Analysis date (UTC): 24 July 2020, 20:54Analysis environment: Windows 10 Pro, build 16299, x64

LetterofIntent-Eckharthelicopter.xls

MD5:6CB7256DDE8C6CF09FC82B7F75FD18AD

SHA1:9B5BB3F2FDA7A6E316A210942D0D65D1E877761D

SHA256:2CB072D9FCC9413A91B245513366C7BB52BFEC2638F67C158520C2854E264208

Analysis result

Threat level:Malicious activity

Tags:

macrosmacros-on-openloadertrojannetwirerat

Full analysis:Analysis LetterofIntent-Eckharthelicopter.xls (MD5: 6CB7256DDE8C6CF09FC82B7F75FD18AD) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Unusual execution from Microsoft Office

EXCEL.EXE (PID: 4580)

Executes PowerShell scripts

cmd.exe (PID: 72)

Application was dropped or rewritten from another process

solute.exe (PID: 2752)
solu.exe (PID: 1740)

Downloads executable files from the Internet

powershell.exe (PID: 1948)

Changes the autorun value in the registry

solu.exe (PID: 1740)

NETWIRE was detected

solu.exe (PID: 1740)

Connects to CnC server

solu.exe (PID: 1740)

Starts CMD.EXE for commands execution

EXCEL.EXE (PID: 4580)

SUSPICIOUS

Reads Environment values

powershell.exe (PID: 1948)

Executable content was dropped or overwritten

powershell.exe (PID: 1948)
solute.exe (PID: 2752)

Starts itself from another location

solute.exe (PID: 2752)

Creates files in the user directory

solute.exe (PID: 2752)

Reads the machine GUID from the registry

powershell.exe (PID: 1948)

INFO

Reads the machine GUID from the registry

EXCEL.EXE (PID: 4580)

Reads settings of System Certificates

EXCEL.EXE (PID: 4580)
powershell.exe (PID: 1948)

Reads Environment values

EXCEL.EXE (PID: 4580)

Reads the software policy settings

EXCEL.EXE (PID: 4580)
powershell.exe (PID: 1948)

Creates files in the user directory

EXCEL.EXE (PID: 4580)

Scans artifacts that could help determine the target

EXCEL.EXE (PID: 4580)

Reads Microsoft Office registry keys

EXCEL.EXE (PID: 4580)

Threats

PID	Process	Class	Message
1948	powershell.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
1948	powershell.exe	Potentially Bad Traffic	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1740	solu.exe	A Network Trojan was detected	MALWARE [PTsecurity] Netwire.RAT
1740	solu.exe	A Network Trojan was detected	MALWARE [PTsecurity] Netwire.RAT
1740	solu.exe	A Network Trojan was detected	MALWARE [PTsecurity] Netwire.RAT