eb1cc0a2e10d226b60ed925071650d00c5e6ba84b80f2028ed0a4b121b944f12

Reason

Machine shutdown

General

Target
Sepsis.vbs
Size 9.5MB
Sample260703-jdy79ads21
SHA256 eb1cc0a2e10d226b60ed925071650d00c5e6ba84b80f2028ed0a4b121b944f12
MD5 68a07a34a42bd3c72b9cc9426ea24a84
SHA1 6ab266f2d48589b48010d8348ad74edc083a8ce8
SHA512 0e90b6529e18a6e368c32680c70b53f6a3ee13c16bdb520befae9b97499c78ec7216f99753e49ecb5de79ce3602a27f49bfd06f09e65519b9e644907506fcb2e
SSDEEP 49152:Pwwnxq7xSXavO4ii5qL459GtTsPUgwymN/HmnJ8p/DOS82WK5IPyBo6B5GUJb8lV:q
TLSH
T12AA6F1395B0416CDB2A0838A605986C6DCB2CFFB8CB65A1865649C6FCD7EF0C77172D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\debugger = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\debugger = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\debugger = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4qF3s9L10lV = "C:\\Windows\\Fonts\\Sepsis\\autoexec.bat"	WScript.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\lock_screen\LockScreen___1024_0768_notdimmed.jpg	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\resources.zip.bin	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\resources.zip	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images	WScript.exe
File opened for modification	C:\Windows\System32\Sepsis\Resources\images\lock_screen	WScript.exe
File created	C:\Windows\System32\Sepsis\Resources\images\lock_screen\LockScreen___1024_0768_notdimmed.jpg	WScript.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Sepsis\Sepsis.vbs	WScript.exe
File created	C:\Windows\Fonts\Sepsis\reset.vbs	WScript.exe
File created	C:\Windows\Fonts\Sepsis\initialize.bat	WScript.exe
File created	C:\Windows\Fonts\Sepsis\autoexec.bat	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 696	5944	WScript.exe	89

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sepsis.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sepsis.vbs" /elevate
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Event Triggered Execution: Image File Execution Options Injection
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:696
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 0 /f
    3⤵
    PID:5184

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\Fonts\Sepsis\Sepsis.vbs"
1⤵
PID:3444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\Fonts\Sepsis\reset.vbs"
1⤵
PID:3068

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a31855 /state1:0x41c64e6d
1⤵
PID:3084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reset.vbs

Path C:\Windows\Fonts\Sepsis\reset.vbs
Size 103B
SHA256 7f26811e1f0212066d2f5d7e1ae74eec4e600040188f6ef311eadddbaa19660a
MD5 e281b7503fe8ecc209e8b3bbcd991aeb
SHA1 d370524aea3d2f3b2e0586e0a58529be00e9174b
SHA512 ae341a1ba7cd9203cd7c6d2a07f129843ed8bb6ba82f536a3331b0cfb90ae349f32a55ea4e01115414452babecf7efb33f15d7b831666d0f2821ad8fb7702981
TLSH
T14DB01220268DE0720145A2C27A93C01D8FBCC824F045DA5044D1E1891A5AE152B34C03
MD5 SHA1 SHA512 TLSH

Submit Download

user.bmp

Path C:\Windows\System32\Sepsis\Resources\pfps\user.bmp
Size 392KB
SHA256 f66d426e1d6d5b79bf75860847df62e2010829ff6959f50cdb36aac1272e91c7
MD5 2bdb31f5eb14cace97393d7a97f4eb4a
SHA1 79cb05d39105f7dd643366338c26fc982f41fd81
SHA512 51b1bc1cbed4ade62fa4248511be39a9cbac67401543b6e9265ca0dd254ba747c1ac4408b6e6c92ed7e9d19b3accf6450e85af3f008b27c16301467ff6a47cc9
SSDEEP 768:F6qPXhKCb3RpYHwf9/wMy4jExb7jEGj0xZGb:FdxKCb3RKHK/hy4jj
TLSH
T1EC8437537431071CE3EBF132AA65AF30E95763E1DBE3D186900D4EB899DC0E616CB692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.zip

Path C:\Windows\System32\Sepsis\Resources\resources.zip
Size 3.5MB
SHA256 3850ca2975e2a81b59ab73e176bbc81025c0fea9c6935b512ab34c0d6730c1b9
MD5 09a045ea3992a4383e89f711ddd5fa4f
SHA1 86f33b566ae4c413c205874211a4a75a7f0d793e
SHA512 6bd787b85a88846e5763735458d3ac2b0ab1e16cf8f099327bfb2427b5335b6852b3e848938468a341e5979b92c0ab2fca4b8cea9ae75d9430cdb8690d5d716a
SSDEEP 98304:gOtcS9ZlluMbazrwsTnDzBzoX9QykxB02zkd3r:gOCSnfwrwsZoSykxa2zkV
TLSH
T143063397A7DE20B1F76EB43B79772947ED868ACE82F31036714473A94E2B4965F0600C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-1327-0x0000000000A20000-0x0000000000A39000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads