| File name: | 1 (545) |
| Full analysis: | https://app.any.run/tasks/cfb05720-097a-4193-99e6-0e5c6d513456 |
| Verdict: | Malicious activity |
| Analysis date: | March 25, 2025, 00:06:08 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 34F8614F46D03B196560144EF35B26B0 |
| SHA1: | 03D4EFDBAD47D971AA5B34B9AB72D495D9295F0F |
| SHA256: | A92CDB13B6D4C7DDD8511F8883F86CB11AA045D82F07A9894CB581130D675F87 |
| SSDEEP: | 6144:p7K0NdIDvDFqA5BYEShDS+fx/tBKePJGBH/WyeOork/8SwjwpyAvEhX1u7un3rfB:p+UOVqA5eESBBnBaHOyeOoNx4DxmDfR |
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-46731.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46731.exe | Unicorn-12177.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 536 | C:\Users\admin\AppData\Local\Temp\Unicorn-63284.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63284.exe | — | Unicorn-7546.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-9692.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9692.exe | Unicorn-21851.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-23346.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23346.exe | Unicorn-21851.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-3924.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3924.exe | Unicorn-20621.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 728 | C:\Users\admin\AppData\Local\Temp\Unicorn-45153.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45153.exe | Unicorn-43846.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-42286.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42286.exe | — | Unicorn-32061.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-9855.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9855.exe | — | Unicorn-8838.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-25912.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25912.exe | 1 (545).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1012 | C:\Users\admin\AppData\Local\Temp\Unicorn-37716.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37716.exe | Unicorn-64605.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| (PID) Process: | (2240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7396) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7396) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7396) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7584) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7584) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7584) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7944) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6564 | Unicorn-49836.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-35639.exe | executable | |
MD5:CA1D814EDBC06ED19F0542350144CB15 | SHA256:9E744B34D3C39B5682D537D01121E25DCF6D4D8D38773FDFEE3A878D538B02EE | |||
| 6032 | Unicorn-8838.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12177.exe | executable | |
MD5:DAC1B8F6E86454CCD1D8F3C446931EAB | SHA256:F099D9DD842FDDDE38AFEAF33A7484E3549636FDA72A9B7E1B74DFB23EFC3D1E | |||
| 1676 | 1 (545).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8838.exe | executable | |
MD5:05856500FCF210F73C0838B6453532E5 | SHA256:61B982048141B5014474C5FBE9235AAABC36F9AAEFD8DD140B2ECA74E3FBAE2F | |||
| 6032 | Unicorn-8838.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64605.exe | executable | |
MD5:1E7E707C1D06C67EACBC9C9EE0B5562B | SHA256:522DD9A566B25C4CEAEF8FB558B9E4AAE031CA8E25D07B62B7DBF6E23EF69AA0 | |||
| 5548 | Unicorn-64605.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21851.exe | executable | |
MD5:78685A934DCC1C9CD7BBD4193F5ED3F4 | SHA256:892D161BA0439DC8E605045C89DBC9C3BC921BAA04CE7F75D67AB55B7B320140 | |||
| 1676 | 1 (545).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25912.exe | executable | |
MD5:C3C085681FF31EA3750C56FB5E1F306E | SHA256:9509BCF02C360D2B8A366AE2504813AE6BDB6FB0AE6E31E209EBD8103D6913E5 | |||
| 6564 | Unicorn-49836.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63920.exe | executable | |
MD5:C27E87B4AB45574BC274ED27E832FD79 | SHA256:B7F7C674138FA07BEC68B2EB1A79C849A229DF3D839B5035B65C0A029C95C2AE | |||
| 5640 | Unicorn-12177.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14652.exe | executable | |
MD5:97EB70DA67271526DB99FBD0818F06FB | SHA256:E77AB141980848EABFA1952CA8E340518246A10ACCA826A40D05786A3C536242 | |||
| 6032 | Unicorn-8838.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11070.exe | executable | |
MD5:FC43305AA9BB945E4B6DD139507E6749 | SHA256:0791B0E820764261A187F791447C81F5FC27F4083EBFCC50D6D9F66C1CA2ABC9 | |||
| 5504 | Unicorn-35639.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42304.exe | executable | |
MD5:B26810BF88ED39AFD6243A3B19E8DF97 | SHA256:81F238351A5D45B74D44BBBE98E3B402793B652836169FD88941D11B48327206 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7396 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6040 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
2268 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
2268 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6040 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |