Technical Information
Modifies file system
Creates the following files
- %ProgramFiles%\vuescan\vuescan.exe
- %WINDIR%\dpinst.log
- %TEMP%\vuescan\dpinst64.exe
- %TEMP%\vue2884.tmp
- %TEMP%\vuescan\scadrv60.cat
- %TEMP%\vue277a.tmp
- %TEMP%\vuescan\scadrv60.inf
- %TEMP%\vue269f.tmp
- %WINDIR%\twain_64\vuescan.ds
- %TEMP%\vuescan\vuetw64.ds
- %TEMP%\vue2556.tmp
- %WINDIR%\twain_32\vuescan.ds
- %TEMP%\vuescan\vuetw32.ds
- %TEMP%\vue24e8.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\vuescan x64.lnk
- C:\users\public\desktop\vuescan x64.lnk
- %TEMP%\{44a38091-6936-5257-1fc7-df343fd0e932}\set3c44.tmp
- %TEMP%\{44a38091-6936-5257-1fc7-df343fd0e932}\set3d6e.tmp
Moves the following files
- from %TEMP%\{44a38091-6936-5257-1fc7-df343fd0e932}\set3c44.tmp to %TEMP%\{44a38091-6936-5257-1fc7-df343fd0e932}\scadrv60.cat
- from %TEMP%\{44a38091-6936-5257-1fc7-df343fd0e932}\set3d6e.tmp to %TEMP%\{44a38091-6936-5257-1fc7-df343fd0e932}\scadrv60.inf
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://st####.hamrick.com/feedback_v1.txt
- http://st####.hamrick.com/vuescan_version.txt
- http://st###.hamrick.com/v1/submit?Ev########################################################################################################################
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
UDP
- DNS ASK microsoft.com
- DNS ASK st####.hamrick.com
- DNS ASK st###.hamrick.com
- DNS ASK oc##.#tartssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'HPPhotoSmartPhotoScannerMediaDetectUtility' WindowName: ''
- ClassName: 'BlinkMainWndClass1234567890' WindowName: ''
- ClassName: 'NikonFrescoSource' WindowName: ''
- ClassName: 'NikonScan2' WindowName: ''
- ClassName: '' WindowName: 'Dimage Scan Dual'
- ClassName: '' WindowName: 'Dimage Scan Multi'
- ClassName: '' WindowName: 'Dimage Scan Speed'
- ClassName: '' WindowName: 'Dimage Scan Elite'
- ClassName: '' WindowName: 'MiraPhoto'
- ClassName: '' WindowName: 'HP PhotoSmart S20 Scanner'
- ClassName: '' WindowName: 'HP PhotoSmart Photo Scanner'
- ClassName: '#32770' WindowName: 'QuickScan Plus (Plustek OpticFilm 135)'
Creates and executes the following
- '%ProgramFiles%\vuescan\vuescan.exe' /install
- '%TEMP%\vuescan\dpinst64.exe' /sw /sa /path "%TEMP%\VueScan"
- '%TEMP%\vuescan\dpinst64.exe' /sw /sa /path "%TEMP%\VueScan"' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{5a70944c-7770-0bbc-7e88-b54a8856f226} Global\{1647f80b-826c-0825-bcde-471a4a51db12} <DRIVERSTORE>\Temp\{07355ce5-3450-0872-7ced-af1a...
