2023-12-14 13:47:04 +00:00
|
|
|
{
|
2023-12-14 14:30:15 +00:00
|
|
|
"Event": {
|
|
|
|
|
"analysis": "0",
|
|
|
|
|
"date": "2023-08-25",
|
|
|
|
|
"extends_uuid": "",
|
|
|
|
|
"info": "Pandora analysis (NEW ORDER LIST GREEN VALLEY CORP.xlam)",
|
|
|
|
|
"publish_timestamp": "1692957275",
|
|
|
|
|
"published": true,
|
|
|
|
|
"threat_level_id": "3",
|
|
|
|
|
"timestamp": "1692954726",
|
|
|
|
|
"uuid": "89495010-cd5a-4250-9e57-c346426ae62a",
|
|
|
|
|
"Orgc": {
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
|
|
|
},
|
|
|
|
|
"Tag": [
|
|
|
|
|
{
|
|
|
|
|
"colour": "#004646",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "type:OSINT",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0071c3",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "osint:lifetime=\"perpetual\"",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0087e8",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "osint:certainty=\"50\"",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#ffffff",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "tlp:white",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#ffffff",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "tlp:clear",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [],
|
|
|
|
|
"Object": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "24",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"uuid": "31fb98c5-bc46-4f11-863e-e7eac6d4d37e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "e9a126b0-c311-4bc2-aebf-dc3304c3e615",
|
|
|
|
|
"value": "NEW ORDER LIST GREEN VALLEY CORP.xlam"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "101a03ba-9577-4252-8379-c391b4c3a327",
|
|
|
|
|
"value": "750659"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d77b4866-5d5b-46c0-8b04-e6d48a7381e4",
|
|
|
|
|
"value": "7.9976391149987"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "eb6a4227-8678-48d6-9db9-05ca75d0873f",
|
|
|
|
|
"value": "80e6097461cd82991b69946d8054f48d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f2aee604-2dca-45e6-bfc7-e33e1024e40f",
|
|
|
|
|
"value": "fd97abbc16fc30c09d7ea6b66ec359b9d9017b19"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "2021679e-f7c7-4a65-a98e-92d3ee1e82a1",
|
|
|
|
|
"value": "50659dd03345c5b16d6ea45170d63ca5a1846019634b06b4e37a3b97b65f1a36"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c5d76069-1532-4787-ab0a-77586cd47b54",
|
|
|
|
|
"value": "2b1496bacc6ca39a9aa99a67ad051ee1e97131935d8e5cc548558830aa4f7a2cd11b8836a194a46ea11520cf6386f2f154aeeb4bd3db12ec2e98d9b50dc7b6b5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAKpIGVexS3nTy2wLAEN0CwAgABwAODBlNjA5NzQ2MWNkODI5OTFiNjk5NDZkODA1NGY0OGRVVAkAA9Bu6GTQbuhkdXgLAAEEIQAAAAQhAAAASJrwx5HqZjYhHHJk3CujoMtWFDPSIkiP0nXLecHN7yIZ8UsC20luQTzPDowsp53W8CA0xr/LM49IBw+2gvhN+6b6WbXT9HGYkcGAPJlloFywAJdUKG5WEqxdSvjgdQIPNmEXKFqOmOtuzjScsktGo21LgDP0abCTQmStdDaOFsJTpa2Nm7I9ILrLjFiOCvc+W+8Roc6c1ZUX+5Gq6Hio7SmzdDbA+yqM+AncLh7WGJsS74Sc7VOgk5l2JBaV1Urzgj4FGgylXGHiESgNeoEvHeqSA0HOvNZwidp3EX43w0n8cy6/2xgbUyEGQAYDUWGlCOyKtMBZaF899AtET4E9nXnVInYjFT+p5e8jjC1/SNyWomv3R0l/TW0A0zKQTAq//EMgSVTqQOGI3HObT+XvWINvKwcSTql5gdYKXX2z2h9/YpD/GEfzkUHAhmO/ac7rbADYcXI2RbXzeDFWTAzRniAPBPxhNyiafgSDPMJB2gNTGryjrY1LIHhhOPeQD2GnzJ2MT5fdIqR6YulsksEs84+LayEgaPc9Xal1IIJxy9t7qC62LZ5m5PAqpgFl6SOpxQY42fInqQIj/lCz3ma8KYXpOLJ3BdEEGAj4zJhNvwbAVdHjJRm5YkmNf9Hjso33FVk3p1hXhuedf42XATXCgAPfe2rVkTJQnuGZwn/m6Xelps3gOYa4LoB4ypmI85Pm3eaDV7sPpHV9tPzscGTmvDyRHUNDRoEh9X4tvOZSOo2XTPAURtIhnI9TL4AdNAg1RNwZjPo7IrmtdBOeagl1D2XVMJeHIUljmH62bRSNo9YwCajgdYTyXma5AHjSFiHwU1GGgaDe3LdoBT/q2ye09yLzdPNdyGUp1g9KS/c3GQFDlr5pM+H99R4Xszgr8kVk0h/3v/accp2ErZJgaUvpEYHrAwzG6wtQVLr96D8tcz0wI7xdndHYpuOZIQCHbiz7e/YUIuYK1QXubWPDamxyka8iJ96/ujFcxkJ8b9fSw8Z0iwAXXfhghPri2NWS7YfEJTg9AFAjdc/+HEY4ntADJW2Fa3M4HRb7+unirmDzeGQGcTgv/8NrjeRz/AVRAYp17AEiTvjasWatwbDW0CAUx8fzR+V0k4NL+mipN7eU1+ha/lnCEL5rOgh4yInhX8RyymQfi5dgniJWoMh/y6RFDkwA5owdXq+soEKl4uHGHXsq4bQtrjt37b07siXkTxMn/az3UV17OvGyPjhmbs4qUIrMHYWrQQYi278INHenOg7z2QmxhCkKX+O60npD+ii4f7Q7wNIkk+jIooTsVi2Tjpjf2kDHwuP5V7LlXijBIIvejawOsAAtBk4p1nQgs7OLphkOaFpkUgAAcvZCzeI32gGbvxZt7Onze53I35o4W/EAHs8mfwS2LBXwRjkS3bWxg967aItwj04p+BUQi7SzSwzUmyuPM62E35xab1FiVqKE1m2CuuqLBrsEXgz5eqK9U4QGnK12GuDYB2169VK/XbAqkNGEvroKrm2WUl/6A1HZ+kNfiSPM4EgudyZ8acfFoCrNYm9LtBymebz6XfcGXPPL/du/PxgHJH6DkCYODy2uiy0C6or4sxVo7FfX8gWh2MsxRJWwyCjF9emv7tsbQiXfAffyXVy2Xq6DchDPRBLyccTRhtTDrsIZDNzPP/CKnW3MJ5TRxzGySKh93+3Ct0EqlbHC+V037SQreoNl3w5yjdJoGexlHV+BEWRGAiH6gPSHf3ChT/cQGz3D9TAUZQCPqb+IM74zUJNV+W8Zd0HqnjV4jBEbI3TljGbiKxNwScO24FrjzO2PLjiXjalRddb0OMzPiGkTli4Lbj8gAgPv/HG1z9+4/u3hKoIDMjR5MHeat6BTK3x3o+EDIvSIgRbykJxX68xuf6mFVT7HeKX+CL00iBrCrjvjbb6tbLV/r0YPGSyUGHPBiEt5fopCE5BAhSkRB136YtvW0K+yKVLn5BQkGTBfdw6Cp6ay9YrNR+erxsWFOJuoWoMU8re9bEk180teF4wu3bEMj2qm2LU0oIsZ4hsWESBlhWfIRuzzX1vmPs5Cbg62aUoFJEtwy0Y4gHEKyPnMBhOpLpHoJIe/xzRrLeMz8OE587GtvcpXJYK1HCeCC+tAm2mSaG9NJxIawpv7EFycusIMXSBsyawe/KQTHeI/Wh0eRmGON5ga/ruwYAWNm0QKKV5LBGR9WXRPjAhCvl5cVl+VqTb9pEtliaQT5hfYVh5gnE55S/maE7gEHGYaxnE9v3GdR8iPL92XqTFOUIgJpxttoT4xg2zCfHQD7ftSVu/dTsDexw5dNq7N2qVpzr4K0D/HbsnGjd+R33RUQJnmlw7uyeJ3RSE+GrT46xOeOf1+Ml2hX98eN+h9Ihb4/Ki+GupMnquKjFZu+n7PT/vKIV+MEoj5jRVl2Wh+9+F4IYV+X8khMivAWdsxQ+5yoaryRJ4RoWz7FflojIhuW6ywSaz+n0CRKqneroqSPFHb7Dl4MWUzgErLjunaKUZAQIyJOJAMmfLCAFUO5igi2krP2gd/TMowojNoPUUYZ1C3xpb57+XF9UOcSzt8XdZrkDujmFYdY7R9WMVCU6KiKg+jq2AVRTFSecpAAyGUNYleS0M3f11Ti47F/adAoQpcKEY9Dk/YfSkuFPwVSCUpOAK4g+8A+7zE0aT5h2FFz/m5JJEE50wVhXscXyTjeFIzYCJeiJPnF86GWRncHLauC8zfEWR0nBDI8ny5C2w+CWMpdNvlOxGl4f5T8yO2z+Fg0ruW43j6WzY56RDEl6HRpMMd4f9xZWEYn906RMxCX+PHvO4LC2TG7bmEzyN5yrHVzQRQBKK1owHv4OEYohfNh9QAc2/El3xLiGIymHR4Frgv6HrIQppuowWQCLVbJk4B0PdIAsrWfC2UDieE/BMQEG0fzSqf/N+zN2HmRsDr/NUhBbbwU1G4ABTmr10v16Y1DkcicYPyKptpGhsgzm+iIjQy9WnuKA6gH4Cvz+rdEfxnEXUJXgpbySiB6W426KTMUehvEhaS+xjrCQiMYSeaL1P/7IYB+8rvQmQxIjt9prmHF71L6xfqk+t8UwwvJRQfmFQV3o+8zwU6SZH/U1/Wx11+IObF4KPpgl58L2rufwWYl3lBRcL9Nise7yZfojSQNzy0ipGxwlaAMZxKjHkPIm7/2JRzKFLfDc/7o+y4cxJ1rTxKgls5Pp97ve8jUUg+SK+jjsRlweOdcCcYpG46fEOnIsPpUa/HziYoKwUgGSTVLLWcUJSfyTAiQUlS8pbYkXoa/OmwdvyD+tpytQBH0zaoToFRuLdfieK+tAy8aDaxgDo2x2/1CdGzS9aGrYf2ZhX5iLDJgjP6qMRtar5uXnDC8VHZFqUwSCKlu8kseFqkIsZ8bGzfM0GuHHZKRAjYHttMyeMrnRNvSv97UPl2ydnG+d2tyuT372vlzeB72eD+BoSiFo6lP9EZbo5wy0+LicJsVp7LSqFjwKGi+ngm/nPWGin3e1ZMrIIUdcxIk3LachOJNFPOO4JtIYm5UIeoBpp1cjxxWOIvJctghqRj2voiTueNUPt2GiBekBsASdwSS28rXlrwR6HM+O2W/YN41jmDyKB9nl6L9ftk/e3QL9mL46852gDRgNIjin7G1aD6O3BSjI19AYQ9Zi7qoYPnnvJeB4kLFRlnMG58GFMka/qa1U58N8+xFHqjzSM1TZvc3mDZBOD1cybFn9xVCcQZ+Te3WRP6Id6qUzKMOlDEqb++poIalj15H4/sfvaQPZmxy9/BSANdFmLWw3pmYP2pw6q3HE/sIVXVVud2QJFARjUkqVw1Q3Bo0mEhj30hBMHtiKDuDyJhesj3UCjLXib4jNdVieKrDwAnat4xhY9ZYBCtm1GpfggXXgnoY1vCARz/hY1FIkLqNpex45bgz793VFvaYenLw1aLjwmZRH409ZnOVWxeib9L+zzr7PrDGG
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "75ace0c2-ee0c-43c9-b31c-f805be4caa12",
|
|
|
|
|
"value": "NEW ORDER LIST GREEN VALLEY CORP.xlam|80e6097461cd82991b69946d8054f48d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "bb0bbadb-8c60-4f99-b671-5266d2a02a21",
|
|
|
|
|
"value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1692954320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d20f7660-6940-44f9-b5c2-0489765f6234",
|
|
|
|
|
"value": "12288:A9GypEniidYleKQgGaDKQuAn9xTeCEhTgBQT3Uskc5S5Sgh8XgFwXhE9NNVxD:sjpE/2leZapuU9x6pS5SgZo+3NVh"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
2023-12-14 13:47:04 +00:00
|
|
|
]
|
2023-12-14 14:30:15 +00:00
|
|
|
}
|
2023-12-14 13:47:04 +00:00
|
|
|
}
|
