Infected USB Case Study: Recovering Hidden Files and Tracing the Malware Chain

Researcher: {Jack Man}

Recently, I received a USB drive from a friend just come back from Taiwan with a suspicious story.

Three months earlier, in February 2026, the USB drive had been connected to a Windows computer at a printing store near the National Taiwan University. Just a few seconds after being plugged in, the original files appeared to be gone. Only one shortcut named “USB Drive” remains in the root directory.

At first glance, this looked like data loss. However, the drive’s used capacity had not changed. That was the first clue that the files were probably still present, just hidden.

This post walks through how I recovered the visible files, what the malware chain looked like, and why the malware did not execute when the victim double-clicked the shortcut.

Failed Recovery Attempts

Before I received the USB drive, my friend tried several recovery methods found online, including enabling hidden files in Windows Explorer. None of them restored the visible files.

They also tried double-clicking USB Drive.lnk. Fortunately, they were using a Mac. That likely prevented the malware from executing, as the infection chain was Windows-specific.

Let’s look deeper into the USB Drive.lnk file, it is linked to the u642238.vbs under the sysvloume folder. Wait, I didn’t see this folder before, after showing the hidden files.

The folder is real, it just is not showing in the explorer.

Finding the Hidden Data

The first suspect that the files had not been deleted was the drive capacity. Windows still showed roughly the same used space, even though Explorer displayed only USB Drive.lnk.

To confirm this, I opened Command Prompt from the USB drive root and listed all files, including hidden and system entries:

dir /a

There are two hidden folders found by using the command line. One of them was named: USB Drive

That folder contained the original user data. The files were not gone. They had been hidden behind filesystem attributes.

To check which file attributes were applied, we can simply use the attribcommand

attrib /d

The output showed the S and H attributes on the folder:

S = System     H = Hidden

From the attrib document, the folder attributes shows SH means the System file attribute and Hidden file attribute was set.

This explained why the folder did not appear normally in Explorer. Showing hidden files in Explorer is not always enough, because Windows may still hide protected operating system files (S) unless that separate setting is disabled.

Recovering the Visible USB Data

After confirming that the original files were still present, the visible data could be recovered by removing the hidden and system attributes.

From the root directory of the USB drive:

attrib -s -h /s /d

This recursively removes the System and Hidden attributes from files and directories.

After the command completes, the hidden USB Drive folder and the original files should become visible again in Explorer. This restores visibility of the data, but it does not clean the malware. Do not run the shortcut, VBS, batch file, or DLL. Copy the recovered documents to a safe location first.

To remove the malware from the USB.

del /f "USB Drive.lnk"
del /f sysvolume
rmdir /s /q sysvolume

After backing up the recovered data, the safest option is still to format the USB drive before reusing it.

How the Malware Works

Once the victim double-clicks the USB Drive.lnk .The shortcut will execute the VBS (Visual Basic Script) on their own computer.

The malware chain was Windows-specific:

The most important is the decoy behavior. The batch file opens the hidden USB Drive folder so the victim sees their original files. From the victim’s perspective, double-clicking the shortcut appears to “fix” the drive. In reality, on Windows, that same click starts the infection chain.

This also explains why the victim double-clicking on macOS did not appear to trigger the infection. macOS may still hide the folder due to filesystem metadata, but it does not execute the Windows .lnk and VBS as designed.

The VBS file acts as a launcher. It attempts to relaunch itself through wscript.exe using the runas verb, which may trigger a UAC prompt.

The batch file performs the main installation logic. It opens the hidden user-data folder as a decoy, attempts to add Microsoft Defender exclusions, copies a disguised DLL payload into C:\\Windows\\System32, and runs it with rundll32.exe.

The DLL payload was submitted to VirusTotal under the SHA-256 hash:

e60ab99da105ee27ee09ea64ed8eb46d8edc92ee37f039dbc3e2bb9f587a33ba

Defensive Takeaway

For individual users:

• Use the dedicated USB to copy a file across shared machines
• Prefer cloud upload or email for printing.
• Treat unexpected .lnk files on USB drives as suspicious.
• Format the USB drive before reusing it.

For Organization: