540 lines
15 KiB
JSON
540 lines
15 KiB
JSON
|
{
|
||
|
|
"Event": {
|
||
|
|
"analysis": "0",
|
||
|
|
"date": "2020-02-04",
|
||
|
|
"extends_uuid": "5deea6f2-568c-4fe3-a457-0d230a0a019b",
|
||
|
|
"info": "Updating: Tracking Powershell Empire C2 via Urlscan",
|
||
|
|
"publish_timestamp": "1580785391",
|
||
|
|
"published": true,
|
||
|
|
"threat_level_id": "2",
|
||
|
|
"timestamp": "1580785351",
|
||
|
|
"uuid": "5e38d6d4-7d88-40ab-8313-4db80a0a020f",
|
||
|
|
"Orgc": {
|
||
|
|
"name": "laskowski-tech.com",
|
||
|
|
"uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"
|
||
|
|
},
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#ffffff",
|
||
|
|
"name": "tlp:white"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#ff8a00",
|
||
|
|
"name": "Source:Urlscan.io"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#009922",
|
||
|
|
"name": "Threat Source:OSINT"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#004646",
|
||
|
|
"name": "type:OSINT"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "azershop.org",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2019-12-23T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785067",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38d884-a9f8-4f6a-addf-4dbc0a0a020f",
|
||
|
|
"value": "37.220.0.54",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2019-12-23T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785070",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38d89e-730c-46dd-9a84-4dba0a0a020f",
|
||
|
|
"value": "https://azershop.org:443",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785040",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38d8c5-75f8-421b-9ff6-45500a0a020f",
|
||
|
|
"value": "https://virtualofficeroom.com:443",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "virtualofficeroom.com",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580784983",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38d8e9-87d0-470e-b526-4dba0a0a020f",
|
||
|
|
"value": "185.165.168.226",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580784978",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38d917-fca8-47c0-8664-447c0a0a020f",
|
||
|
|
"value": "https://officestorage.org:443",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "officestorage.org",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785129",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38d93f-6364-4d78-9375-4d9a0a0a020f",
|
||
|
|
"value": "185.245.84.106",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2019-12-12T00:00:00+00:00",
|
||
|
|
"last_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580784842",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38d96f-ed58-4208-99ff-4db80a0a020f",
|
||
|
|
"value": "https://194.99.22.145/",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2019-12-12T00:00:00+00:00",
|
||
|
|
"last_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580784842",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38d982-ca10-45a5-9e82-4ab00a0a020f",
|
||
|
|
"value": "194.99.22.145",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785042",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38d99c-da60-4aff-9656-42f20a0a020f",
|
||
|
|
"value": "http://23.83.133.15:333/",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785079",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38d9b0-312c-4b67-8cce-4e180a0a020f",
|
||
|
|
"value": "23.83.133.15",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-20T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785007",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38da2b-11d4-4821-97a1-4dbc0a0a020f",
|
||
|
|
"value": "https://updateinfoapps.com/",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "updateinfoapps.com",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-20T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785011",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38da52-c9fc-48ef-ad16-4f9a0a0a020f",
|
||
|
|
"value": "45.61.139.40",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-15T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785046",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38dab6-5a90-4dad-90b7-4dbe0a0a020f",
|
||
|
|
"value": "https://www.microsoft-lync.cf/",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "www.microsoft-lync.cf",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-15T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785048",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38dad8-dc10-4645-8ef0-42960a0a020f",
|
||
|
|
"value": "54.229.88.99",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-09T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785053",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38db7a-cfa0-42e5-a1ab-4db80a0a020f",
|
||
|
|
"value": "https://cdnupdate2.ddns.net/",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "cdnupdate2.ddns.net",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-09T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785055",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38dba2-15dc-4574-af0b-418b0a0a020f",
|
||
|
|
"value": "149.28.128.67",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-08T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785058",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38dbea-5224-4bb2-81cd-49c70a0a020f",
|
||
|
|
"value": "http://securityinsiderblogs.com/",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "securityinsiderblogs.com",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-08T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785061",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38dc10-07ec-4d75-a5f5-4db80a0a020f",
|
||
|
|
"value": "155.138.238.182",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-31T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785028",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38dc48-57a8-4fa8-b333-4dfc0a0a020f",
|
||
|
|
"value": "https://bankingadvice.net:443",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "bankingadvice.net",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-31T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785034",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38dc64-48b8-45da-bf4c-4db80a0a020f",
|
||
|
|
"value": "23.101.118.20",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580784997",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5e38dc8c-66fc-4338-9747-4dbe0a0a020f",
|
||
|
|
"value": "http://23.83.133.137:443/",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-27T00:00:00+00:00",
|
||
|
|
"timestamp": "1580785001",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5e38dca6-4644-4508-8a3a-4eef0a0a020f",
|
||
|
|
"value": "23.83.133.137",
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#10e874",
|
||
|
|
"name": "Powershell Empire"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#e200a3",
|
||
|
|
"name": "kill-chain:Command and Control"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Support Tool",
|
||
|
|
"comment": "Urlscan scearch that contains the raw OSINT source",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"first_seen": "2020-01-27T05:00:00+00:00",
|
||
|
|
"last_seen": "2020-01-28T05:00:00+00:00",
|
||
|
|
"timestamp": "1580785123",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "5e38dd01-18f0-4378-a084-4d9a0a0a020f",
|
||
|
|
"value": "https://urlscan.io/search/#hash%3Ab8c892fbb49921529be6f6ce17685c31724f76959111b28f39e39dc299b8acaf%20"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|