2023-06-14 17:31:25 +00:00
{
"type" : "bundle" ,
"id" : "bundle--595ffeba-0eac-4c22-953c-c6c402de0b81" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-23T06:23:48.000Z" ,
"modified" : "2017-11-23T06:23:48.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "grouping" ,
"spec_version" : "2.1" ,
"id" : "grouping--595ffeba-0eac-4c22-953c-c6c402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-23T06:23:48.000Z" ,
"modified" : "2017-11-23T06:23:48.000Z" ,
"name" : "OSINT - Attack on Critical Infrastructure Leverages Template Injection" ,
"context" : "suspicious-activity" ,
"object_refs" : [
"observed-data--595ffec5-ab90-496e-8edf-41bc02de0b81" ,
"url--595ffec5-ab90-496e-8edf-41bc02de0b81" ,
"x-misp-attribute--595ffed7-8f20-4ae7-839f-419c02de0b81" ,
"indicator--595fff2d-3c18-4ae2-98c6-46f902de0b81" ,
"indicator--595fff2d-b108-4f78-bd75-437a02de0b81" ,
"indicator--595fff2d-e9fc-439a-b74a-417c02de0b81" ,
"indicator--595fff43-ea00-4f5c-b80d-478f02de0b81" ,
"indicator--595fff43-ef64-46c8-a17f-42e302de0b81" ,
"indicator--595fff43-90e4-4bab-896b-41df02de0b81" ,
"indicator--595fff5c-5e24-4630-851a-4a4b02de0b81" ,
"indicator--595fff5c-89b0-40fc-83ce-498702de0b81" ,
"indicator--595fff83-90dc-49bb-adfb-474102de0b81" ,
"indicator--595fff83-4b40-4ca6-b436-4b7b02de0b81" ,
"observed-data--595fff83-6fa4-4702-8563-40cf02de0b81" ,
"url--595fff83-6fa4-4702-8563-40cf02de0b81" ,
"indicator--595fff83-099c-4d69-8fd3-4ff202de0b81" ,
"indicator--595fff83-6c80-4097-a592-449902de0b81" ,
"observed-data--595fff83-28d8-4599-ab7e-411a02de0b81" ,
"url--595fff83-28d8-4599-ab7e-411a02de0b81" ,
"indicator--595fff83-f46c-47e4-9a96-45d202de0b81" ,
"indicator--595fff83-bab4-47da-ae9a-492602de0b81" ,
"observed-data--595fff83-9aa8-4361-bf50-42a502de0b81" ,
"url--595fff83-9aa8-4361-bf50-42a502de0b81" ,
"indicator--595fff83-72e0-4302-9540-494302de0b81" ,
"indicator--595fff83-5cac-4e37-8a69-447502de0b81" ,
"observed-data--595fff83-fbdc-41f5-b908-47cf02de0b81" ,
"url--595fff83-fbdc-41f5-b908-47cf02de0b81"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"certsi:critical-sector=\"energy\"" ,
"osint:source-type=\"blog-post\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--595ffec5-ab90-496e-8edf-41bc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:48.000Z" ,
"modified" : "2017-07-07T21:39:48.000Z" ,
"first_observed" : "2017-07-07T21:39:48Z" ,
"last_observed" : "2017-07-07T21:39:48Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--595ffec5-ab90-496e-8edf-41bc02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--595ffec5-ab90-496e-8edf-41bc02de0b81" ,
"value" : "http://blog.talosintelligence.com/2017/07/template-injection.html"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--595ffed7-8f20-4ae7-839f-419c02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:48.000Z" ,
"modified" : "2017-07-07T21:39:48.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Attackers are continually trying to find new ways to target users with malware sent via email. Talos has identified an email-based attack targeting the energy sector, including nuclear power, that puts a new spin on the classic word document attachment phish. Typically, malicious Word documents that are sent as attachments to phishing emails will themselves contain a script or macro that executes malicious code. In this case, there is no malicious code in the attachment itself. The attachment instead tries to download a template file over an SMB connection so that the user's credentials can be silently harvested. In addition, this template file could also potentially be used to download other malicious payloads to the victim's computer."
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff2d-3c18-4ae2-98c6-46f902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Related IP Address" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '184.154.150.66']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff2d-b108-4f78-bd75-437a02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Related IP Address" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.153.58.45']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff2d-e9fc-439a-b74a-417c02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Related IP Address" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.8.193.206']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff43-ea00-4f5c-b80d-478f02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Controls Engineer.docx" ,
"pattern" : "[file:hashes.SHA256 = 'b02508baf8567e62f3c0fd14833c82fb24e8ba4f0dc84aeb7690d9ea83385baa']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff43-ef64-46c8-a17f-42e302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Controls Engineer.docx" ,
"pattern" : "[file:hashes.SHA256 = '3d6eadf0f0b3fb7f996e6eb3d540945c2d736822df1a37dcd0e25371fa2d75a0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff43-90e4-4bab-896b-41df02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Controls Engineer.docx" ,
"pattern" : "[file:hashes.SHA256 = 'ac6c1df3895af63b864bb33bf30cb31059e247443ddb8f23517849362ec94f08']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff5c-5e24-4630-851a-4a4b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"pattern" : "[file:name = 'Report03-23-2017.docx']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff5c-89b0-40fc-83ce-498702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Report03-23-2017.docx" ,
"pattern" : "[file:hashes.SHA256 = '93cd6696e150caf6106e6066b58107372dcf43377bf4420c848007c10ff80bc9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff83-90dc-49bb-adfb-474102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Report03-23-2017.docx - Xchecked via VT: 93cd6696e150caf6106e6066b58107372dcf43377bf4420c848007c10ff80bc9" ,
"pattern" : "[file:hashes.SHA1 = '67175f1de3a911958e4c075336160462df3ea7b1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff83-4b40-4ca6-b436-4b7b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Report03-23-2017.docx - Xchecked via VT: 93cd6696e150caf6106e6066b58107372dcf43377bf4420c848007c10ff80bc9" ,
"pattern" : "[file:hashes.MD5 = '3c432a21cfd05f976af8c47a007928f7']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--595fff83-6fa4-4702-8563-40cf02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"first_observed" : "2017-07-07T21:39:15Z" ,
"last_observed" : "2017-07-07T21:39:15Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--595fff83-6fa4-4702-8563-40cf02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--595fff83-6fa4-4702-8563-40cf02de0b81" ,
"value" : "https://www.virustotal.com/file/93cd6696e150caf6106e6066b58107372dcf43377bf4420c848007c10ff80bc9/analysis/1499449645/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff83-099c-4d69-8fd3-4ff202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Controls Engineer.docx - Xchecked via VT: ac6c1df3895af63b864bb33bf30cb31059e247443ddb8f23517849362ec94f08" ,
"pattern" : "[file:hashes.SHA1 = '2872dcdf108563d16b6cf2ed383626861fc541d2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff83-6c80-4097-a592-449902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Controls Engineer.docx - Xchecked via VT: ac6c1df3895af63b864bb33bf30cb31059e247443ddb8f23517849362ec94f08" ,
"pattern" : "[file:hashes.MD5 = '722154a36f32ba10e98020a8ad758a7a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--595fff83-28d8-4599-ab7e-411a02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"first_observed" : "2017-07-07T21:39:15Z" ,
"last_observed" : "2017-07-07T21:39:15Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--595fff83-28d8-4599-ab7e-411a02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--595fff83-28d8-4599-ab7e-411a02de0b81" ,
"value" : "https://www.virustotal.com/file/ac6c1df3895af63b864bb33bf30cb31059e247443ddb8f23517849362ec94f08/analysis/1499451984/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff83-f46c-47e4-9a96-45d202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Controls Engineer.docx - Xchecked via VT: 3d6eadf0f0b3fb7f996e6eb3d540945c2d736822df1a37dcd0e25371fa2d75a0" ,
"pattern" : "[file:hashes.SHA1 = '421eecdfe4f6987bb9ff7a6d65827563e53eafbb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff83-bab4-47da-ae9a-492602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Controls Engineer.docx - Xchecked via VT: 3d6eadf0f0b3fb7f996e6eb3d540945c2d736822df1a37dcd0e25371fa2d75a0" ,
"pattern" : "[file:hashes.MD5 = '4e4e9aac289f1c55e50227e2de66463b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--595fff83-9aa8-4361-bf50-42a502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"first_observed" : "2017-07-07T21:39:15Z" ,
"last_observed" : "2017-07-07T21:39:15Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--595fff83-9aa8-4361-bf50-42a502de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--595fff83-9aa8-4361-bf50-42a502de0b81" ,
"value" : "https://www.virustotal.com/file/3d6eadf0f0b3fb7f996e6eb3d540945c2d736822df1a37dcd0e25371fa2d75a0/analysis/1499463315/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff83-72e0-4302-9540-494302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Controls Engineer.docx - Xchecked via VT: b02508baf8567e62f3c0fd14833c82fb24e8ba4f0dc84aeb7690d9ea83385baa" ,
"pattern" : "[file:hashes.SHA1 = '5df2cb4b3a29adad4ba0a8f0b7eab5b6ae633977']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--595fff83-5cac-4e37-8a69-447502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"description" : "Controls Engineer.docx - Xchecked via VT: b02508baf8567e62f3c0fd14833c82fb24e8ba4f0dc84aeb7690d9ea83385baa" ,
"pattern" : "[file:hashes.MD5 = '4909db36f71106379832c8ca57ba5be8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-07-07T21:39:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--595fff83-fbdc-41f5-b908-47cf02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-07-07T21:39:15.000Z" ,
"modified" : "2017-07-07T21:39:15.000Z" ,
"first_observed" : "2017-07-07T21:39:15Z" ,
"last_observed" : "2017-07-07T21:39:15Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--595fff83-fbdc-41f5-b908-47cf02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--595fff83-fbdc-41f5-b908-47cf02de0b81" ,
"value" : "https://www.virustotal.com/file/b02508baf8567e62f3c0fd14833c82fb24e8ba4f0dc84aeb7690d9ea83385baa/analysis/1499445440/"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
