General
- Target 2025-12-08_048739c77f1270872156d514137966cb_elex_mimic_pay2key_wannacry
- Size 2.2MB
- Sample251208-cndkzaymbr
- SHA256 facfcfdd8cbbe2065a9d174a64a7608d39e93ebd4bfa8d1d48585fd4190901f3
Malware Config
Targets
-
- Target 2025-12-08_048739c77f1270872156d514137966cb_elex_mimic_pay2key_wannacry
- Size 2.2MB
- SHA256 facfcfdd8cbbe2065a9d174a64a7608d39e93ebd4bfa8d1d48585fd4190901f3
Score10/10Detects Mimic ransomware
Mimic
Ransomware family was first exploited in the wild in 2022.
Mimic family
Modifies boot configuration data using bcdedit
Renames multiple (5870) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
Event Triggered Execution: Image File Execution Options Injection
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Modifies system executable filetype association
Adds Run key to start application
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1