adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5b6c44c2-e8cc-4c56-8eb9-4f0a950d210f.json

1626 lines
56 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
"Event": {
"analysis": "2",
"date": "2018-08-08",
"extends_uuid": "",
"info": "OSINT - Familiar Feeling A Malware Campaign Targeting the Tibetan Diaspora Resurfaces",
"publish_timestamp": "1537215875",
"published": true,
"threat_level_id": "3",
"timestamp": "1537215802",
"uuid": "5b6c44c2-e8cc-4c56-8eb9-4f0a950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
"name": "tlp:white"
},
{
"colour": "#3b7500",
"name": "circl:incident-classification=\"malware\""
},
{
"colour": "#00223b",
"name": "osint:source-type=\"blog-post\""
},
{
"colour": "#0088cc",
"name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\""
},
{
"colour": "#0088cc",
"name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"PowerShell - T1086\""
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537189076",
"to_ids": false,
"type": "link",
"uuid": "5b6c44d2-6094-4926-a919-48a3950d210f",
"value": "https://citizenlab.ca/2018/08/familiar-feeling-a-malware-campaign-targeting-the-tibetan-diaspora-resurfaces/",
"Tag": [
{
"colour": "#00223b",
"name": "osint:source-type=\"blog-post\""
}
]
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537174539",
"to_ids": true,
"type": "domain",
"uuid": "5b9f6c0b-d8b4-4acd-a92e-d8a3950d210f",
"value": "commail.co"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537174540",
"to_ids": true,
"type": "domain",
"uuid": "5b9f6c0c-6bb8-4353-88d2-d8a3950d210f",
"value": "tibetnews.info"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537174540",
"to_ids": true,
"type": "domain",
"uuid": "5b9f6c0c-f6c8-466a-b35f-d8a3950d210f",
"value": "comemails.email"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537174541",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9f6c0d-265c-4879-8048-d8a3950d210f",
"value": "27.126.186.222"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537174541",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9f6c0d-3360-4aae-a319-d8a3950d210f",
"value": "103.55.24.196"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537174542",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9f6c0e-5760-4610-8e19-d8a3950d210f",
"value": "203.189.232.207"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537176051",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9f71f3-d42c-46dc-a8df-d052950d210f",
"value": "45.127.97.222"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537176052",
"to_ids": true,
"type": "domain",
"uuid": "5b9f71f4-bd0c-4a10-bafb-d052950d210f",
"value": "tibetnews.today"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537176052",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9f71f4-96d4-4c41-843c-d052950d210f",
"value": "115.126.86.151"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537178791",
"to_ids": true,
"type": "domain",
"uuid": "5b9f7ca7-2330-438c-a9ba-43f1950d210f",
"value": "tibethouse.info"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537178794",
"to_ids": true,
"type": "domain",
"uuid": "5b9f7caa-aa08-47db-af9c-479f950d210f",
"value": "daynew.today"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537178798",
"to_ids": true,
"type": "domain",
"uuid": "5b9f7cae-9a30-4928-a17a-4f2d950d210f",
"value": "daynews.today"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537189105",
"to_ids": false,
"type": "text",
"uuid": "5b9fa4dd-15a8-44c8-87a8-489f950d210f",
"value": "In January 2018, a Tibetan activist received a mundane-looking email purporting to be program updates from a human rights NGO. Attached to the message were a PowerPoint presentation and a document. The activist, like many in the Tibetan diaspora, had grown wary of unsolicited emails with attachments, and instead of opening the documents, shared the files with Citizen Lab researchers.\r\n\r\nThe suspicion was warranted: the attachments were malicious. If clicked, the files would run recent exploits to infect Windows computers with custom malware. This email was the start of a malware campaign active between January to March 2018 that targeted Tibetan activists, journalists, members of the Tibetan Parliament in exile, and the Central Tibetan Administration. We worked closely with the targeted groups to collect the malicious messages, and also engaged in incident response with a compromised organization. This collaboration enabled us to gain further insights into the tactics, techniques, and procedures used by the operators.\r\n\r\nThe campaign used social engineering to trick targets into opening exploit-laden PowerPoint (CVE-2017-0199) and Microsoft Rich Text Format (RTF) documents (CVE-2017-11882) attached to e-mail messages. The malware includes a PowerShell payload we call DMShell++, a backdoor known as TSSL, and a post-compromise tool we call DSNGInstaller.\r\n\r\nWe call this recent campaign the \u00e2\u20ac\u0153Resurfaced Campaign\u00e2\u20ac\u009d because of connections to a 2016 campaign that targeted Tibetan Parliamentarians (which we refer to as the \u00e2\u20ac\u0153Parliamentary Campaign\u00e2\u20ac\u009d). These connections suggest that the same group may be involved or tools and infrastructure are being shared between multiple groups.",
"Tag": [
{
"colour": "#00223b",
"name": "osint:source-type=\"blog-post\""
}
]
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190954",
"to_ids": true,
"type": "url",
"uuid": "5b9fac2a-3ad4-456c-910f-408a950d210f",
"value": "commail.co:5453/qqqzqa"
},
{
"category": "Network activity",
"comment": "On port 6001",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190954",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac2a-60e0-4df7-b188-4000950d210f",
"value": "27.126.186.222|6001"
},
{
"category": "Network activity",
"comment": "On port 6002",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190955",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac2b-0454-4ae0-abe4-4f2a950d210f",
"value": "27.126.186.222|6002"
},
{
"category": "Network activity",
"comment": "On port 6003",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190956",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac2c-a7a8-400d-bee5-49fd950d210f",
"value": "27.126.186.222|6003"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190957",
"to_ids": true,
"type": "url",
"uuid": "5b9fac2d-32b8-451b-ad3d-4c50950d210f",
"value": "tibetnews.info:8026/qqqzqa"
},
{
"category": "Network activity",
"comment": "On port 80",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190957",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac2d-43a0-4cbd-bdd2-44ee950d210f",
"value": "103.55.24.196|80"
},
{
"category": "Network activity",
"comment": "On port 443",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190958",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac2e-2c38-4491-b0bd-471a950d210f",
"value": "103.55.24.196|443"
},
{
"category": "Network activity",
"comment": "On port 443",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190959",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac2f-ce44-4c61-8f50-427a950d210f",
"value": "45.127.97.222|443"
},
{
"category": "Network activity",
"comment": "On port 80",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190960",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac30-3800-4895-b7da-4795950d210f",
"value": "27.126.186.222|80"
},
{
"category": "Network activity",
"comment": "On port 443",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190961",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac31-4418-4328-9f94-4c82950d210f",
"value": "27.126.186.222|443"
},
{
"category": "Network activity",
"comment": "On port 8080",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190962",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac32-3fa8-469e-82b7-4a14950d210f",
"value": "27.126.186.222|8080"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190963",
"to_ids": true,
"type": "url",
"uuid": "5b9fac33-2688-4056-b9a2-42bd950d210f",
"value": "comemails.email:1234/hgf"
},
{
"category": "Network activity",
"comment": "On port 80",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190963",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac33-b9cc-492f-9271-4c9c950d210f",
"value": "203.189.232.207|80"
},
{
"category": "Network activity",
"comment": "On port 443",
"deleted": false,
"disable_correlation": false,
"timestamp": "1537190964",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5b9fac34-9494-4180-97f4-494a950d210f",
"value": "203.189.232.207|443"
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "14",
"timestamp": "1537171463",
"uuid": "5b9f6007-36ec-49cc-b7cc-e30b950d210f",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1537171463",
"to_ids": true,
"type": "md5",
"uuid": "5b9f6007-47a8-4e3c-a5e9-e30b950d210f",
"value": "11e0f3e1c7d8855ed7f1dcfce4b7702a"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1537171463",
"to_ids": false,
"type": "text",
"uuid": "5b9f6007-9970-48cf-b364-e30b950d210f",
"value": "Malicious"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"meta-category": "vulnerability",
"name": "vulnerability",
"template_uuid": "81650945-f186-437b-8945-9f31715d32da",
"template_version": "5",
"timestamp": "1537172313",
"uuid": "5b9f6302-18e0-4459-a463-e6f4950d210f",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-score",
"timestamp": "1537172313",
"to_ids": false,
"type": "float",
"uuid": "5b9f6302-f2e4-4422-9159-e6f4950d210f",
"value": "9.3"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537172313",
"to_ids": false,
"type": "link",
"uuid": "5b9f6303-ac3c-4c20-a111-e6f4950d210f",
"value": "http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537172313",
"to_ids": false,
"type": "link",
"uuid": "5b9f6303-c8d4-40a5-ab8e-e6f4950d210f",
"value": "http://www.securityfocus.com/bid/101757"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537172313",
"to_ids": false,
"type": "link",
"uuid": "5b9f6304-0060-4649-a3e5-e6f4950d210f",
"value": "http://www.securitytracker.com/id/1039783"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537172313",
"to_ids": false,
"type": "link",
"uuid": "5b9f6304-e490-458d-aed8-e6f4950d210f",
"value": "https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537172313",
"to_ids": false,
"type": "link",
"uuid": "5b9f6304-678c-435e-a60c-e6f4950d210f",
"value": "https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1537172313",
"to_ids": false,
"type": "text",
"uuid": "5b9f6305-ff90-4ab8-8e89-e6f4950d210f",
"value": "Published"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1537172313",
"to_ids": false,
"type": "text",
"uuid": "5b9f6305-fcd4-4c7f-8d0b-e6f4950d210f",
"value": "Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka \"Microsoft Office Memory Corruption Vulnerability\". This CVE ID is unique from CVE-2017-11884."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1537172313",
"to_ids": false,
"type": "text",
"uuid": "5b9f6305-6f0c-46d8-acb3-e6f4950d210f",
"value": "CVE-2017-11882"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "published",
"timestamp": "1537172316",
"to_ids": false,
"type": "datetime",
"uuid": "5b9f635c-eb60-4583-bec1-e6f4950d210f",
"value": "2017-11-14T22:29:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537172316",
"to_ids": false,
"type": "text",
"uuid": "5b9f635c-9f98-46f2-9a5e-e6f4950d210f",
"value": "Microsoft Office 2007 Service Pack 3"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537172317",
"to_ids": false,
"type": "text",
"uuid": "5b9f635d-b704-48ba-a42b-e6f4950d210f",
"value": "cpe:2.3:a:microsoft:office:2010:sp2"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537172317",
"to_ids": false,
"type": "text",
"uuid": "5b9f635d-3ca0-458e-a3cb-e6f4950d210f",
"value": "Microsoft Office 2013 SP1"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537172318",
"to_ids": false,
"type": "text",
"uuid": "5b9f635e-ca54-4722-85d1-e6f4950d210f",
"value": "Microsoft Office 2016"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "modified",
"timestamp": "1537172318",
"to_ids": false,
"type": "datetime",
"uuid": "5b9f635e-d0fc-412f-bc5e-e6f4950d210f",
"value": "2017-12-30T21:29:00"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"meta-category": "vulnerability",
"name": "vulnerability",
"template_uuid": "81650945-f186-437b-8945-9f31715d32da",
"template_version": "5",
"timestamp": "1537174420",
"uuid": "5b9f6b94-f650-4701-be1d-e6f5950d210f",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-score",
"timestamp": "1537174421",
"to_ids": false,
"type": "float",
"uuid": "5b9f6b95-16fc-4c8a-8f49-e6f5950d210f",
"value": "9.3"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174421",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b95-5e2c-4a80-9638-e6f5950d210f",
"value": "http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174421",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b95-36d8-4470-99d6-e6f5950d210f",
"value": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174422",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b96-87a8-4818-b0b7-e6f5950d210f",
"value": "https://www.exploit-db.com/exploits/41934/"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174422",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b96-5238-4d66-a799-e6f5950d210f",
"value": "https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174423",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b97-5ccc-45a3-9bc1-e6f5950d210f",
"value": "https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174423",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b97-81e0-4372-8fe3-e6f5950d210f",
"value": "http://www.securitytracker.com/id/1038224"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174424",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b98-a4ac-4e94-b14c-e6f5950d210f",
"value": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174424",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b98-84d4-4871-a8c7-e6f5950d210f",
"value": "http://www.securityfocus.com/bid/97498"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174425",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b99-7738-4c7b-b9b8-e6f5950d210f",
"value": "https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174425",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b99-0b58-4de3-8738-e6f5950d210f",
"value": "https://www.exploit-db.com/exploits/42995/"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1537174426",
"to_ids": false,
"type": "link",
"uuid": "5b9f6b9a-e87c-433d-beff-e6f5950d210f",
"value": "https://www.exploit-db.com/exploits/41894/"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1537174426",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9a-c684-44c4-a71f-e6f5950d210f",
"value": "Published"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "published",
"timestamp": "1537174426",
"to_ids": false,
"type": "datetime",
"uuid": "5b9f6b9a-670c-49d4-b0f8-e6f5950d210f",
"value": "2017-12-04T10:59:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1537174426",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9a-6238-47ef-87d1-e6f5950d210f",
"value": "Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\""
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537174427",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9b-bc64-4992-8547-e6f5950d210f",
"value": "cpe:2.3:a:microsoft:office:2010:sp2"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537174427",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9b-36fc-4425-b2a5-e6f5950d210f",
"value": "Microsoft Office 2007 Service Pack 3"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537174428",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9c-6630-4daa-93a7-e6f5950d210f",
"value": "Microsoft Windows Server 2008 Service Pack 2"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537174428",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9c-fa74-4b6c-afc5-e6f5950d210f",
"value": "Microsoft Office 2016"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537174429",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9d-9600-474e-94bd-e6f5950d210f",
"value": "cpe:2.3:o:microsoft:windows_7:-:sp1"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537174429",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9d-5d80-4ae0-8fe4-e6f5950d210f",
"value": "Microsoft Windows Vista Service Pack 2"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537174430",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9e-a930-4fe2-8030-e6f5950d210f",
"value": "Microsoft Windows Server 2008 R2 Service Pack 1"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537174430",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9e-1f34-47a0-b77c-e6f5950d210f",
"value": "Microsoft Office 2013 SP1"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable_configuration",
"timestamp": "1537174431",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9f-fbec-460a-88c0-e6f5950d210f",
"value": "Microsoft Windows Server 2012"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "modified",
"timestamp": "1537174431",
"to_ids": false,
"type": "datetime",
"uuid": "5b9f6b9f-22d4-4d35-84c2-e6f5950d210f",
"value": "2018-03-27T21:29:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1537174431",
"to_ids": false,
"type": "text",
"uuid": "5b9f6b9f-7c48-4507-b345-e6f5950d210f",
"value": "CVE-2017-0199"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Whois records information for a domain name or an IP address.",
"meta-category": "network",
"name": "whois",
"template_uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a",
"template_version": "10",
"timestamp": "1537178039",
"uuid": "5b9f78e4-1670-4c68-bcca-e3a7950d210f",
"ObjectReference": [
{
"comment": "",
"object_uuid": "5b9f78e4-1670-4c68-bcca-e3a7950d210f",
"referenced_uuid": "5b9f6c0b-d8b4-4acd-a92e-d8a3950d210f",
"relationship_type": "uses",
"timestamp": "1537177994",
"uuid": "5b9f798a-7bbc-4a32-9dc3-4359950d210f"
},
{
"comment": "",
"object_uuid": "5b9f78e4-1670-4c68-bcca-e3a7950d210f",
"referenced_uuid": "5b9f6c0c-6bb8-4353-88d2-d8a3950d210f",
"relationship_type": "derived-from",
"timestamp": "1537178019",
"uuid": "5b9f7990-3014-4686-b8ff-499f950d210f"
},
{
"comment": "",
"object_uuid": "5b9f78e4-1670-4c68-bcca-e3a7950d210f",
"referenced_uuid": "5b9f6c0c-6bb8-4353-88d2-d8a3950d210f",
"relationship_type": "uses",
"timestamp": "1537178029",
"uuid": "5b9f79ad-150c-4bc4-b204-4e82950d210f"
},
{
"comment": "",
"object_uuid": "5b9f78e4-1670-4c68-bcca-e3a7950d210f",
"referenced_uuid": "5b9f71f4-bd0c-4a10-bafb-d052950d210f",
"relationship_type": "uses",
"timestamp": "1537178036",
"uuid": "5b9f79b4-1468-4df9-a900-4b4c950d210f"
}
],
"Attribute": [
{
"category": "Attribution",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "registrant-email",
"timestamp": "1537177828",
"to_ids": false,
"type": "whois-registrant-email",
"uuid": "5b9f78e4-e480-487c-a060-e3a7950d210f",
"value": "bqfkdrmnhh0623[@]gmail.com"
},
{
"category": "Attribution",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "registrant-name",
"timestamp": "1537177830",
"to_ids": false,
"type": "whois-registrant-name",
"uuid": "5b9f78e6-19b8-4185-969d-e3a7950d210f",
"value": "huang ning"
},
{
"category": "Attribution",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "registrant-phone",
"timestamp": "1537177833",
"to_ids": false,
"type": "whois-registrant-phone",
"uuid": "5b9f78e9-0aa4-4e65-91e3-e3a7950d210f",
"value": "8677687877"
}
]
},
{
"comment": "",
"deleted": false,
"description": "A domain and IP address seen as a tuple in a specific time frame.",
"meta-category": "network",
"name": "domain-ip",
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
"template_version": "6",
"timestamp": "1537179167",
"uuid": "5b9f7e1f-8f14-4416-9f3a-452a950d210f",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1537179167",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9f7e1f-565c-4741-b0ca-4236950d210f",
"value": "115.126.86.29"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "domain",
"timestamp": "1537179171",
"to_ids": true,
"type": "domain",
"uuid": "5b9f7e23-9dd0-4849-8613-4e1d950d210f",
"value": "google.comemails.email"
}
]
},
{
"comment": "",
"deleted": false,
"description": "A domain and IP address seen as a tuple in a specific time frame.",
"meta-category": "network",
"name": "domain-ip",
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
"template_version": "6",
"timestamp": "1537179207",
"uuid": "5b9f7e47-4ddc-4470-987c-459e950d210f",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1537179207",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9f7e47-54b0-4cf3-95f0-4ae5950d210f",
"value": "115.126.98.78"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "domain",
"timestamp": "1537179210",
"to_ids": true,
"type": "domain",
"uuid": "5b9f7e4a-8e6c-4445-84d0-443e950d210f",
"value": "mail.google.commail.co"
}
]
},
{
"comment": "",
"deleted": false,
"description": "A domain and IP address seen as a tuple in a specific time frame.",
"meta-category": "network",
"name": "domain-ip",
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
"template_version": "6",
"timestamp": "1537179261",
"uuid": "5b9f7e7d-f3ac-44cb-8d2a-4866950d210f",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1537179261",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9f7e7d-43e8-44c6-8170-464e950d210f",
"value": "118.99.59.214"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "domain",
"timestamp": "1537179265",
"to_ids": true,
"type": "domain",
"uuid": "5b9f7e81-b274-43fe-b947-48c0950d210f",
"value": "google.comemail.email"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "14",
"timestamp": "1537188384",
"uuid": "5b9f8073-bb3c-481d-b7b1-dc87950d210f",
"ObjectReference": [
{
"comment": "",
"object_uuid": "5b9f8073-bb3c-481d-b7b1-dc87950d210f",
"referenced_uuid": "5b9f7e1f-8f14-4416-9f3a-452a950d210f",
"relationship_type": "related-to",
"timestamp": "1537188380",
"uuid": "5b9fa21c-8cb4-4b03-8b43-e337950d210f"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1537179763",
"to_ids": true,
"type": "sha1",
"uuid": "5b9f8073-ece4-40d9-95f2-dc87950d210f",
"value": "6a4690f454c91fdc559a223d43f0a77d40b59b2a"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1537179763",
"to_ids": false,
"type": "text",
"uuid": "5b9f8073-7130-4dca-89d3-dc87950d210f",
"value": "Malicious"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "14",
"timestamp": "1537187589",
"uuid": "5b9f8086-5f30-4482-891d-475b950d210f",
"ObjectReference": [
{
"comment": "",
"object_uuid": "5b9f8086-5f30-4482-891d-475b950d210f",
"referenced_uuid": "5b9f7e47-4ddc-4470-987c-459e950d210f",
"relationship_type": "derived-from",
"timestamp": "1537187586",
"uuid": "5b9f9ef4-f650-4882-adb6-e337950d210f"
},
{
"comment": "",
"object_uuid": "5b9f8086-5f30-4482-891d-475b950d210f",
"referenced_uuid": "5b9f7e47-4ddc-4470-987c-459e950d210f",
"relationship_type": "related-to",
"timestamp": "1537187579",
"uuid": "5b9f9efb-7da0-4156-8863-4554950d210f"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1537179783",
"to_ids": true,
"type": "sha1",
"uuid": "5b9f8087-258c-46f2-9236-4f25950d210f",
"value": "e55cea25ecc118fd798f84eb5395be0678bdbc51"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1537179783",
"to_ids": false,
"type": "text",
"uuid": "5b9f8087-4ee8-426f-9c1b-49df950d210f",
"value": "Malicious"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "14",
"timestamp": "1537187205",
"uuid": "5b9f8098-16dc-4483-8b05-d04e950d210f",
"ObjectReference": [
{
"comment": "",
"object_uuid": "5b9f8098-16dc-4483-8b05-d04e950d210f",
"referenced_uuid": "5b9f7e7d-f3ac-44cb-8d2a-4866950d210f",
"relationship_type": "related-to",
"timestamp": "1537187202",
"uuid": "5b9f9d82-0464-4fe9-93fb-4c83950d210f"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1537179800",
"to_ids": true,
"type": "sha1",
"uuid": "5b9f8098-554c-477c-8525-d04e950d210f",
"value": "cdd2fd64a4996b7d901d4a899d660cc5ff118e73"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1537179800",
"to_ids": false,
"type": "text",
"uuid": "5b9f8098-6c40-46f4-aa5f-d04e950d210f",
"value": "Malicious"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Email object describing an email with meta-information",
"meta-category": "network",
"name": "email",
"template_uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552",
"template_version": "12",
"timestamp": "1537190429",
"uuid": "5b9faa1d-28a8-4957-b2ab-4b2b950d210f",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "from",
"timestamp": "1537190430",
"to_ids": true,
"type": "email-src",
"uuid": "5b9faa1e-6ad8-4f5b-8f42-4942950d210f",
"value": "tibetanparliarnent@yahoo.com"
}
]
},
{
"comment": "",
"deleted": false,
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
"meta-category": "network",
"name": "ip-port",
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
"template_version": "7",
"timestamp": "1537193094",
"uuid": "5b9fb486-9674-4e70-9077-4614950d210f",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1537193095",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9fb487-f794-43ee-bdb8-4dbb950d210f",
"value": "27.126.186.222"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537193096",
"to_ids": false,
"type": "port",
"uuid": "5b9fb488-2298-44ad-b6a1-4667950d210f",
"value": "6001"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537193096",
"to_ids": false,
"type": "port",
"uuid": "5b9fb488-ba34-4d44-8076-4304950d210f",
"value": "6002"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537193096",
"to_ids": false,
"type": "port",
"uuid": "5b9fb488-78ec-4c54-be54-47dd950d210f",
"value": "6003"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537193096",
"to_ids": false,
"type": "port",
"uuid": "5b9fb488-b77c-48ac-88bb-4816950d210f",
"value": "80"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537193096",
"to_ids": false,
"type": "port",
"uuid": "5b9fb488-4a08-4bcd-a751-484a950d210f",
"value": "8080"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537193096",
"to_ids": false,
"type": "port",
"uuid": "5b9fb488-8960-4217-8b08-4d66950d210f",
"value": "443"
}
]
},
{
"comment": "",
"deleted": false,
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
"meta-category": "network",
"name": "ip-port",
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
"template_version": "7",
"timestamp": "1537194880",
"uuid": "5b9fbb80-f010-4a72-a7ab-4f41950d210f",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1537194880",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9fbb80-2f00-4b53-9268-4c9d950d210f",
"value": "103.55.24.196"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537194880",
"to_ids": false,
"type": "port",
"uuid": "5b9fbb80-ad20-4584-b1cb-497e950d210f",
"value": "443"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537194880",
"to_ids": false,
"type": "port",
"uuid": "5b9fbb80-8440-46ef-87d6-484e950d210f",
"value": "80"
}
]
},
{
"comment": "",
"deleted": false,
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
"meta-category": "network",
"name": "ip-port",
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
"template_version": "7",
"timestamp": "1537194902",
"uuid": "5b9fbb96-36dc-47c1-a0b3-4173950d210f",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1537194902",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9fbb96-8e8c-4d13-a456-4bb1950d210f",
"value": "45.127.97.222"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537194903",
"to_ids": false,
"type": "port",
"uuid": "5b9fbb97-70a8-454c-a54c-4ac4950d210f",
"value": "443"
}
]
},
{
"comment": "",
"deleted": false,
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
"meta-category": "network",
"name": "ip-port",
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
"template_version": "7",
"timestamp": "1537194923",
"uuid": "5b9fbbab-e5b8-4120-99fd-40b2950d210f",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1537194923",
"to_ids": true,
"type": "ip-dst",
"uuid": "5b9fbbab-8a80-40a2-8dfd-4b0f950d210f",
"value": "203.189.232.207"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537194923",
"to_ids": false,
"type": "port",
"uuid": "5b9fbbab-3770-4593-af40-46c8950d210f",
"value": "443"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1537194923",
"to_ids": false,
"type": "port",
"uuid": "5b9fbbab-a8c8-4db4-9565-4547950d210f",
"value": "80"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "11",
"timestamp": "1537215759",
"uuid": "d2f5d552-96c4-43ad-84e1-fb8cebbf6000",
"ObjectReference": [
{
"comment": "",
"object_uuid": "d2f5d552-96c4-43ad-84e1-fb8cebbf6000",
"referenced_uuid": "857a21fc-b3c9-47ae-93e4-9e5fe62dc79b",
"relationship_type": "analysed-with",
"timestamp": "1537215772",
"uuid": "5ba00d1c-ff94-4943-8629-48f302de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1537215758",
"to_ids": true,
"type": "md5",
"uuid": "ed307627-2220-4407-99c5-affe8a1f6d27",
"value": "11e0f3e1c7d8855ed7f1dcfce4b7702a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1537215760",
"to_ids": true,
"type": "sha1",
"uuid": "e194e107-af6f-4b8e-8561-332af810ab23",
"value": "9bb47262664b10b60a853002eace4db083ee10af"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1537215763",
"to_ids": true,
"type": "sha256",
"uuid": "40b0b152-ef0e-47ad-8e2b-a731d121f6b2",
"value": "1b156c7d2cc651d0a58c8dac1353332614b489e4d21e51ca7a0a929295e6ad40"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "2",
"timestamp": "1537215765",
"uuid": "857a21fc-b3c9-47ae-93e4-9e5fe62dc79b",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1537215768",
"to_ids": false,
"type": "datetime",
"uuid": "87f7f5c5-40a4-465d-ba91-e82e4595f4e7",
"value": "2018-08-10T08:33:52"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1537215770",
"to_ids": false,
"type": "link",
"uuid": "2236a126-0d1a-4f18-b8b4-87d5424a7b7b",
"value": "https://www.virustotal.com/file/1b156c7d2cc651d0a58c8dac1353332614b489e4d21e51ca7a0a929295e6ad40/analysis/1533890032/"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1537215772",
"to_ids": false,
"type": "text",
"uuid": "4e295ad5-8545-422f-8c7d-683e1a2de6f4",
"value": "24/67"
}
]
}
]
}
}
Reference in a new issue Copy permalink