Detection of a new ransomware strain targeting the Windows search engine

Security researchers at Trend Micro have just announced a new strain of ransomware that abuses the application programming interface of a third-party Windows search engine called Everything to encrypt the target system.

Named Mimic, this ransomware strain primarily targets Russian and English-speaking users. It possesses the following malicious capabilities:

1. Collect system information
2. Bypass User Account Control (UAC)
3. Disable Windows Defender
4. Disable Windows telemetry
5. Enable anti-shutdown measures
6. Remove the virtual drive
7. Termination of processes and services
8. Disable sleep mode and shutdown the system
9. Remove indexes
10. Prevent system recovery

A ransomware attack begins when the victim receives an executable file containing malicious code via email. When launched, this will extract four more files on the target system (shown above), including the main payload, additional files, and a tool to disable Windows Defender

Once the malicious file system is extracted, Mimic immediately exploits Everything's search capabilities using the 'Everything32.dll' file to find specific file names and extensions on the compromised system . This allows the ransomware to identify files that can be encrypted, while avoiding files that could cause the system to crash if locked. This is one of the extremely smart mechanisms of this ransomware strain.

Finally, Mimic will add the .QUIETPLACE extension to the encrypted files and display a ransom note to the victim. The malware demands a ransom to be paid in Bitcoin, calculated based on the number of encrypted files.

To protect your computer from ransomware attacks in general and Mimic in particular, always exercise caution when opening unwanted emails and attachments, and limit access to potentially malicious websites . Also, make sure your security programs are up to date so they can properly detect and remove ransomware. Finally, make it a habit to back up important files on external storage systems such as flash drives, hard drives, or the cloud. This way, even if ransomware encrypts your data, you can still easily restore everything you need from the backup.

Lesley Montoya

Update 15 October 2023