File name:

windows-weasel-2023.06.15-installer.exe

Full analysis: https://app.any.run/tasks/e2516401-1e5e-4c0d-9e04-10475130d8d9
Verdict: Malicious activity
Analysis date: February 27, 2024, 13:51:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

CD6D5D52183673815CAD35A4C5CE1173

SHA1:

330489BE1446E3375B0EFACC033C4FB34816E057

SHA256:

C424C10E17086F0F9BF499FD930713834F245BCF1E9ECAF625DC18311B1B6272

SSDEEP:

98304:kHs6E0rPOoNUyG4VqXYjDllS3qfQd3UzZ+QcwX2912AH9ss5IXbIRM6UDKRifRRW:m+3Vb0LJejtDdySL+QY/bTe5V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselSetup.exe (PID: 1876)

    • Creates a writable file in the system directory

      • WeaselSetup.exe (PID: 1876)

    • Registers / Runs the DLL via REGSVR32.EXE

      • WeaselSetup.exe (PID: 1876)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselSetup.exe (PID: 1876)

    • Drops 7-zip archiver for unpacking

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

    • The process creates files with name similar to system file names

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

    • Reads the Internet Settings

      • WeaselSetup.exe (PID: 1876)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

    • Reads security settings of Internet Explorer

      • WeaselSetup.exe (PID: 1876)

    • Creates a software uninstall entry

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

  • INFO

    • Checks supported languages

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselSetup.exe (PID: 1876)
      • WeaselDeployer.exe (PID: 2444)

    • Reads the computer name

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselSetup.exe (PID: 1876)
      • WeaselDeployer.exe (PID: 2444)

    • Creates files in the program directory

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

    • Create files in a temporary directory

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselDeployer.exe (PID: 2444)

    • Creates files or folders in the user directory

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselDeployer.exe (PID: 2444)

    • Reads the machine GUID from the registry

      • WeaselDeployer.exe (PID: 2444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:30 03:57:41+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x34a5
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.15.0.0
ProductVersionNumber: 0.15.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
Comments: Powered by RIME | 中州韻輸入法引擎
CompanyName: 式恕堂
FileDescription: 小狼毫輸入法
FileVersion: 0.15.0
LegalCopyright: Copyleft RIME Developers
ProductName: 小狼毫
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start windows-weasel-2023.06.15-installer.exe weaselsetup.exe regsvr32.exe no specs weaseldeployer.exe windows-weasel-2023.06.15-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1876"C:\Program Files\Rime\weasel-0.15.0\WeaselSetup.exe" /iC:\Program Files\Rime\weasel-0.15.0\WeaselSetup.exe
windows-weasel-2023.06.15-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\rime\weasel-0.15.0\weaselsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2160"C:\Users\admin\AppData\Local\Temp\windows-weasel-2023.06.15-installer.exe" C:\Users\admin\AppData\Local\Temp\windows-weasel-2023.06.15-installer.exe—explorer.exe
User:
admin
Company:
式恕堂
Integrity Level:
MEDIUM
Description:
小狼毫輸入法
Exit code:
3221226540
Version:
0.15.0
Modules
Images
c:\users\admin\appdata\local\temp\windows-weasel-2023.06.15-installer.exe
c:\windows\system32\ntdll.dll
2332"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\weasel.dll"C:\Windows\System32\regsvr32.exe—WeaselSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2444"C:\Program Files\Rime\weasel-0.15.0\WeaselDeployer.exe" /installC:\Program Files\Rime\weasel-0.15.0\WeaselDeployer.exe
windows-weasel-2023.06.15-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\rime\weasel-0.15.0\weaseldeployer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\rime\weasel-0.15.0\rime.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2852"C:\Users\admin\AppData\Local\Temp\windows-weasel-2023.06.15-installer.exe" C:\Users\admin\AppData\Local\Temp\windows-weasel-2023.06.15-installer.exe
explorer.exe
User:
admin
Company:
式恕堂
Integrity Level:
HIGH
Description:
小狼毫輸入法
Exit code:
0
Version:
0.15.0
Modules
Images
c:\users\admin\appdata\local\temp\windows-weasel-2023.06.15-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
3 510
Read events
3 483
Write events
27
Delete events
0

Modification events

(PID) Process:(2852) windows-weasel-2023.06.15-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Rime\Weasel
Operation:writeName:InstallDir
Value:
C:\Program Files\Rime
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0210404
Operation:writeName:Ime File
Value:
WEASEL.IME
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0210404
Operation:writeName:Layout Text
Value:
小狼毫
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0210404
Operation:writeName:Layout File
Value:
kbdus.dll
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Keyboard Layout\Preload
Operation:writeName:2
Value:
E0210404
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\LanguageProfile\0x00000404\{3D02CAB6-2B8E-4781-BA20-1C9267529467}
Operation:writeName:Enable
Value:
1
Executable files
16
Suspicious files
11
Text files
77
Unknown types
26

Dropped files

PID
Process
Filename
Type
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\curl-ca-bundle.crttext
MD5:1E32496378E8FEE43CB01B0689963A67
SHA256:5B47AEE36F594B7737E00990C9922A87252729B74CC2F1A83C0FCEED9816BDB9
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\README.txttext
MD5:EE65FDC9F42FCD7DAEA4CD1D19077D9E
SHA256:E4B23B9A8F41ECAE699CAF632FF0F4FB30FC1FB62FF0401F2B910C95B5617557
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\weaselt.dllexecutable
MD5:0157192043907894F72271FC60AB2DAE
SHA256:8BBDBE8A835EFED071530BC455BEA60FCA411A243D33987F3E1360C11D289699
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\7-zip-license.txttext
MD5:DE83A54FA6D43AC15AA945616A05AD31
SHA256:57D1AB127A01A29C2EF7A956A3D0DF3CB74CA3391A679D337AA92D42C80EC5D6
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\curl.exeexecutable
MD5:D9EA512EE580ECFFEE587A4C3759527F
SHA256:4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\weasel.dllexecutable
MD5:4FEC98A29BE77634B7386132D224978A
SHA256:8DDF23E8C8CCD3CC26ADF2B76F094F456B7F44FE589D848F43EEFFDF0427E77D
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\weasel.imeexecutable
MD5:90267D71D4583E7B05574D36176B7BAF
SHA256:E668C991308FE4AAC059D66CDFE593D0B8E283D0908C904BBDF975116188A645
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\weaselt.imeexecutable
MD5:ED47BFE91CAC2881E70EC959EE03EE59
SHA256:6E5214982DC2A12D0238B8FC05A61CAE27EA9A0691676DF11125D5D59A087E39
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\WeaselDeployer.exeexecutable
MD5:4C9E9135C59EA49F77E41C3C70E4F275
SHA256:588DE5CE285470FD31CA784BCB071BA32A3EC347F7D7222798713D51BE866471
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\LICENSE.txttext
MD5:3C34AFDC3ADF82D2448F12715A255122
SHA256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
Process
Message
WeaselDeployer.exe
W20240227 13:51:40.688374 2624 config_data.cc:68] nonexistent config file 'C:\Users\admin\AppData\Roaming\Rime\build\default.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\default.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Users\admin\AppData\Roaming\Rime\default.custom.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\cangjie5.schema.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\jyut6ping3.schema.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\jyut6ping3_ipa.schema.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\loengfan.schema.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 core_module.cc:20] registering core components.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 registry.cc:14] registering component: config_builder
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 registry.cc:14] registering component: config
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
windows-weasel-2023.06.15-installer.exe