{
  "family": "sillysharecopy",
  "sample_count": 4,
  "category": "advanced_threat",
  "description": "Worm:Win32/Sillysharecopy is a heuristic detection name for a rudimentary, heavily repackaged class of computer worms that propagate primarily by copying themselves to removable drives (USB flash drives) and open network shares. Unlike sophisticated exploits that use vulnerabilities like EternalBlue, Sillysharecopy relies on simplistic file copying and the abuse of Windows AutoRun features or tricking users into clicking on disguised executables to spread.<br><br><b>Understanding Simplistic Network Worms</b><br>To an end-user, an infection might not be immediately obvious, but they may notice their USB drives suddenly containing hidden files or strangely named folders that are actually executable `.exe` files. For a network administrator, these worms are a persistent nuisance. They don't typically cause massive immediate destruction, but they create a constant low-level spread of malware across the organization, often acting as a vector for secondary payloads.<br><br><b>Execution and Spreading Mechanics</b><br>The initial infection often occurs when a user plugs in a compromised USB drive (`T1091`) or opens an infected file from an open network share (`T1021.002`). When the worm executes (`T1204.002`), it establishes persistence, often by modifying Registry Run keys or dropping a copy of itself into the Startup folder (`T1547.001`). The worm then continually scans the system for newly attached removable drives or mapped network shares (`T1046`). When found, it copies its executable to the root of the drive (`T1570`). It frequently hides the legitimate folders on the drive and creates malicious `.exe` files with the same names and folder icons, tricking the next user into executing the worm when they attempt to open their files (`T1036`). It may also drop an `autorun.inf` file to attempt automatic execution on older systems.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is persistent infection and the potential for secondary payload delivery. Host-based IoCs include EDR alerts for anomalous processes constantly enumerating attached drives and copying `.exe` or `.vbs` files to the root directories of removable media and network shares. Users will report that their folders on USB drives have 'turned into applications.'",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1021.002",
    "T1570",
    "T1091",
    "T1036"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (USB spreading)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares (Spreading via network shares)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1036",
      "name": "Masquerading (Disguising executables as folders)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1570",
      "name": "Lateral Tool Transfer (Copying the worm)",
      "tactic": "Lateral Movement"
    }
  ],
  "containment_steps": [
    "Isolate the infected endpoint and immediately disable access to critical, open network shares to prevent the worm from copying itself there.",
    "Enforce strict Group Policies to disable AutoRun/AutoPlay for all removable media enterprise-wide.",
    "Run specialized AV scans designed to unhide the legitimate folders on affected USB drives and remove the malicious executables.",
    "Audit file server permissions; users should only have write access to directories strictly necessary for their role to limit the worm's spread."
  ],
  "what_to_avoid": [
    "Do not allow the use of unencrypted, unmanaged USB drives in secure environments, as they are a primary vector for these types of worms.",
    "Avoid simply formatting the USB drives if they contain critical data; the data is usually just hidden, not destroyed, and can be recovered."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}