| File name: | 1 (556) |
| Full analysis: | https://app.any.run/tasks/000d7fe6-d0b2-4a13-a354-0333d20c3445 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 23:56:07 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 038B3BF8880C680EE3A4054A3E4BDEB0 |
| SHA1: | 8E38E285E56340D791E82671D0E1D8C7271EEAB9 |
| SHA256: | 907073A77945EEE16D711AE6C72243AFC2AA4CE43F0BB66ACC24D95EA7BD395E |
| SSDEEP: | 6144:47ugl5IjNDm5A5R6T4mZJkpx5t3lEp8GB4/KyVTqRk/8SwjwpyAvEhTjvqg6N3pa:4KYKQ5A5ET7k3C+a4iyVTqsx4DxmDsR |
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicrn.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-19442.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19442.exe | — | Unicorn-20111.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-6836.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6836.exe | — | Unicorn-64106.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-53857.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53857.exe | 1 (556).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 732 | C:\Users\admin\AppData\Local\Temp\Unicorn-32009.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32009.exe | Unicorn-13250.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-4137.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4137.exe | Unicorn-38397.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-61439.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61439.exe | Unicorn-10510.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Temp\Unicorn-7086.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-7086.exe | — | Unicorn-4739.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 960 | C:\Users\admin\AppData\Local\Temp\Unicorn-49715.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49715.exe | — | Unicorn-5829.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-20111.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20111.exe | Unicorn-55331.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1164 | C:\Users\admin\AppData\Local\Temp\Unicorn-53769.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53769.exe | Unicorn-43965.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| (PID) Process: | (7364) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7364) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7364) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7612) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7612) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7612) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7788) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7788) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7788) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6808 | 1 (556).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53857.exe | executable | |
MD5:0C03B5C399DBA095E9383DEB90942897 | SHA256:B932C89308E9A44820B7ADFB7183EDDA0189934AC9422FEA7C4137EF57FF765A | |||
| 5512 | Unicorn-61750.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27537.exe | executable | |
MD5:FDB434B9F9A6517A76C5D359976F8EA3 | SHA256:7384CC10A0B400CC0DBB04BA7AD78CD4796B08398101D2DC02440EEF2FF1D8B5 | |||
| 6808 | 1 (556).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61750.exe | executable | |
MD5:2AC1BA81653C4488106F3107E37E2AB2 | SHA256:2AA1FD86CB701EC20CCAD8D1A4735A9FF894E28C33F091FEB4F52D52C786787A | |||
| 6744 | Unicorn-59057.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33759.exe | executable | |
MD5:F2DC664873D5A777757D75E4230481DA | SHA256:7AA077DE67CA39FF20F88B5AC8D79CDEDBFA204EEB0038304728678B33DDAB95 | |||
| 6808 | 1 (556).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43965.exe | executable | |
MD5:72296E076FCBCADC9454D7F859F74C50 | SHA256:8C311949960048578BDECC5FC4216B54A7061E92CA5221CFD8A4871E8E24B3DA | |||
| 720 | Unicorn-53857.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38397.exe | executable | |
MD5:128AE121AC6C5FC53BB8A1A9A87721ED | SHA256:4A3A45432DBF0E5014ADB41F487A104CD204C2F075F8704F6D2B097E7FA3AA1F | |||
| 5380 | Unicorn-27537.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18959.exe | executable | |
MD5:10345765CC7EBD14C7F56F8E53066A2F | SHA256:07A10AF78CE2729D6A0D17C6FEB002B0DE34A79417B77ADC5C9305246362D17B | |||
| 720 | Unicorn-53857.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59057.exe | executable | |
MD5:30F104E686355C7EBF27742117E874F0 | SHA256:0616CAC688983501932990857C12C90B2C3943AF18B1CFFC635E8CDF0DBAF3A7 | |||
| 6744 | Unicorn-59057.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4739.exe | executable | |
MD5:E3494961193C3990FFEF5B365BB98F65 | SHA256:FF3E847B6EF25FA388F10FF7733E99D64AF8A97232C579B739057DD6FBF51DF3 | |||
| 6988 | Unicorn-33759.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24941.exe | executable | |
MD5:6789799CAD76CE03CEF860027E51D37D | SHA256:B573FF602AD35FA924B35BF94D54F0FF0B7686A9D75286A81857604AD009486C | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6272 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8432 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8432 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 20.197.71.89:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 20.190.159.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
6272 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6272 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
7612 | BackgroundTransferHost.exe | 104.126.37.128:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |