| File name: | 1 (378) |
| Full analysis: | https://app.any.run/tasks/94c780fc-d19d-430f-a0ea-64a4306d71ba |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 20:04:14 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 7EFD8BB7272CBC825B9418ECB3BA6210 |
| SHA1: | CB9F12B722E9E57A4B8BD1AD6893E01D7D0B4901 |
| SHA256: | 7E7BE0F4F8DDEF8C0E78C72ECA5B3215CE9AC6EE9D3817EF6547E12FB48A299E |
| SSDEEP: | 6144:QPH/erIkSDyEA5n05VeOET6x5t32lA8GjH/reDZKk/8fwjwpyA7Eh4MbMntbEnxM:QP2cMEA505MA3Q9EHTeDZfx4DxmDsR |
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Üawaii-Unicorn.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 300 | C:\Users\admin\AppData\Local\Temp\Unicorn-64871.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64871.exe | Unicorn-4357.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-28634.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28634.exe | — | Unicorn-43911.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 516 | C:\Users\admin\AppData\Local\Temp\Unicorn-5535.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5535.exe | Unicorn-21082.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-62406.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62406.exe | Unicorn-63433.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-17548.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17548.exe | Unicorn-45032.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 728 | C:\Users\admin\AppData\Local\Temp\Unicorn-32732.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32732.exe | Unicorn-6282.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 732 | C:\Users\admin\AppData\Local\Temp\Unicorn-54549.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54549.exe | Unicorn-10631.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-39722.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39722.exe | Unicorn-30812.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 960 | C:\Users\admin\AppData\Local\Temp\Unicorn-32178.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32178.exe | Unicorn-55338.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-47428.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47428.exe | Unicorn-29106.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5508 | 1 (378).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57974.exe | executable | |
MD5:5CCEF5B0631EF23B5BD38C021A417F39 | SHA256:F71C93B948D397DBF19D0F83DE1608CC7A21F7DE1B67AACD6A0A0AEAE83AC796 | |||
| 7464 | Unicorn-44518.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10631.exe | executable | |
MD5:462FDE78132B83BE71E6FA3AD630590A | SHA256:4D6A04F972CBFF1CA55A1E1891A5AA11B2B9ACF987A1E40B35BB3918C1A2F486 | |||
| 5508 | 1 (378).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-1439.exe | executable | |
MD5:2A2CE0D69C08D855491B8F9DF40CC618 | SHA256:6A778FFF9BAC889F4E6C4640292753371C0F25E5532DE0EC0AAD23587E7005B5 | |||
| 5380 | Unicorn-57974.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39282.exe | executable | |
MD5:705F09BE4DAD9D7337A5CB75631E44FF | SHA256:100D83C90180F729EED725ED8AC63F59CCD32BF3DD73F5A31CA80CE2265370ED | |||
| 5508 | 1 (378).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-41974.exe | executable | |
MD5:105D25285A2D396DEE011AD2521D3851 | SHA256:C3BE69EDD90AC2EBD5CEECEB10526746AC3D24D4D4EE357C83AE1B2E9E9A8BD2 | |||
| 5508 | 1 (378).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6282.exe | executable | |
MD5:CC463D0C3909FF73F023B17894C81113 | SHA256:61781F64E23330A0332B85BDE80C76A1A16C5D398292DDA8316B24CD8055F10A | |||
| 5892 | Unicorn-41974.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44518.exe | executable | |
MD5:B694440A328882201F5E53F3F446DBFB | SHA256:16C8E8A69B0423AA5A6E3849DFE005B72DF516B5D2BD0B284C87105CC5AC50AD | |||
| 7424 | Unicorn-13791.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29106.exe | executable | |
MD5:D6D0A75591CD9CE92284CA1195E29213 | SHA256:D3B6F09B8AA663922C98B625B4AEAF50CC5E94FF91F8EE8677C55D44E27A184A | |||
| 5380 | Unicorn-57974.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28736.exe | executable | |
MD5:1256C201AF135EC268D0B1B5D3C4E9BD | SHA256:193C3C806877DBD338913F104C5A31085C71DFC5CBAAE04D0D6EF40254B2D87A | |||
| 5380 | Unicorn-57974.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4501.exe | executable | |
MD5:BBE9DA7E4573961ACC63D4904D9719B7 | SHA256:75CD86B1DA320877DB50CF0E1D899D23CC060BDC6C25BF5C96F2C8EC43436450 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.190:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2432 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8516 | SIHClient.exe | GET | 200 | 69.192.161.161:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8516 | SIHClient.exe | GET | 200 | 69.192.161.161:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.190:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.67:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2432 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |