Trend Micro researchers discovered a new ransomware that abuses the APIs of a legitimate tool called Everything, a Windows filename search engine developed by Voidtools that offers quick searching and real-time updates for minimal resource usage.
Trend Micro researchers discovered a new ransomware that abuses the APIs of a legitimate tool called Everything, a Windows filename search engine developed by Voidtools that offers quick searching and real-time updates for minimal resource usage. This ransomware (which we named Mimic based on a string we found in its binaries), was first observed in the wild in June 2022 and targets Russian and English-speaking users. It is equipped with multiple capabilities such as deleting shadow copies, terminating multiple applications and services, and abusing Everything32.dll functions to query target files that are to be encrypted.
In this blog entry, we will take a closer look at the Mimic ransomware, its components and functions, and its connection to the Conti builder that was leaked in early 2022.
Arrival and components
Mimic arrives as an executable that drops multiple binaries and a password-protected archive (disguised as Everything64.dll) which when extracted, contains the ransomware payload. It also includes tools that are used for turning off Windows defender and legitimate sdel binaries.
| Filename | Description |
| 7za.exe | Legitimate 7zip file that is used to extract the payload |
| Everything.exe | Legitimate Everything application |
| Everything32.dll | Legitimate Everything application |
| Everything64.dll | Password protected archive that contains the malicious payloads |
Table 1. Details of the Mimic ransomware components
When executed, it will first drop its components to the %Temp%/7zipSfx folder. It will then extract the password protected Everything64.dll to the same directory using the dropped 7za.exe via the following command:
%Temp%7ZipSfx.0007za.exe” x -y -p20475326413135730160 Everything64.dll
It will also drop the session key file session.tmp to the same directory, which will be used for continuing the encryption in case the process is interrupted.
It will then copy the dropped files to “%LocalAppData%{Random GUID}”, after which the ransomware will be renamed to bestplacetolive.exe and the original files deleted from the %Temp% directory.
Based on our analysis, Mimic supports other command line arguments as shown in table 2.
| Cmdline option | Acceptable values | Description |
| -dir | File path to be encrypted | Directory for encryption |
| -e | all
local net watch ul1 ul2 |
Encrypt all (Default)
Encrypt Local files Encrypt files on Network shares ul:unlocker |
| -prot |
Protects the ransomware from being killed |
|
| -pid | <integer> | The process identifier (PID) of the previously-running ransomware. |
Table 2. Arguments accepted by Mimic ransomware
Mimic ransomware analysis
Mimic ransomware consists of multiple threads that employ the CreateThread function for faster encryption and render analysis more challenging for security researchers.
When executed, it will first register a hotkey (Ctrl + F1, using the RegisterHotKey API) that displays the status logs being performed by the ransomware.
The ransomware’s config is located at its overlay and is decrypted using the NOT Operation.
Figure 8 shows a more thorough look at the config and its values.
Mimic ransomware possesses a plethora of capabilities, including the following:
- Collecting system information
- Creating persistence via the RUN key
- Bypassing User Account Control (UAC)
- Disabling Windows Defender
- Disabling Windows telemetry
- Activating anti-shutdown measures
- Activating anti-kill measures
- Unmounting Virtual Drives
- Terminating processes and services
- Disabling sleep mode and shutdown of the system
- Removing indicators
- Inhibiting System Recovery
Abusing Everything32 APIs for encryption
Mimic uses Everything32.dll, a legitimate Windows filename search engine that can return real time results for queries, in its routine. It abuses the tool by querying certain file extensions and filenames using Everything’s APIs to retrieve the file’s path for encryption.
It uses the Everything_SetSearchW function to search for files to be encrypted or avoided using the following search format:
file:<ext:{list of extension}>file:<!endwith:{list of files/directory to avoid}>wholefilename<!{list of files to avoid}>
The query used by Mimic to search for files to be encrypted or avoided can be found here.
It then appends the .QUIETPLACE file extension to the encrypted files and, finally, displays the ransom note.
Code from leaked Conti builder
From our analysis, some parts of the code seemed to be based on, and share several similarities with the Conti ransomware builder that was leaked in March 2022. For example, the enumeration of the encryption modes shares the same integer for both Mimic and Conti.
The code related to argument net is also based on Conti. It will use the GetIpNetTable function to read the Address Resolution Protocol (ARP) cache and check if IP addresses contain “172.”, “192.168”, “10.”, or “169.” Mimic added a filter to exclude IP addresses that contain “169.254”, which is the IP range of Automatic Private IP Addressing (APIPA).
Mimic also uses the Conti code in Windows Share Enumeration, where it employs the NetShareEnum function to enumerate all shares on the gathered IP addresses.
Finally, Mimic’s port scanning is also based on the Conti builder.
More information about the behavior of Mimic ransomware can be found in this report.
Conclusion
Mimic ransomware, with its multiple bundled capabilities, seems to implement a new approach to speeding up its routine by combining multiple running threads and abusing Everything’s APIs for its encryption (minimizing resource usage, therefore resulting in more efficient execution). Furthermore, the threat actor behind Mimic seems to be resourceful and technically adept, using a leaked ransomware builder to capitalize on its various features, and even improve on it for more effective attacks.
To protect systems from ransomware attacks, we recommend that both individual users and organizations implement best practices such as applying data protection, backup, and recovery measures to secure data from possible encryption or erasure. Conducting regular vulnerability assessments and patching systems in a timely manner can also minimize the damage dealt by ransomware that abuse exploits.
A multilayered approach can help organizations guard possible entry points into the system (endpoint, email, web, and network). The right security solutions can also detect malicious components and suspicious behavior to protect enterprises.
- Trend Micro Vision One™ provides multilayered protection and behavior detection, which helps block questionable behavior and tools early on before the ransomware can do irreversible damage to the system.
- Trend Micro Cloud One™ Workload Security protects systems against both known and unknown threats that exploit vulnerabilities. This protection is made possible through techniques such as virtual patching and machine learning.
- Trend Micro™ Deep Discovery™ Email Inspector employs custom sandboxing and advanced analysis techniques to effectively block malicious emails, including phishing emails that can serve as entry points for ransomware.
- Trend Micro Apex One™ offers next-level automated threat detection and response against advanced concerns such as fileless threats and ransomware, ensuring the protection of endpoints.
Indicators of Compromise
The indicators of compromise for this entry can be found here.