seon | 96995eadf0555a4f7759c817a64f58810b64a423ab172ac809c373f381d5cd3e

General

Target

seon.exe
Size

62KB
MD5

7d3573bee1a9acd192c50bc72a65ef7a
SHA1

8ff77e69046c8cecd4407c536219e6fc1a747af7
SHA256

221ab2fabe92b623834e7214d05dbef0cdc2b4399d34721de63e7c32ab5820ea
SHA512

dcf3998861c2c1818d05ba526134edddee58bea51d4065ec5d156dfac2d24a63d65df057a1319e0886bdf37a394f82fb4435c0292c3e1f135646623ad3aaf347

Score

10^/10

seon ransomware trojan

Malware Config

Extracted

Path

C:\MSOCache\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

SEON RANSOMWARE ver 0.2 all your files has been encrypted There is only way to get your files back: contact with us and pay $1500 We accept Bitcoin and other cryptocurrencies Do not try to reinstall operation system on your computer Do not try to decrypt files with third party tools, this can lead to data loss You can decrypt 1 file for free Our contact emails: seonunlock@protonmail.com seonunlock@naver.com

Emails

seonunlock@protonmail.com

seonunlock@naver.com

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme.hta

Ransom Note

All your documents, photos, databases and other important files have been encrypted and you can't decrypt it yourself. No one but us can return your files. Free decryption utility does not exist. Each file is encrypted with its unique key, cryptography based on elliptic curves, key recovery is impossible. Focus on the problem, follow your instructions and everything will be fine. DON'T PANIC! YOU CAN RETURN ALL YOUR FILES! FREE decrypting as guarantee You can test decryption 1 any file for free (with help our special software " SEON Decryptor "). What to do? First you should write me and i'll send you a special software " SEON Decryptor " (this software needed to decrypt encrypted files). To start the process of decrypting ALL files, you need buy key to the " SEON Decryptor ". The price is $1500 in any cryptocurrency . Contacts E-Mail: seonunlock@protonmail.com E-Mail: seonunlock@naver.com Attention! Decryption keys are individual, the keys of other users will not work for you Do not try to decrypt files with third party tools, this can lead to data loss Do not try to reinstall operation system on your computer

Emails

seonunlock@protonmail.com

seonunlock@naver.com

Signatures

Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
trojan ransomware seon

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

seon.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ResumeUnpublish.tiff	seon.exe
File renamed	C:\Users\Admin\Pictures\DismountPublish.tif => C:\Users\Admin\Pictures\DismountPublish.tif.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\StepProtect.raw => C:\Users\Admin\Pictures\StepProtect.raw.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\ConvertFind.tif => C:\Users\Admin\Pictures\ConvertFind.tif.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\UpdateBlock.png => C:\Users\Admin\Pictures\UpdateBlock.png.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\CompressHide.png => C:\Users\Admin\Pictures\CompressHide.png.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\OutCheckpoint.crw => C:\Users\Admin\Pictures\OutCheckpoint.crw.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\PublishRead.png => C:\Users\Admin\Pictures\PublishRead.png.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\ResumeUnpublish.tiff => C:\Users\Admin\Pictures\ResumeUnpublish.tiff.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\UnprotectPop.raw => C:\Users\Admin\Pictures\UnprotectPop.raw.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\EnableComplete.crw => C:\Users\Admin\Pictures\EnableComplete.crw.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\MeasureSelect.tif => C:\Users\Admin\Pictures\MeasureSelect.tif.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\SearchNew.png => C:\Users\Admin\Pictures\SearchNew.png.FIXT	seon.exe
File renamed	C:\Users\Admin\Pictures\BackupConvertFrom.tif => C:\Users\Admin\Pictures\BackupConvertFrom.tif.FIXT	seon.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

seon.exe

description	ioc	process
File opened (read-only)	\??\D:	seon.exe
File opened (read-only)	\??\E:	seon.exe
File opened (read-only)	\??\G:	seon.exe
File opened (read-only)	\??\I:	seon.exe
File opened (read-only)	\??\T:	seon.exe
File opened (read-only)	\??\A:	seon.exe
File opened (read-only)	\??\H:	seon.exe
File opened (read-only)	\??\J:	seon.exe
File opened (read-only)	\??\K:	seon.exe
File opened (read-only)	\??\M:	seon.exe
File opened (read-only)	\??\N:	seon.exe
File opened (read-only)	\??\O:	seon.exe
File opened (read-only)	\??\U:	seon.exe
File opened (read-only)	\??\W:	seon.exe
File opened (read-only)	\??\B:	seon.exe
File opened (read-only)	\??\L:	seon.exe
File opened (read-only)	\??\R:	seon.exe
File opened (read-only)	\??\Z:	seon.exe
File opened (read-only)	\??\F:	seon.exe
File opened (read-only)	\??\P:	seon.exe
File opened (read-only)	\??\Q:	seon.exe
File opened (read-only)	\??\S:	seon.exe
File opened (read-only)	\??\V:	seon.exe
File opened (read-only)	\??\X:	seon.exe
File opened (read-only)	\??\Y:	seon.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

seon.exe

description	pid	process	target process
PID 376 wrote to memory of 2028	376	seon.exe	mshta.exe
PID 376 wrote to memory of 2028	376	seon.exe	mshta.exe
PID 376 wrote to memory of 2028	376	seon.exe	mshta.exe
PID 376 wrote to memory of 2028	376	seon.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\seon.exe
"C:\Users\Admin\AppData\Local\Temp\seon.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:376

C:\Windows\SysWOW64\mshta.exe
mshta.exe C:\Users\Admin\AppData\Local\Temp\readme.hta
2⤵
- Modifies Internet Explorer settings
PID:2028

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\readme.hta
Filesize
16KB

MD5
867e488f26e23d94a78cd020a852cf30

SHA1
29a4b0dc6edae5fbdf6bb13f60029ef4a48c8d29

SHA256
da37639b77c11ccfe848ae6457e08eb98521ee01d481a8c7ce5d410576c2e606

SHA512
3a30ef7d5adabae108b50060cad992383a8b8d951cbd32c99379a7e7b0a1276fd2a912b0f2f0d4f16e777ef045ba9c5e81f2dfe67bc3e7b04bbe0d69881ac659

Download Submit
memory/376-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads