Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, wscript.exe "%ProgramFiles%\mrsmajor\Launcher.vbs"'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\mrs major wants to meet you 1.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 29.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 30.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 31.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 32.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 33.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 34.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 35.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 36.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 37.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 13.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 38.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 40.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 41.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 42.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 43.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 44.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 45.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 46.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 47.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 48.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 27.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 28.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 26.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 25.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 24.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 3.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 4.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 5.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 6.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 7.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 8.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 9.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 10.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 11.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 49.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 39.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 12.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 15.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 16.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 17.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 18.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 19.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 20.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 21.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 22.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 23.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 2.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 14.txt
- %HOMEPATH%\desktop\mrs major wants to meet you 50.txt
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\shutdown.exe' -r -t 03' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\windows media player\wmplayer.exe' "%ProgramFiles%\mrsmajor\def_resource\f11.mp4"
- '<SYSTEM32>\shutdown.exe' -r -t 03
Attempts to shut down the Windows operating system.
