Overview

overview

5

Static

static

3

VesperaRebrandPC.exe

windows10-2004-x64

5

VesperaRebrandPC.exe

windows11-ltsc_2024-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    30s
  • max time network
    30s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 03:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VesperaRebrandPC.exe
  • Size 1.5MB
  • Sample260808-eddjbsbe88
  • SHA256 cff5f37b6a91feb87eb16dd0cdd25fe426e171dbe84386a8d89e6db7a20e6fbd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasionexecutionransomware

Malware Config

Signatures

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Modifies Control Panel 24 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\VesperaRebrandPC.exe
    "C:\Users\Admin\AppData\Local\Temp\VesperaRebrandPC.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:460
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$imagePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\user_avatar_custom.png'; if (Test-Path $imagePath) { $accFolder = [System.IO.Path]::Combine($env:APPDATA, 'Microsoft\Windows\AccountPictures'); New-Item -ItemType Directory -Force -Path $accFolder | Out-Null; Copy-Item $imagePath (Join-Path $accFolder 'user.png') -Force; }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3044

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_4xdkvby3.vj1.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4xdkvby3.vj1.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dark_arrow.cur
        • Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\dark_arrow.cur
        • Size 4KB
        • SHA256 7f8d680821cd916ccfc4c9d9203cdd8e90ec9833e1cccd489ce9edf4f8cfafc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dark_cross.cur
        • Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\dark_cross.cur
        • Size 4KB
        • SHA256 9e4f34f5e3e3ff248ff08afa42e684a7a514f83cac2bb266c9953eaedc33ae4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dark_hand.cur
        • Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\dark_hand.cur
        • Size 4KB
        • SHA256 7caf5058c473b2dae0aefe8b18ef2b8a0ba915abb1faea4b9aa2a292701db1d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dark_no.cur
        • Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\dark_no.cur
        • Size 4KB
        • SHA256 18b03003f1e87a1be96e13ab20fed4e2217207c7e5ca46a70566e0a60bf1c16d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        user_avatar.png
        • Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\user_avatar.png
        • Size 176KB
        • SHA256 8a8a2fa6e078ad7847de38212e5c8605d6222b77995feb184217520900dbd006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3044-55-0x00000228F3F20000-0x00000228F3F30000-memory.dmp
        Download

        memory/3044-54-0x00000228F3F20000-0x00000228F3F30000-memory.dmp
        Download

        memory/3044-56-0x00000228F5CF0000-0x00000228F5D12000-memory.dmp
        Download