7

Pretty interesting series of event unfolded. I had a newly installed Windows Image downloaded from Microsoft Dreamspark/Imagine. less 3 weeks old with some security restriction policy, gpos etc. Anyhow I started to notice that I saw Cortana and MS Calculator would appear to use a some TCP traffic. Which Cortana was obvous but the calculator?

So I scanned the machine with Windows Defender, Maleware Bytes Anti Exploit and Rootkit and a Viper Scan.... Nothing on the Calculator. I would see the calculator spawned as a schedule task as well.

Unnerving me. I scanned it with YARA it had signature of using HIjack Network, UDP and TCP sockets, Keylogger, Screenshots, an Audio Dropper, Privalage escalation signatures etc as I suspected.

I since than deleted all the Windows Apps. (which is also DOD STIG requirement)

Has anyone seen this behavior? Any thoughts or explainations? Why Did Malware Bytes and Microsoft fail to detect this as a virus? or exploit? I am almost assuming this is normal behavior?

enter image description here

|improve this question
  • 2
    Which version of Windows and Yara are we talking about? Are you sure, that the Yara scan is correct? I'm not a windows user myself but I read something about a new feature within the calculator: currency conversion. Is it possible, that the TCP you observed is just the calc app connecting to some some service to get the latest conversion rates? – Tom K. Aug 24 '17 at 15:28
  • I think you could be right about the conversion rates. that would make a lot of sense. I am using Windows 10 Educational, (beyond developers update so this would be the new calculator) and I myself didnt write the rules but got them from github.com/Yara-Rules/rules if you want to test it your self :) – Sam Arnold Aug 24 '17 at 15:43
  • I'll pass, thanks. ;) But maybe you can report this to the developers of Yara. – Tom K. Aug 24 '17 at 15:56
  • i thought windows calculator was named calc.exe, which i always Run...... – dandavis Aug 24 '17 at 21:15
  • @dandavis, I think calc.exe just provides a shortcut to the UWP Calculator.exe. Running calc.exe from a run prompt launches Calculator.exe. I'm not sure how that works, but it does. – MoonRunestar Aug 25 '17 at 14:15
13

The Calculator app has a currency conversion feature, which actually grabs conversion rates from the internet. As such this network traffic is normal.

Edit: To expand on this, Windows 10 has telemetry all over the place, but how much information is gathered depends on your privacy settings. If you're willing to read through an extremely detailed page about what is collected when the "Basic" privacy level setting is selected, this page by Microsoft should satisfy your needs. There is also this page by Microsoft that goes into the diagnostic data that is collected in version 1703 of Windows 10, which also includes information on how keyboard usage is collected.

|improve this answer
  • That would make a lot of sense. Should I dismiss the Keylogger and audio dropper signatures a false postive then? – Sam Arnold Aug 24 '17 at 15:46
  • It's most likely just related to telemetry, but whether they are used for anything really depends on Microsoft's intentions I guess. – MoonRunestar Aug 24 '17 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.