Extracted

• • Target
    Recourse Communications, Inc.xls
  • Size 150KB
  • SHA256 da8e7ac8e0b9e047af16e085a4f59b15ef044370a876bacef3a2b77a2aad609c
  • MD5 a86ed851b80e29705449704024f6e4a6
  • SHA1 60f6394404277112abbfd930369f0b287a535811
  • SHA512 c2cbfc11e09e8ab7802cedbd773d5c48118151c5a7364d30c6d9b642d8b4fc2569f71f7cefa7ed026400ccff13411b265cee234711ce20d6532711c8e8e230c3
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2