| File name: | 1 (35) |
| Full analysis: | https://app.any.run/tasks/489f9a4e-97ac-46de-913a-9859988ee40a |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 20:38:48 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 0E3E58A3550555727A9B8E80DF6A6690 |
| SHA1: | 6F01BEC378910B2BB3154280CFA4F65C1B3CE991 |
| SHA256: | 2890B151012D61DB766EB0A02A15CA2BD2CE92C76027F2D592939A885676DCA4 |
| SSDEEP: | 6144:O7dgd7mwfD6HA9Z4Y7sXK5fx5pBEovJGB3/WpSaCNk/8SwjwpyiOEh1wKarUYq5J:OhUi5HA9GYQUBbha3OpSaCGxYDxDsR |
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProdctVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-46558.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46558.exe | Unicorn-53766.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-54348.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54348.exe | Unicorn-65146.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 872 | C:\Users\admin\AppData\Local\Temp\Unicorn-55066.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55066.exe | — | Unicorn-35624.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1020 | C:\Users\admin\AppData\Local\Temp\Unicorn-40206.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40206.exe | Unicorn-20196.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-10112.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10112.exe | Unicorn-54046.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1184 | C:\Users\admin\AppData\Local\Temp\Unicorn-36122.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36122.exe | Unicorn-40708.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1228 | C:\Users\admin\AppData\Local\Temp\Unicorn-62764.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62764.exe | Unicorn-12027.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1324 | C:\Users\admin\AppData\Local\Temp\Unicorn-12172.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12172.exe | Unicorn-40210.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1452 | C:\Users\admin\AppData\Local\Temp\Unicorn-33346.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33346.exe | Unicorn-52074.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1568 | C:\Users\admin\AppData\Local\Temp\Unicorn-2894.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2894.exe | Unicorn-10787.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7348 | 1 (35).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45712.exe | executable | |
MD5:F791FB9F71B206ECDA2E258041A40887 | SHA256:2DB64C63A0CA46343847F8E88F79949DEEF228E1F58686B91096DA1CAC3283C8 | |||
| 7436 | Unicorn-45712.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-65146.exe | executable | |
MD5:A81D2742A12D935007000DF457CB3EA6 | SHA256:022E71DA48B5791E1FCDD05F9F6D5572583E292B1174A28B0C41B0824B21D988 | |||
| 7436 | Unicorn-45712.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40210.exe | executable | |
MD5:6424F9C45BC9B89197FE0F472B38F079 | SHA256:A0B6B124834114F77350CD964CB99F4D104C8FC73FBC322620D1715C1C3BECFE | |||
| 7436 | Unicorn-45712.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40708.exe | executable | |
MD5:C867A851C0240BBD94F9CCA756222D88 | SHA256:B0D626606578DB3D374C66FAEC74233F7DC69769CE74B62906D8620B287074B8 | |||
| 4880 | Unicorn-40210.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12027.exe | executable | |
MD5:500851A1B198362C0F31FCB3CBFD716A | SHA256:3F9A7CA60A84F0D63CCD5EB7863F6F37FEB7F226199CD086149B99B88FC0F799 | |||
| 7348 | 1 (35).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53449.exe | executable | |
MD5:CC7F54DB7CF1CCBEB15E504233981083 | SHA256:A2BD493CFCD4E2DC8DEC4A22CF03AAD07E5CFE9C9FADB59CE8F4B704E80D85C0 | |||
| 2320 | Unicorn-54046.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57144.exe | executable | |
MD5:C37AA7691C588CB16C405B34CCFAC937 | SHA256:786FFA68B5A23BDFDB5F46B7E9A66DF321F4AB3BC00351698B922C102AA6F44A | |||
| 5364 | Unicorn-27303.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20196.exe | executable | |
MD5:C10BCDB4F118E19861F608019598776F | SHA256:5DFDF48D1C66C59A12F8DF04B12CC084EF33FA1823CACD583CC4787DD1030FD5 | |||
| 8132 | Unicorn-53449.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31056.exe | executable | |
MD5:3695BA4BF91AD8254B2EC4F14FCF0D40 | SHA256:E76364A11B9C4B58DE22791DAF24FF7B6A5CF2156BAA4A812544B93DFDE692E9 | |||
| 6944 | Unicorn-43308.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46620.exe | executable | |
MD5:28B2527253302F9B9F4DAA0A1EDDAAF1 | SHA256:14D07F0587859ABE7028111B491C168A7722BCAE41715A63818BC44696ECA3A5 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.141:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.141:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
8788 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
8788 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
7780 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
2104 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 23.48.23.141:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
5496 | MoUsoCoreWorker.exe | 23.48.23.141:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
5496 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2112 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3216 | svchost.exe | 20.197.71.89:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | unknown |
6544 | svchost.exe | 20.190.159.23:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
Domain | IP | Reputation |
|---|---|---|
google.com |
| unknown |
crl.microsoft.com |
| unknown |
client.wns.windows.com |
| unknown |
login.live.com |
| unknown |
ocsp.digicert.com |
| unknown |
arc.msn.com |
| unknown |
settings-win.data.microsoft.com |
| unknown |
slscr.update.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
fe3cr.delivery.mp.microsoft.com |
| unknown |