Overview

overview

10

Static

static

3

2026-04-15...ry.exe

windows10-2004-x64

10

2026-04-15...ry.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/04/2026, 02:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_172bd8cc09edb66e97bdda6cf6752143_elex_mimic_pay2key_wannacry.exe
  • Size 3.5MB
  • Sample260415-cmsnhadv8p
  • SHA256 0eed4f8f14e639d0f6774a58aeda52e69b78c17777037312486bb92a30ada259
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverymimicpersistenceransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\global_options.ini

Ransom Note
  • 26=ELPACO-team 27=TIB;sql;sqlite;sqlite3;sqlitedb;mdf;mdb;adb;db;db3;dbf;dbs;udb;dbv;dbx;edb;exb;1cd;fdb;idb;mpd;myd;odb;xls;xlsx;doc;docx;bac;bak;back;zip;rar;dt;4dd;4dl;abcddb;abs;abx;accdb;accdc;accde;accdr;accdt;accdw;accft;ade;adf;adn;adp;alf;arc;ask;bacpac;bdf;btr;cat;cdb;chck;ckp;cma;cpd;dacpac;dad;dadiagrams;daschema;db-shm;db-wal;db2;dbc;dbt;dcb;dct;dcx;ddl;dlis;dp1;dqy;dsk;dsn;dtsx;dxl;eco;ecx;epim;fcd;fic;fm5;fmp;fmp12;fmpsl;fol;fp3;fp4;fp5;fp7;fpt;frm;gdb;grdb;gwi;hdb;his;hjt;ib;icg;icr;ihx;itdb;itw;jet;jtx;kdb;kexi;kexic;kexis;lgc;lut;lwx;maf;maq;mar;mas;mav;maw;mdn;mdt;mrg;mud;mwb;ndf;nnt;nrmlib;ns2;ns3;ns4;nsf;nv;nv2;nwdb;nyf;oqy;ora;orx;owc;p96;p97;pan;pdb;pdm;pnz;qry;qvd;rbf;rctd;rod;rodx;rpd;rsd;s2db;sas7bdat;sbf;scx;sdb;sdc;sdf;sis;sl3;spq;sqlite2;te;temx;tmd;tps;trc;trm;udl;usr;v12;vis;vpd;vvv;wdb;wmdb;wrk;xdb;xld;xmlff;7z; 28=386;cmd;deskthemepack;diagcab;diagcfg;diagpkg;dll;info;mui;sys;theme;tmp; 29=steamapps;Cache;Boot;Chrome;Firefox;Mozilla;Mozilla Firefox;MicrosoftEdge;Internet Explorer;Tor Browser;Opera;Opera Software;Common Files;Config.Msi;Intel;Microsoft;Microsoft Shared;Microsoft.NET;MSBuild;MSOCache;Packages;PerfLogs;ProgramData;System Volume Information;tmp;Temp;USOShared;Windows;Windows Defender;Windows Journal;Windows NT;Windows Photo Viewer;Windows Security;Windows.old;WindowsApps;WindowsPowerShell;WINNT;$RECYCLE.BIN;$WINDOWS.~BT;$Windows.~WS;:\Users\Public\;:\Users\Default\; 30=desktop.ini;iconcache.db;thumbs.db; 31= 32= 33=reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AllowMultipleTSSessions" /t REG_DWORD /d 0x1 /f;reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fSingleSessionPerUser" /t REG_DWORD /d 0x0 /f;reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "c:\windows\system32\cmd.exe"; 34=1 35=2 36=0 37=0 38=0 39=1 40=0 41=1 42=1 43=1 44=1 45=1 46=1 47=0 48=1 49=0 50=0 51=0 53=1 54=0 55=1 56=1 57=1 58=1 59=1 60=1 61=1 62=1 63=Hello my dear friend (Do not scan the files with antivirus in any case. In case of data loss, the consequences are yours)\nYour data is encrypted\nYour decryption ID is ID_PLACEHOLDER\nUnfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\nIf you want to recover your files, write us\n1) eMail - [email protected]\n2) Telegram - @DataSupport911 or https://t.me/DataSupport911\n\nAttention!\n\nDo not rename encrypted files. \nDo not try to decrypt your data using third party software - it may cause permanent data loss. \nWe are always ready to cooperate and find the best way to solve your problem. \nThe faster you write - the more favorable conditions will be for you. \nOur company values its reputation. We give all guarantees of your files decryption. 66=1
Emails
URLs

  • https://t.me/DataSupport911\n\nAttention!\n\nDo

Signatures

  • Family: Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic
  • Detects Mimic ransomware 2 IoCs
  • Clears Windows event logs 1 TTPs 2 IoCs
    defense_evasionransomware
  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs
  • Detects command variations typically used by ransomware 2 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 2 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 2 IoCs
  • Detects executables packed with ConfuserEx Mod 4 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • ConfuserEx .NET packer 3 IoCs

    Detects ConfuserEx .NET packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_172bd8cc09edb66e97bdda6cf6752143_elex_mimic_pay2key_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_172bd8cc09edb66e97bdda6cf6752143_elex_mimic_pay2key_wannacry.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5660
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5728
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p7183204373585782 Everything64.dll
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1080
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ELPACO-team.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ELPACO-team.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\svhostss.exe
        "C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\svhostss.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5612
        • C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\gui40.exe
          C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\gui40.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5588
        • C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\Everything.exe
          "C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3404
        • C:\Windows\SysWOW64\wevtutil.exe
          wevtutil.exe cl security
          4⤵
          • Clears Windows event logs
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5544
        • C:\Windows\SysWOW64\wevtutil.exe
          wevtutil.exe cl system
          4⤵
          • Clears Windows event logs
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:648
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2900

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Everything.db
        • Path C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\Everything.db
        • Size 15.1MB
        • SHA256 044655f6a942918f44d0c5ba185886d72f79c98c0dc54c547232b054c567fb38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Everything.ini
        • Path C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\Everything.ini
        • Size 20KB
        • SHA256 6bbc228271f822a3332e691a4b84f76cf8a1f158b4c9eb4b3fc8a53226fb8ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        global_options.ini
        • Path C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\global_options.ini
        • Size 6KB
        • SHA256 c51ab1e621d417a87074c5d65f264df4a913329456811cc065d26cb298d4c271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        global_options.ini
        • Path C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\global_options.ini
        • Size 5KB
        • SHA256 d5ab2b261c3138070a70fa2feeb435162c40f7d0ba8a15f6ac6064d57b6a3545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        session.tmp
        • Path C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\session.tmp
        • Size 32B
        • SHA256 ab5fb255896a0d5ddcf63a693ad48ba55c3e919f99216665a9c8db11d95122ce
        • MD5 SHA1 SHA512
        Submit Download

        7ZSfx000.cmd
        • Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
        • Size 314B
        • SHA256 f40a1e88e3ca40f44d31979a40a4398a53962873ddd543e95677d9d545ac2485
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7za.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
        • Size 772KB
        • SHA256 ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DC.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe
        • Size 802KB
        • SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ELPACO-team.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ELPACO-team.exe
        • Size 2.4MB
        • SHA256 e160d7d21c917344f010e58dcfc1e19bec6297c294647a06ce60efc7420d3b13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]
        • Size 2.4MB
        • SHA256 b600e06f14e29b03f0b1456723a430b5024816518d704a831dde2dc9597ce9c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Everything.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
        • Size 1.7MB
        • SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Everything.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini
        • Size 548B
        • SHA256 2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Everything2.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini
        • Size 550B
        • SHA256 89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Everything32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
        • Size 84KB
        • SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Everything64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
        • Size 2.5MB
        • SHA256 d180f63148fbbfcfd88aa7938ab88fcea3881402b6617f4f3e152427aeb6c59c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        global_options.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\global_options.ini
        • Size 10B
        • SHA256 14f93a82d99cd2bf3da0aba73b162a7bb183eded695cffff47a05c1290d2a2fa
        • MD5 SHA1 SHA512
        Submit Download

        gui35.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\gui35.exe
        • Size 276KB
        • SHA256 22ea129b0f57184f30b1771c62a3233ba92e581c1f111b4e8abfa318dc92cc46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gui40.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\gui40.exe
        • Size 276KB
        • SHA256 31feff32d23728b39ed813c1e7dc5fe6a87dcd4d10aa995446a8c5eb5da58615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xdel.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xdel.exe
        • Size 350KB
        • SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5588-96-0x0000000000630000-0x000000000067E000-memory.dmp
        Download

        memory/5588-115-0x0000000002780000-0x000000000278C000-memory.dmp
        Download

        memory/5588-114-0x000000001B7D0000-0x000000001B8BA000-memory.dmp
        Download

        memory/5588-97-0x0000000000E80000-0x0000000000E86000-memory.dmp
        Download

        memory/5588-99-0x0000000000E90000-0x0000000000E96000-memory.dmp
        Download

        memory/5588-98-0x00000000027C0000-0x0000000002814000-memory.dmp
        Download

        memory/5588-136-0x0000000002780000-0x000000000278C000-memory.dmp
        Download

        memory/5588-135-0x000000001B7D0000-0x000000001B8BA000-memory.dmp
        Download