Trojan.INF.HIDDENTEAR.THAOGBA: Analysis of a Low-Risk Windows Trojan with Autorun Persistence

Trojan.INF.HIDDENTEAR.THAOGBA is a Windows-based Trojan classified as low-risk by Trend Micro. It spreads through malicious downloads or as a secondary payload from other malware, leveraging autorun functionality to execute when users access infected drives. While its direct impact is limited, its persistence mechanism requires attention in environments with removable media usage.

Technical Overview

This Trojan operates by creating an AUTORUN.INF file that triggers execution upon drive access. The file contains commands to launch a randomly named executable stored in C:\Windows\temp\. Modern Windows systems typically disable autorun by default, but legacy systems or misconfigured environments remain vulnerable. The malware also attempts to terminate cmstp.exe (Connection Manager Profile Installer) to evade detection.

Key behavioral indicators include:

Process manipulation through termination of system utilities
Registry modifications targeting application paths
Payload storage in temporary directories with randomized filenames

Defensive Recommendations

For security operations teams, monitoring for unexpected AUTORUN.INF files in root directories is critical. System administrators should implement the following controls:

Disable autorun functionality through Group Policy (Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies)
Monitor registry writes to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
Implement endpoint detection for cmd /c start commands targeting temporary directories

Remediation Procedures

Trend Micro recommends a three-step remediation process:

Disable System Restore on affected Windows systems before scanning

Execute PowerShell commands to locate and remove malicious INF files:

Get-ChildItem -Path C:\ -Include AUTORUN.INF -Recurse -Force | Where-Object { 
    Select-String -Path $_ -Pattern "RunPreSetupCommandsSection|CustInstDestSectionAllUsers" 
} | Remove-Item -Force

Perform full system scans with updated antivirus signatures (Trend Micro patterns: VSAPI OPR 16.463.00 or later)

Security Implications

While Trojan.INF.HIDDENTEAR.THAOGBA presents minimal direct risk, its persistence mechanism could facilitate secondary infections. Organizations should prioritize autorun hardening, particularly in environments with frequent removable media usage. The malware’s low-risk classification reflects its limited payload rather than its potential as an infection vector for more dangerous threats.