File name:

VueScan.Pro-Patch-Keygen_analyse.rar

Full analysis: https://app.any.run/tasks/afedcc87-f038-4d4a-bb2b-2d3d55e64117
Verdict: Malicious activity
Analysis date: March 23, 2018, 12:41:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

F100FD684D113AB86C07925DFDFAA57F

SHA1:

121C3892E05A236003DC900F6589D27D0EAAB2BB

SHA256:

D837C6A962586CE86D4FFB22139EDD8467E6BB1F181FE62002B34F587C9CF8A5

SSDEEP:

196608:8GCPE1ih0DhdExnIC8aMgod3z6Ad/k/71iq4n0wsl1h8NOQwI7iuA:8E1ih0DhItfcdD+7in0XbeVil

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • vuex3295_9.5.58.exe (PID: 2740)
      • vuescan.exe (PID: 4044)
      • dpinst32.exe (PID: 2608)
      • vuex3295_9.5.58.exe (PID: 3092)

    • Changes settings of System certificates

      • vuescan.exe (PID: 4044)
      • DrvInst.exe (PID: 2304)

    • Uses NETSH.EXE for network configuration

      • vuescan.exe (PID: 4044)

  • SUSPICIOUS

    • Creates files in the program directory

      • vuex3295_9.5.58.exe (PID: 3092)
      • vuescan.exe (PID: 4044)

    • Adds / modifies Windows certificates

      • vuescan.exe (PID: 4044)

    • Creates files in the Windows directory

      • vuescan.exe (PID: 4044)
      • DrvInst.exe (PID: 2304)
      • dpinst32.exe (PID: 2608)

    • Creates a software uninstall entry

      • vuescan.exe (PID: 4044)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2304)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2304)

    • Creates or modifies windows services

      • DrvInst.exe (PID: 2304)

  • INFO

    • Dropped object may contain URL's

      • DrvInst.exe (PID: 2304)
      • dpinst32.exe (PID: 2608)
      • vuescan.exe (PID: 4044)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3700)

    • Creates or modifies windows services

      • vssvc.exe (PID: 3700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 2040
UncompressedSize: 6656
OperatingSystem: Win32
ModifyDate: 2015:12:17 12:38:11
PackingMethod: Normal
ArchivedFileName: VueScan.Pro-Patch-Keygen\Keygen.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
12
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start 7zfm.exe vuex3295_9.5.58.exe no specs vuex3295_9.5.58.exe vuescan.exe dpinst32.exe no specs drvinst.exe no specs rundll32.exe no specs vssvc.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2068netsh advfirewall firewall add rule name="VueScan (canon-bjnp2-In)" protocol=UDP dir=in localport=8612 program="C:\Program Files\VueScan\vuescan.exe" action=allow description="Inbound rule for VueScan to allow searching network for legacy Canon scanners."C:\Windows\system32\netsh.exe—vuescan.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2304DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{04b866ce-f6d2-7dc0-eb76-31200ad66c1b}\scadrv60.inf" "0" "65379d6cf" "000003AC" "WinSta0\Default" "000004F0" "208" "c:\users\admin\appdata\local\temp\vuescan"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2608dpinst /sw /sa /path "C:\Users\admin\AppData\Local\Temp\VueScan"C:\Users\admin\AppData\Local\Temp\VueScan\dpinst32.exe—vuescan.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
256
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\vuescan\dpinst32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2644netsh advfirewall firewall delete rule name="VueScan (canon-bjnp2-In)"C:\Windows\system32\netsh.exe—vuescan.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2740"C:\Users\admin\AppData\Local\Temp\7zOC1C80616\vuex3295_9.5.58.exe" C:\Users\admin\AppData\Local\Temp\7zOC1C80616\vuex3295_9.5.58.exe—7zFM.exe
User:
admin
Company:
Hamrick Software
Integrity Level:
MEDIUM
Description:
VueScan Installer
Exit code:
3221226540
Version:
9.5.58
Modules
Images
c:\users\admin\appdata\local\temp\7zoc1c80616\vuex3295_9.5.58.exe
c:\systemroot\system32\ntdll.dll
2756netsh advfirewall firewall add rule name="VueScan (mDNS-In)" protocol=UDP dir=in localport=5353 program="C:\Program Files\VueScan\vuescan.exe" action=allow description="Inbound rule for VueScan to allow searching network for scanners using mDNS."C:\Windows\system32\netsh.exe—vuescan.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3092"C:\Users\admin\AppData\Local\Temp\7zOC1C80616\vuex3295_9.5.58.exe" C:\Users\admin\AppData\Local\Temp\7zOC1C80616\vuex3295_9.5.58.exe
7zFM.exe
User:
admin
Company:
Hamrick Software
Integrity Level:
HIGH
Description:
VueScan Installer
Exit code:
0
Version:
9.5.58
Modules
Images
c:\users\admin\appdata\local\temp\7zoc1c80616\vuex3295_9.5.58.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3100"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\admin\AppData\Local\Temp\VueScan.Pro-Patch-Keygen_analyse.rar"C:\Program Files\7-Zip\7zFM.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Exit code:
0
Version:
16.04
Modules
Images
c:\program files\7-zip\7zfm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3700C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3832netsh advfirewall firewall delete rule name="VueScan (mDNS-In)"C:\Windows\system32\netsh.exe—vuescan.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
Total events
1 058
Read events
662
Write events
396
Delete events
0

Modification events

(PID) Process:(3100) 7zFM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3100) 7zFM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(4044) vuescan.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\8F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4044) vuescan.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
Operation:writeName:Blob
Value:
04000000010000001000000087CE0B7B2A0E4900E158719B37A893720F00000001000000140000006DCA5BD00DCF1C0F327059D374B29CA6E3C50AA6090000000100000034000000303206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B060105050703085300000001000000230000003021301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C06200000001000000200000003E9099B5015E8F486C00BCEA9D111EE721FABA355A89BCF1DF69561E3DC6325C14000000010000001400000045EBA2AFF492CB82312D518BA7A7219DF36DC80F0B00000001000000120000004400690067006900430065007200740000001D00000001000000100000004F5F106930398D09107B40C3C7CA8F1C0300000001000000140000000563B8630D62D75ABBC8AB1E4BDFB5A899B24D43190000000100000010000000749966CECC95C1874194CA7203F9B6202000000001000000BB030000308203B73082029FA00302010202100CE7E0E517D846FE8FE560FC1BF03039300D06092A864886F70D01010505003065310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D312430220603550403131B4469676943657274204173737572656420494420526F6F74204341301E170D3036313131303030303030305A170D3331313131303030303030305A3065310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D312430220603550403131B4469676943657274204173737572656420494420526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100AD0E15CEE443805CB187F3B760F97112A5AEDC269488AAF4CEF520392858600CF880DAA9159532613CB5B128848A8ADC9F0A0C83177A8F90AC8AE779535C31842AF60F98323676CCDEDD3CA8A2EF6AFB21F25261DF9F20D71FE2B1D9FE1864D2125B5FF9581835BC47CDA136F96B7FD4B0383EC11BC38C33D9D82F18FE280FB3A783D6C36E44C061359616FE599C8B766DD7F1A24B0D2BFF0B72DA9E60D08E9035C678558720A1CFE56D0AC8497C3198336C22E987D0325AA2BA138211ED39179D993A72A1E6FAA4D9D5173175AE857D22AE3F014686F62879C8B1DAE45717C47E1C0EB0B492A656B3BDB297EDAAA7F0B7C5A83F9516D0FFA196EB085F18774F0203010001A3633061300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E0416041445EBA2AFF492CB82312D518BA7A7219DF36DC80F301F0603551D2304183016801445EBA2AFF492CB82312D518BA7A7219DF36DC80F300D06092A864886F70D01010505000382010100A20EBCDFE2EDF0E372737A6494BFF77266D832E4427562AE87EBF2D5D9DE56B39FCCCE1428B90D97605C124C58E4D33D834945589735691AA847EA56C679AB12D8678184DF7F093C94E6B8262C20BD3DB32889F75FFF22E297841FE965EF87E0DFC16749B35DEBB2092AEB26ED78BE7D3F2BF3B726356D5F8901B6495B9F01059BAB3D25C1CCB67FC2F16F86C6FA6468EB812D94EB42B7FA8C1EDD62F1BE5067B76CBDF3F11F6B0C3607167F377CA95B6D7AF112466083D72704BE4BCE97BEC3672A6811DF80E70C3366BF130D146EF37F1F63101EFA8D1B256D6C8FA5B76101B1D2A326A110719DADE2C3F9C39951B72B0708CE2EE650B2A7FA0A452FA2F0F2
(PID) Process:(4044) vuescan.exeKey:HKEY_CURRENT_USER\Software\VueScan\path
Operation:writeName:
Value:
C:\Program Files\VueScan\vuescan.exe
(PID) Process:(4044) vuescan.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\VueScan\path
Operation:writeName:
Value:
C:\Program Files\VueScan\vuescan.exe
(PID) Process:(2608) dpinst32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\8F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4044) vuescan.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VueScan x32
Operation:writeName:
Value:
(PID) Process:(4044) vuescan.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VueScan x32
Operation:writeName:DisplayName
Value:
VueScan x32
(PID) Process:(4044) vuescan.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VueScan x32
Operation:writeName:UninstallString
Value:
"C:\Program Files\VueScan\vuescan.exe" /remove
Executable files
5
Suspicious files
15
Text files
128
Unknown types
9

Dropped files

PID
Process
Filename
Type
3092vuex3295_9.5.58.exeC:\Program Files\VueScan\vuescan.exe.tmp —
MD5:—
SHA256:—
4044vuescan.exeC:\Users\admin\AppData\Local\Temp\Cab5E90.tmp —
MD5:—
SHA256:—
4044vuescan.exeC:\Users\admin\AppData\Local\Temp\Tar5E91.tmp —
MD5:—
SHA256:—
4044vuescan.exeC:\Users\admin\AppData\Local\Temp\VUE6103.tmp —
MD5:—
SHA256:—
4044vuescan.exeC:\Users\admin\AppData\Local\Temp\VUE6152.tmp —
MD5:—
SHA256:—
4044vuescan.exeC:\Users\admin\AppData\Local\Temp\VUE6162.tmp —
MD5:—
SHA256:—
4044vuescan.exeC:\Users\admin\AppData\Local\Temp\VUE6163.tmp —
MD5:—
SHA256:—
2608dpinst32.exeC:\Users\admin\AppData\Local\Temp\{04b866ce-f6d2-7dc0-eb76-31200ad66c1b}\SET62D5.tmp —
MD5:—
SHA256:—
2608dpinst32.exeC:\Users\admin\AppData\Local\Temp\{04b866ce-f6d2-7dc0-eb76-31200ad66c1b}\SET62D6.tmp —
MD5:—
SHA256:—
2304DrvInst.exeC:\Windows\System32\DriverStore\Temp\{72511587-c694-38e7-5f47-64128dba2471}\SET63DF.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
162.243.24.127:80
http://stats.hamrick.com/v1/submit?EventName=Startup&InstallTime=1521808927&VueScanVersion=VueScan%209%20x32%20(9.5.58)&EventTime=1521808956&Edition=Unregistered&Platform=Windows&PlatformVersion=6.1&NumberOfCPUs=4
US
text
2 b
unknown
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSYagvY3tfizDNoybzVSPFZmSEm0wQUe2jOKarAF75JeuHlP9an90WPNTICEA41gAUOBLzSFQQKkI7KT8o%3D
US
der
471 b
whitelisted
—
—
GET
200
52.85.22.193:80
http://static.hamrick.com/vuescan_version.txt
US
text
7 b
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA%2BoSQYV1wCgviF2%2FcXsbb0%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
162.243.24.127:80
stats.hamrick.com
Digital Ocean, Inc.
US
unknown
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
52.85.22.193:80
static.hamrick.com
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
ocsp.digicert.com
  • 93.184.220.29
whitelisted
static.hamrick.com
  • 52.85.22.193
  • 52.85.22.244
  • 52.85.22.94
  • 52.85.22.139
  • 52.85.22.23
  • 52.85.22.147
  • 52.85.22.106
  • 52.85.22.41
whitelisted
stats.hamrick.com
  • 162.243.24.127
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
VueScan.Pro-Patch-Keygen_analyse.rar