Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 14:16
Static task
static1
Behavioral task
behavioral1
Sample
Fantom.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Fantom.exe
Resource
win10v2004-20240226-en
General
-
Target
Fantom.exe
-
Size
261KB
-
MD5
7d80230df68ccba871815d68f016c282
-
SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6
-
SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
-
SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
-
SSDEEP
3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML
Signatures
-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Renames multiple (1877) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1968 WindowsUpdate.exe -
Loads dropped DLL 1 IoCs
pid Process 2368 Fantom.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png Fantom.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar Fantom.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\settings.css Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css Fantom.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html Fantom.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_up.png Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml Fantom.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png Fantom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif Fantom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageScript.js Fantom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\attention.gif Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar Fantom.exe File created C:\Program Files\Microsoft Games\Solitaire\fr-FR\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Half.png Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_h.png Fantom.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Couture.thmx Fantom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Flow.thmx Fantom.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt Fantom.exe File created C:\Program Files\Mozilla Firefox\uninstall\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\settings.js Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png Fantom.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png Fantom.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar Fantom.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png Fantom.exe File created C:\Program Files\Java\jre7\lib\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css Fantom.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\settings.css Fantom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\menu_arrow.gif Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar Fantom.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\DECRYPT_YOUR_FILES.HTML Fantom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2368 Fantom.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2368 Fantom.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1968 2368 Fantom.exe 30 PID 2368 wrote to memory of 1968 2368 Fantom.exe 30 PID 2368 wrote to memory of 1968 2368 Fantom.exe 30 PID 2368 wrote to memory of 1968 2368 Fantom.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fantom.exe"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"2⤵
- Executes dropped EXE
PID:1968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5109031361eae8836c9a439c56676f5c8
SHA16ffc1a22847ad4d5d4647e7c2090141bc3d60004
SHA2567d67681ffc54b14e87538398ebe2e09bd6a899ca181d6790fa35bd21ad150b97
SHA51274901a8301f9d3f9705623c51567c04b55b452ecef9e8109581615a1dcf0dc8e7f80e8c07762d0879f60506f28352c3dca18805875915673c248f14761059315
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
Filesize5KB
MD52a7082dd85d3fc502b6f9cc1680f925c
SHA143d4a02ceeaa16ce2a95f8a77a4d95e28f4ab1fa
SHA256ab87ab4ddb9b9424b6c3828edaf22b154362c2dd1d63cc6c05bdf4c3cac124c3
SHA512c3a2debb159051bd8b280d9bccb16bf03b1d60c10e71acbfb51a868078f612335cd0969066d2d87f0422b8d3f1029a7d7925566e1d85de18605dd673e93c9f7e
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
Filesize31KB
MD5f892fa2fd841632c98ff951036ee2b33
SHA19f0e33110856c492c299b3ae00833ff9daf99560
SHA25663ee7f6b89db7548f8acc1cfbe5d08be35ed65a3d360ebb54f53180ba3a8bc05
SHA5124422be73047a075987b97e4bfafa56599db155b4f0a50dc2a05e604422ed605cbe6f1436591d6ccf3e218d01f40f22d7e58efdc3671de4153b099d7dac5ec4e0
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
Filesize4KB
MD5e0a5b38b3e6853bd53d8a24c8950bef2
SHA1597a85f8abaf1c528b47d67a96f9eaa847de84a5
SHA2564497ffe20e7b61c0c68d6ab6a70cc6e5d59fd0af98ad89adc52dfcb530b3d679
SHA5123f8901c959b7b1d147249b6c9d46a3c689ef3a12f47e54c2f76aedd2efad29553de2749a8ee8daa4c58c039a33028fcec19d01275ff9b7ac96c27d1f9eeb8410
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
Filesize21KB
MD58d239a64caa31497f626e5d8d02ccef6
SHA14f2aa7da623b244d15c065bc39e7504de36ef7bc
SHA256e9bffcb1960273c0930c1054e0bd86198dbce4b47b3efc4685c5c99e72d22a28
SHA512a226800ec282baaf1b0b6ad6cd0a8c8e19f9a8b3d80f7d01770f31e6d7f61b40e29dfae0a226ce738b91507af55dfc0dd9cfa8c59547efb6118b3ea867b56eed
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif
Filesize112B
MD5d432be16b72d9d791f6b46f67065289f
SHA1a8f07c71b71ef73142e0c1fc2246fdda19017575
SHA256113d89ad82ce955759896421005433971bd36e91f1ccd3569809a20b2e2c92fd
SHA51229ef25e9f4d7a7ed1cce766c42234e424c519000688231bccafefb18c0cdabf527308f5cee559580e618f361f66f2359f26ec2288378e733598872d51bd75098
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
Filesize8KB
MD50a40d57479315dcf325cfc613042972c
SHA1ab06cf1f94fd1a5f9b6a46c99bbf6edc7b1dd658
SHA2562ade44281fca2e19b4f7aaeae2b437ae9d6dce62d1d41827cf498ad5b55a78cc
SHA512cf6b89dc7017c00b3ab872c3c1de2985cac1138f0f2b8e1bf9992f84941e41f4cfab3e96e0af0e943e1b6d591867f19dea1004d545b2426e80beadb3be79e487
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
Filesize15KB
MD5467338e7325d0d32f31e18f470d7fe69
SHA12f5232fa8611411e9c8449fec5878ecdc66815b1
SHA256f78cd7ae1bb627fd60e2c6d57d83603db5431cdf205e68a8c37e68a4117cdd48
SHA512f2dcb5802c3a1067f1d3d6e6a778b40252d84dd260b5de5af4bc4839911d6f72d4cf252b4d10f198305e45dddc57f97a56d0ab2d88177971ef839c1c8bd7965c
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
Filesize6KB
MD579d57214dbb29da4a2a69ed3b378b1bb
SHA12074643327ee4f43b1b0a808d52c5dd041c83c6c
SHA256898c26703c937f7180773affdcf62c0fcf3efd1e7bedde15921f6ce0ff04666d
SHA5124a26103801839397ebd504f3450b4e7fb8382ee0fb1c6385ecae2a57347203d0ac9b384e2133ed351bce50c1437b337f47917d6a1901ebe9e6acaee764587349
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
Filesize20KB
MD5bf4a0673b9e2c4b35cd0c39da43db133
SHA15278f6a65c7d1dcb46c06a8762c6fe03d618e230
SHA2563917304a029b5e168041c15a66480e88d3b4841bd9dcd1de9a11d30a4e0fc35b
SHA512509f3516a2c20bdff27d3753304d6570f5c87a822cc7630da16598c6082080fc3a4ddeef10211e06ccf1a7f1d1f38e828e30a688cff42190a0f5e6623a04dde2
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
Filesize6KB
MD5cd8bfea8254032fdef9d5bb47bba856d
SHA1970999cc2213dba172ec18b9ab37150c15811a1f
SHA25619840f58bcdb89d442316e3055b6dbfd640a513d748c8641b52b6586a9b3721d
SHA51226f964b134970550139b86297510f165417c59651c5d9bc7e1079eb2f4b9e3906a0679fbd53f0432271698d503a02f3c8040d50bcf6c4faef7102abc7022b409
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
Filesize15KB
MD58b41db813c03043a6efca4c123f805f5
SHA1c6a9c7ada07d31873860a1c6cb4f76f7faeefa5e
SHA256dd55d38eb7d898f1af3dc1ac711536a30ff267d35d7f0394f09a2f1bb865ea95
SHA51214d9663210326b45df9905442478773ad68a6519963186184fb420152c51f4cfd0df745b3cc6e74233bad3fc8aa06ceed7c8e69a32b66e58272c81c3730b917b
-
Filesize
160B
MD51b563e0c91dd07552e957a36e43669d4
SHA18546b39b7cd84e06799ca627ab6661dfba4dc51a
SHA256d64fe9b30b10bf821f86c556d8ef6330275d61ff935bc24d12b30f4859bf3d0a
SHA5127053d67fce8bc70ce04938513437a189544207a3d7f102bea1f52b7788e11692dcd5279d694118e6a8d5be95d1d66830eba318deabe972b8d2ff962045fe24df
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize12KB
MD5f9c987fe1f67ff244258a3e8c1998b52
SHA1103cbc625dfd5a20a1cbdae5c8676bee1d203883
SHA256d3ff0a25eacfac2ec9386cbd8edc789aab49cc6533566036f4c8aef257a00f03
SHA512f33094d2e4567ecc3a8825c62cd1f8a6527a986e77f43511bea5b38aa376f9c1a4db1486140a3cbc6fb30c3f0c7e1e04185678b5a1bfdeec62c92143094deb1a
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize8KB
MD5bfa9f5b2bcae85d586b8b0941182bfdc
SHA184efad247a3a160606f9a6acdcc6f49100a49f9c
SHA25655018beb18233aaa64bba8b3e327fd8748415cd8258f4b2204d1c98440789223
SHA512bee1528285a4185e8ae0393ddafd62648b50195ef0e715fe5cac923e1c95750f57a5b2eed9daadc3eeb0c1dff4d570e7130f4768a844ad2ea416a48ccae9e187
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize11KB
MD5abc46e483bc4adb000f0e3f3b4d409e7
SHA13c9cd1c6cc291b16ce86920435c4113cf8db77c9
SHA256925fb20d8e259904f317901a154314805535876b372d89db85451a6babd5b494
SHA5124f7d8df54ae29a609445308a69c30e3f6610dcb37596df471c8bb4522f10bdbcf218ef35ab5d45b6f96f4462f80da4135072ec265ccae995b5850ab5770eec36
-
Filesize
109KB
MD54a0e2def87f5ff243abb5554537e5236
SHA16e2c7c19d5be5fc4653d5f46963314c7e6a3050c
SHA256b5813be6a9be8aaa4c42c147fd06bb238c44fcb43653fd9ca30b9e56abf45194
SHA5122459fd62f3c906d2c83490acf125d33bf88bbb0f7611cb8fded47245e7aa8b504ac401e3eebdff5662bc4f2dbbc0e2367edb5890f4958aec03b1e6851c88808d
-
Filesize
172KB
MD5bb6ebff978df7c3a572a3e9637bf493c
SHA144ae7b3b1e2d85d4a19a468a6d62f02fae606cbf
SHA2568a070618722568e13658cb910aa0926ca3bddde1acf7befe7825a614de8ea9fc
SHA512779bb0b4cfc9d4596a3ef49b927f489464974a5441d973b6671ae5f9abfb82283583fb5c65e8c47794607d08a3ad28f4b7888182280ccd39af775123ffcc772b
-
Filesize
21KB
MD5fec89e9d2784b4c015fed6f5ae558e08
SHA1581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2
SHA256489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
SHA512e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24