seon | 591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b

General

Target

591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
Size

62KB
MD5

eb5d62f37c2a7cdd355b483d06ff7278
SHA1

e21b853bd54e1305f3c0d0eb6f8da52b70b0d722
SHA256

591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b
SHA512

80c377cfe3f707bb118740b98f2a04f8e3700394ff7519e09f04a861a2ed91e516337d729526c4203f41c87ffd2de9f6542a9f0986d73f7fec4e32740adfc4b3

Score

10^/10

seon ransomware trojan

Malware Config

Extracted

Path

C:\odt\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

SEON RANSOMWARE ver 0.2 all your files has been encrypted There is only way to get your files back: contact with us We accept Bitcoin and other cryptocurrencies Do not try to reinstall operation system on your computer Do not try to decrypt files with third party tools, this can lead to data loss You can decrypt 1 file for free Our contact emails: [email protected] [email protected]

Emails

[email protected]

Signatures

Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
trojan ransomware seon

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\UseUnblock.tiff => C:\Users\Admin\Pictures\UseUnblock.tiff.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened for modification	C:\Users\Admin\Pictures\AssertJoin.tiff	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened for modification	C:\Users\Admin\Pictures\UseUnblock.tiff	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\BlockResume.crw => C:\Users\Admin\Pictures\BlockResume.crw.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\CloseBackup.tif => C:\Users\Admin\Pictures\CloseBackup.tif.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\CompleteUnprotect.png => C:\Users\Admin\Pictures\CompleteUnprotect.png.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\ReceiveInvoke.tif => C:\Users\Admin\Pictures\ReceiveInvoke.tif.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\ConfirmTest.raw => C:\Users\Admin\Pictures\ConfirmTest.raw.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\SuspendCompare.crw => C:\Users\Admin\Pictures\SuspendCompare.crw.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened for modification	C:\Users\Admin\Pictures\UndoUpdate.tiff	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\AssertJoin.tiff => C:\Users\Admin\Pictures\AssertJoin.tiff.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\UndoUpdate.tiff => C:\Users\Admin\Pictures\UndoUpdate.tiff.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\UnprotectClose.raw => C:\Users\Admin\Pictures\UnprotectClose.raw.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File renamed	C:\Users\Admin\Pictures\WatchPing.crw => C:\Users\Admin\Pictures\WatchPing.crw.FIXT	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\M:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\T:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\U:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\G:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\J:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\X:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\Y:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\A:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\B:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\K:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\L:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\N:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\P:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\S:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\V:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\E:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\F:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\H:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\I:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\O:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\Q:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\R:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\W:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
File opened (read-only)	\??\Z:	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 4656	532	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe	89
PID 532 wrote to memory of 4656	532	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe	89
PID 532 wrote to memory of 4656	532	591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe	89

C:\Users\Admin\AppData\Local\Temp\591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
"C:\Users\Admin\AppData\Local\Temp\591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\mshta.exe
  mshta.exe C:\Users\Admin\AppData\Local\Temp\readme.hta
  2⤵
  PID:4656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads