4043ddf542d7ac9a682a35076ccdd14108244af6c051ffe341b451a104194fd2

Analysis

max time kernel
289s
max time network
273s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
05/03/2025, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REPO-SteamRIP.com.rar
Size

410.9MB
MD5

f8fabd4b722570eac5bb9d5b982aee22
SHA1

cf543e7a789e22962fb8974b2c3249c01938e4b4
SHA256

4043ddf542d7ac9a682a35076ccdd14108244af6c051ffe341b451a104194fd2
SHA512

c78c80fd75d36a6157045834effcc403a607c0f34142a8ba69e4de520c93f800a6450478b148e7f2a7050c339dd59bd5e78704c27108dd62508f93e940c8277a
SSDEEP

12582912:HnS2UmihshrHNkdaGxh8ocYbtixfiYYoh2Dw:HnS2FgshbWMCh8oRmfiYIDw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2564	REPO.exe
1068	REPO.exe
2856	REPO.exe

Loads dropped DLL 9 IoCs

pid	Process
2564	REPO.exe
2564	REPO.exe
2564	REPO.exe
1068	REPO.exe
1068	REPO.exe
1068	REPO.exe
2856	REPO.exe
2856	REPO.exe
2856	REPO.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4512	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4512	7zFM.exe
Token: 35	4512	7zFM.exe
Token: SeSecurityPrivilege	4512	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4512	7zFM.exe
4512	7zFM.exe
4512	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4564	OpenWith.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\REPO-SteamRIP.com.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3440

C:\Users\Admin\Desktop\New folder\R.E.P.O\REPO.exe
"C:\Users\Admin\Desktop\New folder\R.E.P.O\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564

C:\Users\Admin\Desktop\New folder\R.E.P.O\REPO.exe
"C:\Users\Admin\Desktop\New folder\R.E.P.O\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068

C:\Users\Admin\Desktop\New folder\R.E.P.O\REPO.exe
"C:\Users\Admin\Desktop\New folder\R.E.P.O\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\New folder\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Users\Admin\Desktop\New folder\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Users\Admin\Desktop\New folder\R.E.P.O\REPO.exe

Filesize
651KB

MD5
37e2e7e012343ccef500133286fcbf27

SHA1
4b7e66039d04b14ddcfb580a6e6a395ea52222be

SHA256
1643ff9ed131adde7a22363f26d36308b4b4fb8f9ba61e5afce3b6803c5cb302

SHA512
418dcb69e506f42248c00459eb3fa5a576006fead83cb5372e5710a8e95265654c316bbb314e4b8afa69e393a7cdf01219b7e17095d1990ab418f0aed68c687e

Download Submit
C:\Users\Admin\Desktop\New folder\R.E.P.O\SteamOverlay64.dll

Filesize
114KB

MD5
0a5429b888c75f6525e1100e32dd2b69

SHA1
8ae224580aa0838a7b1570c79d4d8f27a1b46d19

SHA256
f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df

SHA512
5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef

Download Submit
C:\Users\Admin\Desktop\New folder\R.E.P.O\UnityPlayer.dll

Filesize
29.5MB

MD5
b33d91200048e718c7207367f49d60fe

SHA1
cc95b2632f33ec9a533852df3402c58ef3faf0c1

SHA256
4b34672318371b54be9d89c9482a91ab3d26ae5d209935b8ad5919e00ec4f1d9

SHA512
edc94d2deab48e3aa57566904ebafc7082d63f14901c36067783deb10538e74124cdbadc72d40ec3c9db09c9e1cd27b18bdfd1969545e2607d34d5d12ec1d220

Download Submit
C:\Users\Admin\Desktop\New folder\R.E.P.O\dlllist.txt

Filesize
139B

MD5
7dd443df8404c42b7db22908ad5132b9

SHA1
302f827ca20c8b4c7d71a466907c2421661429e1

SHA256
4b93c54c0d588197645352d11ebc066f6f8150a2826ed04c1525ae865ce00153

SHA512
a5be18614385400aadc57c2bd09760ac58a367b3bd1643b2e4aaa2db5426e5fe806a5428568fadc896243f65f7391c12f71b83475ed6db9ad175de6c3ab9f530

Download Submit
C:\Users\Admin\Desktop\New folder\R.E.P.O\winmm.dll

Filesize
512KB

MD5
e59aac558d9f9c5d1312ac24d09c51d5

SHA1
2f11c4b00f5f92d4466348f9501aa657c9bf6fa7

SHA256
ba37009eef6c041bc6d0a271c13679fb9e14a005bd7e038cee596cd4064cf8b3

SHA512
1c3b357074d62d5ca11c92d71ffdacb4a7e3d6fb17cbd4b489e5bea0032cea43650a6809388e98e4b98256b477c6b5dbd8fd2c7f4e3e08af00ef68e0ed4406d0

Download Submit