f227c850cda9b562d2d045140640fc5758af2d3739db6ae8394794aece57d790

Analysis

user interaction
yes
max time kernel
24s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 09:42

Target
MussoliniGrabber.rar
Size 3.8MB
Sample260416-lpbbnsb14p
SHA256 f227c850cda9b562d2d045140640fc5758af2d3739db6ae8394794aece57d790
MD5 ad600ccc04078870774f84e04b910728
SHA1 8fd134ddf20bde90219b7bc0d6cf0e800fe825ef
SHA512 f278646887e817d1acf0c73525c13b2e943e268cafe9083f8dbbe2f6d0c9c5285c42a947581cd8e88d68faabd4ffe374ec00973faa031c6ca25304b259e9b5db
SSDEEP 98304:h67z3DfuPqsTGC9ZFP/UYgjKe7G8JopUzjod:hhPLvnU/hGsjod
TLSH
T144063344D20C735F186C200D96DBAFB2FE73B27EA883826D9CD345C71B8651B4AF94A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4340	Mussolini.builder.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	7zFM.exe
4796	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4796	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4796	7zFM.exe
4796	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4340	4796	7zFM.exe	90

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MussoliniGrabber.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\7zOCB26A728\Mussolini.builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCB26A728\Mussolini.builder.exe"
  2⤵
  - Executes dropped EXE
  PID:4340

Mussolini.builder.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOCB26A728\Mussolini.builder.exe
Size 140KB
SHA256 96170baae195c9adae1111d5cd4754f56c490ffa66f37709145018e11d393ca9
MD5 e5fa5e0b3f67669c26de4f214d97e7f8
SHA1 c0112c75a54336ab99e4e34bf0cb68443be384d2
SHA512 dfa461c787ed3d31c55d4b6b42a4659f74f5668a3a65b3df74ef29cb162d6ea966f8e0b20693a0976655f742fdce6fe36c160015e2c7243a0e4d933f07570c44
SSDEEP 1536:uMB+x95Ffc4mrKFB3MNv6uerrrrrr7VnwuFGhjjjjjjjjYKzUoJe0kbOmVcl:U95Ffc4mrKFB3MNvj0wxQoJ7kbO8Y
TLSH
T1CBE3394133B89D9BD57E8AF011F209901BF2615718A9D3DE6CD222CD0BF2B5543A2F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4340-12-0x0000023105AB0000-0x0000023105AD8000-memory.dmp

Download