File name:

golden.exe

Full analysis: https://app.any.run/tasks/8d1ce413-a8bd-417d-b7fb-448c46a2ee92
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 21, 2024, 21:32:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E068EE33B5E9CB317C1AF7CECC1BACB5

SHA1:

EF3D2563FA3E29C1BE76A149FF91398AB9987775

SHA256:

B5EF16922E2C76B09EDD71471DD837E89811C5E658406A8495C1364D0D9DC690

SSDEEP:

3072:rTAjnioLO7WpLyLNZ45OlTZHiKb8ljJ3ijAviJcfM698RyOiy12KJ3I4YgTl5:r6nrD0ZvRcjcOiJ+98X2sYXg3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • golden.exe (PID: 116)
      • EOSNotify.exe (PID: 864)
      • EOSNotify.exe (PID: 2724)

    • Runs injected code in another process

      • EOSNotify.exe (PID: 864)
      • EOSNotify.exe (PID: 2724)

    • Creates a writable file in the system directory

      • dllhost.exe (PID: 2304)

    • Steals credentials from Web Browsers

      • EOSNotify.exe (PID: 864)

    • Renames files like ransomware

      • EOSNotify.exe (PID: 864)

    • Modifies files in the Chrome extension folder

      • EOSNotify.exe (PID: 864)

    • Application was injected by another process

      • explorer.exe (PID: 1164)

    • Actions looks like stealing of personal data

      • EOSNotify.exe (PID: 2724)
      • EOSNotify.exe (PID: 864)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • golden.exe (PID: 116)
      • EOSNotify.exe (PID: 864)
      • dllhost.exe (PID: 2304)
      • EOSNotify.exe (PID: 2724)

    • Process drops legitimate windows executable

      • golden.exe (PID: 116)
      • dllhost.exe (PID: 2304)
      • EOSNotify.exe (PID: 864)
      • EOSNotify.exe (PID: 2724)

    • Creates files like ransomware instruction

      • EOSNotify.exe (PID: 864)

    • The process creates files with name similar to system file names

      • dllhost.exe (PID: 2304)

    • Reads browser cookies

      • EOSNotify.exe (PID: 864)

  • INFO

    • Reads the machine GUID from the registry

      • golden.exe (PID: 116)
      • EOSNotify.exe (PID: 864)
      • EOSNotify.exe (PID: 2724)
      • EOSNotify.exe (PID: 2176)
      • EOSNotify.exe (PID: 2368)
      • EOSNotify.exe (PID: 3072)

    • Checks supported languages

      • golden.exe (PID: 116)
      • EOSNotify.exe (PID: 864)
      • EOSNotify.exe (PID: 2724)
      • EOSNotify.exe (PID: 2176)
      • EOSNotify.exe (PID: 1484)
      • EOSNotify.exe (PID: 3064)
      • EOSNotify.exe (PID: 2368)
      • EOSNotify.exe (PID: 3072)

    • Reads the computer name

      • golden.exe (PID: 116)
      • EOSNotify.exe (PID: 864)
      • EOSNotify.exe (PID: 2724)
      • EOSNotify.exe (PID: 2368)

    • Creates files or folders in the user directory

      • golden.exe (PID: 116)

    • Dropped object may contain TOR URL's

      • EOSNotify.exe (PID: 864)

    • Drops the executable file immediately after the start

      • dllhost.exe (PID: 2304)

    • Manual execution by a user

      • AdapterTroubleshooter.exe (PID: 980)
      • taskmgr.exe (PID: 876)
      • AdapterTroubleshooter.exe (PID: 2856)
      • AdapterTroubleshooter.exe (PID: 2372)
      • bthudtask.exe (PID: 2364)
      • taskmgr.exe (PID: 3076)
      • bthudtask.exe (PID: 2388)
      • AdapterTroubleshooter.exe (PID: 2112)
      • slui.exe (PID: 2888)

    • Create files in a temporary directory

      • EOSNotify.exe (PID: 864)
      • EOSNotify.exe (PID: 2724)

    • Checks transactions between databases Windows and Oracle

      • explorer.exe (PID: 1164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:06:18 23:01:49+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 194560
InitializedDataSize: 75264
UninitializedDataSize: -
EntryPoint: 0xc424
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
19
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject golden.exe eosnotify.exe Copy/Move/Rename/Delete/Link Object adaptertroubleshooter.exe no specs bthudtask.exe no specs taskmgr.exe no specs eosnotify.exe adaptertroubleshooter.exe no specs slui.exe no specs eosnotify.exe no specs adaptertroubleshooter.exe eosnotify.exe no specs adaptertroubleshooter.exe bthudtask.exe eosnotify.exe no specs eosnotify.exe no specs taskmgr.exe no specs eosnotify.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\Desktop\golden.exe" C:\Users\admin\Desktop\golden.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\golden.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
864"C:\Users\admin\AppData\Roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\EOSNotify.exe"C:\Users\admin\AppData\Roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\EOSNotify.exe
golden.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
EOS Notification
Exit code:
0
Version:
6.1.7601.24544 (win7sp1_ldr_escrow.191230-1647)
Modules
Images
c:\users\admin\appdata\roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\eosnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
876"C:\Windows\System32\com\taskmgr.exe" C:\Windows\System32\com\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\com\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
980"C:\Windows\System32\0409\AdapterTroubleshooter.exe" C:\Windows\System32\0409\AdapterTroubleshooter.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Troubleshoot Display Adapter
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\0409\adaptertroubleshooter.exe
c:\windows\system32\ntdll.dll
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1484C:\Users\admin\AppData\Roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\EOSNotify.exeC:\Users\admin\AppData\Roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\EOSNotify.exe—taskmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
EOS Notification
Exit code:
0
Version:
6.1.7601.24544 (win7sp1_ldr_escrow.191230-1647)
Modules
Images
c:\users\admin\appdata\roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\eosnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2112"C:\Windows\System32\catroot2\AdapterTroubleshooter.exe" C:\Windows\System32\catroot2\AdapterTroubleshooter.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Troubleshoot Display Adapter
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\catroot2\adaptertroubleshooter.exe
c:\windows\system32\ntdll.dll
2176C:\Users\admin\AppData\Roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\EOSNotify.exeC:\Users\admin\AppData\Roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\EOSNotify.exe—slui.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
EOS Notification
Exit code:
0
Version:
6.1.7601.24544 (win7sp1_ldr_escrow.191230-1647)
Modules
Images
c:\users\admin\appdata\roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\eosnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2304C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2364"C:\Windows\System32\cs-CZ\bthudtask.exe" C:\Windows\System32\cs-CZ\bthudtask.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Bluetooth Uninstall Device Task
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cs-cz\bthudtask.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
Total events
12 936
Read events
12 935
Write events
1
Delete events
0

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DBDD10622BD67741A42163F361389C4700000000020000000000106600000001000020000000714C0B985B0540658F4A2080B484A48FEA0193B4945278E76DEADC9EF300F178000000000E80000000020000200000002B477AD6A48910EDA2BF44A8E4FAAFB7E2EDF3EE6F87B8965B303D8016BD90EA30000000CB02147CAA96DADF9F5A3BD08AC8A954F632048A3EC443FAA534C64E43A96953CAB4A202A2BC0443ADBC5B693897DBB44000000078BCD17E1DCD91E99A86D38616C049FA8C5E2A7C07BB269B76B0709DC8A01ABF25866BF6638D5C4422D1151CE173748901F5A2433E1BD07914E254B07BB130FD
Executable files
39
Suspicious files
1 532
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
864EOSNotify.exeC:\Users\admin\Pictures\transportationoutdoor.jpgbinary
MD5:75085CF6D198B692F96901670353A1BC
SHA256:B01A2E0A6451977FE74A51654FFF0CFD611506E15274492A6044C2ABF5DFEC02
864EOSNotify.exeC:\Users\admin\Pictures\electronicssign.jpgbinary
MD5:248879CCEB319BD9C8290AA8B2641E53
SHA256:B42087153C7C04ADDF19162A7287698164FC613FB6833F402CB8B0F04E7EE1E9
116golden.exeC:\Users\admin\AppData\Roaming\{7cac1994-67a8-49b9-9723-db7f9a1783a6}\RCX858.tmpexecutable
MD5:ADEAD0AF52B02F152746F6847EB878C6
SHA256:6B7FC7233C534B5CA0B7C91A40DD056C9102A9E6C88100BB961E804CBEECF4B3
864EOSNotify.exeC:\Users\admin\Downloads\YOUR_FILES_ARE_ENCRYPTED.TXTtext
MD5:D82E1E74FF748E8B6D32698AC903A5EB
SHA256:2169626B369C52A9210BF1FB42C16B2DE00E00A549F9E441400FBB68D12E3358
864EOSNotify.exeC:\Users\admin\YOUR_FILES_ARE_ENCRYPTED.TXTtext
MD5:D82E1E74FF748E8B6D32698AC903A5EB
SHA256:2169626B369C52A9210BF1FB42C16B2DE00E00A549F9E441400FBB68D12E3358
864EOSNotify.exeC:\Users\admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.TXTtext
MD5:D82E1E74FF748E8B6D32698AC903A5EB
SHA256:2169626B369C52A9210BF1FB42C16B2DE00E00A549F9E441400FBB68D12E3358
864EOSNotify.exeC:\Users\admin\Pictures\transportationoutdoor.jpg.w7KVUTRxbinary
MD5:75085CF6D198B692F96901670353A1BC
SHA256:B01A2E0A6451977FE74A51654FFF0CFD611506E15274492A6044C2ABF5DFEC02
864EOSNotify.exeC:\Users\admin\Documents\YOUR_FILES_ARE_ENCRYPTED.TXTtext
MD5:D82E1E74FF748E8B6D32698AC903A5EB
SHA256:2169626B369C52A9210BF1FB42C16B2DE00E00A549F9E441400FBB68D12E3358
864EOSNotify.exeC:\Users\admin\Downloads\dictionaryarchitecture.jpg.w7KVUTRxbinary
MD5:1239685C2DCD22D906ADB7417495A106
SHA256:7CC80BFD223E017D1BE3FA11DF9F4DC749FF0ED74D91CE4F1FE7A6CC37EAC1CA
864EOSNotify.exeC:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXTtext
MD5:D82E1E74FF748E8B6D32698AC903A5EB
SHA256:2169626B369C52A9210BF1FB42C16B2DE00E00A549F9E441400FBB68D12E3358
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
golden.exe