826716515b44057a4d7254c62a9a42fdb892145a349a1ab50b5ca80063c4c58e

Resubmissions

21/04/2026, 19:57

260421-yph3qsbv5j10

21/04/2026, 19:54

260421-ymmcdaez613

21/04/2026, 19:46

260421-ygzeraez213

21/04/2026, 19:39

260421-yczjysbt2p3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
298s
max time network
263s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
21/04/2026, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Better-Survival/Better-Survival.zip
Size 1.0MB
Sample260421-ygzeraez21
SHA256 826716515b44057a4d7254c62a9a42fdb892145a349a1ab50b5ca80063c4c58e
MD5 e4336c9c8b8a77d32a0785cbb068498e
SHA1 d4276427841d18f597521e75f3172a44384e8246
SHA512 86ae81a4eb60152dea61c5c441d9bfab76860c2f7294a441e40f8703216d97a8a3e696aa3250505095bbd106ad7f7bd3089ed53f6259fcb918a7a8ed410be94f
SSDEEP 24576:p9S5gQKrDQvkWRfkCARxJjD1g9S5gQKrDQvkWRfkCARxJjD19:p9t/MfRfk1jp1g9t/MfRfk1jp19
TLSH
T1FD35233A781DB442D2B27273422E71026AC080D5F5F4CD3719D9A76F70B2B79362B9A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
984	NOTEPAD.EXE
5508	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
216	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3084	7zG.exe
Token: 35	3084	7zG.exe
Token: SeSecurityPrivilege	3084	7zG.exe
Token: SeSecurityPrivilege	3084	7zG.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3084	7zG.exe
984	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe
216	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 984	216	OpenWith.exe	103

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Better-Survival\Better-Survival.zip
1⤵
PID:4880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4844

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Better-Survival\" -an -ai#7zMap20114:142:7zEvent10483
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3084

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\44907712\payload.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\44907712\payload.dat
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:984

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads