4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

Analysis

max time kernel
898s
max time network
432s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/02/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The-MALWARE-Repo-master/Trojan/MrsMajors/MrsMajor3.0.exe
Size 381KB
Sample260222-cdtt7sb16e
SHA256 4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69
MD5 35a27d088cd5be278629fae37d464182
SHA1 d5a291fadead1f2a0cf35082012fe6f4bf22a3ab
SHA512 eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5
SSDEEP 6144:Th3idhONY259BH1DzJ5PzVNtGgc+F9TBd096cTKAsLEbqqbd+VWM8AHiKn9SlXNA:Th3iXPw9Tc6kVXMHHLEf8l7
TLSH
T1F884AD2272904588C5B5A2BAC611D72AD2713EA51B21D3EB37B57BB73E365818F3C3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

agilenet defense_evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	MrsMajor3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
3920	eulascr.exe

Loads dropped DLL 1 IoCs

pid	Process
3920	eulascr.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral30/files/0x00070000000285c0-6.dat	agile_net
behavioral30/memory/3920-9-0x0000000000FA0000-0x0000000000FCA000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3920	eulascr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	eulascr.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 4020	3596	MrsMajor3.0.exe	84
PID 4020 wrote to memory of 3920	4020	wscript.exe	85

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\1C0F.tmp\1C10.tmp\1C11.vbs //Nologo
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4020
- - C:\Users\Admin\AppData\Local\Temp\1C0F.tmp\eulascr.exe
    "C:\Users\Admin\AppData\Local\Temp\1C0F.tmp\eulascr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1C11.vbs

Path C:\Users\Admin\AppData\Local\Temp\1C0F.tmp\1C10.tmp\1C11.vbs
Size 352B
SHA256 ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569
MD5 3b8696ecbb737aad2a763c4eaf62c247
SHA1 4a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5
SHA512 713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb
TLSH
T14AE08C42DBFA0200F7F70E026DB488589933BE602E29C2CE05100E4E05B2E19CD70B2B
MD5 SHA1 SHA512 TLSH

Submit Download

eulascr.exe

Path C:\Users\Admin\AppData\Local\Temp\1C0F.tmp\eulascr.exe
Size 143KB
SHA256 2c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e
MD5 8b1c352450e480d9320fce5e6f2c8713
SHA1 d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a
SHA512 2d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc
SSDEEP 3072:BYAyVvCBHAzfuYLfoG0yBH1UbGsQT5nhAcvLiHiD0QEX5wzDNAMYFNx:BnyVeALvfoLkVUbGso5nhniTP5IAlN
TLSH
T15EE3CF4A37C38EE9D485077F3832D092FE30F5AD456BDBDA868C15291AD13CA53DB24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgileDotNetRT64.dll

Path C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll
Size 75KB
SHA256 adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
MD5 42b2c266e49a3acd346b91e3b0e638c0
SHA1 2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA512 770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
SSDEEP 1536:mXvHWEbJMwk3HwGTc/1dbJ5xUSns9Ymi5j:ovHsTTI1xUSns9YmEj
TLSH
T1DE73D747E7B651D9D4B6C0389292223FF97178A8833897DB5764891B0B61FE4EE3D380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3920-9-0x0000000000FA0000-0x0000000000FCA000-memory.dmp

Download

memory/3920-16-0x00007FFB2E1E0000-0x00007FFB2E32F000-memory.dmp

Download

memory/3920-17-0x000000001EE20000-0x000000001EFE2000-memory.dmp

Download

memory/3920-18-0x000000001F520000-0x000000001FA48000-memory.dmp

Download

memory/3920-20-0x0000000003040000-0x000000000304C000-memory.dmp

Download

memory/4020-8-0x00000246680B0000-0x00000246680BC000-memory.dmp

Download