TrojanDownloader:Win32/Small.ZZJ is a 61952 bytes Win32 executable which, when run, contacts remote hosts in order to download and execute arbitrary files without the user's consent.
System changes
The following system changes may indicate the presence of this malware:
-
The presence of the following registry modifications:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "cwintool"
With data: "c:\documents and settings\administrator\application data\cwintool.exe"
In subkey: HKCU\Software\cwintool
Sets value "idt"
With data: "201101061309"
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cwin
Sets value "DisplayName"
With data: "cwintool uninstall"
TrojanDownloader:Win32/Small.ZZJ is a 61952 bytes Win32 executable which, when run, contacts remote hosts in order to download and execute arbitrary files without the user's consent.
Installation
TrojanDownloader:Win32/Small.ZZJ may be spammed to an affected user as an executable; in the wild, we have observed the trojan using the following name:
The name of the executable file may vary; it may be changed to entice a user to execute it by employing social engineering techniques.
On execution, the trojan creates a mutex "cwintool" to prevent multiple copies of the trojan process in memory.
TrojanDownloader:Win32/Small.ZZJ modifies the following registry entry to ensure that its copy executes at each Windows start:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "cwintool"
With data: "c:\documents and settings\administrator\application data\cwintool.exe"
TrojanDownloader:Win32/Small.ZZJ modifies the following registry settings to allow the trojan to keep internal information:
In subkey: HKCU\Software\cwintool
Sets value "idt"
With data: "201101061309"
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cwin
Sets value "DisplayName"
With data: "cwintool uninstall"
Payload
Downloads and executes arbitrary files
The trojan attempts to download and execute arbitrary files form the following domain:
At the time of writing, there were no files available for download.
Contacts remote hosts
The trojan contacts the following domain to share information about the system it is executed on:
Such information includes a MAC address, the version of the trojan, and several parameters representing execution stages of the trojan.
Analysis by Oleg Petrovsky
To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:
