Overview

overview

7

Static

static

1

MussoliniGrabber.rar

windows10-2004-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    62s
  • max time network
    62s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/08/2026, 10:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MussoliniGrabber.rar
  • Size 3.8MB
  • Sample260823-mkjmxswbme
  • SHA256 7b4002fdec99c74229841b0cc8366bdec1075582b606e2c2ec42cf1c2e4f883e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
ransomware

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MussoliniGrabber.rar"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Users\Admin\AppData\Local\Temp\7zOC64B46A8\Mussolini.builder.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC64B46A8\Mussolini.builder.exe"
      2⤵
      • Executes dropped EXE
      PID:4864
    • C:\Users\Admin\AppData\Local\Temp\7zOC64EE8C8\Mussolini.builder.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC64EE8C8\Mussolini.builder.exe"
      2⤵
      • Executes dropped EXE
      PID:3348
    • C:\Users\Admin\AppData\Local\Temp\7zOC64569D8\Mussolini.builder.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC64569D8\Mussolini.builder.exe"
      2⤵
      • Executes dropped EXE
      PID:2168
    • C:\Users\Admin\AppData\Local\Temp\7zOC645B4E8\Mussolini.builder.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC645B4E8\Mussolini.builder.exe"
      2⤵
      • Executes dropped EXE
      PID:4408
    • C:\Users\Admin\AppData\Local\Temp\7zOC64E93E8\Mussolini.builder.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC64E93E8\Mussolini.builder.exe"
      2⤵
      • Executes dropped EXE
      PID:1000
    • C:\Users\Admin\AppData\Local\Temp\7zOC64621E8\Mussolini.builder.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC64621E8\Mussolini.builder.exe"
      2⤵
      • Executes dropped EXE
      PID:540
    • C:\Users\Admin\AppData\Local\Temp\7zOC64F00E8\Mussolini.builder.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC64F00E8\Mussolini.builder.exe"
      2⤵
      • Executes dropped EXE
      PID:3304
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOC649CBF8\version.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:3608
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4492

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          version.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zOC649CBF8\version.txt
          • Size 1KB
          • SHA256 db65045081daceed796092a214fc1e968b7ccbbcf19368c23a9913669a8f469b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mussolini.builder.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zOC64B46A8\Mussolini.builder.exe
          • Size 140KB
          • SHA256 96170baae195c9adae1111d5cd4754f56c490ffa66f37709145018e11d393ca9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4864-12-0x000001F0E07C0000-0x000001F0E07E8000-memory.dmp
          Download