General
- Target 2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry
- Size 2.1MB
- Sample261105-rr57qaxt2m
- SHA256 ccac2b64933948bf66c31c3cd54e6af63f78d91e07d4e9cd6154172fd40dfe09
Malware Config
Targets
-
- Target 2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry
- Size 2.1MB
- SHA256 ccac2b64933948bf66c31c3cd54e6af63f78d91e07d4e9cd6154172fd40dfe09
Score10/10Detects Mimic ransomware
Family: Mimic
Ransomware family was first exploited in the wild in 2022.
Renames multiple (896) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Event Triggered Execution: Image File Execution Options Injection
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Modifies system executable filetype association
Adds Run key to start application
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1