Analysis
- geolocation tags
- max time kernel
898s - max time network
442s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
20/07/2026, 02:03
General
- Target MrsMajor-main/reStart.vbs
- Size 638B
- Sample260720-cgp1escs8m
- SHA256 2cbd8bc239c5cfc3ef02f8472d867dff61e5aed9fde8a3823cda28cc37d77722
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MrsMajor-main\reStart.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Program files\mrsmajor\mrsmajorlauncher.vbs" RunAsAdministrator2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo MsgBox"Mr Major Wanna See You!",1+16,"This is not easy to turn me muted">"C:\Users\Admin\AppData\Local\Temp\defrez.vbs"&wscript.exe "C:\Users\Admin\AppData\Local\Temp\defrez.vbs"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\defrez.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
defrez.vbs