Analysis
- user interaction
yes - max time kernel
203s - max time network
205s - platform
windows10-2004_x64 - resource
win10v2004-20260513-fr - resource tags
arch:x64arch:x86image:win10v2004-20260513-frlocale:fr-fros:windows10-2004-x64systemwindows - submitted
08/08/2026, 20:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VesperaRebrandPC.exe
Resource
win10v2004-20260513-fr
windows10-2004-x64
23 signatures
300 seconds
Behavioral task
behavioral2
Sample
VesperaRebrandPC.exe
Resource
win11ltsc2024-20260709-fr
windows11-ltsc_2024-x64
7 signatures
300 seconds
General
- Target VesperaRebrandPC.exe
- Size 1.5MB
- Sample260808-zahn4afd44
- SHA256 cff5f37b6a91feb87eb16dd0cdd25fe426e171dbe84386a8d89e6db7a20e6fbd
- MD5 014c3df14771ba5662cedd57ea208c0e
- SHA1 6de77c0094ce3fb90d4d27f8174b3a13e2b4dc07
- SHA512 c0a0a9f3ddc648f8193c2dde7b513c0251bada788fd213488e97da89241d57c6c15c68c37bfb731087150f82d0f0b81e33fa082e84943d37ae8482d336c19bc5
- SSDEEP 24576:4Rc+QTolI+P/WnGuHPvb8yWDXlBroZdbP2NF+:AkolBMvvbuDlEP2
- TLSH T19F75BE12BA944DA8EC7253F88891C87597327C591B71D28F22F0BD6BFFF32914D29612
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast DeviceCensus.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast DeviceCensus.exe Key opened \REGISTRY\MACHINE\SOFTWARE\KasperskyLab DeviceCensus.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab DeviceCensus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klhk\Parameters DeviceCensus.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 DeviceCensus.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache DeviceCensus.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock DeviceCensus.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val DeviceCensus.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx DeviceCensus.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 DeviceCensus.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_wallpaper.jpg" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_wallpaper.jpg" VesperaRebrandPC.exe - Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\INF\monitor.PNF PaintStudio.View.exe File created C:\Windows\INF\compositebus.PNF PaintStudio.View.exe File created C:\Windows\INF\vdrvroot.PNF PaintStudio.View.exe File created C:\Windows\INF\sensorsalsdriver.PNF PaintStudio.View.exe File created C:\Windows\INF\volume.PNF PaintStudio.View.exe File created C:\Windows\INF\umbus.PNF PaintStudio.View.exe File created C:\Windows\INF\usbport.PNF PaintStudio.View.exe File created C:\Windows\INF\swenum.PNF PaintStudio.View.exe File created C:\Windows\INF\keyboard.PNF PaintStudio.View.exe File created C:\Windows\INF\cdrom.PNF PaintStudio.View.exe File created C:\Windows\INF\msmouse.PNF PaintStudio.View.exe File created C:\Windows\INF\vhdmp.PNF PaintStudio.View.exe File created C:\Windows\INF\spaceport.PNF PaintStudio.View.exe File created C:\Windows\INF\hdaudio.PNF PaintStudio.View.exe File created C:\Windows\INF\hdaudbus.PNF PaintStudio.View.exe File created C:\Windows\INF\rdpbus.PNF PaintStudio.View.exe File created C:\Windows\INF\input.PNF PaintStudio.View.exe File created C:\Windows\INF\volmgr.PNF PaintStudio.View.exe File created C:\Windows\INF\pci.PNF PaintStudio.View.exe File created C:\Windows\INF\mshdc.PNF PaintStudio.View.exe File created C:\Windows\INF\acpi.PNF PaintStudio.View.exe File created C:\Windows\INF\mssmbios.PNF PaintStudio.View.exe -
pid Process 5892 powershell.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1188 msedge.exe - Checks SCSI registry key(s) 3 TTPs 45 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DeviceCensus.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DeviceCensus.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DeviceCensus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DeviceCensus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A PaintStudio.View.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 PaintStudio.View.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A PaintStudio.View.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DeviceCensus.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DeviceCensus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A PaintStudio.View.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A PaintStudio.View.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status DeviceCensus.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision DeviceCensus.exe - Enumerates system info in registry 2 TTPs 12 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion DeviceCensus.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS DeviceCensus.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion DeviceCensus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS DeviceCensus.exe - Modifies Control Panel 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\IBeam = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_ibeam.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\NWPen = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_arrow.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\SizeNS = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_cross.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\SizeNESW = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_cross.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\WallpaperStyle = "2" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\AppStarting = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_wait.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\Crosshair = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_cross.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\No = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_no.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\SizeWE = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_cross.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\Hand = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_hand.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\Pin = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_hand.cur" VesperaRebrandPC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\PaintDesktopVersion = "1" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\Arrow = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_arrow.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\Help = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_help.cur" VesperaRebrandPC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\Scheme Source = "1" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\Wait = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_wait.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\SizeNWSE = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_cross.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\SizeAll = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_cross.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\UpArrow = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_arrow.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\Person = "C:\\Users\\Admin\\AppData\\Roaming\\VesperaRebrandPC\\Assets\\dark_hand.cur" VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors\ = "Custom Dark Scheme" VesperaRebrandPC.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop VesperaRebrandPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\TileWallpaper = "0" VesperaRebrandPC.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Cursors VesperaRebrandPC.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\MuiCache PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheVersion = "1" PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheVersion = "1" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200" PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1" PaintStudio.View.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2804 vlc.exe 6020 PaintStudio.View.exe - Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 5892 powershell.exe 5892 powershell.exe 1588 mspaint.exe 1588 mspaint.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2804 vlc.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 216 msedge.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 5892 powershell.exe Token: SeDebugPrivilege 6020 PaintStudio.View.exe Token: SeDebugPrivilege 6020 PaintStudio.View.exe Token: SeDebugPrivilege 6020 PaintStudio.View.exe Token: SeDebugPrivilege 2988 taskmgr.exe Token: SeSystemProfilePrivilege 2988 taskmgr.exe Token: SeCreateGlobalPrivilege 2988 taskmgr.exe Token: 33 2988 taskmgr.exe Token: SeIncBasePriorityPrivilege 2988 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2804 vlc.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe 2988 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2804 vlc.exe 1588 mspaint.exe 6020 PaintStudio.View.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4944 wrote to memory of 5892 4944 VesperaRebrandPC.exe 83 PID 2616 wrote to memory of 216 2616 msedge.exe 125 PID 216 wrote to memory of 2256 216 msedge.exe 126 PID 216 wrote to memory of 1188 216 msedge.exe 127 PID 216 wrote to memory of 1104 216 msedge.exe 128 PID 216 wrote to memory of 1104 216 msedge.exe 128 PID 216 wrote to memory of 1104 216 msedge.exe 128 PID 216 wrote to memory of 408 216 msedge.exe 130 PID 216 wrote to memory of 408 216 msedge.exe 130 PID 216 wrote to memory of 408 216 msedge.exe 130 PID 216 wrote to memory of 6016 216 msedge.exe 129 PID 216 wrote to memory of 6016 216 msedge.exe 129 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System VesperaRebrandPC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "SISTEMA PERSONALIZADO - VESPERAREBRANDPC" VesperaRebrandPC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Bienvenido al sistema. Este equipo ha sido configurado con la experiencia de interfaz personalizada VesperaRebrandPC." VesperaRebrandPC.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VesperaRebrandPC.exe"C:\Users\Admin\AppData\Local\Temp\VesperaRebrandPC.exe"1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4944 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$imagePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\user_avatar_custom.png'; if (Test-Path $imagePath) { $accFolder = [System.IO.Path]::Combine($env:APPDATA, 'Microsoft\Windows\AccountPictures'); New-Item -ItemType Directory -Force -Path $accFolder | Out-Null; Copy-Item $imagePath (Join-Path $accFolder 'user.png') -Force; }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5892
-
-
C:\Windows\system32\DeviceCensus.exeC:\Windows\system32\DeviceCensus.exe1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:5380
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4620
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\error.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2804
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\logon.wav"1⤵PID:2196
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\user_avatar.png" /ForceBootstrapPaint3D1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1588
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
PID:2396
-
C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6020
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2988
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault64ed2ae8hb386h4e07ha847h2754fea1e3e91⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault64ed2ae8hb386h4e07ha847h2754fea1e3e9 --edge-skip-compat-layer-relaunch2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ff89cc3c188,0x7ff89cc3c194,0x7ff89cc3c1a03⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,15039973270565712121,11299522976992753576,524288 --field-trial-handle=2248,i,5484365721707684991,15635326747300908520,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:33⤵
- System Time Discovery
PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,7798435645724183089,15084287775408739538,262144 --field-trial-handle=2248,i,5484365721707684991,15635326747300908520,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:23⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,10686999517667855322,3684166746571993672,524288 --field-trial-handle=2248,i,5484365721707684991,15635326747300908520,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:83⤵PID:6016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3188,i,7877823252379388345,4346317212810752969,2097152 --field-trial-handle=2248,i,5484365721707684991,15635326747300908520,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:23⤵PID:408
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
- MD5 dd54db185d82309b854bfa7657ba4600
- SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
- SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
- TLSH T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
- MD5 e3962be2eb3bd350a67bf6309159a1cc
- SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
- SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
- TLSH T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 61B
- SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
- MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
- SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
- SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
- TLSH T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 dd0c84fdb42c4920d4f2d763fd66144161555b2ddde1c43a6c35320701fbf3d3
- MD5 09cc0fd1eb03cde1b2ce19ea7d113c0c
- SHA1 1d4bab96ccbd99229800d9b4de64f3c91d108d82
- SHA512 3ad631631b667a644c4942c15dd127f17ef5bc8aa5ae08aa0022248e3b29ce8aea2b315cd29e99cdce9892b1a2c76c34154b751f474f0fabcab06c23150038f2
- SSDEEP 96:sa2jkiqWMpscnb9Q7cWJIdHWb6W6hfuH9EOx+WVoMfm+uecpYQjHU67pwUhgNVDB:sxokGsFfewHW6+WNGYUxhgF
- TLSH T1F8E1B6566E38697B4CCBE11EBB267B43E2F6402165C41A48AFFC965C08CB6CD230780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 26KB
- SHA256 1d4fac91d658615ee7798f1cc136615a2cb80007e8558f243d070853c5800733
- MD5 0774a32c01d1f04acb7931a0ae9f17b0
- SHA1 3396601e31464c14b566fe2c5588a1573fcefeb6
- SHA512 68454131498aef15af0fd4dbd610fd28dad1dafa654c1d8ca62f945d35148bfd33d3c41caca6f76dd886859fa3230b47d5ec2c31513e5d316ef48d2512604e79
- SSDEEP 768:yieZu3MWvg0Go8F1+UoAYDCx9Tuqh0VfUC9xbog/OVueLlPZ4Vlroz0:yieZu3MWvg0Gou1jajeLZmVeQ
- TLSH T159C2DA2F744CCA7E4FC00A9DED5A6F973E9802C79A684D4047FA994C02C77EE512A4DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 b3ae4fda55f72d1b1291c0a92c86cd2e3772dde519812dfc49fbf4ee5466ef65
- MD5 455b31a807e8e1a22da15456449fec4e
- SHA1 77d6e09e5b744036d7967572b5339c7088bb4c32
- SHA512 8758fec69ec78934d292f20ec44575fd82cd534c6dbea1feb439b329eb3a7413c4599cf457fdba740ee21333e638503ce8d3538d2ec5df234b2270a760d88455
- SSDEEP 192:yONe61VWQmiUy+OgGX5Obd+jkOeaeQz/aG3raU6:yONe6W+gGX5od+QOeNyaU6
- TLSH T1C602E935A9686C778EE2BE49F48737135FA8206BE9542F84DAE81B1C01D769C2347C27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 9KB
- SHA256 3a0adb8b8a5b9e17da2ef49d4403c68e6cc02d564318933d9ddf0a6ad86cd6f6
- MD5 2a4d5816e21700fd2ea7de9f9236346b
- SHA1 e46c123524a5bc8beefc34d6a8c6b1036cd2eaf3
- SHA512 990bb1227120f3ee355364d0a5e4ee99826c9f42944840022f12ddcfd0313674f8e3ff081c6242ddb87040c6502eb1f741898782035902f2b69c82ec8d291838
- SSDEEP 192:zlsNE61t3WQmiUyclWzX5Obd+jkOeaeQfwFd+ijQPnqSXUO:zlsNE67iRWzX5od+QOeCUd+vPlUO
- TLSH T10A121935A568AC338DE2B649F4C736A39FA810B3D8846F94D6E81F1C04C769C2B5BC17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 053094b8bab6dc588e550205fe3cbfba28388530c01dc153dbf545bebbf017da
- MD5 bbd31b8d7bfa9b6f4d4639a112e8ecab
- SHA1 ef4fdd3dbe1239a6baddd5564774f695c5e70432
- SHA512 2cd0c7926725cd3c38018298c8ccf32c835ea965f3a3f6da8ab4c4c3585aa4c26b5c7ddf9f41e5800a71a67afa9663bf504f7e22f5ef871c0eed1cae9ac398f0
- SSDEEP 192:9ONj61QWQmiUyYOWGX5Obd+jkOeaeQfwFd+ijJsnqSXU6:9ONj6tOWGX5od+QOeCUd++slU6
- TLSH T129121935A568AC334DE2B549F4C736A39EA820B7DD846F84D6E81B1C04C769C2B5FC17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 9KB
- SHA256 a66883c14e974380644087f020be659270dc515c09f3c70b99f12f24e62aead4
- MD5 61d184ea203adc2f639a817fc4d9564e
- SHA1 a814a1234c112a20c1ec84509f26149c4204e6f2
- SHA512 379e4105b5b7fb3541ca75035626b33a1e1b1f36e9718e3444069f6e2371eba96e8555d7bb4ce1fa1a72779153928196c7d8efbf105555eed905c2e16d5164d1
- SSDEEP 192:zlsNE61t3WQmiUy5lWzX5Obd+jkOeaeQfwFd+ijQPnqSXUO:zlsNE67iIWzX5od+QOeCUd+vPlUO
- TLSH T13E121935A568AC338DE2B249F4C736A39FA810B3D8446F94D6E81F1C04C769C2B5BC17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
- Size 240B
- SHA256 4ad742363fe185d4f773019ed004af7489cbb90c45fa93e7f5b990148eb9a704
- MD5 a93cb5395d8fa4d44d3d3e39fc7c3cdd
- SHA1 8e417023797eab3ce2d36c819f794dd6b9c8fb49
- SHA512 d35edc3e92510b48454bb70c1751f8d162b93fc0663c84a9d237dc66b6c8f64dfa22e839159b54246168cdbb261891a308d420e4693bd419db9b04ef7604b325
- TLSH T1D8D0A73B51448FBD96C193854A6CC946A5E44764A3960418EC467CDCB65245D1337464
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json
- Size 2KB
- SHA256 52bfb22aa2d7b0ce083d312fb8fa8dcda3063207186f99fc259aebd9064cbedc
- MD5 f4e4a03ebd0ab3a953c56a300d61d223
- SHA1 97a9acf22c3bdd6989d7c120c21077c4d5a9a80e
- SHA512 12aa71eea45720a4d7d057da0b662635671e4cd165ad2e0d30a3d2a43950b47dd60c26c1bbbe049418f815850e571b8d93e4c8b8cbbd686abc3cf7926ba719c2
- TLSH T12F519CEB0003BD5826FF95057133F52FF48FE096548856DB98C1E8BFE6A9064B29A028
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xlqklsmx.x0l.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\dark_arrow.cur
- Size 4KB
- SHA256 7f8d680821cd916ccfc4c9d9203cdd8e90ec9833e1cccd489ce9edf4f8cfafc8
- MD5 57970063bf80acc3076ae100061067cb
- SHA1 fcdf69ed12cfaac2a12c095b0fa2c65d3c3573b9
- SHA512 e33a8b867dc73df7983c5448ea05c0244c9ebadedfc9da75954df9068ae91941481819d4153b6bf8358574103907b506069bd1cad7e7bd2b733d3c301a8ab69c
- SSDEEP 6:Gl/KlsuO++OueeuO++OueeuO++OueeuO++O7Lb:C+
- TLSH T19591024073C0D05CC14437340002C1FE02797C115174124334C13C03F5010470836640
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\dark_cross.cur
- Size 4KB
- SHA256 9e4f34f5e3e3ff248ff08afa42e684a7a514f83cac2bb266c9953eaedc33ae4a
- MD5 ee757b02aab2dfca7e44fde44da36f28
- SHA1 638a11ed5453901557e56533ba8f42cf0437739d
- SHA512 b82bc8f83cd1342cb12c7e968f67fd506706e625d6808e3522f6344db7b21ac6302fdb162a295d3b19dea3a2d1d1312de386eff7155404b04cc6c8b1f2cd6108
- SSDEEP 12:CW4gSgSgSgSgSgSgSgSgSgSgCAyACgSgSgSgSgSgSgSgSgSgSg:74HHHHHHHHHHHnnHHHHHHHHHH
- TLSH T12F9101442E001F58C1C4033440CFF147C269F41D517F124034D13C0347010440C27743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\dark_hand.cur
- Size 4KB
- SHA256 7caf5058c473b2dae0aefe8b18ef2b8a0ba915abb1faea4b9aa2a292701db1d2
- MD5 2366eaabf4dc870a0e874958f2295951
- SHA1 2b0a43f1aa40fac8b28761141bcff0c12cb94058
- SHA512 78621810ab1137c4826733d97a59e9300978256d737cde86f1cdd47dfb85de4e56e01fc07f9f90a0e704feff72c54bcacc30bd1516217e8b1557b121ff6382ff
- SSDEEP 6:Gl/mlsaBH+qBi+6B3+KByaWBnuuu3+uue2/muWvG+2fmOWPGe2/muWvG3vm++++X:CSD7cbcsCbyri7SLCbyS
- TLSH T1B49104423EE0DA58C2C4763408CFE9FFD279BC2A916A924734C23C03F7010670827A43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\dark_no.cur
- Size 4KB
- SHA256 18b03003f1e87a1be96e13ab20fed4e2217207c7e5ca46a70566e0a60bf1c16d
- MD5 3d6acc0fb1ab6c6ab00852cb72da4257
- SHA1 044b35578218b1796e6d1a6914cfc8c006ad17b1
- SHA512 e9dc119da6ca59ba21721b9f7bb795adeae48a9838787820ff39c964f13e9a06fa0bdb9094492cce4b07a70445f817409b2c160e09cec0cbf7db8e599bc63314
- SSDEEP 6:Gl/GqIlsaBH+qBi+6B3+KByaWBnuuu3+uue2/muWvG+2fmOWPGe2/muWvG3vm++7:CWD7cbcsCbyri7SLCbyS
- TLSH T1A59104463EE0DA58C2C4323448CFE9FFC279BC2A916A924334D23C03F7010470827A43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\error.wav
- Size 11KB
- SHA256 97383090bd35c705d3cf6d6b3885c4e13e801188bc66c4b48ded560058b08a02
- MD5 238ff871dcd2332ef5c87f5eb9677aac
- SHA1 1b54388330e23af9a0dccf62f91e645f7e0057e9
- SHA512 2daaebf23365a4c6a7b9d8642813f31eb14d88aa62937a379996fd702344eb41346773bc01a0299b394d0c794e2ae41bf6531d6a5b1ab174d316b29a2e4470c2
- SSDEEP 192:X5YqdkY/Yk5hheeWAHKEDAd8Jc28YXSJfArVhyzEu8GV/oY:RkYve2HKEG8t8YXSKNM/L
- TLSH T1A032BFD13AB957C8F01792B3FA584C16C931B95B749F81CD13D53CA6432E2B2006A8FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\logon.wav
- Size 41KB
- SHA256 609f5a04c8155ca2f036cb0faaed752196588a7f73dab305b6399162b9d6b358
- MD5 31ed572ccd52aca12b1908bd8dcd48fa
- SHA1 2a3d1e802780075e1bf0d9bc4e3d418781afcfec
- SHA512 d9c999d0ac508d1c455b691c157a963ee403a2a2ff8ba8e6cfc014f7d2da3a1060a6edbb5f08fc919a967b814ca7bed243a443eafa89e958a151b29d31646057
- SSDEEP 768:JirAbgmBv6s7sg+zBVPjLb39YqAg05wFTEVOebLFYhd1Q50BdgXgWc5iARo4:KCtsPzBdD399FIVxF61gXgW8iW
- TLSH T12F13D067D4A08F8187E4C3839E863C0497A57892FC71EDEF6985CE447243F1AB979026
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\VesperaRebrandPC\Assets\user_avatar.png
- Size 176KB
- SHA256 8a8a2fa6e078ad7847de38212e5c8605d6222b77995feb184217520900dbd006
- MD5 3aac6dbae97fde9e8958963085177268
- SHA1 9af4cc0d31fe73652afdcf6a9dcbdc90e12556e6
- SHA512 6e9f9eaa7a3d7f46a7aa5bbc2ee870dfb34d4da4b84549667b4ec4ce76a8a6dd15ac250534ee63150b20175be3d939fd6423d61ddb0bdcd541fe517c94ca3249
- SSDEEP 3072:9yRkqQ6LuET6RcQsAHuymfcoOSBpUaetjcFfqFQpN0jkJbJxnSqVuiCO6b:9ituET6RcaHfmROJ15FpkNSqwiCOq
- TLSH T1C004232B4D8BBCB1F96032F9989EC9283E2878FB02261787125E45CD8D7D6F645D8931
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\vlc\vlcrc
- Size 95KB
- SHA256 21675f120002ca528b68df9a610ba3d46df1596dc741f7ed426b95783dec81ef
- MD5 f24c1dba91bd70017edb8d8ff8731de5
- SHA1 77077b518464e494ac705a22edb8413e3a012587
- SHA512 f8475e1ccec644d599bd42c6b7b70fba47831d26ca3af572da8da8424dd80960ccf08c8d4cd6bb2ad93ef213120b77fb9fb3ce855d6ead2969ce695f63175a62
- SSDEEP 1536:6Pezh1FZ5f4z8ubu+3z8Y683+uHb40CZEk1vfI50FNpSN5d7wL2:ttf4z8OYplHZEj50FNpi7V
- TLSH T12C9370E45DE813908402D48733E9F0C4F62EA93EDE8C2236999D674413D9DEE7A189DF
- MD5 SHA1 SHA512 SSDEEP TLSH