Resubmissions
09-01-2023 22:29
230109-2ebsfsga92 1009-01-2023 22:03
230109-1ypyraga35 1009-01-2023 21:39
230109-1hta8sbc9t 104-01-2023 08:47
230104-kqak4aeh79 1Analysis
-
max time kernel
954s -
max time network
956s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2023 22:03
Static task
static1
Behavioral task
behavioral1
Sample
01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe
Resource
win7-20220901-en
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral2
Sample
01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe
Resource
win10-20220812-en
windows10-1703-x64
3 signatures
1200 seconds
Behavioral task
behavioral3
Sample
01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
1200 seconds
General
-
Target
01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe
-
Size
592KB
-
MD5
e0dc86b7daa917d9ecf8d3d7511ad909
-
SHA1
92b1f64a5071c7df0fe484e520ca5e3d38636fc2
-
SHA256
01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538
-
SHA512
20700119b07d9a632b15baefbe91eafe4d4388d3fdcca43ac3ce097d372b5d817b54de9807024c8de1c4acd03df43585f4ff7050922655a716f35e2429a687b8
-
SSDEEP
12288:BzMOFIgp5Xr04Sfc3EUDYrWLrq3j+xNfeujr6n:BMk5Lr02DYrWL+3j+
Score
10/10
Malware Config
Signatures
-
Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailWideTile.scale-200.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\es-419_get.svg 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-125.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\Xusage.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-200_contrast-black.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-200.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_2x.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-32_altform-unplated.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\as.pak.DATA 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\fil.pak 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\resources.pri 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-100.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\CloseComplete.css 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\README.md 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_contrast-white.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\ui-strings.js 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-150.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\5.jpg 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_comment_18.svg 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosStoreLogo.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-200.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\manifest.json.DATA 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBOB6.CHM 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-400_contrast-black.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-150.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-100.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\69.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-125.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-unplated_contrast-black.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations_retina.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200_contrast-high.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-100_contrast-black.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-100_contrast-white.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-48_altform-fullcolor.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\ui-strings.js 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\LargeTile.scale-200.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-400_contrast-white.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-100.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\198.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-fullcolor.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-100_contrast-white.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch-Dark.scale-400.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\3DViewerProductDescription-universal.xml 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe