| File name: | 1 (1144) |
| Full analysis: | https://app.any.run/tasks/86b59299-7a8f-423e-a4d8-330f5ee66ade |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 08:38:40 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 8681810F4E18594136DC826277FE6A20 |
| SHA1: | 8544AF66384F60F92B732F7712BDC64C00AA9B2E |
| SHA256: | EAD413146099AB9BFF0489BA670F581176D78D6E76EF18AD95040B1ABEF857CC |
| SSDEEP: | 6144:i7KpO1IPvDhHl5LEt4eviYfx/tBqlvJGBq/WyeT99k/8SwjwpyAvEhLBUp+0riRa:i+YGtHl5ItzrBMhaqOyeT9lx4DxmDsR |
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 300 | "C:\Users\admin\AppData\Local\Temp\1 (1144).exe" | C:\Users\admin\AppData\Local\Temp\1 (1144).exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 536 | C:\Users\admin\AppData\Local\Temp\Unicorn-49943.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49943.exe | Unicorn-50459.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 900 | C:\Users\admin\AppData\Local\Temp\Unicorn-63271.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63271.exe | Unicorn-25709.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-33839.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33839.exe | Unicorn-51031.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1020 | C:\Users\admin\AppData\Local\Temp\Unicorn-38670.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38670.exe | — | Unicorn-39077.exe | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-48527.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48527.exe | — | Unicorn-44079.exe | |||||||||||
User: admin Integrity Level: MEDIUM | |||||||||||||||
| 1116 | C:\Users\admin\AppData\Local\Temp\Unicorn-22029.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22029.exe | — | Unicorn-56165.exe | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-13789.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13789.exe | Unicorn-5966.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1132 | C:\Users\admin\AppData\Local\Temp\Unicorn-40869.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40869.exe | 1 (1144).exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1180 | C:\Users\admin\AppData\Local\Temp\Unicorn-52917.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52917.exe | Unicorn-13685.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 920 | Unicorn-33839.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13109.exe | executable | |
MD5:1B6D6C75748AF9AB580ED2C0313CAA9D | SHA256:4AAA45F0B0D26101929E782E8F7365FBC2621E81D7C8436C9F2DBF77FDD2AB2D | |||
| 300 | 1 (1144).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51031.exe | executable | |
MD5:E8D7E6E7367573CA336578367B0F7AC2 | SHA256:4AB5BA74751D1F9BAD4A785DE23C0BF40C85A1FE328B732E75F26ABB45F77425 | |||
| 5116 | Unicorn-51031.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33839.exe | executable | |
MD5:FD46F20320A17B32E13E5B8868F04B5C | SHA256:9AC78DDFE69974FBEEAE9CA5176883E1A3FC01CE5207A5C13D877F456136E3B8 | |||
| 5116 | Unicorn-51031.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43757.exe | executable | |
MD5:E3A89AACB72C9C2C6D307E5E52211ECF | SHA256:E4FF282C6C8DFF06F53F747E690F6FFE749AAE9933F3DF17A4FA54E7349CB573 | |||
| 6424 | Unicorn-5966.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47775.exe | executable | |
MD5:ED72A0234C1A3ADB12B1AD8AE7A9553E | SHA256:7A8A96AF3F468D2DA3E86A9603FAE180516CFEF9D3A9895634D8CB70BBBC886D | |||
| 300 | 1 (1144).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40869.exe | executable | |
MD5:80461C433C50F4B5B9B4C6F64F1FB7A8 | SHA256:8CF0804142A6DDE3B46A3C42F449B4649653BB5B126476411CC094E37DAD618D | |||
| 6972 | Unicorn-46999.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49887.exe | executable | |
MD5:7310CAC72D0D05651F7886D0DCFDD6A0 | SHA256:0103BFAC6F6EC15E4B6D3BC9474EA7F7426CA492E08C590B9E3311632FFEADCB | |||
| 5112 | Unicorn-63174.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46999.exe | executable | |
MD5:A40819734F60E9B6342C0BBF56052A28 | SHA256:3318485FE6285A14943FD693FF95AA02BF213B29985E4A187345A021E7C04E07 | |||
| 920 | Unicorn-33839.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5966.exe | executable | |
MD5:9585C0666EBAF0D0E20F2B21DE845DE7 | SHA256:333F5DEF402F69F4BC0263288FC76A9B7ADF2892F90A95577C01687D34446AF3 | |||
| 300 | 1 (1144).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63174.exe | executable | |
MD5:9E17AF65D90E204E99F01346BF375C8A | SHA256:ED4A4B2908BECF1DF58C841DE026E2DEDBB0A04CAD4F1D9016AF6EFFCC2203CE | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
644 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
644 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
3900 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.72:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.164.72:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 4.213.25.241:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6544 | svchost.exe | 40.126.32.136:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
3900 | backgroundTaskHost.exe | 20.105.99.58:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3900 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |