Overview

overview

8

Static

static

3

RoseNotifier.exe

windows10-2004-x64

8

RoseNotifier.exe

windows11-ltsc_2024-x64

8

default.pyc

windows10-2004-x64

3

default.pyc

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 11:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RoseNotifier.exe
  • Size 14.2MB
  • Sample260701-m723sact8k
  • SHA256 b78a1f5fb3927a828cf5d03b1f714926c09e7b2c018da2142ce23a6643423922
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistencepyinstallerransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 46 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RoseNotifier.exe
    "C:\Users\Admin\AppData\Local\Temp\RoseNotifier.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5724
    • C:\Users\Admin\AppData\Local\Temp\RoseNotifier.exe
      "C:\Users\Admin\AppData\Local\Temp\RoseNotifier.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "IMAGENAME eq rosenotifier.exe" /FO CSV /NH
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1236
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /PID 5724 /F
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5616
  • C:\Users\Admin\AppData\Local\GoogleChrome\corehost.exe
    "C:\Users\Admin\AppData\Local\GoogleChrome\corehost.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:984
    • C:\Users\Admin\AppData\Local\GoogleChrome\corehost.exe
      "C:\Users\Admin\AppData\Local\GoogleChrome\corehost.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\System32\tasklist.exe
        tasklist /FI "IMAGENAME eq corehost.exe" /FO CSV /NH
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5888
      • C:\Windows\System32\taskkill.exe
        taskkill /PID 984 /F
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4088
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5376
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5656
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1928
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:876

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        corehost.exe
        • Path C:\Users\Admin\AppData\Local\GoogleChrome\corehost.exe
        • Size 14.2MB
        • SHA256 b78a1f5fb3927a828cf5d03b1f714926c09e7b2c018da2142ce23a6643423922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\VCRUNTIME140.dll
        • Size 93KB
        • SHA256 92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_bz2.pyd
        • Size 84KB
        • SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_ctypes.pyd
        • Size 124KB
        • SHA256 73acf2e0e28040cd696255abd53caaa811470b17a07c7b4d5a94f346b7474391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_hashlib.pyd
        • Size 64KB
        • SHA256 12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_lzma.pyd
        • Size 159KB
        • SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_queue.pyd
        • Size 28KB
        • SHA256 3bc50ac551635b9ce6fbcddea5d3d621c1216e49e9958fa24546ab8f6f2d111a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_socket.pyd
        • Size 78KB
        • SHA256 258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_ssl.pyd
        • Size 151KB
        • SHA256 e4aa33b312cec5aa5a0b064557576844879e0dccc40047c9d0a769a1d03f03f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\base_library.zip
        • Size 858KB
        • SHA256 e113502ecb8e0b8962cab091abd6d7a732065e7f266fa285cefcd503ac261307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\cache\os.py
        • Size 9KB
        • SHA256 96a584dd19af6056b83caf9c9f1035c15d75620d13185f8a10c8e6ba1dc5d14b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sys.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\cache\sys.py
        • Size 9KB
        • SHA256 afda25e6f3c81240f7e87b0d845d78c5936e6ec4961f151abd9975d017014962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\libssl-1_1.dll
        • Size 674KB
        • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\psutil\_psutil_windows.pyd
        • Size 75KB
        • SHA256 d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\pyarmor_runtime_000000\__init__.py
        • Size 101B
        • SHA256 86235c3baffd3e2ecd4626db29542eaf05f857f4bc3d73c5157a32fa98972ac2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pyarmor_runtime.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\pyarmor_runtime_000000\pyarmor_runtime.pyd
        • Size 605KB
        • SHA256 6ea2ceb961125a8a22e9494692b846b9960e1f19eee28664f45e0ca5191daa65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\python3.DLL
        • Size 58KB
        • SHA256 1dc81d8066d44480163233f249468039d3de97e91937965e7a369ae1499013da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\python39.dll
        • Size 4.3MB
        • SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\pywin32_system32\pythoncom39.dll
        • Size 543KB
        • SHA256 9b3d25eb5b8cd86dac4b6301df30c2a9b9815732e52b6d8e96bf58a6ad988a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\pywin32_system32\pywintypes39.dll
        • Size 139KB
        • SHA256 4dcdc4f5e684d0c031122515b4f089e33dc0cc9869ef1ab65832ac90cf428906
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\select.pyd
        • Size 28KB
        • SHA256 c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\unicodedata.pyd
        • Size 1.1MB
        • SHA256 7f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\win32api.pyd
        • Size 131KB
        • SHA256 2ab33cca6227c6a2d5d9cc5e694a678a292b3b26e299cb94343a466900d7014c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\win32crypt.pyd
        • Size 124KB
        • SHA256 f8eddf3ca7024622cc4de54aa24f6eb2befddc6c93a7ca9a7dea9ea8d636de6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/876-209-0x0000020603BA0000-0x0000020603CA0000-memory.dmp
        Download

        memory/876-217-0x0000020607800000-0x0000020607900000-memory.dmp
        Download

        memory/876-216-0x0000020605FE0000-0x0000020606000000-memory.dmp
        Download

        memory/876-229-0x0000020607720000-0x0000020607740000-memory.dmp
        Download

        memory/876-254-0x0000020617BC0000-0x0000020617BE0000-memory.dmp
        Download

        memory/2760-172-0x0000000061B00000-0x0000000061BA5000-memory.dmp
        Download

        memory/2760-170-0x0000015F374B0000-0x0000015F377F8000-memory.dmp
        Download

        memory/2760-171-0x0000015F37960000-0x0000015F37A74000-memory.dmp
        Download

        memory/2760-169-0x0000015F36D70000-0x0000015F36D98000-memory.dmp
        Download

        memory/5000-116-0x0000000061B00000-0x0000000061BA5000-memory.dmp
        Download