ad2593d3611bc077826cb32b3f06419b9e841552d32294f2b28a8d53df2a1e8c

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Size 4.2MB
Sample261113-lmamcss12m
SHA256 ad2593d3611bc077826cb32b3f06419b9e841552d32294f2b28a8d53df2a1e8c
MD5 782bcf3fe3a59c7bcb10aeaab0c9013b
SHA1 fa52f67a5eea889f80bfa61101a9f6813f3fb9cd
SHA512 cb7dae056a6da26416419b7beb72cf11d9e54b8a3b2a0fa7d2be6b0ad60bbbcaf16c257c16384c1c1cd81ecad32eeff6244b99ef4aceb875b5d6b3479e714a6b
SSDEEP 49152:x/09O1vS7+Ck8D1oF6Zr0OEK2DbdqoiPJ4yUnwykR56phwg8aSnUIA2lnus:x/d78qNbiPJjUn7PGBaxO0s
TLSH
T10916CE50FCDB10B5E607593118AB62BF2734AD094F35CAC7E6447B6DED73AE1093222A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1576	powershell.exe
5176	powershell.exe
3904	powershell.exe
1284	powershell.exe
5448	powershell.exe
5572	powershell.exe
1628	powershell.exe
1452	powershell.exe
1044	powershell.exe
5784	powershell.exe
3956	powershell.exe
4412	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1844	fleetdeck_agent_svc.exe
3160	fleetdeck_agent_svc.exe
4624	fleetdeck_agent_svc.exe
5316	fleetdeck_agent_svc.exe
1380	fleetdeck_agent.exe

Loads dropped DLL 3 IoCs

pid	Process
6140	MsiExec.exe
4556	MsiExec.exe
1380	fleetdeck_agent.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5304	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	msiexec.exe
File created	C:\Program Files (x86)\FleetDeck Agent\deployment.json	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\20261021023420\fd_agent.dll	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\latest.json	fleetdeck_agent_svc.exe
File opened for modification	C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	powershell.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t3r21dkh.ciu.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_maq5mjna.v1j.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_l3gxudiq.oew.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5d2ozt1q.rod.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{91D2B1CB-907C-4D2E-BA94-4205540E5C02}	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lt3z1wpp.ggy.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_odpezejp.iwx.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jxondl3b.edl.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fnhpdwui.e4y.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vpvp000n.vhl.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0glwjojk.inf.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hzdxkjpx.xor.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI812C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fsbwst2h.zgf.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_o1s2nr0d.abu.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DF386EACD07FB66CBF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wpe4kcia.t1t.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nxjzxtwc.jvl.ps1	powershell.exe
File created	C:\Windows\Installer\wix{91D2B1CB-907C-4D2E-BA94-4205540E5C02}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_yyrux5zo.r4u.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xfjltfhc.qcg.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zo3cpqgw.hag.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_dtjxuvzi.xmm.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI9989.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDA3FBAAA49FFAE28.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uerh0m0g.vdz.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pzqvphy1.tq3.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pwcyompf.5na.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_p23univ5.ppn.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3qq5wuaq.dqc.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2t4fbxzn.hj5.psm1	powershell.exe
File created	C:\Windows\Installer\{91D2B1CB-907C-4D2E-BA94-4205540E5C02}\fleetdeck.ico	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2bgorjfw.1xa.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ex1h5qoe.z11.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wmdaqyb2.blk.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_h5phdvok.h11.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3q5pzbps.mje.ps1	powershell.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_15z51i1w.lf0.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tww5gpu2.wk0.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI816C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_n1noo3v4.vya.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tsmkntyr.20u.ps1	powershell.exe
File created	C:\Windows\SystemTemp\~DFF94E591227BB142D.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\FleetDeck\fd_agent.log	fleetdeck_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_42iewml2.1ld.ps1	powershell.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t2smi2km.vyd.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\{91D2B1CB-907C-4D2E-BA94-4205540E5C02}\fleetdeck.ico	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nszzxlo3.b54.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_41rbsgd2.fil.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pczzmox1.r5f.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1z5r2s4z.yq5.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\e59799b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zgvxnv0e.g2i.psm1	powershell.exe
File created	C:\Windows\Installer\e59799f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFABF6D5668F9E00A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uo0seri1.uha.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1abetbsc.4gp.ps1	powershell.exe
File created	C:\Windows\Installer\e59799b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ejc130sg.r2s.psm1	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fleetdeck_agent_svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fleetdeck_agent_svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fleetdeck_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fleetdeck_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fleetdeck_agent_svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fleetdeck_agent_svc.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000094b15be3c89983180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380194b15be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410194b15be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e394b15be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e694b15be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\ProductName = "FleetDeck Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\ProductIcon = "C:\\Windows\\Installer\\{91D2B1CB-907C-4D2E-BA94-4205540E5C02}\\fleetdeck.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BC1B2D19C709E2D4AB49245045E0C520\MainApplication	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\PackageCode = "B16F86C0C2923DE428A798F83DF0E7A3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BC1B2D19C709E2D4AB49245045E0C520	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\PackageName = "719368892.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC\BC1B2D19C709E2D4AB49245045E0C520	msiexec.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
5304	msiexec.exe
5304	msiexec.exe
1844	fleetdeck_agent_svc.exe
1844	fleetdeck_agent_svc.exe
1576	powershell.exe
1576	powershell.exe
1576	powershell.exe
1844	fleetdeck_agent_svc.exe
1844	fleetdeck_agent_svc.exe
5176	powershell.exe
5176	powershell.exe
5176	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
3956	powershell.exe
3956	powershell.exe
3956	powershell.exe
5316	fleetdeck_agent_svc.exe
5316	fleetdeck_agent_svc.exe
5316	fleetdeck_agent_svc.exe
5316	fleetdeck_agent_svc.exe
3904	powershell.exe
3904	powershell.exe
3904	powershell.exe
5316	fleetdeck_agent_svc.exe
5316	fleetdeck_agent_svc.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
5448	powershell.exe
5448	powershell.exe
5448	powershell.exe
1452	powershell.exe
1452	powershell.exe
1452	powershell.exe
1044	powershell.exe
1044	powershell.exe
1044	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5784	powershell.exe
5784	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeIncreaseQuotaPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSecurityPrivilege	5304	msiexec.exe
Token: SeCreateTokenPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeAssignPrimaryTokenPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeLockMemoryPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeIncreaseQuotaPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeMachineAccountPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeTcbPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSecurityPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeTakeOwnershipPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeLoadDriverPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSystemProfilePrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSystemtimePrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeProfSingleProcessPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeIncBasePriorityPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeCreatePagefilePrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeCreatePermanentPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeBackupPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeRestorePrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeShutdownPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeDebugPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeAuditPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSystemEnvironmentPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeChangeNotifyPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeRemoteShutdownPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeUndockPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSyncAgentPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeEnableDelegationPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeManageVolumePrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeImpersonatePrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeCreateGlobalPrivilege	4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeBackupPrivilege	720	vssvc.exe
Token: SeRestorePrivilege	720	vssvc.exe
Token: SeAuditPrivilege	720	vssvc.exe
Token: SeBackupPrivilege	5304	msiexec.exe
Token: SeRestorePrivilege	5304	msiexec.exe
Token: SeRestorePrivilege	5304	msiexec.exe
Token: SeTakeOwnershipPrivilege	5304	msiexec.exe
Token: SeRestorePrivilege	5304	msiexec.exe
Token: SeTakeOwnershipPrivilege	5304	msiexec.exe
Token: SeRestorePrivilege	5304	msiexec.exe
Token: SeTakeOwnershipPrivilege	5304	msiexec.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1576	powershell.exe
Token: SeIncreaseQuotaPrivilege	1576	powershell.exe
Token: SeSecurityPrivilege	1576	powershell.exe
Token: SeTakeOwnershipPrivilege	1576	powershell.exe
Token: SeLoadDriverPrivilege	1576	powershell.exe
Token: SeBackupPrivilege	1576	powershell.exe
Token: SeRestorePrivilege	1576	powershell.exe
Token: SeShutdownPrivilege	1576	powershell.exe
Token: SeSystemEnvironmentPrivilege	1576	powershell.exe
Token: SeUndockPrivilege	1576	powershell.exe
Token: SeManageVolumePrivilege	1576	powershell.exe
Token: 31	1576	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	5176	powershell.exe
Token: SeIncreaseQuotaPrivilege	5176	powershell.exe
Token: SeSecurityPrivilege	5176	powershell.exe
Token: SeTakeOwnershipPrivilege	5176	powershell.exe
Token: SeLoadDriverPrivilege	5176	powershell.exe
Token: SeBackupPrivilege	5176	powershell.exe
Token: SeRestorePrivilege	5176	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
4536	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5304	msiexec.exe
6140	MsiExec.exe
4556	MsiExec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 2884	5304	msiexec.exe	94
PID 5304 wrote to memory of 6140	5304	msiexec.exe	96
PID 5304 wrote to memory of 1844	5304	msiexec.exe	97
PID 1844 wrote to memory of 1576	1844	fleetdeck_agent_svc.exe	98
PID 1844 wrote to memory of 5176	1844	fleetdeck_agent_svc.exe	101
PID 5304 wrote to memory of 4556	5304	msiexec.exe	103
PID 3160 wrote to memory of 1628	3160	fleetdeck_agent_svc.exe	105
PID 4624 wrote to memory of 3956	4624	fleetdeck_agent_svc.exe	108
PID 5316 wrote to memory of 4232	5316	fleetdeck_agent_svc.exe	112
PID 5316 wrote to memory of 3904	5316	fleetdeck_agent_svc.exe	114
PID 5316 wrote to memory of 1380	5316	fleetdeck_agent_svc.exe	116
PID 1380 wrote to memory of 4412	1380	fleetdeck_agent.exe	118
PID 1380 wrote to memory of 1284	1380	fleetdeck_agent.exe	120
PID 1380 wrote to memory of 5448	1380	fleetdeck_agent.exe	122
PID 1380 wrote to memory of 1452	1380	fleetdeck_agent.exe	124
PID 1380 wrote to memory of 1044	1380	fleetdeck_agent.exe	126
PID 1380 wrote to memory of 5572	1380	fleetdeck_agent.exe	128
PID 1380 wrote to memory of 5784	1380	fleetdeck_agent.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4536

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FB28C687A06E78B43617699866194723
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6140
- C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
  "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID cc3e17ff-3f97-4875-b32f-602d68808e59 -askForName=0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 157BF5CAFAE2C4642D540262390F7795 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1628

C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4232
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe
  "C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4412
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1284
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5448
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1452
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1044
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5572
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59799e.rbs

Path C:\Config.Msi\e59799e.rbs
Size 219KB
SHA256 f835447993470babc30c7f303adbce5bfd4700d4f8e33bf0969117d30e2acbbb
MD5 65a7b7a360bb30b96523e508142ab688
SHA1 cb4b3748603f439ef234275f2831bc6a004a5255
SHA512 2521d954513b5b774366ceeb527cc361a7534683837c469e308b678855b70c444bd245fd61c1af29486f7f13aa320ed99cfc73024e032917bdcdd10a5976b544
SSDEEP 3072:hJz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxab:ht/kE1jOZy2KL4GBiwQtEa4L2sW
TLSH
T1BE249D216190947EE7FA0A36993EDA31BF7DF2240760C99EC3848C1E5D644C06BB7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd_agent.dll

Path C:\Program Files (x86)\FleetDeck Agent\20261021023420\fd_agent.dll
Size 1.8MB
SHA256 4ce08a6bf859b188ace0cf5aa61fd0e455d0baf34215369e561dc5fc6c315aac
MD5 c3adda737beb39bf3fe721c80eb68e79
SHA1 7159a7214267d43aeba4a836718a99b242d5da31
SHA512 0825bb629c3dc433db6172028c868a72de64b4e8df9570c779766b455376ba6b0c256c98304e57aea34253f349c9f168940c9319fc266293756ede69745201fc
SSDEEP 49152:eBXKkqGgYq8vNX7kb9hDqJCZIV/hWuVphsy:eBXysqeTCZI5hWuV
TLSH
T17A858E22FC41C035F9EA20BAC6FDABBE59AC8520037806D357D518B99E605D3773D29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fleetdeck_agent.exe

Path C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe
Size 6.3MB
SHA256 08c5fc1cca98e77549f14d87abde0dda7a5d58076be6d88ceaaf26e3283b786d
MD5 57c20b15518c4498f31dddace020cbb1
SHA1 2fb038e48e33b04f6fb1309c1bc9a2f70d55a628
SHA512 cf20c8a4a3b1cd89cadc338d26aa2c6fbffb6988b15d73d00e9ab891c5af5c36cc80ef76fecf5db778383e3d737500958945731b176c24e473e8a667cfbdd3d2
SSDEEP 98304:Nl8YgLZng+nOMxdgiI+yy4UI6fXtkiv7PKT:sYgdgQxyh6koM
TLSH
T17E664A91F9DB40F5D903183044AB623F67306D0A8B35CFD7EA507F6AE9779E20A32619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fleetdeck_agent_svc.exe

Path C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe
Size 6.0MB
SHA256 ded6bd6efa372d340d9f8b827cff4a8f90ca069d86011bac7443dd9785f292bd
MD5 3715bf40e9519883fe72d1400c84d4a6
SHA1 537e0e150fe89ba5f5fe79efd19435fbaf45eacb
SHA512 f9f16def59a6f9a62535ac57ac1ea094fcc98b561b67786d2c49f3d35928c387219c7dea5c3c399a3ab6f15b026a7864e4a2797803ea11cd1cb1d7fd2f9ffb30
SSDEEP 49152:X5wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQW:X5wTWNupq+w67Y8ZQmBKYUWaMtTHZ
TLSH
T189562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deployment.json

Path C:\Program Files (x86)\FleetDeck Agent\deployment.json
Size 69B
SHA256 903e85458bc000bce8682f8490d858da8013af1a7af057f29f8b948da8d7b71a
MD5 886f390b6668b9e955d2d24077152009
SHA1 fe508be60808382d9fd3a4e0af3d93f0285da50b
SHA512 2db0d5713c1d54666ef07317d0adfd54ce8c5b23bb1dc0c551c43432a01f12c4d0c70278001b8304e31b6e1cb92b30f3e9e20c74b2c243384ef9277ba00a4bab
TLSH
T11BA022000B80AE8302000AAC2CBE2AA8AF03820803000CA0C8200C33822CCCA0CA2333
MD5 SHA1 SHA512 TLSH

Submit Download

fleetdeck_agent_svc.exe

Path C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
Size 6.0MB
SHA256 bd0285b480122f05ae85bae5edffa751095ddd216d05c04dafb204950b17c863
MD5 0468a819def38923bee96f1fead5710a
SHA1 230bdaf90995992f6a64ab39487446deb3fbd5a4
SHA512 0c84592a3040e67d94e8b69158b6f5373e0405db1008e96e64279affab85079df32994eb1f1918274720508854514ed6f26583ab82ce064794d9b708a1b181b7
SSDEEP 49152:o5wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQx:o5wTWNupq+w67Y8ZQmBKYUWaMtTHi
TLSH
T14C562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

latest.json

Path C:\Program Files (x86)\FleetDeck Agent\latest.json
Size 102B
SHA256 5660ebdc065d3a9fe7a4557daa71728a4b5b07980dd02e4b85812c2e2f7d9932
MD5 c0094d81a0987a052557ba8457358cc8
SHA1 e8a15b296be2bb76cd387543f129f6aef088dd86
SHA512 3a3fe7f7e8e08005a063cdd49a9894c92cb20f4dbbb7d7270cfbfeab248248d4c92c3e19b0d048ec1d828adfd638adfd79a0c6497b0802281b60ce67effc141a
TLSH
T16EB012F798147033CA74025014F412B05B042A890182A409F3C243C0DC0C7F3FD8346F
MD5 SHA1 SHA512 TLSH

Submit Download

719368892.msi

Path C:\Users\Admin\AppData\Local\Temp\719368892.msi
Size 2.3MB
SHA256 a70ce7c36d344cf5fdd62481c7fdc5067842923493d1d588422e4ac15314d218
MD5 80478c63395f3eb8e51d3b885c8e4405
SHA1 8a9b3621daaa82804a359729b72a1f18b7d8e91e
SHA512 63f0f047a6c2c9e42d83a3bd10134cb1e61e5502c0dd4572549502ef0dadcee897dc29e360e88529202475da4e5b3f163cf5e0851338c4d85d26c080353bdfd7
SSDEEP 49152:lF6Zr0OEK2DbdqoiPJ4yUnwykR56phwg8aSnUIA2:l8qNbiPJjUn7PGBaxO
TLSH
T1B7B52321B541403EDBBB0932E1BE8AB06E79FE340775C4698388B50E2D745D067B7BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI816C.tmp

Path C:\Windows\Installer\MSI816C.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ejc130sg.r2s.psm1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_ejc130sg.r2s.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

FleetDeck Agent Service.log

Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
Size 787B
SHA256 85fab70f16716cbce688c2c3d4f83b0a89d6c3e59374fa77703d1ed6d01d7e0e
MD5 ccd3ee540e6b25e2d7f6b00525111a70
SHA1 09a4b72037e5b7630a9aff2bcf61ce176af5e1f8
SHA512 46781410f7f765ec2cd0888a86ef9be3e6def865eff782b427839da2d575c7e51149cbd321d1521fb7fbd038585ac532577f370931f3930f59db03a2ac82d3a7
TLSH
T1BC0168AB41C3A4FDAB1B024048CA177397054311B70DFC0DB3C4E2CA68459EBC8690E7
MD5 SHA1 SHA512 TLSH

Submit Download

FleetDeck Agent Service.log

Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
Size 1KB
SHA256 3c49066dbb8e4ebbddc2105d1a2425cfb6b137891b78a7fe0c6d0a6e52f6ac00
MD5 336e14144c61593fe40d145ed249f936
SHA1 da42fba7c249445cfe583d5a6e4d54efc4b4434d
SHA512 169ba7d8978d66231e873d62482b9c931597da9ab18160bb83bb9c9ee9a0639ac8b52bf358450e309f499e88ae53c56fff1f5e4ce900a3b585b74eae1e779d1d
TLSH
T18631456641C3A5FEAB1A124088DA1BA3A7064221B74CF81DB3D4B1C76849DEBC4790D7
MD5 SHA1 SHA512 TLSH

Submit Download