a1c731e98bcfb2feca89196d57603faa68d2d3a70bc1c41fcf3e217f86fe8f5f

Analysis

max time kernel
31s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20250314-fr
resource tags

arch:x64arch:x86image:win10v2004-20250314-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
21/03/2025, 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R.E.P.O.rar
Size

356.7MB
MD5

fff6da0c4fae4c6bc3c295dbc4f5e009
SHA1

13001d9ab888bf27cef8119f2c413dbf9bde30ba
SHA256

a1c731e98bcfb2feca89196d57603faa68d2d3a70bc1c41fcf3e217f86fe8f5f
SHA512

061a932a5d57fab07f0f8f007a1722ae84821284dbb079e702793e301173d04b3f62fccf0a1100572786ce07d610ebe1a99f8327f1a4baabeb1e48100c3d7052
SSDEEP

6291456:BL7FS+sdsh82HcvufaTWaN6QtrlxBn3soLhG0pHvHwt8zx+/+qJY5U3yvh2Mt+:BLR6dshrHNaN6Gxh8ocYQtixfiYY8h27

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2656	REPO.exe

Loads dropped DLL 3 IoCs

pid	Process
2656	REPO.exe
2656	REPO.exe
2656	REPO.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4456	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4456	7zFM.exe
Token: 35	4456	7zFM.exe
Token: SeSecurityPrivilege	4456	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4456	7zFM.exe
4456	7zFM.exe
4456	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\R.E.P.O.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3952

C:\Users\Admin\Desktop\R.E.P.O\REPO.exe
"C:\Users\Admin\Desktop\R.E.P.O\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zE861D4B97\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE861D4B97\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Users\Admin\Desktop\R.E.P.O\REPO.exe

Filesize
651KB

MD5
37e2e7e012343ccef500133286fcbf27

SHA1
4b7e66039d04b14ddcfb580a6e6a395ea52222be

SHA256
1643ff9ed131adde7a22363f26d36308b4b4fb8f9ba61e5afce3b6803c5cb302

SHA512
418dcb69e506f42248c00459eb3fa5a576006fead83cb5372e5710a8e95265654c316bbb314e4b8afa69e393a7cdf01219b7e17095d1990ab418f0aed68c687e

Download Submit
C:\Users\Admin\Desktop\R.E.P.O\SteamOverlay64.dll

Filesize
114KB

MD5
0a5429b888c75f6525e1100e32dd2b69

SHA1
8ae224580aa0838a7b1570c79d4d8f27a1b46d19

SHA256
f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df

SHA512
5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef

Download Submit
C:\Users\Admin\Desktop\R.E.P.O\UnityPlayer.dll

Filesize
29.5MB

MD5
b33d91200048e718c7207367f49d60fe

SHA1
cc95b2632f33ec9a533852df3402c58ef3faf0c1

SHA256
4b34672318371b54be9d89c9482a91ab3d26ae5d209935b8ad5919e00ec4f1d9

SHA512
edc94d2deab48e3aa57566904ebafc7082d63f14901c36067783deb10538e74124cdbadc72d40ec3c9db09c9e1cd27b18bdfd1969545e2607d34d5d12ec1d220

Download Submit
C:\Users\Admin\Desktop\R.E.P.O\dlllist.txt

Filesize
138B

MD5
4970dc218d3b8965128822de14aedb4d

SHA1
c24f3948a8a8e0b814c36534b4cfe488009c1270

SHA256
6f2a8f3ee941c39513f1815a47c2bf7c6c736977df77b4a8c0a857f8a98b3988

SHA512
4ce0d0b677c6f1c0723cb9cb7f924a5f9c9cd3e4f4482e017e53bb801974967e3d0e2867b3565cecc7e21af762da48c3efffe787f65e79b6f2adce78008ac627

Download Submit
C:\Users\Admin\Desktop\R.E.P.O\winmm.dll

Filesize
512KB

MD5
e59aac558d9f9c5d1312ac24d09c51d5

SHA1
2f11c4b00f5f92d4466348f9501aa657c9bf6fa7

SHA256
ba37009eef6c041bc6d0a271c13679fb9e14a005bd7e038cee596cd4064cf8b3

SHA512
1c3b357074d62d5ca11c92d71ffdacb4a7e3d6fb17cbd4b489e5bea0032cea43650a6809388e98e4b98256b477c6b5dbd8fd2c7f4e3e08af00ef68e0ed4406d0

Download Submit