File name:

Windows 10 Rounded.exe

Full analysis: https://app.any.run/tasks/f725683b-79dd-4b31-92bb-54c2aa6a2f4f
Verdict: Malicious activity
Analysis date: January 20, 2022, 09:05:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

11FF322997D98D02AFE198C20B613FF3

SHA1:

48E70395F187454BDDC01484A6CBCF1C5F1753FC

SHA256:

9482BE3FCB23242751DFC68C1F239C92DE3999618CA2D3AE0D7C9F5F596876F4

SSDEEP:

49152:DXNPtf+dAGSXAZGxgF3Nr13EfePGBT5OHTdg5K6EnCN11Y:DPxD5g1p9keGLc+SH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Windows 10 Rounded.exe (PID: 1060)
      • UXTheme.exe (PID: 2656)

    • Loads dropped or rewritten executable

      • Windows 10 Rounded.exe (PID: 1060)
      • UXTheme.exe (PID: 2656)

    • Registers / Runs the DLL via REGSVR32.EXE

      • RD.exe (PID: 400)

    • Application was dropped or rewritten from another process

      • UXTheme.exe (PID: 2656)
      • RD.exe (PID: 400)
      • ric.exe (PID: 2180)

  • SUSPICIOUS

    • Reads the computer name

      • Windows 10 Rounded.exe (PID: 1060)
      • UXTheme.exe (PID: 2656)
      • RD.exe (PID: 400)
      • ric.exe (PID: 2180)

    • Checks supported languages

      • Windows 10 Rounded.exe (PID: 1060)
      • ns9B35.tmp (PID: 304)
      • UXTheme.exe (PID: 2656)
      • RD.exe (PID: 400)
      • ric.exe (PID: 2180)

    • Creates a software uninstall entry

      • Windows 10 Rounded.exe (PID: 1060)
      • UXTheme.exe (PID: 2656)

    • Starts application with an unusual extension

      • Windows 10 Rounded.exe (PID: 1060)

    • Searches for installed software

      • DllHost.exe (PID: 2072)
      • UXTheme.exe (PID: 2656)

    • Creates files in the Windows directory

      • UXTheme.exe (PID: 2656)
      • Windows 10 Rounded.exe (PID: 1060)

    • Drops a file with too old compile date

      • UXTheme.exe (PID: 2656)
      • Windows 10 Rounded.exe (PID: 1060)

    • Reads Environment values

      • UXTheme.exe (PID: 2656)
      • vssvc.exe (PID: 1444)

    • Executed as Windows Service

      • vssvc.exe (PID: 1444)

    • Executed via COM

      • DllHost.exe (PID: 2072)

    • Executable content was dropped or overwritten

      • UXTheme.exe (PID: 2656)
      • Windows 10 Rounded.exe (PID: 1060)

    • Creates files in the program directory

      • UXTheme.exe (PID: 2656)

    • Removes files from Windows directory

      • UXTheme.exe (PID: 2656)

    • Creates a directory in Program Files

      • UXTheme.exe (PID: 2656)

    • Drops a file that was compiled in debug mode

      • UXTheme.exe (PID: 2656)
      • Windows 10 Rounded.exe (PID: 1060)

    • Uses ICACLS.EXE to modify access control list

      • UXTheme.exe (PID: 2656)

    • Drops a file with a compile date too recent

      • Windows 10 Rounded.exe (PID: 1060)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2648)

  • INFO

    • Reads the computer name

      • DllHost.exe (PID: 2072)
      • vssvc.exe (PID: 1444)
      • icacls.exe (PID: 540)
      • takeown.exe (PID: 3048)
      • icacls.exe (PID: 3176)
      • takeown.exe (PID: 3644)
      • icacls.exe (PID: 3108)
      • takeown.exe (PID: 2496)

    • Dropped object may contain Bitcoin addresses

      • UXTheme.exe (PID: 2656)
      • Windows 10 Rounded.exe (PID: 1060)

    • Checks supported languages

      • vssvc.exe (PID: 1444)
      • DllHost.exe (PID: 2072)
      • takeown.exe (PID: 3048)
      • takeown.exe (PID: 3644)
      • icacls.exe (PID: 3176)
      • icacls.exe (PID: 3108)
      • takeown.exe (PID: 2496)
      • icacls.exe (PID: 540)
      • regsvr32.exe (PID: 2648)
      • regsvr32.exe (PID: 2928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x3461
UninitializedDataSize: 1024
InitializedDataSize: 118784
CodeSize: 25600
LinkerVersion: 6
PEType: PE32
TimeStamp: 2020:08:01 04:43:48+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 01-Aug-2020 02:43:48
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 01-Aug-2020 02:43:48
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000623C
0x00006400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.40258
.rdata
0x00008000
0x00001274
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.0575
.data
0x0000A000
0x0001A858
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.08975
.ndata
0x00025000
0x00015000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0003A000
0x00008280
0x00008400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.03853

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.14431
898
UNKNOWN
English - United States
RT_MANIFEST
2
2.92071
4264
UNKNOWN
English - United States
RT_ICON
3
2.10715
3752
UNKNOWN
English - United States
RT_ICON
4
2.50372
2216
UNKNOWN
English - United States
RT_ICON
5
2.50341
1640
UNKNOWN
English - United States
RT_ICON
6
6.82974
1450
UNKNOWN
English - United States
RT_ICON
7
1.77641
1384
UNKNOWN
English - United States
RT_ICON
8
3.66853
1128
UNKNOWN
English - United States
RT_ICON
9
5.94444
1019
UNKNOWN
English - United States
RT_ICON
10
3.16563
744
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
16
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start windows 10 rounded.exe ns9b35.tmp no specs uxtheme.exe vssvc.exe no specs DllHost.exe no specs takeown.exe no specs icacls.exe no specs takeown.exe no specs icacls.exe no specs takeown.exe no specs icacls.exe no specs rd.exe no specs regsvr32.exe no specs regsvr32.exe no specs ric.exe windows 10 rounded.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Users\admin\AppData\Local\Temp\nsa3016.tmp\ns9B35.tmp" "C:\Users\admin\AppData\Local\Temp\nsa3016.tmp\UXTheme.exe" /SC:\Users\admin\AppData\Local\Temp\nsa3016.tmp\ns9B35.tmp—Windows 10 Rounded.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsa3016.tmp\ns9b35.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
400"C:\SkinPack\RD.exe"C:\SkinPack\RD.exe—Windows 10 Rounded.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1003
Modules
Images
c:\skinpack\rd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
540"C:\Windows\system32\icacls.exe" "C:\Windows\system32\uxtheme.dll" /grant admin:(d,wdac)C:\Windows\system32\icacls.exe—UXTheme.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
1060"C:\Users\admin\AppData\Local\Temp\Windows 10 Rounded.exe" C:\Users\admin\AppData\Local\Temp\Windows 10 Rounded.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\windows 10 rounded.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1444C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft� Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2072C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2180"C:\SkinPack\ric.exe"C:\SkinPack\ric.exe
Windows 10 Rounded.exe
User:
admin
Company:
Mr Blade Design's
Integrity Level:
HIGH
Description:
Reload Icons Cache
Exit code:
0
Version:
1.00
Modules
Images
c:\skinpack\ric.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cabinet.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
2224"C:\Users\admin\AppData\Local\Temp\Windows 10 Rounded.exe" C:\Users\admin\AppData\Local\Temp\Windows 10 Rounded.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\windows 10 rounded.exe
c:\windows\system32\ntdll.dll
2496"C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxtheme.dll"C:\Windows\system32\takeown.exe—UXTheme.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
2648"C:\Windows\System32\regsvr32.exe" /s C:\skinpack\OldNewExplorer32.dllC:\Windows\System32\regsvr32.exe—RD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
3 488
Read events
3 287
Write events
201
Delete events
0

Modification events

(PID) Process:(1060) Windows 10 Rounded.exeKey:HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\Close\.Current
Operation:writeName:(default)
Value:
(PID) Process:(1060) Windows 10 Rounded.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:AllowProtectedRenames
Value:
1
(PID) Process:(1060) Windows 10 Rounded.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SkinPack
Operation:writeName:DisplayName
Value:
SkinPack Windows 11 Modern Dark
(PID) Process:(1060) Windows 10 Rounded.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SkinPack
Operation:writeName:UninstallString
Value:
C:\SkinPack\uninst.exe
(PID) Process:(1060) Windows 10 Rounded.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SkinPack
Operation:writeName:DisplayIcon
Value:
C:\SkinPack\Install.ico
(PID) Process:(1060) Windows 10 Rounded.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SkinPack
Operation:writeName:DisplayVersion
Value:
Windows 11 Modern Dark
(PID) Process:(1060) Windows 10 Rounded.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SkinPack
Operation:writeName:URLInfoAbout
Value:
http://www.skinpacks.com
(PID) Process:(1060) Windows 10 Rounded.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SkinPack
Operation:writeName:Publisher
Value:
SkinPack
(PID) Process:(2656) UXTheme.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000009B60E1F4DC0DD801600A00005C0A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2656) UXTheme.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000009B60E1F4DC0DD801600A00005C0A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
54
Suspicious files
3
Text files
24
Unknown types
6

Dropped files

PID
Process
Filename
Type
2072DllHost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1060Windows 10 Rounded.exeC:\Users\admin\AppData\Local\Temp\nsa3016.tmp\System.dllexecutable
MD5:FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA256:6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
1060Windows 10 Rounded.exeC:\SkinPack\install.icoimage
MD5:8B263537DEB8CE7F8036D6B064811F50
SHA256:47BB8050F70AF7888BA8EEC9506633C5779C8503CE354B1F068EABB89A6F67BA
1060Windows 10 Rounded.exeC:\Users\admin\AppData\Local\Temp\nsa3016.tmp\modern-header.bmpimage
MD5:D7896A36E3707EEFF22295E8D04F61CD
SHA256:BFEE9AAD1D895B830107587CADDDE942D43C3920773E19F08D1C62E3C7D2430E
1060Windows 10 Rounded.exeC:\Users\admin\AppData\Local\Temp\nsa3016.tmp\Aero.dllexecutable
MD5:243BF44688B131C3171F2827A93E39DC
SHA256:04A577DF50431EB0FF6FB103566402BF66C50415BCC1F8A86B9C235053131455
1060Windows 10 Rounded.exeC:\Users\admin\AppData\Local\Temp\nsa3016.tmp\advsplash.dllexecutable
MD5:176EC6DC75972CE900793396723ED374
SHA256:F568EBB5792B5054CD871CBE128E6F409B097E79BE7366D409189E0A1C1F9F83
1060Windows 10 Rounded.exeC:\Users\admin\AppData\Local\Temp\nsa3016.tmp\modern-wizard.bmpimage
MD5:5B6CC42CC68A4FA0DFC40C160F9FF94A
SHA256:01E755C383FE88A0D09B141CBBC334C55E4F3F205CF773EC750C7E3707B914E9
1060Windows 10 Rounded.exeC:\SkinPack\uninst.exeexecutable
MD5:A2293A148D4A9B746474DC9C76E467CE
SHA256:CD88BF74E57C122D25DBBC3B7FFF5590A19A956AD01DFA79F398D44FD694FCE9
1060Windows 10 Rounded.exeC:\Users\admin\AppData\Local\Temp\nsa3016.tmp\nsDialogs.dllexecutable
MD5:1C8B2B40C642E8B5A5B3FF102796FB37
SHA256:8780095AA2F49725388CDDF00D79A74E85C9C4863B366F55C39C606A5FB8440C
1060Windows 10 Rounded.exeC:\SkinPack\license.txttext
MD5:4357516BFD0AFFE4133B27E9DC30E9A7
SHA256:1CFF3139690C417BEE9D893044E67290E5356FFE683EC84A26EAD1AC176F72F0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Windows 10 Rounded.exe