286599e4f82056e1865527f7d3d0e66ee413ceb6e6c4464bb2f9c4d717fce748

Analysis

max time kernel
16s
max time network
21s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Sepsis.vbs
Size 9.5MB
Sample260506-xmmsgagx8s
SHA256 286599e4f82056e1865527f7d3d0e66ee413ceb6e6c4464bb2f9c4d717fce748
MD5 b79a38330d60e6fe66cc3686174a7871
SHA1 cd5a170fd08606f0c3752de05b1eb9e2d73c58f6
SHA512 107b3b1272ac1716ecf3f07b6595013e6d6d2178964f7a40d329c35a7b449863746be10b0678b91bb6de8d22f04cc5c1fd33d14d92fd4817fa29dea9b996d34f
SSDEEP 49152:Nwwnxq7xSXavO4ii5qL459GtTsPUgwymN/HmnJ8p/DOS82WK5IPyBo6B5GUJb8lV:s
TLSH
T167A6F1395B0416CDB2A0838A605986C6DCB2CFFB8CB65A1865649C6FCD7EF0C77172D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\debugger = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\debugger = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\debugger = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vh6uj0CrrcL = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Sepsis\Resources\images	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img1.jpg	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img10.jpg	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\resources.zip.bin	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\lock_screen\LockScreen___1024_0768_notdimmed.jpg	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img1.jpg	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img10.jpg	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img11.jpg	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img11.jpg	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\resources.zip	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\lock_screen	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\images\lock_screen\LockScreen___1024_0768_notdimmed.jpg	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img0.jpg	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img0.jpg	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img12.jpg	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\images\lock_screen\LockScreen___1920_1080_notdimmed.jpg	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\lock_screen\LockScreen___1920_1080_notdimmed.jpg	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\septic_wallpapers\img12.jpg	WScript.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Sepsis\Sepsis.vbs	WScript.exe
File opened for modification	C:\Windows\Fonts\Sepsis\Sepsis.vbs	WScript.exe
File created	C:\Windows\Fonts\Sepsis\reset.vbs	WScript.exe
File created	C:\Windows\Fonts\Sepsis\initialize.bat	WScript.exe
File created	C:\Windows\Fonts\Sepsis\autoexec.bat	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4896	2036	WScript.exe	80

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sepsis.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sepsis.vbs" /elevate
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Event Triggered Execution: Image File Execution Options Injection
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:4896
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 0 /f
    3⤵
    PID:232

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\Fonts\Sepsis\Sepsis.vbs"
1⤵
PID:3596

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\Fonts\Sepsis\reset.vbs"
1⤵
PID:1344

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2b055 /state1:0x41c64e6d
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sepsis.vbs

Path C:\Windows\Fonts\Sepsis\Sepsis.vbs
Size 9.5MB
SHA256 286599e4f82056e1865527f7d3d0e66ee413ceb6e6c4464bb2f9c4d717fce748
MD5 b79a38330d60e6fe66cc3686174a7871
SHA1 cd5a170fd08606f0c3752de05b1eb9e2d73c58f6
SHA512 107b3b1272ac1716ecf3f07b6595013e6d6d2178964f7a40d329c35a7b449863746be10b0678b91bb6de8d22f04cc5c1fd33d14d92fd4817fa29dea9b996d34f
SSDEEP 49152:Nwwnxq7xSXavO4ii5qL459GtTsPUgwymN/HmnJ8p/DOS82WK5IPyBo6B5GUJb8lV:s
TLSH
T167A6F1395B0416CDB2A0838A605986C6DCB2CFFB8CB65A1865649C6FCD7EF0C77172D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reset.vbs

Path C:\Windows\Fonts\Sepsis\reset.vbs
Size 103B
SHA256 7f26811e1f0212066d2f5d7e1ae74eec4e600040188f6ef311eadddbaa19660a
MD5 e281b7503fe8ecc209e8b3bbcd991aeb
SHA1 d370524aea3d2f3b2e0586e0a58529be00e9174b
SHA512 ae341a1ba7cd9203cd7c6d2a07f129843ed8bb6ba82f536a3331b0cfb90ae349f32a55ea4e01115414452babecf7efb33f15d7b831666d0f2821ad8fb7702981
TLSH
T14DB01220268DE0720145A2C27A93C01D8FBCC824F045DA5044D1E1891A5AE152B34C03
MD5 SHA1 SHA512 TLSH

Submit Download

user.bmp

Path C:\Windows\System32\Sepsis\Resources\pfps\user.bmp
Size 392KB
SHA256 f66d426e1d6d5b79bf75860847df62e2010829ff6959f50cdb36aac1272e91c7
MD5 2bdb31f5eb14cace97393d7a97f4eb4a
SHA1 79cb05d39105f7dd643366338c26fc982f41fd81
SHA512 51b1bc1cbed4ade62fa4248511be39a9cbac67401543b6e9265ca0dd254ba747c1ac4408b6e6c92ed7e9d19b3accf6450e85af3f008b27c16301467ff6a47cc9
SSDEEP 768:F6qPXhKCb3RpYHwf9/wMy4jExb7jEGj0xZGb:FdxKCb3RKHK/hy4jj
TLSH
T1EC8437537431071CE3EBF132AA65AF30E95763E1DBE3D186900D4EB899DC0E616CB692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.zip

Path C:\Windows\System32\Sepsis\Resources\resources.zip
Size 3.5MB
SHA256 3850ca2975e2a81b59ab73e176bbc81025c0fea9c6935b512ab34c0d6730c1b9
MD5 09a045ea3992a4383e89f711ddd5fa4f
SHA1 86f33b566ae4c413c205874211a4a75a7f0d793e
SHA512 6bd787b85a88846e5763735458d3ac2b0ab1e16cf8f099327bfb2427b5335b6852b3e848938468a341e5979b92c0ab2fca4b8cea9ae75d9430cdb8690d5d716a
SSDEEP 98304:gOtcS9ZlluMbazrwsTnDzBzoX9QykxB02zkd3r:gOCSnfwrwsZoSykxa2zkV
TLSH
T143063397A7DE20B1F76EB43B79772947ED868ACE82F31036714473A94E2B4965F0600C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-981-0x000001DA72FD0000-0x000001DA72FDC000-memory.dmp

Download

memory/2036-0-0x000001B646C80000-0x000001B646C8C000-memory.dmp

Download

memory/2036-1-0x000001B649030000-0x000001B64911A000-memory.dmp

Download

memory/3596-990-0x000001E3E1D10000-0x000001E3E1D1C000-memory.dmp

Download

memory/4896-2-0x000001FDFE760000-0x000001FDFE76C000-memory.dmp

Download

memory/4896-982-0x00000000007C0000-0x00000000007D9000-memory.dmp

Download

memory/4896-989-0x000001FD8C590000-0x000001FD8C67A000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads