | malicious |
2784 | msedge.exe | 157.240.0.6:443 | connect.facebook.net | — | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
freedesktopsoft.com |
| malicious |
pagead2.googlesyndication.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
connect.facebook.net |
| whitelisted |
googleads.g.doubleclick.net |
| whitelisted |
www.bing.com |
| whitelisted |
www.gstatic.com |
| whitelisted |