New Mimic Ransomware Abuses Everything APIs for its Encryption Process By Nathaniel Morales, Earle Maui Earnshaw, Don Ovid Ladores, Nick Dai, Nathaniel Gregory Ragasa ( words) Published: 2023-01-26 · Archived: 2026-04-05 21:33:27 UTC Ransomware Trend Micro researchers discovered a new ransomware that abuses the APIs of a legitimate tool called Everything, a Windows filename search engine developed by Voidtools that offers quick searching and real-time updates for minimal resource usage. By: Nathaniel Morales, Earle Maui Earnshaw, Don Ovid Ladores, Nick Dai, Nathaniel Gregory Ragasa Jan 26, 2023 Read time: 5 min (1240 words) Save to Folio Trend Micro researchers discovered a new ransomware that abuses the APIs of a legitimate tool called Everything, a Windows filename search engine developed by Voidtools that offers quick searching and real-time updates for minimal resource usage. This ransomware (which we named Mimic based on a string we found in its binaries), was first observed in the wild in June 2022 and targets Russian and English-speaking users. It is equipped with multiple capabilities such as deleting shadow copies, terminating multiple applications and services, and abusing Everything32.dll functions to query target files that are to be encrypted.  In this blog entry, we will take a closer look at the Mimic ransomware, its components and functions, and its connection to the Conti builder that was leaked in early 2022. Arrival and components Mimic arrives as an executable that drops multiple binaries and a password-protected archive (disguised as Everything64.dll) which when extracted, contains the ransomware payload. It also includes tools that are used for turning off Windows defender and legitimate sdel binaries.  Filename Description 7za.exe Legitimate 7zip file that is used to extract the payload Everything.exe Legitimate Everything application Everything32.dll Legitimate Everything application Everything64.dll Password protected archive that contains the malicious payloads https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html Page 1 of 8 Table 1. Details of the Mimic ransomware components When executed, it will first drop its components to the %Temp%/7zipSfx folder. It will then extract the password protected Everything64.dll to the same directory using the dropped 7za.exe via the following command: %Temp%\7ZipSfx.000\7za.exe" x -y -p20475326413135730160 Everything64.dll It will also drop the session key file session.tmp to the same directory, which will be used for continuing the encryption in case the process is interrupted. It will then copy the dropped files to “%LocalAppData%\{Random GUID}\”, after which the ransomware will be renamed to bestplacetolive.exe and the original files deleted from the %Temp% directory. Based on our analysis, Mimic supports other command line arguments as shown in table 2. Cmdline option Acceptable values Description -dir  File path to be encrypted Directory for encryption  -e all local net watch ul1 ul2 Encrypt all (Default) Encrypt Local files  Encrypt files on Network shares ul:unlocker  Creates a thread with interprocess communication and tries to unlock certain memory addresses from another process  -prot   Protects the ransomware from being killed -pid The process identifier (PID) of the previously-running ransomware. Table 2. Arguments accepted by Mimic ransomware Mimic ransomware analysis Mimic ransomware consists of multiple threads that employ the CreateThread function for faster encryption and render analysis more challenging for security researchers. https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html Page 2 of 8 When executed, it will first register a hotkey (Ctrl + F1, using the RegisterHotKey API) that displays the status logs being performed by the ransomware. The ransomware’s config is located at its overlay and is decrypted using the NOT Operation. Figure 8 shows a more thorough look at the config and its values. Mimic ransomware possesses a plethora of capabilities, including the following: Collecting system information Creating persistence via the RUN key Bypassing User Account Control (UAC) Disabling Windows Defender Disabling Windows telemetry Activating anti-shutdown measures Activating anti-kill measures Unmounting Virtual Drives Terminating processes and services Disabling sleep mode and shutdown of the system Removing indicators Inhibiting System Recovery   Abusing Everything32 APIs for encryption Mimic uses Everything32.dll, a legitimate Windows filename search engine that can return real time results for queries, in its routine. It abuses the tool by querying certain file extensions and filenames using Everything’s APIs to retrieve the file’s path for encryption. It uses the Everything_SetSearchW function to search for files to be encrypted or avoided using the following search format: file:file:wholefilename The query used by Mimic to search for files to be encrypted or avoided can be found here. It then appends the .QUIETPLACE file extension to the encrypted files and, finally, displays the ransom note. Code from leaked Conti builder From our analysis, some parts of the code seemed to be based on, and share several similarities with the Conti ransomwarenews article builder that was leaked in March 2022. For example, the enumeration of the encryption modes shares the same integer for both Mimic and Conti.  https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html Page 3 of 8 open on a new tab Figure 13. Similarities between Mimic (top) and the leaked Conti builder (bottom) The code related to argument net is also based on Conti. It will use the GetIpNetTable function to read the Address Resolution Protocol (ARP) cache and check if IP addresses contain “172.”, “192.168”, “10.”, or “169.” Mimic added a filter to exclude IP addresses that contain “169.254”, which is the IP range of Automatic Private IP Addressing (APIPA). https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html Page 4 of 8 open on a new tab Figure 14. Comparison of the Mimic (top) and the leaked Conti builder (bottom) “net” argument Mimic also uses the Conti code in Windows Share Enumeration, where it employs the NetShareEnum function to enumerate all shares on the gathered IP addresses.  https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html Page 5 of 8 open on a new tab Figure 15. Comparison of the Mimic (top) and the leaked Conti (bottom) Share Enumeration function Finally, Mimic’s port scanning is also based on the Conti builder. https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html Page 6 of 8 open on a new tab Figure 16. Comparison of the Mimic (top) and leaked Conti builder (bottom) port scanning function More information about the behavior of Mimic ransomware can be found in this report. Conclusion Mimic ransomware, with its multiple bundled capabilities, seems to implement a new approach to speeding up its routine by combining multiple running threads and abusing Everything’s APIs for its encryption (minimizing resource usage, therefore resulting in more efficient execution).  Furthermore, the threat actor behind Mimic seems to be resourceful and technically adept, using a leaked ransomware builder to capitalize on its various features, and even improve on it for more effective attacks. To protect systems from ransomware attacks, we recommend that both individual users and organizations implement best practices such as applying data protection, backup, and recovery measures to secure data from possible encryption or erasure. Conducting regular vulnerability assessments and patching systems in a timely manner can also minimize the damage dealt by ransomware that abuse exploits. A multilayered approach can help organizations guard possible entry points into the system (endpoint, email, web, and network). The right security solutions can also detect malicious components and suspicious behavior to protect enterprises. https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html Page 7 of 8 Trend Micro Vision One™one-platform provides multilayered protection and behavior detection, which helps block questionable behavior and tools early on before the ransomware can do irreversible damage to the system. Trend Micro Cloud One™ Workload Securityproducts protects systems against both known and unknown threats that exploit vulnerabilities. This protection is made possible through techniques such as virtual patching and machine learning.  Trend Micro™ Deep Discovery™ Email Inspectorproducts employs custom sandboxing and advanced analysis techniques to effectively block malicious emails, including phishing emails that can serve as entry points for ransomware. Trend Micro Apex One™products offers next-level automated threat detection and response against advanced concerns such as fileless threats and ransomware, ensuring the protection of endpoints.   Indicators of Compromise The indicators of compromise for this entry can be found here. Tags Source: https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html Page 8 of 8