730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a

Analysis

max time kernel
30s
max time network
52s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/02/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
The-MALWARE-Repo-master/Trojan/MrsMajors/BossDaMajor/BossDaMajor.exe
Size 1.9MB
Sample260222-cdtt7sb16e
SHA256 730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a
MD5 38ff71c1dee2a9add67f1edb1a30ff8c
SHA1 10f0defd98d4e5096fbeb321b28d6559e44d66db
SHA512 8347782951f2647fe433482cb13186653afa32ee9f5be83a138c4ed47ff34d8de66a26e74b5a28ea21c1529b2078401922a9a26803772677b70489967c10f3e9
SSDEEP 49152:veG3J7FtM9SbJakTiTBMGSARaspyyx979PSxgKFdGlYU:2GZxSoJrTiTBMGtRa8t7EFddU
TLSH
T1E0952336F7697951D14202B148A26BA0AA304C36E7205CDB7AE57B0FFC722FD563326C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\mrsmajor\\Launcher.vbs\""	wscript.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	wscript.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1"	wscript.exe

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	BossDaMajor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\mrsmajor\def_resource\creepysound.mp3	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\Skullcur.cur	wscript.exe
File created	C:\Program Files\mrsmajor\CPUUsage.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\default.txt	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\f11.mp4	wscript.exe
File created	C:\Program Files\mrsmajor\DreS_X.bat	wscript.exe
File created	C:\Program Files\mrsmajor\Launcher.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\MrsMjrGuiLauncher.bat	wscript.exe
File created	C:\Program Files\mrsmajor\reStart.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\WinLogon.bat	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\@Tile@@.jpg	wscript.exe
File created	C:\Program Files\mrsmajor\MrsMjrGui.exe	wscript.exe
File created	C:\Program Files\mrsmajor\Doll_patch.xml	wscript.exe
File created	C:\Program Files\mrsmajor\Icon_resource\SkullIco.ico	wscript.exe
File created	C:\Program Files\mrsmajor\mrsmajorlauncher.vbs	wscript.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
5300	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BossDaMajor.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\Cursors	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "93"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2605425648-1229640847-2920638550-1000\{C31A799D-7D5E-4CF9-83F1-78C9C56A67AD}	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4704	unregmp2.exe
Token: SeCreatePagefilePrivilege	4704	unregmp2.exe
Token: SeShutdownPrivilege	992	wmplayer.exe
Token: SeCreatePagefilePrivilege	992	wmplayer.exe
Token: SeShutdownPrivilege	992	wmplayer.exe
Token: SeCreatePagefilePrivilege	992	wmplayer.exe
Token: SeShutdownPrivilege	3820	shutdown.exe
Token: SeRemoteShutdownPrivilege	3820	shutdown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
992	wmplayer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4064	LogonUI.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 4996	5400	BossDaMajor.exe	88
PID 4996 wrote to memory of 4316	4996	wscript.exe	90
PID 4996 wrote to memory of 5300	4996	wscript.exe	92
PID 5300 wrote to memory of 992	5300	wscript.exe	93
PID 992 wrote to memory of 6100	992	wmplayer.exe	94
PID 6100 wrote to memory of 4704	6100	unregmp2.exe	95
PID 5300 wrote to memory of 3820	5300	wscript.exe	101

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\BossDaMajor\BossDaMajor.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\BossDaMajor\BossDaMajor.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\433E.tmp\433F.vbs
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:4316
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Program files\mrsmajor\mrsmajorlauncher.vbs" RunAsAdministrator
    3⤵
    - Modifies WinLogon for persistence
    - Modifies Windows Defender DisableAntiSpyware settings
    - UAC bypass
    - Disables RegEdit via registry modification
    - Checks computer location settings
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Access Token Manipulation: Create Process with Token
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5300
  - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" "C:\Program Files\mrsmajor\def_resource\f11.mp4"
      4⤵
      Drops desktop.ini file(s)
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:992
    - - C:\Windows\SysWOW64\unregmp2.exe
        
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6100
      - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        6⤵
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
  - - C:\Windows\System32\shutdown.exe
      "C:\Windows\System32\shutdown.exe" -r -t 03
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5664

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39dc855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 0e580344217d851c4a130f4dbe0bc998eb22a7fa538c4e45d9b7f503f89a2fee
MD5 4c164f050e80ec7292343b2ce0ee7e58
SHA1 d7cd3f189bbe45c0a01f58ebd91ab1cbf029493b
SHA512 fdd21a088fc360ab993c1d8db2b9e2376ca9f9c0dcc828078bbd0624b8efc8dae5afdb712d6ca18defe9a704612a77a6fe43ce91776c4c2956dc5491f20a3fb2
SSDEEP 3:l3xallkltlsl7pl+e/lls4XplsMlNllsI1Xlldl0lcNklltlwzl4hR/mll:VY+1E3+e9XplskGI10cAe
TLSH
T1FB539204E3649562C80883B7B8EA0B43B331F0690A1EEB1BA02964381C423D92CB0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 00afba86fa0aa2939580faff6a94a81a9d86e3e024b23e26777a76b32201a3c6
MD5 ddd661eeb73ca639877681378166ae75
SHA1 a07f4ebd08ee1824fef207e7b9ed1fb34f70f7f5
SHA512 04f2baf342998ef721a7bc60e29a7921cbee2e1e08913a7564ff28e882aa0230b93b4ad968726898e5dd914d350f37dc871d5f2ae645c1ecbc799358c5402b94
SSDEEP 768:a0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:0ZP2tFP3vqY88qEM6TaBacg
TLSH
T199257437D190B0C5CE2CB171E9ED8F09BA23A10B12A052465FF8957E7A533D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 6ecb7a07a4dec42ed1973f5ffb3e21fb62058a321f646bd2dbf8f7074f949694
MD5 6f23c7d79fc14b7ccb00878900214b6f
SHA1 7b659c5f7ecfd0215044ba70b9305fdbab1f559c
SHA512 7a5e50bfb8d1e163efe06eca7ae0dddc4a771c74ad513c49dfefdf8f00fe571ca1e8f93924b677edef65c80a8e61d741c474008c8da2e0911e63d122f39ae981
SSDEEP 96:M19KY2MG5lt4NXtZUMUstp7XtKUMbsttUMlst+OXtDL2tALXtQtHAtJtP:GcY46ninonq
TLSH
T18063E73023E4664AF7FBAF7069F655176F7A78915E35D24C0210528D2D72F1AED30B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

433F.vbs

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\433F.vbs
Size 1007B
SHA256 8a74eead47657582c84209eb4cdba545404d9c67dd288c605515a86e06de0aad
MD5 5706bc5d518069a3b2be5e6fac51b12f
SHA1 d7361f3623ecf05e63bb97cc9da8d5c50401575c
SHA512 fb68727db0365ab10c5b0d5e5e1d44b95aa38806e33b0af3280abcefae83f30eb8252653e158ac941320f3b38507649cce41898c8511223ee8642339cfece047
TLSH
T18711E1819982CB7D22D5F0D10E80E8A8D6E149643C79DC74355DD246E3117EC6EBA798
MD5 SHA1 SHA512 TLSH

Submit Download

CPUUsage.vbs

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\CPUUsage.vbs
Size 92B
SHA256 28e69e90466034ce392e84db2bde3ad43ad556d12609e3860f92016641b2a738
MD5 0e4c01bf30b13c953f8f76db4a7e857d
SHA1 b8ddbc05adcf890b55d82a9f00922376c1a22696
SHA512 5e66e2793e7bc88066b8df3dccb554351287dea18207e280b69d7798ecd5cdc99bd4c126c3e394db9f45f54bb561e6688f928de4f638c5eca4f101dc2cea54a1
TLSH
T15DB0045D0DC3C07F171014010C51CCC051407014D043CC1C715CD7401015140050554D
MD5 SHA1 SHA512 TLSH

Submit Download

DreS_X.bat

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\DreS_X.bat
Size 360B
SHA256 2590879a8cd745dbbe7ad66a548f31375ccfb0f8090d56b5e4bd5909573ac816
MD5 ba81d7fa0662e8ee3780c5becc355a14
SHA1 0bd3d86116f431a43d02894337af084caf2b4de1
SHA512 0b768995187f988dc15d055f9689cee3ab3908d10b05a625b40d9757c101e067bbd6067ccbcf1951ebb683f5259eec562802ea6161d59475ce86cf6bc7c957f2
TLSH
T127E0F7438803A00AD9982AE0C3DE0384F88BC0B38C7081A2A4473030B8A128DC23FFDF
MD5 SHA1 SHA512 TLSH

Submit Download

SkullIco.ico

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\Icon_resource\SkullIco.ico
Size 244KB
SHA256 4c1cfbe274f993941ac5fa512c376b6d7344800fb8be08cc6344e6c16a418311
MD5 c7bf05d7cb3535f7485606cf5b5987fe
SHA1 9d480d6f1e3f17d5018c1d2f4ae257ae983f0bb5
SHA512 d30952a75d94dd64b7bd253ed72810690f3550f2262cfaaef45854fc8334f6201a8cbafb9b175c6435f7ce0499567f2fa8667b4b0046bfb651bf61eb4278e6c8
SSDEEP 6144:8jFsHu2sS3g5Cwqv1iR2opIRvmO9YIA6qZEbr//o25u1:8juHnt3gXq9iR2op19GTgQI
TLSH
T1983401733B3BFD85D0220B7101A1E9956CA47C3BAD0585B3B8C4376FB678665AC83A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.vbs

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\Launcher.vbs
Size 590B
SHA256 6f0bb8cc239af15c9215867d6225c8ff344052aaa0deeb3452dbf463b8c46529
MD5 b5a1c9ae4c2ae863ac3f6a019f556a22
SHA1 9ae506e04b4b7394796d5c5640b8ba9eba71a4a6
SHA512 a644c48562e38190720fb55a6c6e7d5ccfab60f362236fe7d63caebdc01758f17196d123fb37bd11f7e247ce8ab21812165b27496d3bd6ca5e2c5efefab8fb03
TLSH
T155F0C90D9A87C708235CE0C10A84EC08CAB08E48FC24A9B17F4AC311D4183B82EBA68D
MD5 SHA1 SHA512 TLSH

Submit Download

MrsMjrGui.exe

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\MrsMjrGui.exe
Size 71KB
SHA256 087fca40e079746b9c1dfaf777d3994c0321ea8f69d08238cdfc02fb109add1d
MD5 450f49426b4519ecaac8cd04814c03a4
SHA1 063ee81f46d56544a5c217ffab69ee949eaa6f45
SHA512 0cae15d863120f4edc6b6dabfe2f0f3d2e028057025d7d5ffe615cde8144f29bdaf099850e91e101e95d13f8a83cb1410a06172dda25a5f92967abcbc8453cbc
SSDEEP 1536:M1GJbcJVksz/mYyXki6GHcSVp5l/eq/mh78EZuMdUQL+ZZN24W6yos1:M4I/mYyX16rSVvl/zCQXMdUQLK211
TLSH
T10163E024F260C775C86947301852E1B217B2EE098E95AE2C55DCFD1FBEB360406EB3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MrsMjrGuiLauncher.bat

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\MrsMjrGuiLauncher.bat
Size 98B
SHA256 47e6c9f62ffc41fbc555f8644ad099a96573c8c023797127f78b1a952ca1b963
MD5 c7146f88f4184c6ee5dcf7a62846aa23
SHA1 215adb85d81cc4130154e73a2ab76c6e0f6f2ff3
SHA512 3b30fa1334b88af3e3382813d316104e3698173bb159c20ff3468cf3494ecfbbc32a9ae78b4919ecd47c05d506435af4a7ccee0576c0d0018a81fbd1b2dfcf10
TLSH
T1CEB00214C701C2AA3013A1C44391BC11110158C87E2C88661388524756C5554522EE54
MD5 SHA1 SHA512 TLSH

Submit Download

WinLogon.bat

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\WinLogon.bat
Size 117B
SHA256 2798dad008f62aace1841edfb43146147a9cade388c419c96da788fcaa2f76bc
MD5 870bce376c1b71365390a9e9aefb9a33
SHA1 176fdbdb8e5795fb5fddc81b2b4e1d9677779786
SHA512 f17c9898f81387daf42c9b858f507889919474ac2a17f96fc6d4606be94327e0b941b23a3ccc3f4af92b8abc0522e94745616da0564cdef1c3f20ee17ee31f53
TLSH
T180B092048F89D551B01630809321B550832164E4271B94B353DAE30B6183EEE8726F98
MD5 SHA1 SHA512 TLSH

Submit Download

@Tile@@.jpg

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\def_resource\@Tile@@.jpg
Size 7KB
SHA256 064f135fcc026a574552f42901b51052345f4b0f122edd7acd5f2dcc023160a5
MD5 3e21bcf0d1e7f39d8b8ec2c940489ca2
SHA1 fa6879a984d70241557bb0abb849f175ace2fd78
SHA512 5577e20f76d6b1cccc513392532a09bdc6dcd3a8a177b8035dc5d7eb082e0093436068f92059e301c5987e6122c4d9aff3e5ae9cc94ccc1ecc9951e2785b0922
SSDEEP 96:hpOepyZ0P7cFODBssO+BPSXc5TQzjeExzOmWD3VJsLWsctzLxDf6j:jAWNsiKXc5czjerB7/Ds6hf6j
TLSH
T1FCF17D8BDE765A85F79B40B6D81614652F78B3D2E70084BC8EE07FC785A6D1BA408146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Skullcur.cur

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\def_resource\Skullcur.cur
Size 3KB
SHA256 d2b6db8b28112da51e34972dec513278a56783d24b8b5408f11997e9e67d422b
MD5 cea57c3a54a04118f1db9db8b38ea17a
SHA1 112d0f8913ff205776b975f54639c5c34ce43987
SHA512 561860907fa2f53c7853094299758232a70c0cd22c6df3534abd094c6970f28792c6c334a33b129d661a46930d90fd8c98f11cb34f3e277cf20a355b792f64f0
TLSH
T15D61F12DB93C85C8F854917B4A0FA9F9C4602DE8B80511F3705B7B3FC4B967607AB91A
MD5 SHA1 SHA512 TLSH

Submit Download

creepysound.mp3

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\def_resource\creepysound.mp3
Size 1.2MB
SHA256 79e9a3611494b5ffafaa79788ba7e11dd218e3800c40b56684ccc0c33ab64eac
MD5 4a9b1d8a8fe8a75c81ddba3e411ddc5d
SHA1 e40cb1ee4490f6d7520902e12222446a8efbf9a8
SHA512 e7a28acb04ca33d57efe0474bb67d6d4b8ceff9198198b81574c76c835d5df05d113fc468f4a4434580b1b58189f38184c376976604dc05d1424af1721995601
SSDEEP 24576:b5G8vkaM33De+S10cJaJ9AaYiWsbFTWJXpgfS2fr1aspyyIYfTO:HtM9SbJakTiTBMGSARaspyyxa
TLSH
T1EF452374C36D381AF04759F3A9F01394A9360CB592A66CCE0DF7AF1B48659FDA273224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f11.mp4

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\def_resource\f11.mp4
Size 227KB
SHA256 a9b0f1f849e0b41924f5e80b0c4948e63fc4b4f335bbdf0f997b03a3aff55424
MD5 17042b9e5fc04a571311cd484f17b9eb
SHA1 585d91c69c3f9e3d2e8cb8cf984871d89cc4adbb
SHA512 709076c6cef8dd61701c93e1fe331d2b1a218498b833db10ee4d2be0816e3444aeebfa092ab1bd10322617cf3385414e8fdb76fd90f25b44ac24d38937b4d47f
SSDEEP 6144:e9JCN13fXdGjZdst2r99/MxTW6RGS2AVQ9safl/ppFxfBw:5VG6k9OjRGS24qsaN/pFBw
TLSH
T1903412BDFFFA6F60CE144A30CA571E9935139CC837313E975C43AA19793A28329986D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.txt

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\default.txt
Size 266B
SHA256 e1ebbd3abfcaddf7d6960708f3ccd8eda64c944723f0905ff76551c692b94210
MD5 30cfd8bb946a7e889090fb148ea6f501
SHA1 c49dbc93f0f17ff65faf3b313562c655ef3f9753
SHA512 8e7d98e6d0c05d199114d2d6ab8da886aed68de690c4d79643868eaf051c229fff94c88d937adb3da5e31fe48116613cf79dd00dda30f296746ce0a8aded9fe2
TLSH
T101D0125E6553C229371450D3CDAECC1DD1B09900EC31B98039C5D384C1103B41DA98DE
MD5 SHA1 SHA512 TLSH

Submit Download

mrsmajorlauncher.vbs

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\mrsmajorlauncher.vbs
Size 3KB
SHA256 4d3aa3ecd16a6ba46a9d6c0bdacdcd9dce70d93585941a94e544696e3e6f7d92
MD5 e3fdf285b14fb588f674ebfc2134200c
SHA1 30fba2298b6e1fade4b5f9c8c80f7f1ea07de811
SHA512 9b0bfbb07c77d9e9979a6c0f88b0a93010133f7dd3cf01e1de5dfbe812a5ed920e916d16d6a32fe21b9ee4b5425e61a616ded1aeeb35a410d4f77c0f9392ed0a
TLSH
T1E5710F4CA963CA3FD3F2718106DA9F06A779A538F2A14D7A709CE34085E33DC54A59CE
MD5 SHA1 SHA512 TLSH

Submit Download

reStart.vbs

Path C:\Users\Admin\AppData\Local\Temp\433E.tmp\mrsmajor\reStart.vbs
Size 638B
SHA256 2cbd8bc239c5cfc3ef02f8472d867dff61e5aed9fde8a3823cda28cc37d77722
MD5 0851e8d791f618daa5b72d40e0c8e32b
SHA1 80bea0443dc4cc508e846fefdb9de6c44ad8ff91
SHA512 57a9d1d75dbbab842060b29f01958f7e6b27d0175ff9a3f7b97e423c1b4e3fae94547a569c2e5c88224fc5dcc785f5a1d49c61199a8c7b3afeb4fc520600df40
TLSH
T125F0EB0E1A8FC30D5B8EE1A10A98DD19D2614A4CFC30D971BA46C30480083BD5FAA5EE
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 fdf6809f8e7310731d14db5de6e2a1ad57a6b7c40303a4fe28aa298bbd7967bd
MD5 3a6aef3a4d9ff37c4ef0e2ac368a7748
SHA1 81a1e934bd88d39b6d03b9c2f9fa2c50d3523032
SHA512 da02080ab88338989bacebd11a2be8e46af4c4f953b3fa495acd0364d3adf3b7d2cb995d62040f851649865c571c7b85e2f267dda4269ea9ef526d32ef31a7f6
TLSH
T130213E570A8A98B1D9A103F71DEC8B2673B7C7CE9760D056B28DA03D480216DAB3F16D
MD5 SHA1 SHA512 TLSH

Submit Download

MRS MAJOR WANTS TO MEET YOU 5.txt

Path C:\Users\Admin\Desktop\MRS MAJOR WANTS TO MEET YOU 5.txt
Size 27B
SHA256 afeebe824fc4a955a673d3d8569a0b49dfbc43c6cc1d4e3d66d9855c28a7a179
MD5 e20f623b1d5a781f86b51347260d68a5
SHA1 7e06a43ba81d27b017eb1d5dcc62124a9579f96e
SHA512 2e74cccdd158ce1ffde84573d43e44ec6e488d00282a661700906ba1966ad90968a16c405a9640b9d33db03b33753733c9b7078844b0f6ac3af3de0c3c044c0b
MD5 SHA1 SHA512

Submit Download

memory/992-149-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-163-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-196-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-127-0x00000000053A0000-0x00000000053B0000-memory.dmp

Download

memory/992-129-0x00000000053A0000-0x00000000053B0000-memory.dmp

Download

memory/992-128-0x00000000053A0000-0x00000000053B0000-memory.dmp

Download

memory/992-126-0x00000000053A0000-0x00000000053B0000-memory.dmp

Download

memory/992-132-0x00000000053A0000-0x00000000053B0000-memory.dmp

Download

memory/992-133-0x00000000053A0000-0x00000000053B0000-memory.dmp

Download

memory/992-134-0x00000000053A0000-0x00000000053B0000-memory.dmp

Download

memory/992-135-0x00000000053A0000-0x00000000053B0000-memory.dmp

Download

memory/992-195-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-193-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-192-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-141-0x0000000005840000-0x0000000005850000-memory.dmp

Download

memory/992-143-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-145-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-146-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-147-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-148-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-191-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-151-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-150-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-154-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-153-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-152-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-156-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-157-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-158-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-161-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-160-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-159-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-162-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-190-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-164-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-165-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-166-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-167-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-169-0x0000000005840000-0x0000000005850000-memory.dmp

Download

memory/992-168-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-170-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-172-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-171-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-173-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-175-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-174-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-178-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-180-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-179-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-177-0x00000000058B0000-0x00000000058C0000-memory.dmp

Download

memory/992-176-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-185-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-186-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-184-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-189-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-188-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/992-187-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/4316-137-0x0000021250740000-0x0000021250854000-memory.dmp

Download

memory/4704-125-0x000001DC27700000-0x000001DC2770C000-memory.dmp

Download

memory/4704-124-0x000001DC29320000-0x000001DC29434000-memory.dmp

Download

memory/4996-46-0x000001EA0C7F0000-0x000001EA0C7FC000-memory.dmp

Download

memory/4996-45-0x000001EA0E340000-0x000001EA0E454000-memory.dmp

Download

memory/5300-182-0x0000027641C90000-0x0000027641C9C000-memory.dmp

Download

memory/5300-181-0x0000027643820000-0x0000027643934000-memory.dmp

Download

memory/5400-0-0x000000000040F000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads