b1df96263ccbda8a94a0f8e17a012ee6fb7baf11c9e6e4f39c3db33717fad54c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DocuSign58.vbs
Size 1KB
Sample260629-1ebxsagy6m
SHA256 b1df96263ccbda8a94a0f8e17a012ee6fb7baf11c9e6e4f39c3db33717fad54c
MD5 cd2e4592e34aa81ec3914c5eb1b5b5e1
SHA1 594cd126098b2d4d7ac9f403b471e41f98a29e30
SHA512 4ceda3e18ec4b6e98441b72cb7f39b5bf28afed2bc8e2b59f4ecaa99daf9541119bab181a5dfd73f811d485c6edc2975da689145be06468b6b2b149945432693
TLSH
T12331241F2D4BD270217D4A864F13F8ABE7A2406B5002C459BA8DD8541B3DD6A5BE51CF
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1852	WScript.exe
3	1852	WScript.exe
4	4468	wscript.exe
5	4468	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1496	powershell.exe
5740	powershell.exe
3192	powershell.exe
5948	powershell.exe
2664	powershell.exe
4296	powershell.exe
1224	powershell.exe
1220	powershell.exe
4452	powershell.exe
5704	powershell.exe
5212	powershell.exe
5824	powershell.exe
2192	powershell.exe
5800	powershell.exe
6016	powershell.exe
1208	powershell.exe
4148	powershell.exe
472	powershell.exe
1052	powershell.exe
4828	powershell.exe

Deletes itself 1 IoCs

pid	Process
1852	WScript.exe

Executes dropped EXE 5 IoCs

pid	Process
1444	fleetdeck_agent_svc.exe
3576	fleetdeck_agent_svc.exe
1988	fleetdeck_agent_svc.exe
3812	fleetdeck_agent_svc.exe
964	fleetdeck_agent.exe

Loads dropped DLL 3 IoCs

pid	Process
4724	MsiExec.exe
3888	MsiExec.exe
964	fleetdeck_agent.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.amazonaws.com
12	checkip.amazonaws.com

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FleetDeck Agent\credentials.json	fleetdeck_agent.exe
File created	C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	msiexec.exe
File created	C:\Program Files (x86)\FleetDeck Agent\deployment.json	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\20260223003825\fd_agent.dll	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\latest.json	fleetdeck_agent_svc.exe
File opened for modification	C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e590526.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F50AF01E-F174-4B1F-8AFA-1059A924993A}	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nukws0l1.i0a.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_53bjaimp.ewc.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_swdjqnxi.1mo.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_eu5mv5pn.u2m.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hlwbnov2.ccn.psm1	powershell.exe
File created	C:\Windows\Installer\wix{F50AF01E-F174-4B1F-8AFA-1059A924993A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_be0rziak.utq.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5qhh5tez.pgm.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5lfp4ja1.hce.ps1	powershell.exe
File created	C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_japl1s1q.ucj.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_de4szg3y.rh0.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xgwzw4ou.ucn.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2qxaaaek.pbp.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_y3tn3myx.jzw.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_h1irmr1k.uso.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_r10u23ab.v1o.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DFE63600D6B9601CCC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rqat2xjl.oai.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vf3mqh2g.ch5.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_i4ir1awl.wx3.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vklp0fuq.bmz.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_s2ptulaw.dcd.psm1	powershell.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\system-component.mst	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_53mkediu.dsv.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xycjesxb.zb3.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_x1cti32g.nva.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DFCF0B1E65AFD1A8C3.TMP	msiexec.exe
File created	C:\Windows\Installer\e590527.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\e590527.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hezvfqes.xwh.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wbavvuby.ctd.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0lbz401e.23v.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rrmscjtb.25b.ps1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\FleetDeck\fd_agent.log	fleetdeck_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_a4g2wi05.kvz.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fyn3tatk.ayx.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t22jnqp1.rqc.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2vmaacsv.jvg.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1qccs5d2.btx.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_u3sqyrkv.byg.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jgytjgnq.rsm.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rf5iqgd4.kiv.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_a4lf0bgz.zjl.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5azefzhq.fjg.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI1D06.tmp	msiexec.exe
File created	C:\Windows\Installer\e59052b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBA309FF6DEE819C6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_juxsg2bv.310.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qqehvt2z.5q2.ps1	powershell.exe
File created	C:\Windows\SystemTemp\~DFAC7BF9A8B83540A6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_12oabeo4.mzy.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4c4oticg.nnn.psm1	powershell.exe
File created	C:\Windows\Installer\e590526.msi	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jcwyizqs.b0c.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lcbxx4b0.cbi.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\system-component.mst	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3\MainApplication	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\PackageCode = "4396C18A14041E649AE5993E00E2B92F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Version = "16777216"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Transforms = "C:\\Windows\\Installer\\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\\system-component.mst"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductIcon = "C:\\Windows\\Installer\\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\\fleetdeck.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC\E10FA05F471FF1B4A8AF01959A4299A3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductName = "FleetDeck Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\PackageName = "system-component.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3824	msiexec.exe
3824	msiexec.exe
1444	fleetdeck_agent_svc.exe
1444	fleetdeck_agent_svc.exe
2192	powershell.exe
2192	powershell.exe
1444	fleetdeck_agent_svc.exe
1444	fleetdeck_agent_svc.exe
5800	powershell.exe
5800	powershell.exe
1052	powershell.exe
1052	powershell.exe
6016	powershell.exe
6016	powershell.exe
3812	fleetdeck_agent_svc.exe
3812	fleetdeck_agent_svc.exe
3812	fleetdeck_agent_svc.exe
3812	fleetdeck_agent_svc.exe
4828	powershell.exe
4828	powershell.exe
3812	fleetdeck_agent_svc.exe
3812	fleetdeck_agent_svc.exe
1224	powershell.exe
1224	powershell.exe
1220	powershell.exe
1220	powershell.exe
4452	powershell.exe
4452	powershell.exe
1496	powershell.exe
1496	powershell.exe
5740	powershell.exe
5740	powershell.exe
5704	powershell.exe
5704	powershell.exe
3192	powershell.exe
3192	powershell.exe
5948	powershell.exe
5948	powershell.exe
2664	powershell.exe
2664	powershell.exe
4296	powershell.exe
4296	powershell.exe
5212	powershell.exe
5212	powershell.exe
1208	powershell.exe
1208	powershell.exe
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe
5824	powershell.exe
5824	powershell.exe
472	powershell.exe
472	powershell.exe
472	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4864	msiexec.exe
Token: SeSecurityPrivilege	3824	msiexec.exe
Token: SeCreateTokenPrivilege	4864	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4864	msiexec.exe
Token: SeLockMemoryPrivilege	4864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4864	msiexec.exe
Token: SeMachineAccountPrivilege	4864	msiexec.exe
Token: SeTcbPrivilege	4864	msiexec.exe
Token: SeSecurityPrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeLoadDriverPrivilege	4864	msiexec.exe
Token: SeSystemProfilePrivilege	4864	msiexec.exe
Token: SeSystemtimePrivilege	4864	msiexec.exe
Token: SeProfSingleProcessPrivilege	4864	msiexec.exe
Token: SeIncBasePriorityPrivilege	4864	msiexec.exe
Token: SeCreatePagefilePrivilege	4864	msiexec.exe
Token: SeCreatePermanentPrivilege	4864	msiexec.exe
Token: SeBackupPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeShutdownPrivilege	4864	msiexec.exe
Token: SeDebugPrivilege	4864	msiexec.exe
Token: SeAuditPrivilege	4864	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4864	msiexec.exe
Token: SeChangeNotifyPrivilege	4864	msiexec.exe
Token: SeRemoteShutdownPrivilege	4864	msiexec.exe
Token: SeUndockPrivilege	4864	msiexec.exe
Token: SeSyncAgentPrivilege	4864	msiexec.exe
Token: SeEnableDelegationPrivilege	4864	msiexec.exe
Token: SeManageVolumePrivilege	4864	msiexec.exe
Token: SeImpersonatePrivilege	4864	msiexec.exe
Token: SeCreateGlobalPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	3824	msiexec.exe
Token: SeTakeOwnershipPrivilege	3824	msiexec.exe
Token: SeRestorePrivilege	3824	msiexec.exe
Token: SeTakeOwnershipPrivilege	3824	msiexec.exe
Token: SeRestorePrivilege	3824	msiexec.exe
Token: SeTakeOwnershipPrivilege	3824	msiexec.exe
Token: SeRestorePrivilege	3824	msiexec.exe
Token: SeTakeOwnershipPrivilege	3824	msiexec.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2192	powershell.exe
Token: SeIncreaseQuotaPrivilege	2192	powershell.exe
Token: SeSecurityPrivilege	2192	powershell.exe
Token: SeTakeOwnershipPrivilege	2192	powershell.exe
Token: SeLoadDriverPrivilege	2192	powershell.exe
Token: SeBackupPrivilege	2192	powershell.exe
Token: SeRestorePrivilege	2192	powershell.exe
Token: SeShutdownPrivilege	2192	powershell.exe
Token: SeSystemEnvironmentPrivilege	2192	powershell.exe
Token: SeUndockPrivilege	2192	powershell.exe
Token: SeManageVolumePrivilege	2192	powershell.exe
Token: 31	2192	powershell.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	5800	powershell.exe
Token: SeIncreaseQuotaPrivilege	5800	powershell.exe
Token: SeSecurityPrivilege	5800	powershell.exe
Token: SeTakeOwnershipPrivilege	5800	powershell.exe
Token: SeLoadDriverPrivilege	5800	powershell.exe
Token: SeBackupPrivilege	5800	powershell.exe
Token: SeRestorePrivilege	5800	powershell.exe
Token: SeShutdownPrivilege	5800	powershell.exe
Token: SeSystemEnvironmentPrivilege	5800	powershell.exe
Token: SeUndockPrivilege	5800	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4864	msiexec.exe
3824	msiexec.exe
4724	MsiExec.exe
3888	MsiExec.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 4468	1852	WScript.exe	87
PID 4468 wrote to memory of 4864	4468	wscript.exe	89
PID 3824 wrote to memory of 4724	3824	msiexec.exe	91
PID 3824 wrote to memory of 1444	3824	msiexec.exe	92
PID 1444 wrote to memory of 2192	1444	fleetdeck_agent_svc.exe	93
PID 1444 wrote to memory of 5800	1444	fleetdeck_agent_svc.exe	95
PID 3824 wrote to memory of 3888	3824	msiexec.exe	97
PID 3576 wrote to memory of 1052	3576	fleetdeck_agent_svc.exe	99
PID 1988 wrote to memory of 6016	1988	fleetdeck_agent_svc.exe	102
PID 3812 wrote to memory of 472	3812	fleetdeck_agent_svc.exe	105
PID 3812 wrote to memory of 4828	3812	fleetdeck_agent_svc.exe	107
PID 3812 wrote to memory of 964	3812	fleetdeck_agent_svc.exe	109
PID 964 wrote to memory of 1224	964	fleetdeck_agent.exe	111
PID 964 wrote to memory of 1220	964	fleetdeck_agent.exe	112
PID 964 wrote to memory of 4452	964	fleetdeck_agent.exe	113
PID 964 wrote to memory of 1496	964	fleetdeck_agent.exe	114
PID 964 wrote to memory of 5740	964	fleetdeck_agent.exe	115
PID 964 wrote to memory of 5704	964	fleetdeck_agent.exe	116
PID 964 wrote to memory of 3192	964	fleetdeck_agent.exe	117
PID 964 wrote to memory of 5948	964	fleetdeck_agent.exe	118
PID 964 wrote to memory of 2664	964	fleetdeck_agent.exe	119
PID 964 wrote to memory of 4296	964	fleetdeck_agent.exe	120
PID 964 wrote to memory of 5212	964	fleetdeck_agent.exe	121
PID 964 wrote to memory of 1208	964	fleetdeck_agent.exe	122
PID 964 wrote to memory of 4148	964	fleetdeck_agent.exe	126
PID 964 wrote to memory of 5824	964	fleetdeck_agent.exe	128
PID 964 wrote to memory of 472	964	fleetdeck_agent.exe	129

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DocuSign58.vbs"
1⤵
- Badlisted process makes network request
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Part3.vbs"
  2⤵
  - Badlisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\system-component.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\system-component.mst" /qn /norestart /log "C:\Users\Admin\AppData\Local\Temp\InstallComponent_log.txt"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4864

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 017B8705CB5B3DEE57B079B6BC8E6004
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4724
- C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
  "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID 41bf7faa-f7aa-4485-bff0-c04ffb8c5fa7 -askForName=0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ACBEEE420CBA2E68CA8EAF3BB82941CD E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3888

C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1052

C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:6016

C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service
  2⤵
  - System Location Discovery: System Language Discovery
  PID:472
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe
  "C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Domain))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1224
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Status))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1220
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Manufacturer))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4452
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Model))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1496
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Get-WmiObject win32_physicalmemory | select -expandproperty Capacity | Measure-Object -Sum | select -expandproperty Sum"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5740
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Caption))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5704
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Version))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3192
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_bios | select -expandproperty SerialNumber))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5948
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "([WMI] '').ConvertToDateTime((Get-WmiObject win32_operatingsystem | select -expandproperty LastBootUpTime)).ToUniversalTime().ToString('o')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2664
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_videocontroller | select -expandproperty Name)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4296
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_processor | select -expandproperty Name)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5212
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).NdisMedium | Select-Object -First 1 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1208
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).MacAddress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4148
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty OSArchitecture))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:5824
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " function Test-PendingFileRename { [OutputType('bool')] [CmdletBinding()] param() $operations = (Get-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\').GetValue('PendingFileRenameOperations') if ($null -eq $operations) { $false } else { $trueOperationsCount = $operations.Length / 2 $trueRenames = [System.Collections.Generic.Dictionary[string, string]]::new($trueOperationsCount) for ($i = 0; $i -ne $trueOperationsCount; $i++) { $operationSource = $operations[$i * 2] $operationDestination = $operations[$i * 2 + 1] if ($operationDestination.Length -eq 0) { } else { $trueRenames[$operationSource] = $operationDestination } } $trueRenames.Count -gt 0 } } if (Get-ChildItem \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending\" -EA Ignore) { return 1 } if (Get-Item \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\" -EA Ignore) { return 1 } if (Test-PendingFileRename) { return 1 } try { $util = [wmiclass]\"\\.\root\ccm\clientsdk:CCM_ClientUtilities\" $status = $util.DetermineIfRebootPending() if(($status -ne $null) -and $status.RebootPending){ return 1 } }catch{} return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59052a.rbs

Path C:\Config.Msi\e59052a.rbs
Size 219KB
SHA256 c51816c04ee4d426b816e6d9491c1df9deacefdd8dfeed41acbaa9f8928f1e98
MD5 6727713de2085c237c4094c2102c2cf4
SHA1 75c37af355930d622d3e1e6130fd1d7f45660a04
SHA512 7f82a3d2d2ebafeb1fc1f0ac0c6b57eb811f684042616c5da0623386c35ef878192f82b13d1a84e53d3afd3ea92d663973d8b54cba468a5321f0a5c3e45a9059
SSDEEP 3072:FJz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaq:Ft/kE1jOZy2KL4GBiwQtEa4L2sf
TLSH
T1D8249E216090847EEBFA0A35993ED671BF7DF2241760C99EC3848C1E5DA44C06BB7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd_agent.dll

Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fd_agent.dll
Size 1.8MB
SHA256 a075919c65120a8a92d3a11895ea456ccbee501717ddb17b29578c029f0c0051
MD5 39b34a26dc09ffa1b2923d5cdd473eb5
SHA1 a706ee87242c0597fae398eafdeaf0d9ac940903
SHA512 930409f08616ae33b3534ad580c349160f77a8b8ea0e077debfae420888855138730ea284377b7b3fca878644d7b2bce7de2dfef0d5b2354a5cab5ae439ae7c3
SSDEEP 49152:WhX2UquWo4tPAmyI0wxJ1hbL9gghWGE1hKk:WhX+K4iEbL9LhWGU
TLSH
T10D858D22FC41C035F9EA10BAC2FDAEBE98AC8520037806D757D518B69E615D3773D29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fleetdeck_agent.exe

Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe
Size 6.3MB
SHA256 7ae8daaa4639ea38723ea77b67ce22e5312e8ac7dd20c016c41b2a88432ba989
MD5 e3fb748bfdcaecd85775077589aab08e
SHA1 a491e836d76989d343627f12e6c2669fd38b03e2
SHA512 503aaeb6631ff6fab157d48ca83c50ca44eac075f9ece9e9574be44c1d6176ee1c4f92388fdf54067120f9dbda725174e5f82df05c0891eb1fcf03f8f44e8398
SSDEEP 98304:El8YgLZng+nOMxdgiI+yy4UI6fXmkiv7PK9:vYgdgQxyhNkou
TLSH
T19C664B91F9DB40F5D903183044AB623F67306D0A8B35CFD7EA507F6AE9779E20A32619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fleetdeck_agent_svc.exe

Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe
Size 6.0MB
SHA256 d07d47dbfe061158592097c738528a808eddb1d05d02459b4fb5d01cde4a735d
MD5 78bec61d72609ad32b5c92b12b5acdf8
SHA1 88375de8357133ceaef024a32247d8cc5ae7fa07
SHA512 ba2de1335cd28a4e80a12217e5f074001f3371a5a23f65fb93ed7e7bfe6240637822fd0c32074dbb35ba7f59ded91e441455ecf46b76eefa2b36cdff7947318c
SSDEEP 49152:N5wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQ4:N5wTWNupq+w67Y8ZQmBKYUWaBtTHk
TLSH
T16B562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deployment.json

Path C:\Program Files (x86)\FleetDeck Agent\deployment.json
Size 69B
SHA256 660bf1a85fd8cbdec3e8f972c7b73b493b7bcb32c363ffbe0dd82926c269529a
MD5 93f1778104f77bda759a8d437dd7342c
SHA1 fc57bef35c7701feb92c0f4a8e26b75b220d719d
SHA512 0485781e39c927e90db1f01e95935382a2d551f38952d4f2970d1ad9b4691bf217f0cd7aae32bfbcc46f3a70fd7ca5bdb94661404429d3a31c491ed4b605c7d0
TLSH
T1C6A0220338802C030C2B00CC3EC00BA8022F030833B888FCC0000B32AE2EE028C2E330
MD5 SHA1 SHA512 TLSH

Submit Download

fleetdeck_agent_svc.exe

Path C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
Size 6.0MB
SHA256 f7d793f458450f8da205887757af84967848fd42c8be78dfcd00524e6cf2ab65
MD5 2854313d8826aab27a90611b85ef3671
SHA1 6bcda85950590ced34406062000ffb1bf36b58e4
SHA512 3ec36105f398f36cbeae2cb3ab5949e4d408c1b2417ce8fb2f9c88c99f72822fb96011849a61db28991fd91ebd5bc0e2c2ca681ebe9672d70b4bda91d1610d7a
SSDEEP 49152:85wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQy:85wTWNupq+w67Y8ZQmBKYUWaBtTH2
TLSH
T1AB562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

latest.json

Path C:\Program Files (x86)\FleetDeck Agent\latest.json
Size 102B
SHA256 564623c3fd47db24a7cdc9e4e31cdeb7ff0d42d2de527fcd1f2dc7b4b3ab017c
MD5 9f75b0938a972c6fa01dff8e83d4fa59
SHA1 6685900a7fa4f2ec4e050eebc550859e317d93e7
SHA512 7eb8a43c317123ffe128ba31db9787c45aac9541764f4ae2bab8e8f76b5f16ea6d0eb815de57533c7f3d78eb3fc42642b2dc996927350269678f985e614e5c61
TLSH
T1A4B012F20C963073C27201D014F450B852038AAB4182680DF1824300E88C2BAF48327F
MD5 SHA1 SHA512 TLSH

Submit Download

InstallComponent_log.txt

Path C:\Users\Admin\AppData\Local\Temp\InstallComponent_log.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Part3.vbs

Path C:\Users\Admin\AppData\Local\Temp\Part3.vbs
Size 4KB
SHA256 729c61c70f7cc192fddd718e69475b5f0a17a53b20b70f339077f924c5b9cbfa
MD5 09f068b4d0ae9777cc2d2772a2c330c6
SHA1 c62dc33341c009784ecd40763bff1895dd235f19
SHA512 768c986c67bcf3fe58694edac081a11db006cc1af3c8b90e6930c03acb155a6879894da63ad4ef785bb8bcdf35eba6a1587f1b4c5202e369a340fe8e55c19b31
SSDEEP 96:0nAbYHgPwGAxUbMqNUSQtgOVdqCaIqral8kAw1j1PtRyRwnXn2nqnDMn+amAWPtC:0A8HgqDqN+fVcCqrXMRbZRc
TLSH
T18691633BB701C13450B31563F351A81EEAF6D10B3511B019B6CC885BA736DADE5B0AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system-component.msi

Path C:\Users\Admin\AppData\Local\Temp\system-component.msi
Size 2.3MB
SHA256 0eb3b3136035ed9b30c1071cdbb69db06a871e04feda8a9cfe8e13ee82aa4d4b
MD5 64de8b74901084b6c96a4a47fc97d564
SHA1 8012fe251350dbb961070d6e84036b1bca6e13c5
SHA512 7512e03df8359c9cfccc096aa77dba17fd453f35c4a8ec2169ccae25c1441622a3f28c707b1f7b22d146ab4b2ece707bf4824656f931568299141085bb3cc1e2
SSDEEP 49152:3+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA2:ELaeoi+0QFfXp4O
TLSH
T119B523213548917DC7FA0D31952FEF62BE38FE180E20C56A93807A5E2D715906B77BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system-component.mst

Path C:\Users\Admin\AppData\Local\Temp\system-component.mst
Size 20KB
SHA256 8efd1b85af6bb2797b534e8af66eb30956f91926c9e1fe1592ad610fd5c8c16b
MD5 bcbc9a62b6c1f77905304cf6267bbe23
SHA1 1bf6d3a62a79ab3075d862101eb13172b0ec425d
SHA512 e43458c7b8f80084e588e0860dc5a27b09909b3ab43bc8b4d1a7b667cc08732867a65ec4c747be4b12adb2aba9d26432503d48f1bfa8dd74114d5591b3ac7c6a
SSDEEP 24:JKpHAv5oWlut9qm8OgjU7nfMaJPSKjHiHJf:8pHKGum81U7dJar
TLSH
T1DC928981BBB4C956D8180B384E82CACD1332FC80DEA1525B78D2B36FAD725902A06221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI74A.tmp

Path C:\Windows\Installer\MSI74A.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jcwyizqs.b0c.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_jcwyizqs.b0c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

FleetDeck Agent Service.log

Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
Size 947B
SHA256 a3533905d17881d485eb4194d5ccec9c3c66f9f5fa94778a54883b4ad8550930
MD5 d98eaf84fedd08e8c34638e67ff453d3
SHA1 0429807f19189df61d3a2ba40afa8576291d1a5b
SHA512 1daf564c9d16f34120afa5f1938f9349642222f8c1b9b576f561c5fbdc3b489881da7c6109e616f18dd04075a81aaedcb54c5eafe1f6a37d0d65b766d93a3c15
TLSH
T12C11C042C5C172FE99160383EBA732B157125D99B78FD40CB34021835785FA9CB790F6
MD5 SHA1 SHA512 TLSH

Submit Download

FleetDeck Agent Service.log

Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
Size 1KB
SHA256 915593afa89a545e78e0ec8e545cb0829fed00978bcd3a541c877bee2e237157
MD5 33e3fa352faa0bcc82cc55a6861d61ef
SHA1 1fe25bd73063a211af513dfd3595e3260314d518
SHA512 f51fb99176aae04b8f633eaccde6bd91bb636f36e25b7573288f98ebbc7d0b9d909c0e2c9d860e0a25a2000d58ad5d708288b11821462ddd2d2aa994ad5c2b4e
TLSH
T15C21AB02C5C1B3FE9A120243FF9336B123164D9A779EE40CB34021835788EA9DA790F7
MD5 SHA1 SHA512 TLSH

Submit Download