Resubmissions
02-10-2022 16:34
221002-t3c2esegb2 1002-10-2022 16:31
221002-t1wezsgbhl 1019-09-2022 13:21
220919-qlrxgaafe8 1015-09-2022 14:04
220915-rdlwxshabn 1026-08-2022 08:00
220826-jwaydaaeg2 9Analysis
-
max time kernel
89s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-09-2022 13:21
Static task
static1
Behavioral task
behavioral1
Sample
lsassd.exe
Resource
win7-20220812-en
General
-
Target
lsassd.exe
-
Size
58KB
-
MD5
d197883d8745a61fe25aebea85622a65
-
SHA1
5d22d359e7b8dc70ccf5e369fb07f2e0960ef76f
-
SHA256
b3ebc327773f5f846deeb1255475644a630c4d0d3b4eda3bbf995a36599c07cf
-
SHA512
da074afa91c88ba5f2ee95ca515e8c608686f8b8e63a28e2fbf21074d311f6c6aab6a433f19f990693c077db9087cf58322f683219401c7c05d3c3cb9a377b7b
-
SSDEEP
1536:BvJwvssB+bN7VkeiQMK9ZPbrJhKYUWXWjkC:B4sLbNizg9ZPbreSAkC
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\!!!READ TO RECOVER YOUR DATA!!!.txt
moisha
https://tox.chat/
Signatures
-
Moisha
Moisha is a ransomware family first seen in August 2022.
-
Drops file in Program Files directory 64 IoCs
Processes:
lsassd.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png lsassd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml lsassd.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Common Files\System\ado\msado21.tlb lsassd.exe File created C:\Program Files\Google\Chrome\Application\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv lsassd.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png lsassd.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png lsassd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt lsassd.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf lsassd.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg lsassd.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc lsassd.exe File created C:\Program Files\DVD Maker\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm lsassd.exe File opened for modification C:\Program Files\Common Files\System\ado\msado25.tlb lsassd.exe File created C:\Program Files\DVD Maker\Shared\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt lsassd.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv lsassd.exe File opened for modification C:\Program Files\EnableBlock.lnk lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml lsassd.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt lsassd.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png lsassd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
lsassd.exepid process 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe 1184 lsassd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
lsassd.exedescription pid process Token: SeDebugPrivilege 1184 lsassd.exe