Ankura CTIX FLASH Update - January 27, 2023

Malware Activity

Mimic Ransomware Identified Abusing Legitimate Windows "Everything" Tool's APIs

Trend Micro researchers published a new report about "Mimic," a new ransomware that was first observed in June 2022, abusing the Windows Everything tool's APIs. The ransomware is an executable that drops various binaries and a password-protected archive that is disguised as "Everything64.dll". The archive contains the ransomware payload and tools that disable Windows Defender and other legitimate binaries. Once executed, the executable drops and extracts its contents as well as drops a session key file that is used for continuing the encryption process even if it is interrupted. The ransomware is renamed to "bestplacetolive.exe" and all other files are deleted from the %Temp% directory. Mimic has an array of capabilities, such as creating persistence through the "RUN" key, removing indicators, disabling sleep mode and shutdown of the compromised machine, collecting