| File name: | 1 (556) |
| Full analysis: | https://app.any.run/tasks/000d7fe6-d0b2-4a13-a354-0333d20c3445 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 23:56:07 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 038B3BF8880C680EE3A4054A3E4BDEB0 |
| SHA1: | 8E38E285E56340D791E82671D0E1D8C7271EEAB9 |
| SHA256: | 907073A77945EEE16D711AE6C72243AFC2AA4CE43F0BB66ACC24D95EA7BD395E |
| SSDEEP: | 6144:47ugl5IjNDm5A5R6T4mZJkpx5t3lEp8GB4/KyVTqRk/8SwjwpyAvEhTjvqg6N3pa:4KYKQ5A5ET7k3C+a4iyVTqsx4DxmDsR |
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicrn.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-19442.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19442.exe | — | Unicorn-20111.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-6836.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6836.exe | — | Unicorn-64106.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-53857.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53857.exe | 1 (556).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 732 | C:\Users\admin\AppData\Local\Temp\Unicorn-32009.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32009.exe | Unicorn-13250.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-4137.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4137.exe | Unicorn-38397.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-61439.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61439.exe | Unicorn-10510.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Temp\Unicorn-7086.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-7086.exe | — | Unicorn-4739.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 960 | C:\Users\admin\AppData\Local\Temp\Unicorn-49715.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49715.exe | — | Unicorn-5829.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-20111.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20111.exe | Unicorn-55331.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1164 | C:\Users\admin\AppData\Local\Temp\Unicorn-53769.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53769.exe | Unicorn-43965.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| (PID) Process: | (7364) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7364) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7364) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7612) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7612) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7612) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7788) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7788) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7788) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6808 | 1 (556).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53857.exe | executable | |
MD5:0C03B5C399DBA095E9383DEB90942897 | SHA256:B932C89308E9A44820B7ADFB7183EDDA0189934AC9422FEA7C4137EF57FF765A | |||
| 720 | Unicorn-53857.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59057.exe | executable | |
MD5:30F104E686355C7EBF27742117E874F0 | SHA256:0616CAC688983501932990857C12C90B2C3943AF18B1CFFC635E8CDF0DBAF3A7 | |||
| 6988 | Unicorn-33759.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55331.exe | executable | |
MD5:96DBD57A4BBE8269A583CCECD55D6215 | SHA256:CFD00A6B14E0BEF92D118CBC7BAFF568D9166092E451C592354FDDB6D484D78C | |||
| 4892 | Unicorn-4739.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24195.exe | executable | |
MD5:4F1AB0953CAC49CEBB13C44E38915F95 | SHA256:C0567F9FC93385E81D754AF8BEB27F9BF2E2F42BB6BD1734E49E8E03FB8F9623 | |||
| 6668 | Unicorn-43965.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53769.exe | executable | |
MD5:44B10EAF929EAB8659A2654D0C2D3195 | SHA256:7B699F733ACE9A3997E1E34141B4B806E691416249A63DC3F55C1FDD46F18CEA | |||
| 6808 | 1 (556).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43965.exe | executable | |
MD5:72296E076FCBCADC9454D7F859F74C50 | SHA256:8C311949960048578BDECC5FC4216B54A7061E92CA5221CFD8A4871E8E24B3DA | |||
| 720 | Unicorn-53857.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12828.exe | executable | |
MD5:A69034E29859B72340F2209DCEAC0C78 | SHA256:4812219324AF64295AD63C029B8CB5D5BEBDC780D759971B0FE0F392B3EE9BBE | |||
| 6744 | Unicorn-59057.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4739.exe | executable | |
MD5:E3494961193C3990FFEF5B365BB98F65 | SHA256:FF3E847B6EF25FA388F10FF7733E99D64AF8A97232C579B739057DD6FBF51DF3 | |||
| 5380 | Unicorn-27537.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18959.exe | executable | |
MD5:10345765CC7EBD14C7F56F8E53066A2F | SHA256:07A10AF78CE2729D6A0D17C6FEB002B0DE34A79417B77ADC5C9305246362D17B | |||
| 6808 | 1 (556).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57588.exe | executable | |
MD5:42E925D2E92865BE1A164972BDC50A6A | SHA256:85BE617680D0C94FF63005EB594900C9C192484ADB3D4E887D2B32051934B5C4 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6272 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8432 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8432 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 20.197.71.89:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 20.190.159.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
6272 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6272 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
7612 | BackgroundTransferHost.exe | 104.126.37.128:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |