Analysis
- user interaction
yes - max time kernel
150s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MrsMajor-main/MrsMjrGui.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
MrsMajor-main/MrsMjrGui.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target MrsMajor-main/MrsMjrGui.exe
- Size 71KB
- Sample260913-scyprsybqa
- SHA256 087fca40e079746b9c1dfaf777d3994c0321ea8f69d08238cdfc02fb109add1d
- MD5 450f49426b4519ecaac8cd04814c03a4
- SHA1 063ee81f46d56544a5c217ffab69ee949eaa6f45
- SHA512 0cae15d863120f4edc6b6dabfe2f0f3d2e028057025d7d5ffe615cde8144f29bdaf099850e91e101e95d13f8a83cb1410a06172dda25a5f92967abcbc8453cbc
- SSDEEP 1536:M1GJbcJVksz/mYyXki6GHcSVp5l/eq/mh78EZuMdUQL+ZZN24W6yos1:M4I/mYyX16rSVvl/zCQXMdUQLK211
- TLSH T10163E024F260C775C86947301852E1B217B2EE098E95AE2C55DCFD1FBEB360406EB3E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MrsMjrGui.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5036 taskmgr.exe Token: SeSystemProfilePrivilege 5036 taskmgr.exe Token: SeCreateGlobalPrivilege 5036 taskmgr.exe - Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe - Suspicious use of SendNotifyMessage 62 IoCs
pid Process 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe 5036 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5036 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MrsMajor-main\MrsMjrGui.exe"C:\Users\Admin\AppData\Local\Temp\MrsMajor-main\MrsMjrGui.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:5876
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2372