74b57e66864831c686f2a1bb445c7ba2a4bd5d985aa9879e67bb8a7c847e04f5

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ByteBreaker V1_78517041.exe
Size 702KB
Sample261023-ymvnrazwft
SHA256 74b57e66864831c686f2a1bb445c7ba2a4bd5d985aa9879e67bb8a7c847e04f5
MD5 77f8a77ae73b41044db787aecfbee35d
SHA1 5e5e23441a6259befbc0b1e6b7755e61937ac186
SHA512 8be8f024b8abf7dee02e3782d37046f0cdb152b5c9bc1f74eda1fd489d89c90ff85f945c659fa50c6caf8ebac8e2814845600c22a4702710cdf61a188288941a
SSDEEP 12288:4nZsx0v39rYke42Kn/ECCNRgf9dGcA8QCkeJ2P:VO95Pn/EbK9dGUQBKw
TLSH
T1E5E47D26B66801FCE0A7D1B9C9924913F7F1B847177197CF03A04A66AF2B6E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	ByteBreaker V1_78517041.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ByteBreaker V1_78517041.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ByteBreaker V1_78517041.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\OperaGXStable	ByteBreaker V1_78517041.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	ByteBreaker V1_78517041.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\OperaStable	ByteBreaker V1_78517041.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	ByteBreaker V1_78517041.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	ByteBreaker V1_78517041.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4996	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4996	2132	ByteBreaker V1_78517041.exe	91

C:\Users\Admin\AppData\Local\Temp\ByteBreaker V1_78517041.exe
"C:\Users\Admin\AppData\Local\Temp\ByteBreaker V1_78517041.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 56B
SHA256 614741c91330a20c85deba6de1d3389fe5c1f183fe6ffce4d6e26262c7e441bc
MD5 7efaf8bd98bc5683286716328275266b
SHA1 4e3145b6dcba747bb0a3c5bf00ecbd5341c1ab0a
SHA512 ff087183dffdd6d5beb259337250a5253ac8d4cbd8f0708ffc6b3e0bd99c4b26aa0b505cabc25cc31a16906cc07c296cc386195ebbe44d6844a62eb4f41c25ed
TLSH
T110900214F49220ED48014A8D71E1945A21120287516DD269DC6055114406E47A0E7595
MD5 SHA1 SHA512 TLSH

Submit Download