Technical Information
Malicious functions:
Creates and executes the following:
- '%WINDIR%\WGAfix\WGA-fix_startmenu.exe'
- '%WINDIR%\WGAfix\MGADiag.exe'
- '%WINDIR%\WGAfix\Setup.exe'
- '%WINDIR%\WGAfix\wga-fix.exe'
Executes the following:
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://go.###rosoft.com/fwlink/?Li##########
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\WGAfix\VerwijderLegitCheckControl.cmd" "
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\cab84c01adb98e52db1906d736d20b8d_23ef5514-3059-436f-a4a7-4cefaab20eb1
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\f960f2e0-078d-448c-87d6-785556739852
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\Preferred
- %ALLUSERSPROFILE%\Menu Start\Programma's\WGA-fix uitvoeren\Uitleg.lnk
- %ALLUSERSPROFILE%\Application Data\Windows Genuine Advantage\data\data.dat
- %ALLUSERSPROFILE%\Application Data\Office Genuine Advantage\data\data.dat
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\f0c3812a71f6e154bded3abbb386bbfc_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\30dc27e8ae73cf2d88992d1cf442a2d8_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\25705406d3f25452365a3da7c8475cbc_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\588e25063519a3531e83b671a6efb16d_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\d44f48b5142c52140e6aa8de7a5057a9_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\fwlink[1]
- %ALLUSERSPROFILE%\Menu Start\Programma's\WGA-fix uitvoeren\fix-wga.lnk
- %WINDIR%\WGAfix\MCE2005CRK.EXE
- %WINDIR%\WGAfix\MGADiag.exe
- %WINDIR%\WGAfix\Setup.exe
- %WINDIR%\WGAfix\MCE2005 Activatie Crack en WGA Patch uitleg.TXT
- %WINDIR%\WGAfix\Uitleg.txt
- %WINDIR%\WGAfix\VerwijderLegitCheckControl.cmd
- %TEMP%\nsi2.tmp
- %TEMP%\nsx3.tmp\System.dll
- <DRIVERS>\etc\hosts1.bak
- %WINDIR%\WGAfix\wga-fix.exe
- %WINDIR%\WGAfix\WGA-fix_startmenu.exe
- %WINDIR%\WGAfix\fix-wga.lnk
Deletes the following files:
- %TEMP%\nsx3.tmp\System.dll
Modifies the HOSTS file.
Network activity:
Connects to:
- '20#.#6.232.182':80
- 'localhost':1042
- 'localhost':443
TCP:
HTTP GET requests:
- 20#.#6.232.182/fwlink/?Li##########
UDP:
- DNS ASK go.###rosoft.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
