The only actual "evidence" that was provided was a link to a falcon sandbox run, something which actually requires human analysis to draw conclusions about -- and anyone who has ever used it knows how many false positives it finds.
A better proclamation might be "cheap network adapter comes with an auto-running executable which needs further analysis".
Settings -> Bluetooth & Devices -> AutoPlay -> Use AutoPlay for all media and devices
Was set to on, and "Removable drive" was set to "Choose a default", which appears to be equivalent to "Ask me every time".
I don't have anything (that I'm aware of) that auto-runs something, but I presume it will prompt me asking if I want to run setup.exe, which seems somewhat reasonable for new hardware.
And from the malware analysis, https://www.hybrid-analysis.com/sample/e3f57d5ebc882a0a0ca96... , it's signed by "Owner: CN=Microsoft Windows Hardware Compatibility Publisher, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Windows Third Party Component CA 2012, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US" which also looks pretty legit.
I can totally see a lot of folks allowing it to run.
No. Microsoft just said it will disable it. On some systems, i've seen it disabled (i don't know if by default or by AD policy) but, on the majority of Windows 10, it was not disabled.
Current verdict - not malware.
Check out https://news.ycombinator.com/item?id=42743033#42743428 for more lulz
I've seen so many correct responses downvoted and with horrible replies. Anyone who used old moderated email lists will see how culture changed and the decline of actual conversation. Even stack overflow has went downhill.
