Jadtre Trojan

 Once on the device and executed, a copy of the Jadtre is dropped as: %SystemDrive%\booter.exe Jadtre then searches for several stopped services and attempts to stop one if they are all running. Disabling Window Systems File Checker early variants of the malware could be named as the following processes:

• schedsvc.dll
• regsvc.dll
• pchsvc.dll
• cryptsvc.dll
• browser.dll
• tapisrv.dll
• mswsock.dll
• netman.dll
• ssdpsrv.dll
• upnphost.dll
• ntmssvc.dll
• es.dll
• xmlprov.dll
• mspmsnsv.dll
• shsvcs.dll
• qmgr.dll
• appmgmts.dll

If a removable device is detected, Jadtre copies itself to it as: \recycle.{645FF040-5081-101B-9F08-00AA002F954E}\setup.exe

The virus then writes an Autorun configuration file named "autorun.inf" pointing to "setup.exe". When the drive is accessed from a computer supporting the Autorun feature, the virus is launched automatically. The malware also achieves network propagation by dropping Windows executable files and modifies HTML files to network drives.

The malware then alters registry keys so it runs an autostart. It also prevents Windows from starting in safe mode and attempts to connect to a remote host for an initial C2 exchange, after collecting system information from the infected host. Depending on the variant, arbitrary files may be downloaded and executed at this stage.