Overview

overview

8

Static

static

3

Rose.exe

windows10-2004-x64

7

Rose.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 07:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Rose.exe
  • Size 45.5MB
  • Sample260626-h82feshw8x
  • SHA256 3c7a3d7278af8885b05be29faee31d1ba99bd8268d64101c64a5bf9ed12f91b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 36 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rose.exe
    "C:\Users\Admin\AppData\Local\Temp\Rose.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\Rose.exe
      "C:\Users\Admin\AppData\Local\Temp\Rose.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      PID:5576
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5932
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4236
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2272
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2372

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\PySide6\MSVCP140_1.dll
        • Size 27KB
        • SHA256 d1a0601e781cab04c8dfd46a488ee8dcf3245092532852e2036f1195845c4c4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\PySide6\MSVCP140_2.dll
        • Size 266KB
        • SHA256 2a0208e4a14e87042469efa481d1f32220bf2a7b7b501173db83c3668fff6669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\PySide6\Qt6Core.dll
        • Size 9.6MB
        • SHA256 c7f6a8b9f2f4e67e50f37662102be9e987a7a061f882112a4982a2446d83662f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\PySide6\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 7b8f64dda29a859755d04622f0dae11282b1598bf027e0b6f4c722e72fc312df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\PySide6\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 1ada9f5b3ca6828f1301ce56cf7fc95eb240b53bfdea15a9cef0cfa6b2077389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\PySide6\QtCore.pyd
        • Size 3.1MB
        • SHA256 d2bd091416eb60b1fd051cc65a42f3efd4db5521b1f1479bba11d44c4d537125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 c2767ba411264cade8698b7fbc089943b5ddbb141ec6a4bbeab56af51320c88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 e09a727f70d027c5dcef08e4bb1c2016d47550104e3ebf3cc1fb36787b1403e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\PySide6\pyside6.abi3.dll
        • Size 254KB
        • SHA256 668d2e42c5afbf9c9a2caec299694ad51ff4d67e962f18cd745382a8b6e3dfb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\VCRUNTIME140.dll
        • Size 93KB
        • SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\VCRUNTIME140_1.dll
        • Size 35KB
        • SHA256 b1d3b6b3cdeb5b7b8187767cd86100b76233e7bbb9acf56c64f8288f34b269ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_brotli.cp39-win_amd64.pyd
        • Size 861KB
        • SHA256 093ab305d9780373c3c7d04d19244f5e48c48e71958963ceca6211d5017a4441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_bz2.pyd
        • Size 84KB
        • SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_ctypes.pyd
        • Size 124KB
        • SHA256 73acf2e0e28040cd696255abd53caaa811470b17a07c7b4d5a94f346b7474391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_hashlib.pyd
        • Size 64KB
        • SHA256 12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_lzma.pyd
        • Size 159KB
        • SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_queue.pyd
        • Size 28KB
        • SHA256 3bc50ac551635b9ce6fbcddea5d3d621c1216e49e9958fa24546ab8f6f2d111a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_socket.pyd
        • Size 78KB
        • SHA256 258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_ssl.pyd
        • Size 151KB
        • SHA256 e4aa33b312cec5aa5a0b064557576844879e0dccc40047c9d0a769a1d03f03f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_uuid.pyd
        • Size 22KB
        • SHA256 6f1cc2d6a770f1b441dc6371decae414ea1bd509b0e37b423faa33fc98a28b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\base_library.zip
        • Size 1012KB
        • SHA256 e0d3cfcaf8aa2fe1ab86db7ebf996d02c4e53eafab24c9a42371d33c52c81c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\libssl-1_1.dll
        • Size 674KB
        • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\pyarmor_runtime_000000\__init__.py
        • Size 103B
        • SHA256 037823142b19fb9de0db360b2f920e9f0f12197245f15eae82fdfda60973c0c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\python3.DLL
        • Size 58KB
        • SHA256 1dc81d8066d44480163233f249468039d3de97e91937965e7a369ae1499013da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\python39.dll
        • Size 4.3MB
        • SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\select.pyd
        • Size 28KB
        • SHA256 c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\shiboken6\Shiboken.pyd
        • Size 33KB
        • SHA256 1bbb27747949b24bc0f6176be73188ef77a83e9db0ac2f933da1b0b7b5e6cb33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\shiboken6\shiboken6.abi3.dll
        • Size 373KB
        • SHA256 0fe96e805a6001efde58818a1ce6cb425227f74be72f3b10d7c06c7435fefa5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\unicodedata.pyd
        • Size 1.1MB
        • SHA256 7f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2272-226-0x000001FB04130000-0x000001FB04150000-memory.dmp
        Download

        memory/2272-208-0x000001FB141B0000-0x000001FB142B0000-memory.dmp
        Download

        memory/2272-240-0x000001FB14570000-0x000001FB14590000-memory.dmp
        Download

        memory/2272-194-0x000001FB00520000-0x000001FB00620000-memory.dmp
        Download

        memory/2272-206-0x000001FB03D50000-0x000001FB03D70000-memory.dmp
        Download

        memory/5576-191-0x000002248FF80000-0x0000022490926000-memory.dmp
        Download

        memory/5576-192-0x000002248FF80000-0x0000022490926000-memory.dmp
        Download

        memory/5576-190-0x000002248FF80000-0x0000022490926000-memory.dmp
        Download

        memory/5576-187-0x00007FFA0D360000-0x00007FFA0D9A6000-memory.dmp
        Download

        memory/5576-186-0x00007FFA0D9B0000-0x00007FFA0DE5D000-memory.dmp
        Download

        memory/5576-181-0x00007FFA0E790000-0x00007FFA0EB45000-memory.dmp
        Download

        memory/5576-189-0x0000022490B60000-0x0000022490B70000-memory.dmp
        Download

        memory/5576-173-0x00007FFA0F500000-0x00007FFA0F825000-memory.dmp
        Download

        memory/5576-342-0x000002248FF80000-0x0000022490926000-memory.dmp
        Download

        memory/5576-383-0x000002248FF80000-0x0000022490926000-memory.dmp
        Download

        memory/5576-384-0x000002248FF80000-0x0000022490926000-memory.dmp
        Download