Resubmissions
09-01-2023 22:29
230109-2ebsfsga92 1009-01-2023 22:03
230109-1ypyraga35 1009-01-2023 21:39
230109-1hta8sbc9t 104-01-2023 08:47
230104-kqak4aeh79 1Analysis
-
max time kernel
113s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2023 22:29
Static task
static1
Behavioral task
behavioral1
Sample
01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe
Resource
win10v2004-20220901-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe
-
Size
592KB
-
MD5
e0dc86b7daa917d9ecf8d3d7511ad909
-
SHA1
92b1f64a5071c7df0fe484e520ca5e3d38636fc2
-
SHA256
01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538
-
SHA512
20700119b07d9a632b15baefbe91eafe4d4388d3fdcca43ac3ce097d372b5d817b54de9807024c8de1c4acd03df43585f4ff7050922655a716f35e2429a687b8
-
SSDEEP
12288:BzMOFIgp5Xr04Sfc3EUDYrWLrq3j+xNfeujr6n:BMk5Lr02DYrWL+3j+
Score
10/10
Malware Config
Signatures
-
Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Advertising 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Tongue.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_scale-200.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reminders_18.svg 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adobe_logo.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-200_contrast-white.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\fr-FR.mail.config 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-60_altform-unplated.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOCRRES.ORP 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_ReptileEye.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.winmd 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_de_135x40.svg 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch.scale-100.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxLargeTile.scale-150.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupWideTile.scale-150.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-32_altform-lightunplated.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.txt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\jit_rich_capture.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\WideTile.scale-100.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-125.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.Preview.winmd 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\ui-strings.js 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Message_Sent.m4a 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\pa.pak 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200_contrast-white.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-30_altform-lightunplated.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\excel.x-none.msi.16.x-none.vreg.dat 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\ui-strings.js 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\calendars.properties 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 (1).exe