MrsMajor.exe: Difference between revisions

|image = BossDaMajor_icon.png

'''MrsMajor.exe''' (also known as '''BossDaMajor.exe''') is a [[screamer]] trojan developed by Elektro Berkay. The trojan gained notoriety after [https://www.youtube.com/channel/UCviSYAcwdnDX1UoRzAHYgNg Siam Alam] created a video about it. Elektro Berkay later developed MrsMajor2.0.exe and MrsMajor3.0.exe, which were also featured on Siam Alam's channel.  

=='''Payload'''==

===BossDaMajor.exe===

The trojan proceeds to flood the user's desktop with numerous .txt files named <code>MRS MAJOR WANTS TO MEET YOU</code> which contain the message <code>MRS MAJOR IS BEHIND OF YOU!.</code>

After, it launches Windows Media Player and plays a copy of the video [[Ghost Caught on Tape]].<ref>The video may not play to completion due to the forced logout and restart routine.</ref> Simultaneously, a window titled <code>Cute Doll!</code> appears on the screen, displaying the message <code>MrsMajor Wants TO MEET YOU!</code> and two buttons, “OK” and “Cancel”. It then logs out the user and forces a restart.  

Upon restarting, the trojan changes the desktop background to an image of skulls, replaces file icons with a skull icon, and replaces the cursor with a skull and crossbones icon. It also disables essential system utilities such as Task Manager and Windows Defender.

A window titled <code>MrMajor</code> appears, displaying a flashing and moving image of a frightening doll. Attempting to close this window results in it immediately reopening. [https://youtu.be/6WyH5E8Xs0c Thresh’s Theme] from ''[[wikipedia:League_of_Legends|League of Legends]]'' plays in the background.

===MrsMajor2.0.exe===

|image = MrsMajor2_icon.png

[[File:MrsMajorWarningMessage.png|thumb|The warning message that appears before MrsMajor2.0 executes its payload]]Upon execution, MrsMajor2.0.exe presents the user with an end-user license agreement (EULA) warning them that running the trojan will destroy the computer. After accepting the EULA, the trojan launches its payload.

First, it proceeds to fill the desktop with multiple invalid .exe files named <code>HUMANS ARE TASTY</code>. Then, it flashes multiple copies of the doll image from BossDaMajor.exe across the screen, and then forces a restart.

Upon restarting, the trojan changes the desktop background to an image of Annabelle from ''[[wikipedia:The_Conjuring_Universe|The Conjuring]]'' franchise, replaces the default cursor with a .gif image of an eyeball looking around, and replaces the icons of the newly created .exe files on the desktop with the same icon as the trojan itself.  

Similar to BossDaMajor.exe, Thresh’s Theme plays in the background.

MrsMajor2.0.exe prevents users from opening Task Manager. If the user attempts to open Task Manager, the words <code>THERE IS NO ESCAPE</code> flash on the screen one by one.

If the user breaks one of the rules, or if the timer reaches zero, the screen is bombarded with multiple flashing copies of the doll image. Simultaneously, the original window's image becomes distorted by chromatic aberration. Similar to the Task Manager payload, the words <code>THERE IS NO ESCAPE</code> flash on the screen one by one.

Then, the trojan triggers a Red Screen of Death (RSoD) and overrides logonui.exe. The RSoD reads:<pre>

===MrsMajor3.0.exe===

|title = MrsMajor3.0.exe

|image = MrsMajor3_icon.png

|maker = Elektro Berkay

|type = Application

|date = 2020

|imagecaption = The '''MrsMajor3.0.exe''' icon.

}}

Upon restarting, an edited image of the doll from the previous versions of MrsMajor appears, featuring blood dripping from its eyes and mouth, as well as several bloody holes in its forehead. Next to the doll is a vertical red meter labeled “Blood Left:” which gradually depletes over time. [https://youtu.be/_Qr2T1az1Ck Song of Unhealing] from the Ben Drowned creepypasta plays in the background. The trojan overlays the screen with a translucent red filter, and small red circles and rectangles resembling drops of blood surround the screen. Shortly after, blood begins dripping down from the top of the screen. This overlay remains visible on top of any other open windows. The trojan also replaces the default cursor with a black and red cursor.

If the blood meter fully depletes, or the user breaks one of the rules, the trojan triggers a Blue Screen of Death (BSoD) with the stop code <code>CRITICAL PROCESS DIED</code>. It overrides logonui.exe with a distorted image of the doll with an open mouth and bleeding eyes, accompanied by the text:<div style="text-align: center;">  

If MrsMajor3.0 detects that logonui.exe has been fixed, it displays an error window titled <code>uh oh</code> that reads <code>You messed up..</code> with an OK button upon booting into Windows. Subsequently, it triggers a BSoD and overrides the Master Boot Record (MBR) with the message:<div style="text-align: center;">

<u>NOTE</u>: the following [[application]] contains a [[screamer]] as well as a [[wikipedia:Cross-site scripting|malicious script]] that may harm your computer!

{{Comments}}<references />

[[Category:Malicious softwares]]

[[Category:Malicious scripts]]