Analysis
-
max time kernel
584s -
max time network
577s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 16:42
Static task
static1
Behavioral task
behavioral1
Sample
MrsMajor 3.0.7z
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
MrsMajor 3.0.7z
Resource
win10v2004-20231215-en
General
-
Target
MrsMajor 3.0.7z
-
Size
234KB
-
MD5
fedb45ddbd72fc70a81c789763038d81
-
SHA1
f1ed20c626d0a7ca2808ed768e7d7b319bc4c84a
-
SHA256
eacd5ed86a8ddd368a1089c7b97b791258e3eeb89c76c6da829b58d469f654b2
-
SHA512
813c0367f3aeceea9be02ffad4bfa8092ea44b428e68db8f3f33e45e4e5e53599d985fa79a708679b6957cbd04d9b9d67b288137fa71ac5a59e917b8792c8298
-
SSDEEP
6144:HMMAgnxjSgdHCueEVIzAMAcqXvYEC86TFSQ:HagxjSg1xrIzAMAcuI5TFT
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7zFM.exesvchost.exedescription pid process Token: SeRestorePrivilege 2716 7zFM.exe Token: 35 2716 7zFM.exe Token: SeManageVolumePrivilege 4196 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
7zFM.exepid process 2716 7zFM.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 3672 wrote to memory of 2716 3672 cmd.exe 7zFM.exe PID 3672 wrote to memory of 2716 3672 cmd.exe 7zFM.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\MrsMajor 3.0.7z"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MrsMajor 3.0.7z"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfmFilesize
16KB
MD5e865fc1b75a0e6a3c9f97746cd95bacd
SHA1f7c31d382fba3056d9a36777d563b7fd08050ae3
SHA25615da004bec6c91612db9bec2cc91bc157087470a480482bbd6f5947e53b8535f
SHA51276b6b4e913b81c71185132a21a59e2fa051ccd6e6716b9afc4971acd292c53d73d6003cc411bdc0c7e89f244dfe93e30726f033daac12adb6ae8752c53c030fd
-
memory/4196-40-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB
-
memory/4196-33-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB
-
memory/4196-42-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB
-
memory/4196-34-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB
-
memory/4196-35-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB
-
memory/4196-36-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB
-
memory/4196-37-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB
-
memory/4196-38-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB
-
memory/4196-43-0x0000024CB6EB0000-0x0000024CB6EB1000-memory.dmpFilesize
4KB
-
memory/4196-0-0x0000024CAEB70000-0x0000024CAEB80000-memory.dmpFilesize
64KB
-
memory/4196-68-0x0000024CB7100000-0x0000024CB7101000-memory.dmpFilesize
4KB
-
memory/4196-32-0x0000024CB7260000-0x0000024CB7261000-memory.dmpFilesize
4KB
-
memory/4196-39-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB
-
memory/4196-44-0x0000024CB6EA0000-0x0000024CB6EA1000-memory.dmpFilesize
4KB
-
memory/4196-46-0x0000024CB6EB0000-0x0000024CB6EB1000-memory.dmpFilesize
4KB
-
memory/4196-49-0x0000024CB6EA0000-0x0000024CB6EA1000-memory.dmpFilesize
4KB
-
memory/4196-52-0x0000024CB6DE0000-0x0000024CB6DE1000-memory.dmpFilesize
4KB
-
memory/4196-16-0x0000024CAEC70000-0x0000024CAEC80000-memory.dmpFilesize
64KB
-
memory/4196-64-0x0000024CB6FE0000-0x0000024CB6FE1000-memory.dmpFilesize
4KB
-
memory/4196-66-0x0000024CB6FF0000-0x0000024CB6FF1000-memory.dmpFilesize
4KB
-
memory/4196-67-0x0000024CB6FF0000-0x0000024CB6FF1000-memory.dmpFilesize
4KB
-
memory/4196-41-0x0000024CB7290000-0x0000024CB7291000-memory.dmpFilesize
4KB