| File name: | 1 (1336) |
| Full analysis: | https://app.any.run/tasks/c494c934-50b2-47c7-8417-b03d2d2cacf0 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 12:35:02 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | C2EBA609E3F74431DC31CF63BB543220 |
| SHA1: | 1C9716342589BA4C52799A0451711A66464C4E1E |
| SHA256: | 3C657BA282F283F7A25D2460DF22EB1DB64D52403C1713605E77C4E06ABD40BA |
| SSDEEP: | 6144:XyKgt/OPyDhHA5l3tdevRzfr/tB6lvJGBV/Wye5SZk/8SwjwpyAvEhfYaH209zVa:XTU2qHA5VtUPBchaVOye5SPx4DxmDsR |
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-59048.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59048.exe | Unicorn-40325.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-34108.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34108.exe | Unicorn-14138.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 732 | C:\Users\admin\AppData\Local\Temp\Unicorn-5379.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5379.exe | Unicorn-23374.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 900 | C:\Users\admin\AppData\Local\Temp\Unicorn-9463.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9463.exe | Unicorn-28222.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1020 | C:\Users\admin\AppData\Local\Temp\Unicorn-18649.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18649.exe | Unicorn-377.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-54720.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54720.exe | Unicorn-14033.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-43236.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43236.exe | Unicorn-6375.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-47512.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47512.exe | Unicorn-20334.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1388 | C:\Users\admin\AppData\Local\Temp\Unicorn-10755.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10755.exe | Unicorn-33340.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1512 | C:\Users\admin\AppData\Local\Temp\Unicorn-2836.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2836.exe | Unicorn-22741.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5968 | Unicorn-2890.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55140.exe | executable | |
MD5:2F4E8DA08428C2794A84F10374846C70 | SHA256:882EFC1E022AD4E28AC8D7A84D71936668270968C4BBC836BF03914C3D36ED12 | |||
| 6268 | 1 (1336).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51122.exe | executable | |
MD5:C65D16541B226EE87604361C416CCDF8 | SHA256:8267958673BC67516D01795983AD8CAB05AC8510FFDEE6AEF2D620DCA2C447A1 | |||
| 7400 | Unicorn-55140.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19042.exe | executable | |
MD5:47D3E5071730B25891532B529731759A | SHA256:D9ABD0F400EC9B6C85853815A5998DDC5D6C757C539E60773CC16477684BE7CC | |||
| 5968 | Unicorn-2890.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9675.exe | executable | |
MD5:A2BB48AF7336473E381B82792DFD5099 | SHA256:BFB109623A293A432DB7BDBDACAC5EF9E0E1F5FEAF0008398A0044FF73B3CF25 | |||
| 7492 | Unicorn-57252.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4372.exe | executable | |
MD5:A766F8E41BEB01D11BA352438A6140FA | SHA256:8ABB8D2456F6262BDE83043FA5F52CB88ED490817FEC83D2055EA582AEE31861 | |||
| 7400 | Unicorn-55140.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3967.exe | executable | |
MD5:C013C280B3C4836A6DF065F9704BA8E2 | SHA256:A1618F8FEF693F6BD4FB9C453340CF3B27916E6C7FD800FE14406AC53C103C82 | |||
| 7416 | Unicorn-14854.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57252.exe | executable | |
MD5:4EEFF78CCF2C51C4DCE1FEAC8DD0E723 | SHA256:AAE5B8768D1ACC8827330929C1C6355BB94C881F5FC3CD67061308DAFE8383A7 | |||
| 7456 | Unicorn-3967.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59328.exe | executable | |
MD5:D5B232C1F46BDE3A637C847B4D1C2BF7 | SHA256:02E449E58F614287EEF4EE3A281A4840D77A9F5AC4514939A6CA31406D8B28C2 | |||
| 7532 | Unicorn-59328.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28960.exe | executable | |
MD5:32F26B40F9DDEF7838CB8D93B44DD54B | SHA256:5F157920C9E0C63B68CB1F8237E982EC9E34A76D6C41CD522E01A935ACDD2672 | |||
| 5968 | Unicorn-2890.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63779.exe | executable | |
MD5:C15F61B6537318867A744F35955CBFC8 | SHA256:F61CCA1096B3F836E87C8EE0E344787CD575C310683A0CB04819D2DD6E92E316 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1812 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5116 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5116 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.48.23.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
1812 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1812 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
5116 | SIHClient.exe | 4.175.87.197:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |