Analysis
- user interaction
yes - max time kernel
10s - max time network
14s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 20:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Win11DisableOrRestoreRoundedCorners.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Win11DisableOrRestoreRoundedCorners.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target Win11DisableOrRestoreRoundedCorners.exe
- Size 150KB
- Sample261029-zebrcacd57
- SHA256 30fe82f8975b5322a7474023c18ad7de01bc4ec2cefc444ae65d8bb3f1948d7a
- MD5 0238f27a51b67a3630c4833e2a84a4d7
- SHA1 0d792e375976af68d033d889c560afaf75b49c88
- SHA512 47ca9bf6c296f30d784f0368222142d51943db81bd53c0fcee0dfa7e38a2cd9138cfca0fd564addfeed2ce37dfa8d7b637965ce64ff66b3fb48fb6f0330a49de
- SSDEEP 3072:SikYR6rMK2E5ypkAM5ZMtc/LhmGG91sa5wq:horMR6DHMtCf
- TLSH T143E36B57B3A530F9E5768238C8611A16F772B8321720DBAF03A446761F273919E3EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 4908 dwm.exe 4908 dwm.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\uDWM_win11drc.bak Win11DisableOrRestoreRoundedCorners.exe File created C:\Windows\system32\uDWM.dll Win11DisableOrRestoreRoundedCorners.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Win11DisableOrRestoreRoundedCorners.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Win11DisableOrRestoreRoundedCorners.exe - Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters dwm.exe - Kills process with taskkill 1 IoCs
pid Process 5056 taskkill.exe - Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4908 dwm.exe 4908 dwm.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5392 Win11DisableOrRestoreRoundedCorners.exe Token: SeDebugPrivilege 5056 taskkill.exe Token: SeCreateGlobalPrivilege 4908 dwm.exe Token: SeChangeNotifyPrivilege 4908 dwm.exe Token: 33 4908 dwm.exe Token: SeIncBasePriorityPrivilege 4908 dwm.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5392 wrote to memory of 5056 5392 Win11DisableOrRestoreRoundedCorners.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Win11DisableOrRestoreRoundedCorners.exe"C:\Users\Admin\AppData\Local\Temp\Win11DisableOrRestoreRoundedCorners.exe"1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im dwm.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\uDWM.pdb
- Size 2.1MB
- SHA256 0d68fb8f3169bcc2bb35345d901c4d432115c765eac6076de0d4dccffba598cd
- MD5 24128699cebe2601dee2dc9ed802a4f1
- SHA1 22178829d8256f892061384b2bf4f7fdb620a2ba
- SHA512 3140ab49ec3797235572da618681b08450639ed32128c059974e53b33ad498e48b19ee6350438288d5818ed225578f329feb0424d1f059d1d8b28d3c01818f88
- SSDEEP 49152:ZHWXr+PGrrtk+CG2YVdeHmbdF9FZRMUBBZW57TBN5yW32hNIJSzesNKi8rDWXrN0:J5vB6Nb
- TLSH T16BA5B42277EB1992D92B437645CA1395BAB5DF422765C69F3D2372722CE3042CF8FA40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\uDWM.dll
- Size 1.2MB
- SHA256 3054d946cb8ef67a8860fc4feee5852ed20bd3f7dce8450749a902be49356dec
- MD5 3bb1372e3aa74ab2cdcd6b2deaf7db47
- SHA1 b3649764712771b9f55553f4350cbfcbcf5b0bb3
- SHA512 82c66f9da69ba1a97acaa527404490c86f7816829f59c339970637af69438a6de15382484944bbb55a5e89f21e014db040e01aa9dcd36bc6c713f5fbe0459fd9
- SSDEEP 24576:UALkfWzvqxrthGKb6zkF3LYrB5jDCeTps8pnWe8vRXRbiFD272R4UgknpBZ:UAnv2YrX+elhkegRXRbiFD2yRTgkp
- TLSH T1E9456B2A26ED40E5D9BAD23DC513861FEAB1781063315ECF1250426D9F3BBF49A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH