Analysis
- user interaction
yes - max time kernel
37s - max time network
49s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
28/03/2026, 16:14
Errors
Reason
Machine shutdown
General
- Target Project1.exe
- Size 48KB
- Sample260328-tp164ag19k
- SHA256 4dab064aab796516eeb2526dcc5025c973cd40e207cbd4354910877fa15ca4df
Score
10/10
Malware Config
Signatures
- Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
- Seon family
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project1.exe"C:\Users\Admin\AppData\Local\Temp\Project1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c notepad.exe "C:\Users\Admin\AppData\Local\Temp\YOUR_FILES_ARE_ENCRYPTED.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\notepad.exenotepad.exe "C:\Users\Admin\AppData\Local\Temp\YOUR_FILES_ARE_ENCRYPTED.txt"3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
YOUR_FILES_ARE_ENCRYPTED.txt
memory/2268-15-0x00000210BE370000-0x00000210BE37C000-memory.dmp
memory/2268-14-0x00000210BBF70000-0x00000210BC71E000-memory.dmp
memory/5180-16-0x000001F36FA90000-0x000001F37023E000-memory.dmp
memory/5180-23-0x000001F36FA90000-0x000001F37023E000-memory.dmp