0

I have receive a USB, but I noticed that as soon as I connected it to my computer, a video of an organization is shown.

Its like an informative video, it makes me think about nothing dangerous.

But...

I noticed that the USB has 2 partitions, one is recognized as a CD ROM and the other is just a normal USB partition.

Volumes

Once, I realized that I opened the CD Drive and I noticed that it has a very innocent looking video file, after that I enabled the option to view hidden files and just as I was expecting, I saw two hidden files.

I received the USB a long time ago, I saw this before, so in the past I was able to change the video name, so I won't show it in the screenshot because the name of the video is not very respectful.

Hidden files

In the past, I thought that I had removed the partition (don't remember what I did), but now as I am planning to use this USB, I noticed that it is still there.

Partitions

My main goal here is to remove that partition because I already checked the files on virustotal and they got detected.

[autorun]
open=laucher.exe        
icon=          
file0 = ******************.mov  // I changed the file name for asterisks
file1 =
file2 =  
url0 = 
url1 = 
url2 = 
url3 = 
url4 = 

enter image description here

enter image description here

I think that I can disable the "thing" by changing the code in autorun.inf to not open the launcher.exe

But files are protected

enter image description here

Of course I tried to change the permissions of the files but I got this message: enter image description here

Yes, I tried to click continue but that just shows a new message:

enter image description here

My main concern is: How do I remove that partition? But also I'd like to know what can happen to the devices that I've connected this USB to, what can I do to remove or revert any configurations changed by the .exe, how do I know if Im infected with something?

Of course Im scanning my device with multiple software but I'd like to make sure by asking to the experts (you).

Thanks in advance.

4
  • You have an image of partition manager ... you should be able to right click and delete the partition from there. However, its possible that its a custom USB drive with a chipset that prevents write access to that partition. IMO, if partition manager doesn't allow you to delete it then pitch the thumbdrive and get a new one ... they are hella cheap these days. Also, you should really really look into disabling autorun for removable media. Commented Sep 9, 2021 at 20:30
  • Yes I have tried to right click and delete the partition but that option is disabled. I'm guessing that it is a custom USB drive that prevents write access but I'm not really sure because in the past I was able to change the file name (I had windows 10 by then). I guess Ill have to not use that USB anymore (Its not mine and I have to give it back at some point). Although I'm afraid something like spyware o RAT be installed in my computer, I think I will have to wipe my drive and fresh install my OS. Commented Sep 9, 2021 at 20:34
  • According to your virus total screenshots ... willing to be the autorun.inf is triggering false positives. The thumbdrive is prob benign but has a write protected partition that contains its advertising information. If you know how and have the time wiping your computer isnt a terrible idea, but its prob overkill in your situation. Commented Sep 9, 2021 at 20:38
  • Could be a false positive but who knows, It was also detected by an AI as something very anomalous. I have not seen any weird behavior in my device, I prefer not to trust and I have decided to backup my work files in an external hard drive and fully wipe the hard drive, then install my os again and never use that USB again. Commented Sep 9, 2021 at 20:59

3 Answers 3

1

First things first: there's no guarantee that the USB device is malicious. What's more, if it is, it's probably too late already; you've plugged it in and its EXE has run. However, it's still worth thinking about whether you want to take some precautions with it (such as not connecting it to other devices).

Unless you're able to reprogram the device, I certainly wouldn't recommend using it as a general-purpose flashdrive. If you are able to reprogram it, well, there's a lot of cool stuff you could do with that but I guess you could use it as a flashdrive worth (generously) one fifth as much as the actual value of that neatly packaged reprogrammable USB microcontroller.


This is actually a really clever technique: the USB device is not a simple flashdrive (a USB Mass Storage device presenting a block device), but is probably actually a disguised USB Hub (you can verify this in Device Manager) that presents two child devices: a USB Mass Storage device (the F: drive) and a (virtual) USB CD-ROM device (the E: drive).

Windows has, ever since Vista (maybe even XP SP3), not auto-run code from flashdrives by default. However, it might still be possible to autorun from optical drives (I can't remember; when was the last time you used an actual data CD-ROM in a PC?). Thus, if you want code to autorun, you might choose to do it this way, with a virtual CD-ROM drive containing a virtual CD-ROM that the PC thinks is a real one, and thus thinks it can autorun code from it.

A few notes about this:

  • You won't be able to delete the CD-ROM partition, because it's not an actual partition on any block device. As far as Windows is concerned, it's a completely different disk.
  • You won't be able to edit or delete files on the "CD-ROM", at least not directly, because as far as Windows knows, it's a CD-ROM (hint: the "ROM" stands for "Read-Only Memory"). That's not a permissions issue; it's Windows saying "hey, this device is physically not writable with this hardware".
  • You also can't (permanently) remove the CD-ROM device, because again, it's a completely different device (as far as Windows knows) from the flashdrive or USB hub that are exposed to the OS, but in reality it's all part of the same virtual USB hub. You can unplug the USB device but everything "connected to it" will still be there when you plug it in again.
  • There might well be more virtual (or real!) devices hanging off that USB hub than you realize! There could be a virtual keyboard (for entering arbitrary keystrokes), a virtual network device (for trying to fool your PC into routing network traffic through the device), an actual WiFi device (for connecting the USB stick to the Internet when your PC tells it the credentials for your WiFi), or so on. You can probably find any such things in Device Manager too. Use the "view devices by connection" layout.
  • You might be able to (virtually) disconnect the CD-ROM drive (using Safely Remove Hardware), or "eject" the CD through Explorer or another tool, though that will only work after you've already connected the device and also might not actually work at all depending on how sophisticated the virtual device is.
  • It's possible that you don't actually have 8GB of storage on the flashdrive portion of the device. Hardware can report whatever size it wants, with no guarantee that all of those addresses actually map to distinct physical storage (or indeed to any storage at all). On the other hand, it's possible that you do; 8GB is a nice believable size for a flashdrive while still being incredibly cheap as far as the amount of storage itself costs. In fact, the device quite likely has more than 8GB of storage on it, it needs somewhere to store both the code that implements the virtual CD-ROM drive, and the data on the virtual CD-ROM itself.
  • You might be able to reprogram the USB device. Usually, the more sophisticated sort of USB devices - such as the ones that can fake being multiple different devices - are programmable so that their owner / the attacker can make them do different things. However, they may need to be interacted with in a particular way (over the USB interface, or physically via a hidden button or similar) to put them in programmable mode (in which mode they'll likely present an entirely different kind of device, a microcontroller with some storage).
1
  • I wasnt able to use the other answer's tools, it seems this was not a U3 drive. In fact, this USB was given to me by a company that manufactures some electronic devices, so I think this is not a virtual CD. I don't know if they did that on purpose or why. All I know is that the .exe file tries to get remote access credentials from my device. Thats based on hybrid-analysis.com/sample/… which is an analysis of the file. Commented Sep 10, 2021 at 3:45
2

What you are dealing with is a U3 device. It's set up to be two devices, one of which is a CD emulation.

It uses the CD auto-run capability to accomplish it's self start.

First off, disable CD Auto-run on your Windows machine! This should have been disabled for some time now by default but apparently you have it on.

Take the U3 thumb drive, place it in a Linux machine and DD a few meg of zeros to the beginning of the device. This should remove all the header structures. After the DD, format the device normally and you should be good to go.

1

If it is a U3 drive, then SanDisk has a CD-partition removal utility here.

SD cards and some USB devices can be cleared with another tool.

Otherwise, Windows 10 is not really reliable for USB partition management (the recommended recipe using DiskMgmt, here, sometimes does not work), so I suspect your best option would be a live GParted disk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .