File name:

windows-weasel-2023.06.15-installer.exe

Full analysis: https://app.any.run/tasks/e2516401-1e5e-4c0d-9e04-10475130d8d9
Verdict: Malicious activity
Analysis date: February 27, 2024, 13:51:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

CD6D5D52183673815CAD35A4C5CE1173

SHA1:

330489BE1446E3375B0EFACC033C4FB34816E057

SHA256:

C424C10E17086F0F9BF499FD930713834F245BCF1E9ECAF625DC18311B1B6272

SSDEEP:

98304:kHs6E0rPOoNUyG4VqXYjDllS3qfQd3UzZ+QcwX2912AH9ss5IXbIRM6UDKRifRRW:m+3Vb0LJejtDdySL+QY/bTe5V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselSetup.exe (PID: 1876)

    • Creates a writable file in the system directory

      • WeaselSetup.exe (PID: 1876)

    • Registers / Runs the DLL via REGSVR32.EXE

      • WeaselSetup.exe (PID: 1876)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

    • Drops 7-zip archiver for unpacking

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

    • Executable content was dropped or overwritten

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselSetup.exe (PID: 1876)

    • The process creates files with name similar to system file names

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

    • Reads the Internet Settings

      • WeaselSetup.exe (PID: 1876)

    • Reads security settings of Internet Explorer

      • WeaselSetup.exe (PID: 1876)

    • Creates a software uninstall entry

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

  • INFO

    • Checks supported languages

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselSetup.exe (PID: 1876)
      • WeaselDeployer.exe (PID: 2444)

    • Reads the computer name

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselSetup.exe (PID: 1876)
      • WeaselDeployer.exe (PID: 2444)

    • Creates files in the program directory

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)

    • Creates files or folders in the user directory

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselDeployer.exe (PID: 2444)

    • Create files in a temporary directory

      • windows-weasel-2023.06.15-installer.exe (PID: 2852)
      • WeaselDeployer.exe (PID: 2444)

    • Reads the machine GUID from the registry

      • WeaselDeployer.exe (PID: 2444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:30 03:57:41+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x34a5
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.15.0.0
ProductVersionNumber: 0.15.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
Comments: Powered by RIME | 中州韻輸入法引擎
CompanyName: 式恕堂
FileDescription: 小狼毫輸入法
FileVersion: 0.15.0
LegalCopyright: Copyleft RIME Developers
ProductName: 小狼毫
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start windows-weasel-2023.06.15-installer.exe weaselsetup.exe regsvr32.exe no specs weaseldeployer.exe windows-weasel-2023.06.15-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1876"C:\Program Files\Rime\weasel-0.15.0\WeaselSetup.exe" /iC:\Program Files\Rime\weasel-0.15.0\WeaselSetup.exe
windows-weasel-2023.06.15-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\rime\weasel-0.15.0\weaselsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2160"C:\Users\admin\AppData\Local\Temp\windows-weasel-2023.06.15-installer.exe" C:\Users\admin\AppData\Local\Temp\windows-weasel-2023.06.15-installer.exe—explorer.exe
User:
admin
Company:
式恕堂
Integrity Level:
MEDIUM
Description:
小狼毫輸入法
Exit code:
3221226540
Version:
0.15.0
Modules
Images
c:\users\admin\appdata\local\temp\windows-weasel-2023.06.15-installer.exe
c:\windows\system32\ntdll.dll
2332"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\weasel.dll"C:\Windows\System32\regsvr32.exe—WeaselSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2444"C:\Program Files\Rime\weasel-0.15.0\WeaselDeployer.exe" /installC:\Program Files\Rime\weasel-0.15.0\WeaselDeployer.exe
windows-weasel-2023.06.15-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\rime\weasel-0.15.0\weaseldeployer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\rime\weasel-0.15.0\rime.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2852"C:\Users\admin\AppData\Local\Temp\windows-weasel-2023.06.15-installer.exe" C:\Users\admin\AppData\Local\Temp\windows-weasel-2023.06.15-installer.exe
explorer.exe
User:
admin
Company:
式恕堂
Integrity Level:
HIGH
Description:
小狼毫輸入法
Exit code:
0
Version:
0.15.0
Modules
Images
c:\users\admin\appdata\local\temp\windows-weasel-2023.06.15-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
3 510
Read events
3 483
Write events
27
Delete events
0

Modification events

(PID) Process:(2852) windows-weasel-2023.06.15-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Rime\Weasel
Operation:writeName:InstallDir
Value:
C:\Program Files\Rime
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0210404
Operation:writeName:Ime File
Value:
WEASEL.IME
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0210404
Operation:writeName:Layout Text
Value:
小狼毫
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0210404
Operation:writeName:Layout File
Value:
kbdus.dll
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Keyboard Layout\Preload
Operation:writeName:2
Value:
E0210404
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1876) WeaselSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\LanguageProfile\0x00000404\{3D02CAB6-2B8E-4781-BA20-1C9267529467}
Operation:writeName:Enable
Value:
1
Executable files
16
Suspicious files
11
Text files
77
Unknown types
26

Dropped files

PID
Process
Filename
Type
2852windows-weasel-2023.06.15-installer.exeC:\Users\admin\AppData\Local\Temp\nsiFAFC.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\curl.exeexecutable
MD5:D9EA512EE580ECFFEE587A4C3759527F
SHA256:4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\7z.dllexecutable
MD5:E7AE42EA24CFF97BDEAD0C560EF2ADD1
SHA256:DB2897EEEA65401EE1BD8FEEEBD0DBAE8867A27FF4575F12B0B8A613444A5EF7
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\LICENSE.txttext
MD5:3C34AFDC3ADF82D2448F12715A255122
SHA256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\7-zip-license.txttext
MD5:DE83A54FA6D43AC15AA945616A05AD31
SHA256:57D1AB127A01A29C2EF7A956A3D0DF3CB74CA3391A679D337AA92D42C80EC5D6
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\COPYING-curl.txttext
MD5:CDC0D67A6E9EF4D4BD692F74AC95F1B4
SHA256:16B6F218F5E66AD723E41E7DA6A6CA152F4D2EF7C5650B88981F1CB20415E212
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\7z.exeexecutable
MD5:AFC08CE359E79887E45B8460E124D63E
SHA256:A20D93E7DC3711E8B8A8F63BD148DDC70DE8C952DE882C5495AC121BFEDB749F
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\WeaselDeployer.exeexecutable
MD5:4C9E9135C59EA49F77E41C3C70E4F275
SHA256:588DE5CE285470FD31CA784BCB071BA32A3EC347F7D7222798713D51BE866471
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\WeaselServer.exeexecutable
MD5:C0E49DEB100D237E100540509B1B8BDB
SHA256:C0D2C68CC129E6BA0572CCCA4F760A6004249FEBD5F26BCD860118190AC2B250
2852windows-weasel-2023.06.15-installer.exeC:\Program Files\Rime\weasel-0.15.0\weasel.dllexecutable
MD5:4FEC98A29BE77634B7386132D224978A
SHA256:8DDF23E8C8CCD3CC26ADF2B76F094F456B7F44FE589D848F43EEFFDF0427E77D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
Process
Message
WeaselDeployer.exe
W20240227 13:51:40.688374 2624 config_data.cc:68] nonexistent config file 'C:\Users\admin\AppData\Roaming\Rime\build\default.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\default.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Users\admin\AppData\Roaming\Rime\default.custom.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\cangjie5.schema.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\jyut6ping3.schema.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\jyut6ping3_ipa.schema.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 config_data.cc:71] loading config file 'C:\Program Files\Rime\weasel-0.15.0\data\loengfan.schema.yaml'.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 core_module.cc:20] registering core components.
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 registry.cc:14] registering component: config_builder
WeaselDeployer.exe
I20240227 13:51:40.688374 2624 registry.cc:14] registering component: config
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
windows-weasel-2023.06.15-installer.exe