{
  "family": "autorunerent",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Worm:Win32/Autorunerent is a classic worm designed to aggressively self-propagate across systems by exploiting the Windows `autorun.inf` feature on removable media (USB drives, external hard drives, and mapped network drives). Its primary objective is rapid, untargeted proliferation, often acting as a delivery mechanism for secondary payloads like infostealers or serving as a rudimentary botnet component (`T1091`).<br><br><b>Understanding Autorunerent (USB Worms)</b><br>To an end-user, the infection might be entirely invisible, or they might notice unexpected files appearing on their USB flash drives. For an enterprise network, Autorunerent is highly problematic because it bypasses traditional perimeter defenses (firewalls, email filters) entirely. It leverages physical media to cross 'air-gapped' networks and spread rapidly from workstation to workstation.<br><br><b>Execution and Propagation Mechanics</b><br>The infection cycle begins when a compromised USB drive is inserted into a Windows machine. Historically, Windows would automatically execute the instructions within the `autorun.inf` file, immediately launching the hidden worm executable. Once active in memory, the worm establishes persistence (often via Registry Run keys) and monitors the system for new drives. When a clean USB drive is inserted, Autorunerent copies its executable onto the drive, sets its file attributes to 'Hidden' and 'System', and creates a new, malicious `autorun.inf` file pointing to itself (`T1091`). To trick users on systems where Autorun is disabled, it often creates a Windows Shortcut (`.lnk`) file with a folder icon that executes the malware when clicked (`T1566.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the rapid spread of the infection and the potential delivery of secondary payloads. Host-based IoCs include the presence of `autorun.inf` files on removable media referencing unknown executables, unexpected `.lnk` files on USB drives, and EDR alerts for executables launching directly from the root directory of a removable drive. Network IoCs depend on the secondary payload, often involving HTTP beacons to C2 servers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1091",
    "T1547.001",
    "T1566.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (The core propagation mechanism using autorun.inf)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Host persistence)",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link (Using fake folder .lnk files to trick users)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Ensure that the Windows 'Autorun' and 'Autoplay' features are strictly disabled via Group Policy across the entire enterprise.",
    "Use enterprise EDR to scan all connected removable drives and network shares for malicious `autorun.inf` and associated hidden executables.",
    "Implement Endpoint Device Control policies to restrict or completely block the use of unapproved USB mass storage devices.",
    "Format infected USB drives rather than attempting manual file deletion, to ensure all hidden components are removed."
  ],
  "what_to_avoid": [
    "Do not blindly click on 'folder' icons on a USB drive without ensuring Windows is set to display file extensions, as they may be malicious `.lnk` files.",
    "Avoid plugging a potentially infected USB drive into a clean, networked machine for analysis without using a dedicated, isolated sandbox."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}