mimic | ccac2b64933948bf66c31c3cd54e6af63f78d91e07d4e9cd6154172fd40dfe09

General

Target
2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry
Size 2.1MB
Sample261105-rnbtps1sf1
SHA256 ccac2b64933948bf66c31c3cd54e6af63f78d91e07d4e9cd6154172fd40dfe09
MD5 bed47846d968146a771ba993ced17bf1
SHA1 b766e08ea668c016950a180464d43183faa962d6
SHA512 55cd69d9d5d7058702bd5f563bbfe406ff2d67ae6d12fa7d7ec4b98143abca1b53ecbc427343313baa2d79d36c4df8d2145a58eef5aba1d14135a9fe097eedc0
SSDEEP 49152:wgwRz+OUvWmmDXnj9ULD0QUU5J0jGEAjw4PR+7H:wgwRzGvWx2LD0KJ0jGPw4J+L
TLSH
T1B0A53391BFDB8032F093137548892A6619BD93750B27D0C767C01A26CFAABE4DB3D167
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry
- Size 2.1MB
- SHA256 ccac2b64933948bf66c31c3cd54e6af63f78d91e07d4e9cd6154172fd40dfe09
- MD5 bed47846d968146a771ba993ced17bf1
- SHA1 b766e08ea668c016950a180464d43183faa962d6
- SHA512 55cd69d9d5d7058702bd5f563bbfe406ff2d67ae6d12fa7d7ec4b98143abca1b53ecbc427343313baa2d79d36c4df8d2145a58eef5aba1d14135a9fe097eedc0
- SSDEEP 49152:wgwRz+OUvWmmDXnj9ULD0QUU5J0jGEAjw4PR+7H:wgwRzGvWx2LD0KJ0jGPw4J+L
- TLSH
  T1B0A53391BFDB8032F093137548892A6619BD93750B27D0C767C01A26CFAABE4DB3D167
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution mimic persistence ransomware
- Detects Mimic ransomware
- Family: Mimic
  Ransomware family was first exploited in the wild in 2022.
  ransomware mimic
- Custom signature
  
  Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Custom signature
  
  Detects command variations typically used by ransomware
- Custom signature
  
  Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
- Custom signature
  
  Detects executables containing commands for clearing Windows Event Logs
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (3897) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1 behavioral2