Trojan:W32/Spybot.JT

When the '7zs.sfx.exe' file is launched, Trojan:W32/Spybot.JT installs itself on the machine so that its files automatically run at each system startup.

To do so, the malware first creates the following file:

• %localsettings\Temp\7zS1.tmp\mshelp.exe

The main bulk of the malicious action is performed by the svchost.exe file, which is also created at this point. To make sure these files are run each time the computer is started, the malware modifies the registry by editing the following keys:

• HKLM\SYSTEM\CurrentControlSet\Services\MWWPAS\Parameters
• HKLM\System\CurrentControlSet\Services\MWWPAS\Security
• HKLM\System\CurrentControlSet\Services\MWWPAS
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

The following mutex objects are also created to prevent re-infection of an already infected machine:

• My_Name
• Global\pmaa
• Global\rfcuzmumlnovmqmf

Once created, the 'mshelp.exe' file will create the following files:

• \windows\system32\krnbavh.dp
• \windows\system32\iumwwpas.dll
• %temp%\kver34t.bat

It also uses the following files to support its later malicious actions:

• %windir%\system32\attrib.exe
• %windir%\system32\cmd.exe

The 'kver34t.bat' file then searches for and deletes the 'mshelp.exe' file. In order to do so, the 'kver34t.bat' file modifies the attributes of the 'mshelp.exe' file using the -a, -r, -s and -h attribute commands, which remove the archive, read-only, system and hidden permissions attributes; the file can then be deleted.

The svchost.exe process will create the following file:

• \documents and settings\all users\drm\rastls\gifjzguqrgrje

While the malware is running on the infected machine, its main payload involves taking screenshots every few seconds continuously, which are saved at the following location:

• %userprofile%\DRM\screen\SYSTEM\[filename based on infected machine's timestamp].jpg