Malware.View on attack.mitre.org
HIUPAN (aka U2DiskWatch) is a is a worm that propagates through removable drives known to be leveraged by Mustang Panda and was first observed utilized in 2024.
| Technique | Procedure example |
|---|---|
| T1057 Process Discovery |
HIUPAN has conducted process discovery to identify the PUBLOAD malware under the process WCBrowserWatcher.exe and will launch it from an install directory if it is not found. |
| T1091 Replication Through Removable Media |
HIUPAN has periodically checked for removable and hot-plugged drives connected to the infected machine, should one be found HIUPAN will propagate to the removeable drives by copying itself and accompanying malware components to a directory to the new drive in a hidden subdirectory `<Drive_Letter>:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\` and hides any other existing files to ensure UsbConfig.exe is the only visible file on the device. |
| T1112 Modify Registry |
HIUPAN has modified registry keys to ensure hidden files and extensions are not visible through the modification of `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced`. |
| T1120 Peripheral Device Discovery |
HIUPAN has checked periodically for removable drives and installs itself when a drive is detected. |
| T1204.002 Malicious File |
HIUPAN has lured victims into executing malicious files from USBs including the use of files such as USBconfig.exe. |
| T1547.001 Registry Run Keys / Startup Folder |
HIUPAN has added Registry Run keys to achieve persistence using `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`. |
| T1564.001 Hidden Files and Directories |
HIUPAN has modified registry keys to ensure hidden files and extensions are not visible through the modification of `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced`. |
| T1574.001 DLL |
HIUPAN has abused legitimate executables to side-load malicious DLLs to include the legitimate exe UsbConfig.exe. |
| T1678 Delay Execution |
HIUPAN has used a config file “$.ini” to store a sleep multiplier to execute at a set interval value prior to initiating a watcher function that checks for a specific running process, that checks for removable drives and installs itself and supporting files if one is available. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
