Extracted

• • Target
    machforce.io_new.exe
  • Size 25KB
  • SHA256 341a91cf02c5dd4cb42e9143525185986493763cb619d6ac448e885277ea5cc4
  • MD5 9594769d1355bd20b5d0e42daba5f214
  • SHA1 6591b690e16c3b95b422a417fdfd58e412a1c893
  • SHA512 02d828c0376a3be6b7ed8354f4c044fce7d8f4c094a925f874f426166cc4eb7f6618bb7e68b0a1ff17ff4be8fe51201bd76e4e653e71fe190f3ed9bd0bdbb15a
  • SSDEEP 384:S+TshrmS6qtHcKv0sPg988zu+SD+dhwl4+FIGUx9UTGwN/8G+H+bz9yS5W5QYW:TIhftVv9PgLSmyIb9OV8zcByST
  • TLSH
    T119C2F74177FCC229E0FF5BB65D7257008775B84B8E16CA0D0EE9848E1E77B444AA4BE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2