Analysis
-
max time kernel
146s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08-07-2024 17:47
General
-
Target
Marfrig/Centaurus_V2-55-0_ParshallDisplay.jar
-
Size
2.6MB
-
MD5
b53d869bc34f8f35c6c43f260d1e47bf
-
SHA1
8be010645d2f1e2081689f464c4737a1b9991bb5
-
SHA256
9eb31561a555f7f727df1c42a68d1e1804c59062fdded01cc586320c8a490552
-
SHA512
2416d7cbf5e8230f432b5e0bd8ac5e277806faa35d165415b74269a51109a6191e865993c72685e25f30860136d7344a5f9a649e682925042376b9d59fe3baeb
-
SSDEEP
49152:hnY4kAoFG3s+mpUOIRelwM6vMwAoGnQMWQyqjj/BU1U62j69ewJVg2hJyCX0ydaZ:hYtfFG9mp29vLAoGnFZn964aVfhJWyIb
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Marfrig\Centaurus_V2-55-0_ParshallDisplay.jar1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\ATTRIB.EXEATTRIB.EXE +H casasDecimais.properties2⤵
- Views/modifies file attributes
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69B
MD5b4fbddc23a294b3075f8ead643a3c3bf
SHA199900056bc3349d2b58c22bc8fddd446d755bfad
SHA2566c2ecd0ddbbca24829a91688d716de85edb6e954d2c7761674bcb0b2635f2fe7
SHA5121f9fd62344526e8fd29021b25d2249f2eef3199faffa60a52a6df5d1eb79fcb5065e9451bb7920b236ef61e732bf357aa68796d84fb0dee81801be48821f61f9
-
Filesize
80KB
MD53abdae97fd4ea7b3094e6705311afb70
SHA1466b45e19109cdee04fb5df6a9f431ac061fbccb
SHA2561b28d56df723221124f05384ea146e5a8b61f58656e60a35851eed35fabfb221
SHA51231294f257f7894e7c1b14dcfaf001c4f98147bcd70d2ae6b7af1b0a4ab28c6ba2f13136c456d67c79455edc59bf507c33fa1ffaf2fe49605ad9d05c006661dcc
-
Filesize
87KB
MD5ab9dace5c381013951a6036e74bbd28d
SHA139a722f6ff96e8c9c0a11629b16e51bafcdc4b75
SHA256f91e89a2b4fd70f081442d13f1e0e6541801edcf6ccf3afc7f0993175b0765b1
SHA51270756acf23f21d68850c46d0c7762c41b4cd99bf9d4a43467800676df51ca9d3984bd1d7a15a97b872eed4b00fd506dd4281cdb2fb583e4867a3354b6b08a996
-
Filesize
58KB
MD5f94e90a2030310fc882f814b8f7eccc6
SHA1e96c946be1e6537378fd532d2742b523df2725a4
SHA25680c06c307be9c54ecf02cf10db921f42f1809087e85f2f1f772a80b282f326cc
SHA512faeb9c58c1918291a9ff2622cabd5b661afce14fe254546d8ae8b7165fcec7ef6b4973ea850b5451610be03d5c83e4af0275420439470daf5ce1394e9575fd4e
-
Filesize
365KB
MD54b7e2e73a0837da83627fa091062f7e5
SHA112478227145c02f02e897c3bc7fdcd6988db88ab
SHA256ccb92be49654f18a88f815271f1b4c9b3b8e25b09e3595df806ce2c6a762e54d
SHA512a3d4b3e98e9e0cd854a0d2b38f1650b51037ad05a09277d0dd7a99af2f0cac4a62231475861bcd95278628ca65cdac99fdf5a38976ac760f85cf6d31ea965563
-
Filesize
126KB
MD569cc163bd480321c66a988c0a8fdae84
SHA15581fe684291b9af2a4dd282d27009fe7e1f2855
SHA256993beae12d71ddab9e5d0139131a562dfb3a560044886e677e332ed56574d1d3
SHA5124878cb7b024797e1aefd259a5c2280b334a6b354462844eab0d70099766e5375b0b937138f2e5c57daa56a3dde94f297fb8ff678cd2bdf19c5bbfa657e823f83
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB