Resubmissions
05/02/2025, 08:55
250205-kvkxmayrcz1005/02/2025, 06:37
250205-hdsvsswldm1017/03/2024, 04:49
240317-ffz1saef6510Analysis
- max time kernel
150s - max time network
127s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
17/03/2024, 04:49
General
- Target ransomwares/Fantom/Fantom.exe
- Size 261KB
- Sample240317-ffz1saef65
- SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
Malware Config
Extracted
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML
- <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>cEMvmbtz5IQ+qoxRFRsGSPwjOMo/s+x1B7TV8GLr2JviqHPSkSP7hPJiasy2BA0ZZy8XuNaUtgpUWyWD3Pbjz6kzF4xCAE8xxPril+PT/X8k2yM1SEVCJxj63fkB9b4fakcWc2Kzqv4v2Imi3Rf6PPGLRs3ddzWAqb6G6MpfRPNRYasEjtGd2On5giXgBNEISZexketEbHpkI8n8IAxt05YhdhxVAXxM0Aabe2PM4bxHpFh/iiF/25p1C93hF1t7oJouCS4h0dYWdTLUosgdNhPfg5kTdREkL5yPIzrU1NJiMNZ5LXgVjJlGyxicTiwL20lYGDiiOg2dxPNxPVTHPQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>
Signatures
- Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
- Renames multiple (1455) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables Task Manager via registry modification
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransomwares\Fantom\Fantom.exe"C:\Users\Admin\AppData\Local\Temp\ransomwares\Fantom\Fantom.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DECRYPT_YOUR_FILES.HTML
win32_LinkNoDrop32x32.gif
epl-v10.html
license.html
asl-v20.txt
THIRDPARTYLICENSEREADME-JAVAFX.txt
THIRDPARTYLICENSEREADME.txt
WindowsUpdate.exe
memory/1196-651-0x000000001B2D0000-0x000000001B350000-memory.dmp
memory/1196-650-0x000000001B2D0000-0x000000001B350000-memory.dmp
memory/1196-649-0x000007FEF5740000-0x000007FEF612C000-memory.dmp
memory/1196-278-0x000000001B2D0000-0x000000001B350000-memory.dmp
memory/1196-244-0x000000001B2D0000-0x000000001B350000-memory.dmp
memory/1196-178-0x000007FEF5740000-0x000007FEF612C000-memory.dmp
memory/1196-143-0x0000000001190000-0x000000000119C000-memory.dmp
memory/1692-54-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-129-0x0000000001FE0000-0x0000000002020000-memory.dmp
memory/1692-28-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-32-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-30-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-34-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-36-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-38-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-40-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-42-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-44-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-46-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-50-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-52-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-48-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-0-0x0000000074390000-0x0000000074A7E000-memory.dmp
memory/1692-56-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-60-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-58-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-62-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-64-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-68-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-66-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-24-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-130-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/1692-131-0x0000000074390000-0x0000000074A7E000-memory.dmp
memory/1692-132-0x0000000001FE0000-0x0000000002020000-memory.dmp
memory/1692-133-0x0000000001FE0000-0x0000000002020000-memory.dmp
memory/1692-134-0x0000000001FE0000-0x0000000002020000-memory.dmp
memory/1692-135-0x0000000001FE0000-0x0000000002020000-memory.dmp
memory/1692-136-0x0000000004D00000-0x0000000004D0E000-memory.dmp
memory/1692-26-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-22-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-20-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-16-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-18-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-14-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-12-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-10-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-8-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-6-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-5-0x0000000001FB0000-0x0000000001FDB000-memory.dmp
memory/1692-4-0x0000000001FB0000-0x0000000001FE2000-memory.dmp
memory/1692-3-0x0000000001FE0000-0x0000000002020000-memory.dmp
memory/1692-2-0x0000000001F40000-0x0000000001F72000-memory.dmp
memory/1692-1-0x0000000001FE0000-0x0000000002020000-memory.dmp