Its a educational tool created to on a raspberry pi micro controller RP2040. Based on an open source github project called hackypi.
Development board :
https://www.waveshare.com/rp2040-geek.htm
It can be used for any RP2040 project you want. For example it has as UART, DEBUG and I2C. Communication protocols to say debug a circuit project.
In this case I am using it to act as a BADUSB which is a type of attack when you act as a keyboard and execute commands in powershell or command prompt. The above is a very simple program to open a website in your default browser. But more damaging payloads can be coded which can execute far more damaging attacks.
will it work if autorun is disabled in windows settings?
Its executing a HID attack acting as a keyboard or mouse. Physical access to a computer is the worst case scenario as its basically giving remote code execution on a machine. If your detection is checking very fast keystrokes, attacker can write a code which types slower to prevent it. HID can download a bigger payload on the target machine depending on access rights. A office machine with group policy can detect security breaches or abnormal behavior but HID is still dangerous there.
Payloads can be for any OS be it Windows, MacOS, Android or Linux. Antivirus software wont detect these devices as technically not doing anything abnormal. It will just appear that you type very fast.
hak5 rubber ducky is a example of commercial grade BADUsb with a payload editor software and repository for more payloads. I built this on a dev board as a proof of concept. Amazon used to sell this flashed for almost 3 times the price of my device.
https://www.amazon.in/HackyPi-Ultimate-Professionals-Programmable-Educational/dp/B0C3LRLPNX/
If you want to read about the biggest badUSB attack you can read about stuxnet attack. Bad USB was a just the method of the attack. The real meat of the attack was the payload with 3 zero day vulnerabilities.
How Kaspersky Lab tracked down the malware that stymied Iran’s nuclear-fuel enrichment program
spectrum.ieee.org
Also sometimes you dont even need physical access.
https://www.bettercap.org/modules/hid/ . You can inject in wireless mouse and keyboards.
TLDR : Don't plug any unknown USB