Overview

overview

10

Static

static

URLScan

urlscan

https://github.com/E...

windows7_x64

10

Analysis

  • max time kernel
    195s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    16-11-2021 18:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/Fantom.zip

Score
10/10
fantomevasionransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-103686315-404690609-2047157615-1000\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>ZBIiEWXbZk5CxDfG5h3zlPPY+vK4nwKcc3xFXcAcyklmwWPqjJIXbZYMagKbWkpQZgPU+wfnN8FIR9ouqwnVQMviJhDKlnKh4m/awJP4OKbitqVkq+c4E6NtDQhr+n5tLbbj4fgQ6Z9ZU78W/YJGaXIxb2XPC8rhYORwz5SpTrO1cJqLgZKvn2MO/+tHEaL1Hg1wg3uRMehZlv6xCXuypgWFHJficB3tet5hN2tzSuTrfc2OZywAphMeVy26TjZ4FDrJI1FC013NfuD52y12mGLub2M6FgA6q8+oeLTssO2389pVMLT7xRajKbGofz2UTxO/Oo5MR1m9UpA2HYTMmw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom
  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/Fantom.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:108
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Fantom\" -spe -an -ai#7zMap19383:74:7zEvent32314
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2004
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4f4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1600
  • C:\Users\Admin\Downloads\Fantom\Fantom.exe
    "C:\Users\Admin\Downloads\Fantom\Fantom.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1640
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1368

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1036-64-0x0000000004913000-0x0000000004914000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1036-63-0x0000000004912000-0x0000000004913000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1036-62-0x0000000004911000-0x0000000004912000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1036-61-0x0000000001E20000-0x0000000001E4B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/1036-78-0x000000000491A000-0x000000000492B000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1036-60-0x00000000004D0000-0x00000000004FC000-memory.dmp

    Filesize

    176KB

    Download

  • memory/1036-65-0x0000000004914000-0x0000000004916000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1036-71-0x0000000002300000-0x0000000002309000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1036-66-0x0000000001E60000-0x0000000001E61000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1640-79-0x000000001B330000-0x000000001B332000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1640-76-0x0000000000D10000-0x0000000000D11000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1640-80-0x000000001B336000-0x000000001B355000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1648-56-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-58-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

    Filesize

    8KB

    Download