Resubmissions
02-10-2022 16:34
221002-t3c2esegb2 1002-10-2022 16:31
221002-t1wezsgbhl 1019-09-2022 13:21
220919-qlrxgaafe8 1015-09-2022 14:04
220915-rdlwxshabn 1026-08-2022 08:00
220826-jwaydaaeg2 9Analysis
-
max time kernel
38s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
lsassd.exe
Resource
win7-20220901-en
General
-
Target
lsassd.exe
-
Size
58KB
-
MD5
d197883d8745a61fe25aebea85622a65
-
SHA1
5d22d359e7b8dc70ccf5e369fb07f2e0960ef76f
-
SHA256
b3ebc327773f5f846deeb1255475644a630c4d0d3b4eda3bbf995a36599c07cf
-
SHA512
da074afa91c88ba5f2ee95ca515e8c608686f8b8e63a28e2fbf21074d311f6c6aab6a433f19f990693c077db9087cf58322f683219401c7c05d3c3cb9a377b7b
-
SSDEEP
1536:BvJwvssB+bN7VkeiQMK9ZPbrJhKYUWXWjkC:B4sLbNizg9ZPbreSAkC
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\!!!READ TO RECOVER YOUR DATA!!!.txt
moisha
https://tox.chat/
Signatures
-
Moisha
Moisha is a ransomware family first seen in August 2022.
-
Drops file in Program Files directory 64 IoCs
Processes:
lsassd.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\mn.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Services\verisign.bmp lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png lsassd.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv lsassd.exe File opened for modification C:\Program Files\GrantInvoke.xml lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png lsassd.exe File opened for modification C:\Program Files\NewLock.MOD lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png lsassd.exe File created C:\Program Files\7-Zip\Lang\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\7-Zip\7z.sfx lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml lsassd.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\Parity.fx lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm lsassd.exe File opened for modification C:\Program Files\DVD Maker\directshowtap.ax lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf lsassd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg lsassd.exe File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax lsassd.exe File opened for modification C:\Program Files\DVD Maker\Shared\!!!READ TO RECOVER YOUR DATA!!!.txt lsassd.exe File opened for modification C:\Program Files\SuspendPing.mpg lsassd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
lsassd.exepid process 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe 844 lsassd.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
lsassd.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 844 lsassd.exe Token: 33 980 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 980 AUDIODG.EXE Token: 33 980 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 980 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\lsassd.exe"C:\Users\Admin\AppData\Local\Temp\lsassd.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:844
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
PID:980