Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
26/02/2025, 14:19
General
-
Target
MimicBuilder.exe
-
Size
3.2MB
-
MD5
5960d101c8170b432f93387b96927af7
-
SHA1
8d7e349c22a11f76fc13e9edc50e25067766ef66
-
SHA256
f23542f7ee78d204034cb11a48c97b04e447fc17535133414da453fadd4738cb
-
SHA512
9c7984f8bb374291af37268fb2c5008ac71d64d6fe0e5837c29000d448c81da0fca820d8a74ffeb3b50b0677cbb64c4331ba27fbce4ca42ec65634926ae4e251
-
SSDEEP
49152:ngwRk5ifu1DBgutBPNl1XIVRGTYAxoLayVwbRp2BQG82XmBTgmrZhhfCYZ:ngwRk5vguPPH1XWGIb4Rp26G844TXn
Malware Config
Extracted
C:\Users\Admin\AppData\Local\BC57CE41-27D7-C825-6CB7-A6508B063C81\global_options.ini
Signatures
-
Detects Mimic ransomware 1 IoCs
-
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Mimic family
-
Clears Windows event logs 1 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies system executable filetype association 2 TTPs 10 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 11 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 59 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MimicBuilder.exe"C:\Users\Admin\AppData\Local\Temp\MimicBuilder.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p2683527442232016684 Everything64.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\datadecrypt.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\datadecrypt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\BC57CE41-27D7-C825-6CB7-A6508B063C81\Datadecrypt.exe"C:\Users\Admin\AppData\Local\BC57CE41-27D7-C825-6CB7-A6508B063C81\Datadecrypt.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\BC57CE41-27D7-C825-6CB7-A6508B063C81\gui40.exeC:\Users\Admin\AppData\Local\BC57CE41-27D7-C825-6CB7-A6508B063C81\gui40.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\BC57CE41-27D7-C825-6CB7-A6508B063C81\Everything.exe"C:\Users\Admin\AppData\Local\BC57CE41-27D7-C825-6CB7-A6508B063C81\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl security4⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl system4⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.2MB
MD55ea469de24b6ad33138f025ea3511e1a
SHA11eda74fb036ef0b47cfc5ec8e541fcc5a79936d3
SHA25675b771081c614ec2a2ac3291ddedb0cc4026770f1046b286507ca995a24c3cf2
SHA5126f9232ab43ec49dda38bee6c1cf350298a8c14e59b15b2bc1b9f85af43be1ca0ba7a04c0d47308826a353c6189062ccd8e5afc852b5952928e89b1df16a54c53
-
Filesize
20KB
MD52912918b8786de783c1108e9bba32b46
SHA1ba41ac41bdd293ba4e38f64c4e91b79daf48598a
SHA2562e778518f6fd08a7694fbebe4afe93b224b1f9e3243065923f466e8db33a7cc3
SHA5129e53c5a44bfb55d11d41df87b7578490dad3277929d1c868e65093698136a718de71406de5f52c9c03049639d038e271a4e79368cb2acd869356148a5ccc9009
-
Filesize
7KB
MD5332d5aa422c1544e0e1ff3bdbf8fec72
SHA1dd98000b077827d868b7a0b4f45a0a334dbc214e
SHA2560cabb626c989e1fff223d0d5d891dfa148c1337a2d80bc8a48f7990a1aec3357
SHA512627408279f8d2d1b0c0e239f04d1107cafeac31d44b44dae78ec0396cc82fe900eedcbe481e8cb8f4d866d910e05961779c663d782953256bb8009c373bd6b7b
-
Filesize
8KB
MD533fc202e6618a81e6e1e98182cbb0c3d
SHA1b7d6be7ad86dda631d8f1e73c7e3ae6546d98d52
SHA25688ae91e383adaeb357b32bd304aadf3586dbe65c02b1057ec85ae094ba1585ea
SHA5124f48a01ec561b8db0d3b8ac60fbaa4063520afab7a6a622bb50446f71e8316afc50180fcf6a5688eb3914e29c522850ff817db3789e8aac0f3bc29eb4e8f268c
-
Filesize
32B
MD538555061bb87a9599a87c9c01e15d1c6
SHA1ffe9aeca1df76cd961b01a51c2158946adc23ecb
SHA256ca0e66926de2b2645dffbdee58d630583a7dab0342bf6b8202b0bbf00bb0fcc4
SHA51213419e2fc555dc97923ee7d14cd425a75fbb4f18ece98216c66ccab5a94bad418d9d74e600ef3afc21144f9ea19505571d3eb9756a249518046d757799d33cde
-
Filesize
196B
MD532a79aba4eeb9fa9e1693b106367c4ef
SHA1e830778969f69b703f625b085336243730d6c960
SHA25687943f487afe6305652c4205771b0a438290e351cc6cc9b877dc6bbd8fa42c8c
SHA5121a1fbbfd1a4a26e49e5ceaa1909ca7d3e07db879fff54cfa9221e860aa265481dcea7d6221e06c1ffec14364ee5714284e1fb98db8a57ef02160ae19557a4293
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
2.2MB
MD56beaabdcebd1819dd160b0137b8d68e0
SHA1354dbc5877c6a24a4b83211b695077e28aaea060
SHA2560da80dffc602b64b17f47a1b82f38f75a2222234d83ffda4131f8ad3ae99682e
SHA512481ef0a44580a713af5f5169fc2ab20ad943dda3b3477e14d4bc92f1131ad6afb629874d0beda72fc3852274f00e3cb4c2c30a6c81bd7d25f89e3f7c29e34a54
-
Filesize
2.4MB
MD56b81003a9aa0f8925e010211048c1035
SHA19e229a278a72b13c59331bac4baab7373a59d2e6
SHA256c3c77f6f43c24ce810a71f6a3174c5de6e8be398479e5f8207e94c802890cf7c
SHA5122833dd94fc7146776a7a3e11c8fcd681080762a24f525682228d533b93f3b9ecdc9c665a036d7fb9fef034db29f6e64e92b20c2cff731eaea44701e34c7b7a43
-
Filesize
10B
MD526f59bb93f02d5a65538981bbc2da9cc
SHA15e99a311784301637638c02401925a89694f463d
SHA25614f93a82d99cd2bf3da0aba73b162a7bb183eded695cffff47a05c1290d2a2fa
SHA512e48f20a62bb2d5de686a7328a682a84821c83c8c4d836287adffbe464a8b4a0ba8ca728a35438c58f142686047b153c9c3f722c0431db620e3ef3479215b9016
-
Filesize
276KB
MD503a63c096b9757439264b57e4fdf49d1
SHA1a5007873ce19a398274aec9f61e1f90e9b45cc81
SHA25622ea129b0f57184f30b1771c62a3233ba92e581c1f111b4e8abfa318dc92cc46
SHA5120d656d807572f6be4574024e2bbcf0cbd291fe13a1adeb86a333177ee38db16b06da9a18509e599db0d2cf8206b84f6856a9674dba29a2cbeb844a216cb45ddd
-
Filesize
276KB
MD557850a4490a6afd1ef682eb93ea45e65
SHA1338d147711c56e8a1e75e64a075e5e2984aa0c05
SHA25631feff32d23728b39ed813c1e7dc5fe6a87dcd4d10aa995446a8c5eb5da58615
SHA51215cf499077e0c8f3421b95e09a18ae5468ae20a7b3a263f01cc8e6d445d54f09ca8a3189ecb40c87d0e6277c99b504424cdd0e35bbe493a1b0849900d21bccf8
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
24KB
-
Filesize
336KB
-
Filesize
24KB
-
Filesize
312KB