Khazzani boarded the Amsterdam-Paris express in Brussels on Friday with a Kalashnikov assault rifle, a Luger automatic pistol, nine cartridge clips and a box-cutter, investigators say. He was overpowered by passengers on the train.
A Spanish counter-terrorism source told news agency AFP that Khazzani had lived in Spain for seven years until 2014.
During his time in Spain, he came to the attention of authorities for making hardline speeches defending jihad, and was once detained for drug trafficking, according to the source.
Spanish intelligence services say he went to France, from where he travelled to Syria.
A source close to the French probe, meanwhile, told AFP that Khazzani "lived in Belgium, got on the train in Belgium with weapons likely acquired in Belgium. And he had identity papers issued in Spain."
French Interior Minister Bernard Cazeneuve said Spanish intelligence services had tipped off France over his ties to "radical Islamist movements", but it is unclear whether he lived in France at any time after leaving Spain.
German security services, meanwhile, flagged Khazzani when he boarded a flight from Berlin to Istanbul in May this year and in Belgium, Justice Minister Koen Geens confirmed Khazzani was "known" to the country's intelligence services.
According to an initial probe, Khazzani has denied any intention of waging a jihadist attack, saying he had merely stumbled upon a weapons stash and decided to use it to rob passengers.
The attack has put train security in the spotlight, and Belgium has said it would increase baggage checks and patrols on high-speed trains. France said its state-run rail firm, the SNCF, would introduce an emergency hotline to report "abnormal situations".
But experts say applying airport-style security to railway stations is nearly impossible.