General
- Target https://github.com/TheDarkMythos/windows-malware/blob/master/MrsMajor%202.0/MrsMajor2.0.exe
- Sample240320-rg7b2aac37
Score
10/10
Malware Config
Targets
-
- Target https://github.com/TheDarkMythos/windows-malware/blob/master/MrsMajor%202.0/MrsMajor2.0.exe
Score10/10Modifies WinLogon for persistence
UAC bypass
Disables RegEdit via registry modification
Disables Task Manager via registry modification
Downloads MZ/PE file
Possible privilege escalation attempt
Executes dropped EXE
Modifies file permissions
Modifies system executable filetype association
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Drops file in System32 directory
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1