{
  "family": "autoruns",
  "sample_count": 21,
  "category": "advanced_threat",
  "description": "Worm:Win32/Autoruns (often flagged generically as `autorun.inf` malware) represents a massive class of self-replicating malware that abuses the legacy Windows 'AutoRun' or 'AutoPlay' feature. While Microsoft has heavily restricted this feature in modern OS versions, Autoruns remains a critical vector for infecting air-gapped networks and industrial control systems (ICS) via USB flash drives.<br><br><b>Understanding Autoruns</b><br>To an end-user, an Autoruns infection might look like an innocent USB drive containing a folder named 'Passwords' or a document that is actually a disguised executable. For security analysts, Autoruns is a highly efficient lateral movement mechanism. The malware specifically targets removable media (`T1091`), writing a hidden executable and a weaponized `autorun.inf` file to the root directory of the drive.<br><br><b>Execution and Lateral Movement Mechanics</b><br>Historically, simply inserting the USB drive would cause the OS to parse the `autorun.inf` file and silently execute the referenced malware (`T1059`). Even with modern mitigations (where auto-execution is disabled), the malware uses social engineering: it hides the legitimate files on the USB and replaces them with shortcuts (`.lnk` files) or executables using folder icons (`T1036.004`). When the victim double-clicks the 'folder' to view their files, the malware executes, infects the host machine, and immediately begins scanning for newly inserted USB drives to infect.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the bridging of network perimeters (e.g., Stuxnet used this exact technique). EDR platforms must alert on processes executing directly from the root of a removable drive (`D:\\malware.exe`). The presence of hidden `autorun.inf` files containing `open=` or `shellexecute=` directives on flash drives is the definitive IoC. Systemic infection indicates a failure in USB Device Control policies.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059",
    "T1091",
    "T1036.004",
    "T1547.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1036.004",
      "name": "Masquerading: Masquerade Task or Service",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the infected machine from the network and confiscate any USB drives currently plugged into the system.",
    "Deploy an enterprise-wide GPO to strictly disable AutoPlay and AutoRun functionality across all drives (not just removable media).",
    "Implement a strict Device Control policy via EDR to block unauthorized USB mass storage devices from mounting.",
    "Scan the confiscated USB drives on an isolated forensic workstation to extract and analyze the original `autorun.inf` drop file."
  ],
  "what_to_avoid": [
    "Do not plug an infected or unknown USB drive into a networked, production machine for analysis; use an isolated sandbox.",
    "Avoid assuming modern Windows completely stops this threat; the malware relies heavily on socially engineering the user into clicking fake folder icons."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}