Trend Micro researchers published a new report about “Mimic,” a new ransomware that was first observed in June 2022, abusing the Windows Everything tool’s APIs. The ransomware is an executable that drops various binaries and a password-protected archive that is disguised as “Everything64.dll”. The archive contains the ransomware payload and tools that disable Windows Defender and other legitimate binaries. Once executed, the executable drops and extracts its contents as well as drops a session key file that is used for continuing the encryption process even if it is interrupted. The ransomware is renamed to “bestplacetolive.exe” and all other files are deleted from the %Temp% directory. Mimic has an array of capabilities, such as creating persistence through the “RUN” key, removing indicators, disabling sleep mode and shutdown of the compromised machine, collecting system information, and more. “Everything32.dll”, a legitimate Windows filename search engine, is leveraged by Mimic to query specific file extensions and filenames using the tool’s APIs in order to retrieve the file’s path for encryption. The “Everything_SetSearchW” function is also used to avoid encrypting certain files. Once files have been encrypted, the “.QUIETPLACE” file extension is added and a ransom note is displayed. Mimic is noted to target primarily English and Russian-speaking users and has code similarities with the Conti ransomware builder, which was leaked in March 2022. Some similarities noted by researchers include the enumeration of the encryption modes sharing the same integer for both ransomwares, the port scanning capabilities are based on Conti, and Conti’s Windows Share Enumeration code is being used by Mimic. Additional technical details as well as indicators of compromise (IOCs) can be reviewed in Trend Micro’s report linked below.