File name:

GoldenEye.exe

Full analysis: https://app.any.run/tasks/9bca75f4-163c-4c6a-8d3a-3739f3afa36d
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: September 23, 2024, 20:50:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
xor-url
generic
stealer
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E3B7D39BE5E821B59636D0FE7C2944CC

SHA1:

00479A97E415E9B6A5DFB5D04F5D9244BC8FBE88

SHA256:

389A7D395492C2DA6F8ABF5A8A7C49C3482F7844F77FE681808C71E961BCAE97

SSDEEP:

3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl5:i6nrD0ZMcPBAL7c0fTHs+2sYXg3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • logagent.exe (PID: 1632)

    • XORed URL has been found (YARA)

      • logagent.exe (PID: 1632)

    • Renames files like ransomware

      • logagent.exe (PID: 1632)

    • Steals credentials from Web Browsers

      • logagent.exe (PID: 1632)

    • Modifies files in the Chrome extension folder

      • logagent.exe (PID: 1632)

    • Runs injected code in another process

      • logagent.exe (PID: 1632)

    • Application was injected by another process

      • explorer.exe (PID: 1296)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • GoldenEye.exe (PID: 1420)
      • logagent.exe (PID: 1632)
      • dllhost.exe (PID: 3816)
      • logagent.exe (PID: 2704)

    • Process drops legitimate windows executable

      • GoldenEye.exe (PID: 1420)
      • logagent.exe (PID: 1632)
      • dllhost.exe (PID: 3816)
      • explorer.exe (PID: 1296)
      • logagent.exe (PID: 2704)

    • Reads browser cookies

      • logagent.exe (PID: 1632)

    • The process creates files with name similar to system file names

      • dllhost.exe (PID: 3816)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2016)
      • bthudtask.exe (PID: 3460)
      • bthudtask.exe (PID: 3452)
      • bthudtask.exe (PID: 1756)
      • bthudtask.exe (PID: 1608)
      • taskmgr.exe (PID: 3040)
      • bthudtask.exe (PID: 3780)
      • AdapterTroubleshooter.exe (PID: 1460)
      • slui.exe (PID: 2544)
      • bthudtask.exe (PID: 720)
      • AdapterTroubleshooter.exe (PID: 4040)

    • Reads the computer name

      • GoldenEye.exe (PID: 1420)
      • wmpnscfg.exe (PID: 2016)
      • logagent.exe (PID: 1632)

    • Checks supported languages

      • GoldenEye.exe (PID: 1420)
      • wmpnscfg.exe (PID: 2016)
      • logagent.exe (PID: 1632)
      • logagent.exe (PID: 2704)
      • logagent.exe (PID: 3216)
      • logagent.exe (PID: 3548)

    • Creates files or folders in the user directory

      • GoldenEye.exe (PID: 1420)

    • Reads the machine GUID from the registry

      • GoldenEye.exe (PID: 1420)
      • logagent.exe (PID: 1632)

    • Create files in a temporary directory

      • logagent.exe (PID: 1632)

    • The process uses the downloaded file

      • explorer.exe (PID: 1296)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:06:18 21:01:49+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 194560
InitializedDataSize: 75264
UninitializedDataSize: -
EntryPoint: 0xc424
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
83
Monitored processes
21
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start goldeneye.exe wmpnscfg.exe no specs #XOR-URL logagent.exe Copy/Move/Rename/Delete/Link Object bthudtask.exe no specs bthudtask.exe logagent.exe bthudtask.exe no specs taskmgr.exe no specs bthudtask.exe logagent.exe no specs logagent.exe no specs bthudtask.exe no specs slui.exe no specs logagent.exe no specs bthudtask.exe logagent.exe no specs adaptertroubleshooter.exe no specs adaptertroubleshooter.exe logagent.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Windows\System32\es-ES\bthudtask.exe" C:\Windows\System32\es-ES\bthudtask.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Bluetooth Uninstall Device Task
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
892C:\Users\admin\AppData\Roaming\{1dcd1446-e4ca-4a81-acdf-bc109172a777}\logagent.exeC:\Users\admin\AppData\Roaming\{1dcd1446-e4ca-4a81-acdf-bc109172a777}\logagent.exe—slui.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Logagent
Exit code:
0
Version:
12.0.7601.17514
1296C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1420"C:\Users\admin\AppData\Local\Temp\GoldenEye.exe" C:\Users\admin\AppData\Local\Temp\GoldenEye.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\goldeneye.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1460"C:\Windows\System32\et-EE\AdapterTroubleshooter.exe" C:\Windows\System32\et-EE\AdapterTroubleshooter.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Troubleshoot Display Adapter
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1476C:\Users\admin\AppData\Roaming\{1dcd1446-e4ca-4a81-acdf-bc109172a777}\logagent.exeC:\Users\admin\AppData\Roaming\{1dcd1446-e4ca-4a81-acdf-bc109172a777}\logagent.exe—AdapterTroubleshooter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Media Player Logagent
Version:
12.0.7601.17514
1608"C:\Windows\System32\el-GR\bthudtask.exe" C:\Windows\System32\el-GR\bthudtask.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Bluetooth Uninstall Device Task
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\el-gr\bthudtask.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
1632"C:\Users\admin\AppData\Roaming\{1dcd1446-e4ca-4a81-acdf-bc109172a777}\logagent.exe"C:\Users\admin\AppData\Roaming\{1dcd1446-e4ca-4a81-acdf-bc109172a777}\logagent.exe
GoldenEye.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Logagent
Exit code:
0
Version:
12.0.7601.17514
Modules
Images
c:\users\admin\appdata\roaming\{1dcd1446-e4ca-4a81-acdf-bc109172a777}\logagent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1756"C:\Windows\System32\appraiser\bthudtask.exe" C:\Windows\System32\appraiser\bthudtask.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Bluetooth Uninstall Device Task
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\appraiser\bthudtask.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
2016"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
14 753
Read events
14 752
Write events
1
Delete events
0

Modification events

(PID) Process:(1296) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000D32B4B24F1CD9E4CB8E80E4ECEAE08E300000000020000000000106600000001000020000000D5DBC12FEE38A2F1CF2E958B44E006ED6DC6511DB1FC0A4DE98AECB65BEE0DEB000000000E800000000200002000000063385C190D8C5DD005799CF19A05832EED294AAC1D8271B53CDD1747E8AEA27D300000003564274BF0A485840045DDA015BF2DC273226B522FBD0276E77A68D971B2B3F368ED59D8B0CA3BB96A01C35410FB11A8400000000C31F41E4C41EFDACCAE9630E9FB161013CC692DD9FA14C6E032707DB5AF089DE98DBD3273067D46C5061976BF9FDFEAA843F4D556B78E9C6030EE600E990554
Executable files
36
Suspicious files
1 297
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
1632logagent.exeC:\Users\admin\YOUR_FILES_ARE_ENCRYPTED.TXTtext
MD5:009F84A21C8C665723B32794E795FD5D
SHA256:7530792680D11F1678D46C15A141E83EEC847237B289C6B26E3AA3815F1CCFD3
1420GoldenEye.exeC:\Users\admin\AppData\Roaming\{1dcd1446-e4ca-4a81-acdf-bc109172a777}\RCXAB72.tmpexecutable
MD5:153A1A32CA5E7315BF3F0871BD2ECEF3
SHA256:BC3119856E473EE01EDE3F80DD37EF526F00DCC3351379A798EBD4B86B1E36FC
1632logagent.exeC:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXTtext
MD5:009F84A21C8C665723B32794E795FD5D
SHA256:7530792680D11F1678D46C15A141E83EEC847237B289C6B26E3AA3815F1CCFD3
1632logagent.exeC:\Users\admin\Pictures\orhere.jpgbinary
MD5:41951A45453C81C1AD2556C73CD42E9A
SHA256:5BAFD34C7976D0830C36FB46FC008BF8C46054DF5D30253969A3D5D1906092C2
1632logagent.exeC:\Users\admin\Pictures\orhere.jpg.oqbDAHC6binary
MD5:41951A45453C81C1AD2556C73CD42E9A
SHA256:5BAFD34C7976D0830C36FB46FC008BF8C46054DF5D30253969A3D5D1906092C2
1632logagent.exeC:\Users\admin\Pictures\secondpresent.jpg.oqbDAHC6binary
MD5:CAD8B48064E39E21CD4AFE2757B744CC
SHA256:68F1CFBD04D5C2144117983B9346F0F1E1165C1EAB0B8DC271189D68FF52D93D
1632logagent.exeC:\Users\admin\Documents\YOUR_FILES_ARE_ENCRYPTED.TXTtext
MD5:009F84A21C8C665723B32794E795FD5D
SHA256:7530792680D11F1678D46C15A141E83EEC847237B289C6B26E3AA3815F1CCFD3
1632logagent.exeC:\Users\admin\Pictures\sameusers.jpgbinary
MD5:F99906F347A062FEFA1DDAE1939A7FE2
SHA256:D690D356B686A977CED7010E451934D7340D5ADE1EA7F2DA723B382254A22951
1632logagent.exeC:\Users\admin\Pictures\secondpresent.jpgbinary
MD5:CAD8B48064E39E21CD4AFE2757B744CC
SHA256:68F1CFBD04D5C2144117983B9346F0F1E1165C1EAB0B8DC271189D68FF52D93D
1632logagent.exeC:\Users\admin\Pictures\qualitycanada.jpgbinary
MD5:DDC35F0495EBA221E55BD0CE521031F6
SHA256:2074CD37EF2CAFA438F85A39F56441F9709B5297BB0F70D7497E6DD3C7DB572F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:3702
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GoldenEye.exe