fantom | f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fantom.exe
Size

261KB
MD5

7d80230df68ccba871815d68f016c282
SHA1

e10874c6108a26ceedfc84f50881824462b5b6b6
SHA256

f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
SHA512

64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
SSDEEP

3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Score

10^/10

fantom evasion ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>KLCFrltuACfTgL/ohvsjyzXEcK/9rwzJhnXi1W+EcT8fnJhifzHj0LLIArbZASQ07H3of06s3OpCpXlMYdnAokDcZ0VwvQ0XilDBZyrB2enZzvdmnyW8RrheWj3BCRqQwfTuT7FshQHiX5cmFfUCKjvoKPX/MDCIXLI5tp9k9agzLsmUwCVU5lD71mwfgQEdtSvI0VZbvQeLg7QJVgNAygnSelMamXwDxmhKzKi8gwScbF5ZXf9oFsITaBpNztn/ECqOMXhUywPWyZOaP1r6mHzm/XE/zay/RWFGZLj9Y9FA8+OBwCv5G5+x7AjZKK99sLbGvHqyECuyMMmvlNn18Q==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Renames multiple (133) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	Fantom.exe

Executes dropped EXE 1 IoCs

pid	Process
4092	WindowsUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	Fantom.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\Stationery\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\CopyDismount.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\DESIGNER\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	Fantom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5000	Fantom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	Fantom.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4092	5000	Fantom.exe	99
PID 5000 wrote to memory of 4092	5000	Fantom.exe	99

C:\Users\Admin\AppData\Local\Temp\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
fa5ec90115bb14bc6c98c6875fd1cdfd

SHA1
cde6f0a5186383a44e3a8d437ee89bf11acca807

SHA256
9a98b88ff92ce4d7c8f3b6590541be1ff669030c083b1a7de02619b03eeb4afd

SHA512
733078725ea349262e048e964a78b90e4ecd977cf2711e1be98e6a154237a70c211d9887c2d2a1d2bc57749bd3384956dfa335e25aab51e7b383f2597800da6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
memory/4092-152-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/4092-153-0x00007FF94CAD0000-0x00007FF94D591000-memory.dmp

Filesize
10.8MB

Download
memory/4092-282-0x00000000024E0000-0x00000000024F0000-memory.dmp

Filesize
64KB

Download
memory/4092-281-0x00007FF94CAD0000-0x00007FF94D591000-memory.dmp

Filesize
10.8MB

Download
memory/4092-154-0x00000000024E0000-0x00000000024F0000-memory.dmp

Filesize
64KB

Download
memory/5000-39-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-51-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-6-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-7-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-11-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-9-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-13-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-15-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-17-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-19-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-21-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-23-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-25-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-27-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-29-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-31-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-33-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-35-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-37-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-4-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/5000-41-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-43-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-45-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-47-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-49-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-5-0x0000000004AB0000-0x0000000004AE2000-memory.dmp

Filesize
200KB

Download
memory/5000-53-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-55-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-57-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-59-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-67-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-69-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-65-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-63-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-61-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/5000-130-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/5000-131-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/5000-132-0x0000000004C20000-0x00000000051C4000-memory.dmp

Filesize
5.6MB

Download
memory/5000-133-0x0000000004B70000-0x0000000004C02000-memory.dmp

Filesize
584KB

Download
memory/5000-134-0x0000000005370000-0x000000000537A000-memory.dmp

Filesize
40KB

Download
memory/5000-135-0x0000000074790000-0x0000000074F40000-memory.dmp

Filesize
7.7MB

Download
memory/5000-3-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/5000-2-0x0000000004A40000-0x0000000004A72000-memory.dmp

Filesize
200KB

Download
memory/5000-1-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/5000-0-0x0000000074790000-0x0000000074F40000-memory.dmp

Filesize
7.7MB

Download
memory/5000-136-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/5000-137-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/5000-138-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/5000-139-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/5000-140-0x0000000000520000-0x000000000052E000-memory.dmp

Filesize
56KB

Download