Home / malware

PDF

Worm:Win32/Autorun.AFF

First posted on 10 May 2019.
Source: Microsoft

Aliases :

Worm:Win32/Autorun.AFF is also known as W32/Autorun.worm.g, Trojan.Win32.Hider.jh.

Explanation :

Worm:Win32/Autorun.AFF is a worm - a self-propagating program that can spread itself from one computer to another. Worms may spread themselves via a variety of different channels in order to compromise new computers. Variants of Worm:Win32/Autorun usually spread using methods that include, but may not be limited to, copying themselves to removable or network drives, and placing an autorun.inf file in the root directory of each affected drive in an attempt to ensure that the worm is run when the removable drive is attached, or the network drive is visited from a remote system supporting the Autorun feature. Installation When executed, Worm:Win32/Autorun.AFF copies itself to c:documents and settingsadministratorlocal settings empoldiesservice.exe.
The malware modifies the following registry entries to ensure that its copy executes at each Windows start:

Adds value: "service"
With data: "c:documents and settingsadministratorlocal settings empoldiesservice.exe"
To subkey: HKCUSoftwareMicrosoftwindowscurrentversion
un Spreads via… Removable drives Worm:Win32/Autorun.AFF may create the following files on targeted drives when spreading:

:subst.exe
It also places an autorun.inf file in the root directory of the targeted drive. Such autorun.inf files contain execution instructions for the operating system, so that when the removable drive is accessed from another computer supporting the Autorun feature, the malware is launched automatically.
Note: This worm was observed to write an executable and create an autorun.inf file on a targeted drive in our automated testing environment. This is particularly common malware behavior, generally utilized in order to spread malware from computer to computer. It should also be noted that autorun.inf files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation CDs. Payload Modifies system settings Worm:Win32/Autorun.AFF overrides the display settings so files with the 'hidden' attribute are not displayed; it does this by making the following registry modification:

Adds value: "Hidden"
With data: "2"
To subkey: HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
This malware description was produced and published using our automated analysis system's examination of file SHA1 4829e0955a49a8447fc36792bdcdf34d42b7a2f7.

Last update 10 May 2019

 

TOP