| File name: | 1 (52) |
| Full analysis: | https://app.any.run/tasks/999de3b5-adc7-41b7-9295-f945e72348b6 |
| Verdict: | Malicious activity |
| Analysis date: | March 25, 2025, 00:31:10 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 01EA01B5A60885806EFAD7B0DEAAEDC0 |
| SHA1: | 0C00C31D953CFAA5D66310DEF3F6F5EC16B2EEDD |
| SHA256: | 2486E3620AEE3B90EAD7145145CF4A2BA196BFFA1DEB841697025C801D002276 |
| SSDEEP: | 6144:tJw8cSm+QDQeAuay1wesrZSx56Pqlp8GBs/xyeOLYk/8SwjwpyAvEhXuLEAVqyJa:tq1rSeAu/1rcPM+asJyeOLbx4DxmDsR |
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-56719.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56719.exe | 1 (52).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 668 | C:\Users\admin\AppData\Local\Temp\Unicorn-782.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-782.exe | Unicorn-4259.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-12427.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12427.exe | Unicorn-9712.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 904 | C:\Users\admin\AppData\Local\Temp\Unicorn-21591.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21591.exe | Unicorn-8334.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-6899.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6899.exe | Unicorn-37643.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1132 | C:\Users\admin\AppData\Local\Temp\Unicorn-15499.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15499.exe | Unicorn-55908.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1228 | C:\Users\admin\AppData\Local\Temp\Unicorn-52232.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52232.exe | — | Unicorn-782.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1300 | C:\Users\admin\AppData\Local\Temp\Unicorn-3330.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3330.exe | — | Unicorn-7059.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1388 | C:\Users\admin\AppData\Local\Temp\Unicorn-62311.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62311.exe | Unicorn-3586.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1568 | C:\Users\admin\AppData\Local\Temp\Unicorn-52081.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52081.exe | Unicorn-38045.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4208 | 1 (52).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56719.exe | executable | |
MD5:10F3FAB03A3ABE6FE45EFED427FE3C0D | SHA256:3FE6C729DCE497B6044A170F40265325B8D3836EDAF43F85783AADB77DE47AC3 | |||
| 6192 | Unicorn-3586.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62311.exe | executable | |
MD5:8243439E0F69FDEAC2CE6E706A8E1BB0 | SHA256:E0EF6A84D5559955C12E1CBE6C80963285FABC2767827CFE090DE91E20B079DF | |||
| 6728 | Unicorn-46952.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3586.exe | executable | |
MD5:C4AD42B6976BDFC97D5F1201EAE1BC66 | SHA256:D84D004A59BF997DAD2749BB094EB192B368E40DB5EEE407D0E59209F4F2DC08 | |||
| 4208 | 1 (52).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27086.exe | executable | |
MD5:F878EED6914D52567C0D601E0D87AE09 | SHA256:132950A9E6B40F1A87F82BF74554254E115CF1649AC97D190D06995C722310EB | |||
| 616 | Unicorn-56719.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23907.exe | executable | |
MD5:728CA15C9EEE47BDA3C461C2D0C9F106 | SHA256:9E94FFA526975CE3AB7B3703749A88EB31370F6EDC3C34FAF9121FDD453EC554 | |||
| 616 | Unicorn-56719.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46952.exe | executable | |
MD5:027BDC83EE1E02866067B7F03B88449B | SHA256:715430A6950117EE0DA37B3D9DA426CBE14BEAD8C317F1B6C414CA6F1622C1BD | |||
| 6872 | Unicorn-3586.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25091.exe | executable | |
MD5:3986E41117F4D407E95E86DC8D62A21F | SHA256:299C3CCD4CE20136721C21DCC3233398ED79CF5608AB178683AD6588798E92B8 | |||
| 4208 | 1 (52).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37643.exe | executable | |
MD5:1974925A1AC8BEA2B5FB2F247DACF3B3 | SHA256:C92131EBF88866224AE7EEB9F0D70AD5C45B4F2F991564AA3099685441A8D893 | |||
| 7144 | Unicorn-23907.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36858.exe | executable | |
MD5:CF57218C2505998B352D77A4F2C5E9C5 | SHA256:F84C087B28063307DDECC8B58D1D9C5A78D5326C712BA9124C62589CD700CEDD | |||
| 2692 | Unicorn-27086.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16992.exe | executable | |
MD5:5FE1BA4EE62D225D2C9D2ED1B5B0FCFC | SHA256:01CBB1ABF68209439811A3820045FC16B465EA6894A14DD8980F9DB56CF51E2C | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.168.200:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6712 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8700 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8700 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 2.16.168.200:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6544 | svchost.exe | 20.190.160.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6712 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6712 | backgroundTaskHost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |