Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 14:16

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>oHZdYIFwJUYSxqduZf2BvIMAibKKEm43nsu8fu4ParB7eYSr8a8uTdv6PaOQ8gJ9wKClc/TQ9hQQvyuXu2C4MT3+QxjHkN2SJ9p6MQ3Wy41Q2BkVgSuPoIrG82Rk/ipG0TvM5DivUe0KOwxMc6k4eP2ZXb5o+4SterHrpcmEo6EOJ7r8LlqZQAET5glQfHnopO67u2sajNBBQVW6gRr6ZMYh4bXZHifJw5hUuKiDIcELwSg5sPkc03gmAfwpa4MB/eRKHOMmKVubTilXhU94r3/lzU3Paynwlinz07ed7m4/RLTX+/nQm6JubMs3r1BG5x793vaTmc6WdD97xrCg4Q==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1877) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    109031361eae8836c9a439c56676f5c8

    SHA1

    6ffc1a22847ad4d5d4647e7c2090141bc3d60004

    SHA256

    7d67681ffc54b14e87538398ebe2e09bd6a899ca181d6790fa35bd21ad150b97

    SHA512

    74901a8301f9d3f9705623c51567c04b55b452ecef9e8109581615a1dcf0dc8e7f80e8c07762d0879f60506f28352c3dca18805875915673c248f14761059315

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

    Filesize

    5KB

    MD5

    2a7082dd85d3fc502b6f9cc1680f925c

    SHA1

    43d4a02ceeaa16ce2a95f8a77a4d95e28f4ab1fa

    SHA256

    ab87ab4ddb9b9424b6c3828edaf22b154362c2dd1d63cc6c05bdf4c3cac124c3

    SHA512

    c3a2debb159051bd8b280d9bccb16bf03b1d60c10e71acbfb51a868078f612335cd0969066d2d87f0422b8d3f1029a7d7925566e1d85de18605dd673e93c9f7e

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

    Filesize

    31KB

    MD5

    f892fa2fd841632c98ff951036ee2b33

    SHA1

    9f0e33110856c492c299b3ae00833ff9daf99560

    SHA256

    63ee7f6b89db7548f8acc1cfbe5d08be35ed65a3d360ebb54f53180ba3a8bc05

    SHA512

    4422be73047a075987b97e4bfafa56599db155b4f0a50dc2a05e604422ed605cbe6f1436591d6ccf3e218d01f40f22d7e58efdc3671de4153b099d7dac5ec4e0

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

    Filesize

    4KB

    MD5

    e0a5b38b3e6853bd53d8a24c8950bef2

    SHA1

    597a85f8abaf1c528b47d67a96f9eaa847de84a5

    SHA256

    4497ffe20e7b61c0c68d6ab6a70cc6e5d59fd0af98ad89adc52dfcb530b3d679

    SHA512

    3f8901c959b7b1d147249b6c9d46a3c689ef3a12f47e54c2f76aedd2efad29553de2749a8ee8daa4c58c039a33028fcec19d01275ff9b7ac96c27d1f9eeb8410

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

    Filesize

    21KB

    MD5

    8d239a64caa31497f626e5d8d02ccef6

    SHA1

    4f2aa7da623b244d15c065bc39e7504de36ef7bc

    SHA256

    e9bffcb1960273c0930c1054e0bd86198dbce4b47b3efc4685c5c99e72d22a28

    SHA512

    a226800ec282baaf1b0b6ad6cd0a8c8e19f9a8b3d80f7d01770f31e6d7f61b40e29dfae0a226ce738b91507af55dfc0dd9cfa8c59547efb6118b3ea867b56eed

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

    Filesize

    112B

    MD5

    d432be16b72d9d791f6b46f67065289f

    SHA1

    a8f07c71b71ef73142e0c1fc2246fdda19017575

    SHA256

    113d89ad82ce955759896421005433971bd36e91f1ccd3569809a20b2e2c92fd

    SHA512

    29ef25e9f4d7a7ed1cce766c42234e424c519000688231bccafefb18c0cdabf527308f5cee559580e618f361f66f2359f26ec2288378e733598872d51bd75098

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

    Filesize

    8KB

    MD5

    0a40d57479315dcf325cfc613042972c

    SHA1

    ab06cf1f94fd1a5f9b6a46c99bbf6edc7b1dd658

    SHA256

    2ade44281fca2e19b4f7aaeae2b437ae9d6dce62d1d41827cf498ad5b55a78cc

    SHA512

    cf6b89dc7017c00b3ab872c3c1de2985cac1138f0f2b8e1bf9992f84941e41f4cfab3e96e0af0e943e1b6d591867f19dea1004d545b2426e80beadb3be79e487

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

    Filesize

    15KB

    MD5

    467338e7325d0d32f31e18f470d7fe69

    SHA1

    2f5232fa8611411e9c8449fec5878ecdc66815b1

    SHA256

    f78cd7ae1bb627fd60e2c6d57d83603db5431cdf205e68a8c37e68a4117cdd48

    SHA512

    f2dcb5802c3a1067f1d3d6e6a778b40252d84dd260b5de5af4bc4839911d6f72d4cf252b4d10f198305e45dddc57f97a56d0ab2d88177971ef839c1c8bd7965c

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

    Filesize

    6KB

    MD5

    79d57214dbb29da4a2a69ed3b378b1bb

    SHA1

    2074643327ee4f43b1b0a808d52c5dd041c83c6c

    SHA256

    898c26703c937f7180773affdcf62c0fcf3efd1e7bedde15921f6ce0ff04666d

    SHA512

    4a26103801839397ebd504f3450b4e7fb8382ee0fb1c6385ecae2a57347203d0ac9b384e2133ed351bce50c1437b337f47917d6a1901ebe9e6acaee764587349

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

    Filesize

    20KB

    MD5

    bf4a0673b9e2c4b35cd0c39da43db133

    SHA1

    5278f6a65c7d1dcb46c06a8762c6fe03d618e230

    SHA256

    3917304a029b5e168041c15a66480e88d3b4841bd9dcd1de9a11d30a4e0fc35b

    SHA512

    509f3516a2c20bdff27d3753304d6570f5c87a822cc7630da16598c6082080fc3a4ddeef10211e06ccf1a7f1d1f38e828e30a688cff42190a0f5e6623a04dde2

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

    Filesize

    6KB

    MD5

    cd8bfea8254032fdef9d5bb47bba856d

    SHA1

    970999cc2213dba172ec18b9ab37150c15811a1f

    SHA256

    19840f58bcdb89d442316e3055b6dbfd640a513d748c8641b52b6586a9b3721d

    SHA512

    26f964b134970550139b86297510f165417c59651c5d9bc7e1079eb2f4b9e3906a0679fbd53f0432271698d503a02f3c8040d50bcf6c4faef7102abc7022b409

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

    Filesize

    15KB

    MD5

    8b41db813c03043a6efca4c123f805f5

    SHA1

    c6a9c7ada07d31873860a1c6cb4f76f7faeefa5e

    SHA256

    dd55d38eb7d898f1af3dc1ac711536a30ff267d35d7f0394f09a2f1bb865ea95

    SHA512

    14d9663210326b45df9905442478773ad68a6519963186184fb420152c51f4cfd0df745b3cc6e74233bad3fc8aa06ceed7c8e69a32b66e58272c81c3730b917b

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    1b563e0c91dd07552e957a36e43669d4

    SHA1

    8546b39b7cd84e06799ca627ab6661dfba4dc51a

    SHA256

    d64fe9b30b10bf821f86c556d8ef6330275d61ff935bc24d12b30f4859bf3d0a

    SHA512

    7053d67fce8bc70ce04938513437a189544207a3d7f102bea1f52b7788e11692dcd5279d694118e6a8d5be95d1d66830eba318deabe972b8d2ff962045fe24df

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

    Filesize

    12KB

    MD5

    f9c987fe1f67ff244258a3e8c1998b52

    SHA1

    103cbc625dfd5a20a1cbdae5c8676bee1d203883

    SHA256

    d3ff0a25eacfac2ec9386cbd8edc789aab49cc6533566036f4c8aef257a00f03

    SHA512

    f33094d2e4567ecc3a8825c62cd1f8a6527a986e77f43511bea5b38aa376f9c1a4db1486140a3cbc6fb30c3f0c7e1e04185678b5a1bfdeec62c92143094deb1a

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

    Filesize

    8KB

    MD5

    bfa9f5b2bcae85d586b8b0941182bfdc

    SHA1

    84efad247a3a160606f9a6acdcc6f49100a49f9c

    SHA256

    55018beb18233aaa64bba8b3e327fd8748415cd8258f4b2204d1c98440789223

    SHA512

    bee1528285a4185e8ae0393ddafd62648b50195ef0e715fe5cac923e1c95750f57a5b2eed9daadc3eeb0c1dff4d570e7130f4768a844ad2ea416a48ccae9e187

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

    Filesize

    11KB

    MD5

    abc46e483bc4adb000f0e3f3b4d409e7

    SHA1

    3c9cd1c6cc291b16ce86920435c4113cf8db77c9

    SHA256

    925fb20d8e259904f317901a154314805535876b372d89db85451a6babd5b494

    SHA512

    4f7d8df54ae29a609445308a69c30e3f6610dcb37596df471c8bb4522f10bdbcf218ef35ab5d45b6f96f4462f80da4135072ec265ccae995b5850ab5770eec36

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    109KB

    MD5

    4a0e2def87f5ff243abb5554537e5236

    SHA1

    6e2c7c19d5be5fc4653d5f46963314c7e6a3050c

    SHA256

    b5813be6a9be8aaa4c42c147fd06bb238c44fcb43653fd9ca30b9e56abf45194

    SHA512

    2459fd62f3c906d2c83490acf125d33bf88bbb0f7611cb8fded47245e7aa8b504ac401e3eebdff5662bc4f2dbbc0e2367edb5890f4958aec03b1e6851c88808d

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

    Filesize

    172KB

    MD5

    bb6ebff978df7c3a572a3e9637bf493c

    SHA1

    44ae7b3b1e2d85d4a19a468a6d62f02fae606cbf

    SHA256

    8a070618722568e13658cb910aa0926ca3bddde1acf7befe7825a614de8ea9fc

    SHA512

    779bb0b4cfc9d4596a3ef49b927f489464974a5441d973b6671ae5f9abfb82283583fb5c65e8c47794607d08a3ad28f4b7888182280ccd39af775123ffcc772b

  • \Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/1968-640-0x000000001B1C0000-0x000000001B240000-memory.dmp

    Filesize

    512KB

  • memory/1968-639-0x000000001B1C0000-0x000000001B240000-memory.dmp

    Filesize

    512KB

  • memory/1968-638-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

    Filesize

    9.9MB

  • memory/1968-145-0x000000001B1C0000-0x000000001B240000-memory.dmp

    Filesize

    512KB

  • memory/1968-144-0x000000001B1C0000-0x000000001B240000-memory.dmp

    Filesize

    512KB

  • memory/1968-143-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

    Filesize

    9.9MB

  • memory/1968-142-0x00000000011A0000-0x00000000011AC000-memory.dmp

    Filesize

    48KB

  • memory/2368-30-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-40-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-50-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-48-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-54-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-58-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-56-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-62-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-60-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-64-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-66-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-68-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-129-0x0000000002030000-0x0000000002070000-memory.dmp

    Filesize

    256KB

  • memory/2368-130-0x0000000002000000-0x0000000002001000-memory.dmp

    Filesize

    4KB

  • memory/2368-131-0x0000000074A80000-0x000000007516E000-memory.dmp

    Filesize

    6.9MB

  • memory/2368-132-0x0000000002030000-0x0000000002070000-memory.dmp

    Filesize

    256KB

  • memory/2368-133-0x0000000002030000-0x0000000002070000-memory.dmp

    Filesize

    256KB

  • memory/2368-134-0x0000000002030000-0x0000000002070000-memory.dmp

    Filesize

    256KB

  • memory/2368-135-0x0000000002300000-0x000000000230E000-memory.dmp

    Filesize

    56KB

  • memory/2368-46-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-44-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-42-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-38-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-52-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-34-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-36-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-32-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-28-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-0-0x00000000004F0000-0x0000000000522000-memory.dmp

    Filesize

    200KB

  • memory/2368-24-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-26-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-22-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-20-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-16-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-18-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-12-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-14-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-10-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-6-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-8-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-5-0x0000000001E80000-0x0000000001EAB000-memory.dmp

    Filesize

    172KB

  • memory/2368-4-0x0000000001E80000-0x0000000001EB2000-memory.dmp

    Filesize

    200KB

  • memory/2368-3-0x0000000002030000-0x0000000002070000-memory.dmp

    Filesize

    256KB

  • memory/2368-1-0x0000000074A80000-0x000000007516E000-memory.dmp

    Filesize

    6.9MB

  • memory/2368-2-0x0000000002030000-0x0000000002070000-memory.dmp

    Filesize

    256KB