Resubmissions
02-10-2022 16:34
221002-t3c2esegb2 1002-10-2022 16:31
221002-t1wezsgbhl 1019-09-2022 13:21
220919-qlrxgaafe8 1015-09-2022 14:04
220915-rdlwxshabn 1026-08-2022 08:00
220826-jwaydaaeg2 9Analysis
-
max time kernel
96s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
submitted
26-08-2022 08:00
Static task
static1
Behavioral task
behavioral1
Sample
lsassd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
lsassd.exe
Resource
win10v2004-20220812-en
General
-
Target
lsassd.exe
-
Size
58KB
-
MD5
d197883d8745a61fe25aebea85622a65
-
SHA1
5d22d359e7b8dc70ccf5e369fb07f2e0960ef76f
-
SHA256
b3ebc327773f5f846deeb1255475644a630c4d0d3b4eda3bbf995a36599c07cf
-
SHA512
da074afa91c88ba5f2ee95ca515e8c608686f8b8e63a28e2fbf21074d311f6c6aab6a433f19f990693c077db9087cf58322f683219401c7c05d3c3cb9a377b7b
-
SSDEEP
1536:BvJwvssB+bN7VkeiQMK9ZPbrJhKYUWXWjkC:B4sLbNizg9ZPbreSAkC
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\!!!READ TO RECOVER YOUR DATA!!!.txt
moisha
https://tox.chat/
Signatures
-
Moisha
Moisha is a ransomware family first seen in August 2022.
-
Drops file in Program Files directory 64 IoCs
Processes:
lsassd.exedescription ioc process File opened for modification C:\Program Files\Common Files\System\ado\adojavas.inc lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa lsassd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar lsassd.exe File opened for modification C:\Program Files\7-Zip\History.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4 lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml lsassd.exe File opened for modification C:\Program Files\7-Zip\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties lsassd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png lsassd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar lsassd.exe File opened for modification C:\Program Files\RedoRead.pcx lsassd.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties lsassd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar lsassd.exe File opened for modification C:\Program Files\FormatInvoke.3g2 lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png lsassd.exe File opened for modification C:\Program Files\EnterProtect.m4a lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9 lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2 lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat lsassd.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoBeta.png lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h lsassd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
lsassd.exepid process 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe 1628 lsassd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
lsassd.exedescription pid process Token: SeDebugPrivilege 1628 lsassd.exe