Resubmissions
23/03/2026, 02:00
260323-cffqcsds9n1005/03/2026, 16:32
260305-t1xm2scx3k1011/02/2026, 21:18
260211-z5q9qaav8h1011/05/2025, 03:54
250511-egp2javwat1003/09/2024, 14:02
240903-rb57sazdqf1003/09/2024, 13:51
240903-q59avszclf1002/09/2024, 19:51
240902-yk8gtsxbpd1002/09/2024, 02:27
240902-cxh7tazflg1002/09/2024, 02:26
240902-cwxc2sygll1021/06/2024, 19:37
240621-yca7cszgnd10Analysis
- max time kernel
64s - max time network
70s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/03/2026, 02:00
General
- Target Ransomware/criticalupdate01.exe
- Size 261KB
- Sample260323-cffqcsds9n
- SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
Malware Config
Extracted
-
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
- <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>MA8cRsHnNaVNiq3dQY6k2ETtj55thueRDkHbseJCS2dRI9d0H+Tg/wEuwgLf3Iad7YmfGQAYCZ+UlCt4u6f2sYTRDRGftCnWR4crpnKsZQBbOE6n1GZiHzfUWV9coSzif9Sj++VUP3OtpqdFex/KNv6DR4OEyccCSYtKnZ5c2i7aTF/QxnIssJUJTefzLH5a7D3HUU4H4/tdXEBj1fluFUxW8mvPjDz0NTkG0Wd4Kzg2iH82qrh1RflP5XwvYRc3AUmJ7vScur4KXXOnc60ybakPlRMMn23RnbTQcQXvtq2v2t2SncFhEn60lnCINhepDGqkvDQoBp9luArDj7xNjg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>
Signatures
- Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
- Fantom family
- Renames multiple (144) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DECRYPT_YOUR_FILES.HTML
WindowsUpdate.exe
memory/4464-148-0x0000000000D10000-0x0000000000D1C000-memory.dmp
memory/4464-149-0x000000001BA50000-0x000000001BA60000-memory.dmp
memory/4940-0-0x0000000002200000-0x0000000002210000-memory.dmp
memory/4940-1-0x0000000002430000-0x0000000002462000-memory.dmp
memory/4940-2-0x0000000002200000-0x0000000002210000-memory.dmp
memory/4940-3-0x0000000002460000-0x0000000002492000-memory.dmp
memory/4940-4-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-31-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-93-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-101-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-130-0x0000000004AC0000-0x0000000005064000-memory.dmp
memory/4940-131-0x00000000050E0000-0x0000000005172000-memory.dmp
memory/4940-129-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
memory/4940-132-0x0000000005320000-0x000000000532A000-memory.dmp
memory/4940-128-0x0000000002200000-0x0000000002210000-memory.dmp
memory/4940-127-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-125-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-123-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-121-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-119-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-117-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-115-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-113-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-111-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-109-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-107-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-105-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-103-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-99-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-97-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-91-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-89-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-87-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-85-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-83-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-81-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-77-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-76-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-73-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-71-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-69-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-67-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-66-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-63-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-61-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-60-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-55-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-54-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-51-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-49-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-45-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-43-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-41-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-40-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-35-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-33-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-29-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-27-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-25-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-23-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-21-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-19-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-95-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-17-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-80-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-15-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-13-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-57-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-11-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-9-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-7-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-5-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-47-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-37-0x0000000002460000-0x000000000248B000-memory.dmp
memory/4940-133-0x0000000002200000-0x0000000002210000-memory.dmp
memory/4940-134-0x0000000002200000-0x0000000002210000-memory.dmp
memory/4940-135-0x0000000002200000-0x0000000002210000-memory.dmp
memory/4940-136-0x0000000006870000-0x000000000687E000-memory.dmp
memory/4940-611-0x0000000006890000-0x000000000690E000-memory.dmp