Resubmissions
02-10-2022 16:34
221002-t3c2esegb2 1002-10-2022 16:31
221002-t1wezsgbhl 1019-09-2022 13:21
220919-qlrxgaafe8 1015-09-2022 14:04
220915-rdlwxshabn 1026-08-2022 08:00
220826-jwaydaaeg2 9Analysis
-
max time kernel
51s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15-09-2022 14:04
Static task
static1
Behavioral task
behavioral1
Sample
lsassd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
lsassd.exe
Resource
win10v2004-20220901-en
General
-
Target
lsassd.exe
-
Size
58KB
-
MD5
d197883d8745a61fe25aebea85622a65
-
SHA1
5d22d359e7b8dc70ccf5e369fb07f2e0960ef76f
-
SHA256
b3ebc327773f5f846deeb1255475644a630c4d0d3b4eda3bbf995a36599c07cf
-
SHA512
da074afa91c88ba5f2ee95ca515e8c608686f8b8e63a28e2fbf21074d311f6c6aab6a433f19f990693c077db9087cf58322f683219401c7c05d3c3cb9a377b7b
-
SSDEEP
1536:BvJwvssB+bN7VkeiQMK9ZPbrJhKYUWXWjkC:B4sLbNizg9ZPbreSAkC
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\!!!READ TO RECOVER YOUR DATA!!!.txt
moisha
https://tox.chat/
Signatures
-
Moisha
Moisha is a ransomware family first seen in August 2022.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png lsassd.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\Logo.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png lsassd.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\89.0.4389.114.manifest lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg lsassd.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan lsassd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt lsassd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png lsassd.exe File created C:\Program Files\Internet Explorer\images\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar lsassd.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.rll lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\LICENSE lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html lsassd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe 1792 lsassd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1792 lsassd.exe