2023-04-21 13:25:09 +00:00
{
"Event" : {
"analysis" : "2" ,
"date" : "2018-06-24" ,
"extends_uuid" : "" ,
"info" : "OSINT - Tick Group Weaponized Secure USB Drives to Target Air-Gapped Critical Systems" ,
"publish_timestamp" : "1529824636" ,
"published" : true ,
"threat_level_id" : "2" ,
"timestamp" : "1529821311" ,
"uuid" : "5b2f3583-d514-458a-a12e-480a02de0b81" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#0088cc" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "misp-galaxy:threat-actor=\"Tick\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#ffffff" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#0088cc" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Multi-Stage Channels - T1104\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#0088cc" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Replication Through Removable Media - T1091\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#00223b" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#0026eb" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "estimative-language:confidence-in-analytic-judgment=\"moderate\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820569" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5b2f3599-ba2c-4e8e-b72b-470402de0b81" ,
"value" : "Tick is a cyberespionage group primarily targeting organizations in Japan and the Republic of Korea. The group is known to conduct attack campaigns with various custom malware such as Minzen, Datper, Nioupale (aka Daserf), and HomamDownloader. Unit 42 last wrote about the Tick group in July 2017.\r\n\r\nRecently, Palo Alto Networks Unit 42 discovered the Tick group targeted a specific type of secure USB drive created by a South Korean defense company. The USB drive and its management system have various features to follow security guidelines in South Korea.\r\n\r\nThe weaponization of a secure USB drive is an uncommon attack technique and likely done in an effort to spread to air-gapped systems, which are systems that do not connect to the public internet. In addition, our research shows that the malware used in these attacks will only try to infect systems running Microsoft Windows XP or Windows Server 2003. This is despite the fact that the malware appears to have been created when newer versions of Windows software were available. This would seem to indicate an intentional targeting of older, out-of-support versions of Microsoft Windows installed on systems with no internet connectivity. Air-gapped systems are common practice in many countries for government, military, and defense contractors, as well as other industry verticals.\r\n\r\nWe have not identified any public reporting on this attack, and we suspect the Tick group used the malware described in this report in attacks multiple years ago. Based on the data collected, we do not believe this malware is part of any active threat campaign.\r\n\r\nOur picture of this past attack is incomplete at this time. Based on our research thus far, we are able to sketch out the following hypothesized attack scenario:\r\n\r\n The Tick Group somehow compromised a secure type of USB drive and loaded a malicious file onto an unknown number of them. These USB drives are supposed to be certified as secure by the South Korean ITSCC (English).\r\n The Tick Group created a specific malware we are calling SymonLoader that somehow gets on older Windows systems and continuously looks for these specific USB drives.\r\n SymonLoader specifically targets Windows XP and Windows Server 2003 systems ONLY.\r\n If SymonLoader detects the presence of a specific type of secure USB drive, it will attempt to load the unknown malicious file using APIs that directly access the file system.\r\n\r\nIn the research below, we outline our findings around SymonLoader. We do not currently have either a compromised USB drive nor the unknown malicious file we believe is implanted on these devices. Because of this we are unable to describe the full attack sequence.\r\n\r\nBecause we do not have either a compromised USB drive or the unknown malicious file, we are also unable to determine how these USB drives have been compromised. Specifically, we do not know if there has been a successful compromise in the supply-chain making these devices, or if these have been compromised post-manufacturing and distributed using other means such as social engineering."
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820582" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5b2f35a6-e330-4e12-ab45-4ce402de0b81" ,
"value" : "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Trojanized Legitimate Software" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820711" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5b2f3627-b4c8-402e-b448-458202de0b81" ,
"value" : "b1bb1d5f178b064eb1d7c9cc7cadcf8b3959a940c14cee457ce3aba5795660aa"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Trojanized Legitimate Software" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820711" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5b2f3627-8830-4caa-b2b8-492d02de0b81" ,
"value" : "3227d1e39fc3bc842245ccdb16eeaadad3bcd298e811573b2e68ef2a7077f6f6"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Trojanized Legitimate Software" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820712" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5b2f3628-7c68-415b-91cd-4d4702de0b81" ,
"value" : "92e0d0346774127024c672cc7239dd269824a79e85b84c532128fd9663a0ce78"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Trojanized Legitimate Software" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820712" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5b2f3628-8254-4b11-bdfc-4e7d02de0b81" ,
"value" : "33665d93ab2a0262551c61ec9a3adca2c2b8dfea34e6f3f723274d88890f6ceb"
} ,
{
"category" : "Payload delivery" ,
"comment" : "HomamDownloader" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820749" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5b2f364d-60f0-4e87-8e5d-45a302de0b81" ,
"value" : "019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e"
} ,
{
"category" : "Payload delivery" ,
"comment" : "HomamDownloader" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820750" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5b2f364e-5fc0-4780-ba0f-4a9702de0b81" ,
"value" : "f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec"
} ,
{
"category" : "Network activity" ,
"comment" : "C2 of HomamDownloader" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820772" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "5b2f3664-0470-4030-b8e0-4b6202de0b81" ,
"value" : "pre.englandprevail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Malformed Legitimate software" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820797" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5b2f367d-cb60-4e89-95d7-487d02de0b81" ,
"value" : "8549dcbdfc6885e0e7a1521da61352ef4f084d969dd30719166b47fdb204828a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "SysmonLoader" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820824" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5b2f3698-ec44-4e8a-8550-454e02de0b81" ,
"value" : "31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820838" ,
"to_ids" : false ,
"type" : "mutex" ,
"uuid" : "5b2f36a6-a27c-47d6-9ec3-45c802de0b81" ,
"value" : "SysMonitor_3A2DCB47"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820878" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5b2f36ce-b3dc-4b08-9627-8e7702de0b81" ,
"value" : "%ProgramFiles%\\Windows NT\\Accessories\\Microsoft\\msxml.exe"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820879" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5b2f36cf-7cb0-43c6-abb7-8e7702de0b81" ,
"value" : "%UserProfile%\\Applications\\Microsoft\\msxml.exe"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820911" ,
"to_ids" : true ,
"type" : "regkey|value" ,
"uuid" : "5b2f36ef-22d4-4f51-8338-40e502de0b81" ,
"value" : "HKLM\\Software\\Microsof\\Windows\\CurrentVersion\\run\\\u00e2\u20ac\u009dxml\u00e2\u20ac\u009d|%ProgramFiles%\\Windows NT\\Accessories\\Microsoft\\msxml.exe"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529820911" ,
"to_ids" : true ,
"type" : "regkey|value" ,
"uuid" : "5b2f36ef-e8b4-4338-accf-4cf302de0b81" ,
"value" : "HKCU\\Software\\Microsof\\Windows\\CurrentVersion\\run\\\u00e2\u20ac\u009dxml\u00e2\u20ac\u009d|%UserProfile%\\Applications\\Microsoft\\msxml.exe"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"data" : " i V B O R w 0 K G g o A A A A N S U h E U g A A A 5 g A A A K K C A Y A A A B Y o f S Z A A A A A X N S R 0 I A r s 4 c 6 Q A A A A l w S F l z A A A X E g A A F x I B Z 5 / S U g A A Q A B J R E F U e A H s v f l z Z N d x L p i o Q l V h a T T Q + 8 L m 0 g v Z J E V S 3 B d x 0 S 7 L l i x 5 k S V 5 f z G 2 Y z w R / m 0 i J i Z m / o g 3 M R P P f n q y / W T L b 2 z J Y 0 u y Z U k U F 3 E T 953 d z d 7 Z 7 H 1 v 7 E A V U I X 5 v r y V V R c g u h s o A H X P L e Q h q 6 t w q u 69 e b 4899 z 8 T u b J 0 / b 6669 P i R d H w B F w B B w B R 8 A R c A Q c A U c g Q A S K x a K 0 Z T K S z + V U u q m p K W F d t j 0 r u f a o L k m x J y Y m p F w u S 0 d H R 0 2 M U q k k U / i v k C / U 6 l r l A 9 v K 9 h X y e c l k s 9 q s y c l J I Q 6 F Q k E y 0 F W S h f 1 j H P 2 j H b L l q n 2 m U q l o n 8 n n c 5 L N t i c p 3 q J f 2 / S R h z 6 y C e u D 98 D 4 + P g P k + 0 B i w 6 x n 9 A R c A Q c A U f A E X A E H A F H o F U Q I H E h O W h v r 5 M C 1 r G 0 B 0 I U T D a T S 2 W D v J V y R Y m n C t t C / 7 C d J D J G L k n o W E c c k i a X h L m t r U 1 l m Z w s C 2 V j o V y U m X J a n X 7 R A v + Y P o x c m j 6 y C e r D C W Y L d C x v g i P g C D g C j o A j 4 A g 4 A q 2 G g B n K S l x A G l h I N p X M w D N F I h F C q R O a O n l p V U J D 7 C s g b U a q i T / r W O J 1 W p H g P 5 S F e q F X 1 U o 7 + g z 5 J j 1 + r V L Y l p k T M O V y p I 8 c M E i q O M F M C n m / r i P g C D g C j o A j 4 A g 4 A o 7 A Z R G Y r B r K c e J C M k P y x v D H k I r J a G S L s p H Q V C p T L U R o I k + l e i + r Y b B G + H O 5 i N C F o h N O P b R D p n I l I m C U K w P C S a / e R A t 5 M d m W a f o A g 56 Y i L z J S U 7 A O M E M 5 U 5 w O R w B R 8 A R c A Q c A U f A E X A E F A E S l z K M Z 66 h M 0 O Z 3 h q + b F 1 d a F B R L v X w Q X Y W E h q S H N a 1 Q l g m i Y u A u c U 9 Y 0 b 4 M 5 m w C D / x 5 y Q E J y O m e T F R R / J J Y p b 2 o m 2 Y q k y 7 H y b h s T X v e Z L t c 4 K Z J P p + b U f A E X A E H A F H w B F w B B y B j y B A 4 t L W F q 2 b s y 9 n e m u s P p R 38 y T F y Y t 5 W t m e N B e G x X J N Y z u S K s 0 k / P G 60 N r I J F D q Z a 2 G x V J 2 T g Q w j J T 1 a S 2 q D / V U x v T B S R m 0 M w R 9 O M F M a 89 y u R 0 B R 8 A R c A Q c A U f A E W h B B G b z V J o X M F T v p a m B 8 l W q n l b W G a G h / G k m N J F n D B 7 Z W G g y P Y M k 1 d l s u H R C w 6 k R F k v 5 z Y u s E w G Y v I h 7 N k 1 / a X m v 6 S O 2 z p J 1 o e g j 3 B 6 R F g 27 n I 6 A I + A I O A K O g C P g C D g C i 4 b A T E 8 l i Q H J Q A 7 b k p j 3 b N E u t s g n s v B E t m E a o W G o 5 m Q 94 c w i X 3 Z J T 1 c j / H E y w / b h q q E T f g J j 62 P Z D i s 6 E Q C P 32 S s z r 4 L / d 30 Y e 2 i v D a B w Z D s E I o T z B C 0 4 D I 4 A o 6 A I + A I O A K O g C P g C K i h D F d f j R Q Q E h r P J J Y M / U t D U d L F k N I Y e Y k 8 m + n b t o Q k m f i r 16 / q v b Q 6 E p z Q C T / 7 S 9 R 3 p q + F 1 Y m A G Z 7 N N P Q t k n r T B 3 X C U t d H D u t + w 6 B 2 Y U i h 8 P g / j o A j 4 A g 4 A o 6 A I + A I O A L L F Q E a y h p 2 C c O f B I B F 18 + B 4 K S F X F L m y x I a E I K 0 h W X S W 0 Y d M C O u F R I c l r g H z b 4 L 9 d 1 k j e N v y Y r i n s 1 Q 5 T e 5 G H 6 t + p j h T e b 31 k b 7 b Z L v T j C T R N + v 7 Q g 4 A o 6 A I + A I O A K O g C O g C E w i h J S J f e K G M g l B 5 G 0 K L 0 v p l d Q W r f P j P o y l 2 s 8 s n N Q I W u 2 L Q D 9 M 94 x F e 44 a 4 W d b o p p A h Z 9 F r F w u r 0 l w y i D M L P G J A L Y r 9 G I T M L w / P j I B Q 30 E p B A n m K H 3 J p f P E X A E H A F H w B F w B B y B F k c g I i 7 c g q Q e d s k Q U 9 a n k c w Y e S m X E R b 7 E U I z I c w C G n o x I t y O t a 9 W a o S / G p 5 p 9 W l 4 Z z K i D O R m M h w r J G v U l b X V 6 k N 8 N x n j E z C s I 9 m M J 18 K Q X Y n m C F o w W V w B B w B R 8 A R c A Q c A U d g G S M w k 7 i o 9 w x E I O 6 t S R s 8 U U b P y x C a G M k J s V 3 T P J V V 11 i c 8 I c o 81 x k 0 r W w I P x G 1 n g M w 38 t c c 5 c z p H E b 0 w f T O J D Q s x i M p t n P A m 5 L n d N J 5 i X Q 8 b r H Q F H w B F w B B w B R 8 A R c A S W H A F b 5 x c 3 l G 1 d X N x b s + S C L M E F Z i U 0 S F Z k 5 G A J L r k o p 2 x F w k 9 g M i B n 7 F P T s v z C A 8 j J g D j p X B Q Q F / E k d U 9 l l C U 2 C l + O t i W x c N l F v N y C T + U E c 8 E Q + g k c A U f A E X A E H A F H w B F w B B p B w A z l u K c y v t b M v D W N n D u E Y y x U l g S B 7 W K p e T Z j d S H I a j I o 4 Z + K Q p O t b n I y 2 u I j 7 Y S f 7 W E b 6 A O M E 0 r W q Z c w l v n X 2 p 70 O 8 O s K x W G j 9 c T L U U 6 i r y v S c s 32 / W d Y M 6 G i t c 5 A o 6 A I + A I O A K O g C P g C C w 5 A m o o V 6 a m J f Y x b w 2 J W C s U 25 t w G q F B q C M J D V + h F X o v s 9 m Z i W R Q V 12 v G J q 885 V H S T / I G v V R Q d 9 j 0 X W M a B 8 T T Y W 2 O l a 9 y T F 9 x C d g 6 J E N s T j B D F E r L p M j 4 A g 4 A o 6 A I + A I O A I t j o C t K 6 N n x j y V V s d 1 c V a X d h j a 4 C 9 j e 2 w N I 9 v D / Q r p N S N 5 M M 9 m C O 3 U 0 F E I Y l t 4 U C Y S s b Y A E 8 k s B C 9 O X p B U T o B Q W l H v L N j l x E S 0 D Y v V J / l O 7 N k / 4 v q g j p Q k B z w B 4 w Q z y V 7 j 13 Y E H A F H w B F w B B w B R 2 C Z I m A e P X r G r E T e s 6 x k Y f y 3 U l F C A 2 + T t Z l t U 0 K D 93 h d k m 0 m k S m D v J D M G L k n 4 S 8 z P D N W l 6 S M i 3 V t + v 0 0 L F Y z F U f h v 0 r a 0E5 i E I J n m f p g 34 h n V l Z 9 l F k X 9 g R M a 929 i 9 X r / D y O g C P g C D g C j o A j 4 A g 4 A k u G Q G Q o g 7 j k Y S h X r x K F y 0 5 f + 7 d k A j T 5 x G w j S Q H b G N + 2 h M S N J C K E b U s i z 1 i d + B I i D c / M g P A H 7 C 1 r V J V s E 19 x j y V J Z y Y z f S K g 0 f M v 9 D i b e L C J C J 6 P s t L 7 H b o + n G A u V P t + v C P g C D g C j o A j 4 A g 4 A o 7 A v B C o e y q j d Z b 0 1 r C O x r R 5 z + Z 1 w h T 8 m C G Z E a G p h 2 X S e 8 v 6 + N 6 M S T R F C T + I b j s y 3 F q x k N 54 e K Z 91 y r v J P 3 m K b Q 2 h b B t C f U R e S / r + o g m Y K Y n + z G Z Q 3 u v x y S E J p n L 4 w g 4 A o 6 A I + A I O A K O g C M Q D A I 0 x P l i 4 b / m e d S K e f x D 45 n n o X F v Z T Z v j X 3 X S u 8 k 0 K V i U c m D e a a I Q 5 F 18 G 4 m l b R l p q d S S V e V 8 J M A t 2 r h Z A Y T G r H / k f z r 39 W J A N Y l N d k x m z 50 U q Y 6 I R G 6 P p x g h q 4 h l 88 R c A Q c A U f A E X A E H I E A E K C B S y / K Y h S S K y M u D A 81 b 0 1 S B v 1 i t G k u 51 A v J t o e J z R a x 1 D N U m k u p 5 j 1 N 20 I m 5 z C 1 i K N F u K e R 7 i y F c r H Y i T Y 6 l v x v b 0 9 i 349 W e u D b K O R f h L / J M p M f d h 9 l x Z v s h P M J H q N X 9 M R c A Q c A U f A E X A E H I G U I U C j O + 51 X I j 4 c S I Z e W u i r K o L O W d a j i V p 476 G X E 9 n p C 6 f z 9e8 w 0 m 1 w 3 Q S D 8 + 0 u q R k a s Z 12 U b 26 x I I f o b r M u H B Z F 2 h U G j G 5 S 97 D c O e + u A 9 Q h m t 7 r I H B f K F E 8 x A F O F i O A K O g C P g C D g C j o A j E D I C S 2 H c 0 n i u w C t K g r V c C n F k W C Z J w 9 R U f c 3 p U u D b C K b 0 l k H E Z e G 9 N H w s P J Y Z Z L P V v h i a P t h n 0 l L S I 2 l a E H U 5 H Q F H w B F w B B w B R 8 A R a C E E b N 3 l Y j b J j P c o P B R J b h C i G H p m z M V s / + R k u b b m z 867 I J z J C K v r Y + 1883 r H 8 b a m l n r Q k F E Q z X Z 8 X g 6 l X I 7 W B c e 3 z N H V x g v B d C H A T d M H t k 7 B / c H t Y t K i D y e Y C 1 G + H + s I O A K O g C P g C D g C j k A L I 2 D h e V F q n 3 p D S Y a M J N Z r 5 / g J x z J M 1 N b 3 M X O p J b l J i w E 9 x 5 b O + j N u B 4 J 0 S Q h 5 r H t t a + t b S R Q b K N T F g g g q r l m A 547 n I e n P M P E N P K w W L t q A S K k 5 h L h N T K K t 1 f B Y C s 46 h s z O 7 P d z b h S O 19 K g P n k s v f p M + s R t U z Q R U Y r 0 4 Q Q z U r //6wg4Ao6AI+AIOAKOgCMwEwEYuEYEp31FA7pB41lJK0gW17tFBnS0/nI5EBoSF4ZhElMj6MSDSXVYR3LXWCExbZgOKcEiybVQZSaTKcKDacmXGpMpHUcxJHgKOmiPrbnUSQDoaiFrjhdwiwD3CSX4pg/2DcqZFn04wUxH33cpHQFHwBFwBBwBR8ARaDoCum3GIodJ0l
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1529824621" ,
"to_ids" : false ,
"type" : "attachment" ,
"uuid" : "5b2f456d-51f0-4675-86f9-446602de0b81" ,
"value" : "tick_1.png"
}
] ,
"Object" : [
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1529821065" ,
"uuid" : "c5e67388-9ebc-43d2-b001-316b11345631" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "c5e67388-9ebc-43d2-b001-316b11345631" ,
"referenced_uuid" : "0df0343d-e5a6-45c5-8b09-4f3276602490" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1529821079" ,
"uuid" : "5b2f3797-f240-46dc-a337-41a702de0b81"
}
] ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1529821064" ,
"uuid" : "0df0343d-e5a6-45c5-8b09-4f3276602490" ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1529821068" ,
"uuid" : "0bf106d7-cee1-47c9-8080-36acc843d925" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "0bf106d7-cee1-47c9-8080-36acc843d925" ,
"referenced_uuid" : "a734632b-801c-4175-bd56-6c057028a9eb" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1529821079" ,
"uuid" : "5b2f3797-e4d8-46fe-9a36-49e402de0b81"
}
] ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1529821066" ,
"uuid" : "a734632b-801c-4175-bd56-6c057028a9eb" ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1529821070" ,
"uuid" : "21ce0ec5-f2f4-41c0-a635-bc69610836ab" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "21ce0ec5-f2f4-41c0-a635-bc69610836ab" ,
"referenced_uuid" : "edfd2583-84e7-487f-9a9e-7fbb87d8379b" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1529821079" ,
"uuid" : "5b2f3797-8668-404b-a615-491a02de0b81"
}
] ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1529821068" ,
"uuid" : "edfd2583-84e7-487f-9a9e-7fbb87d8379b" ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1529821072" ,
"uuid" : "31f39214-38ff-45c1-a415-63747fe90600" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "31f39214-38ff-45c1-a415-63747fe90600" ,
"referenced_uuid" : "7ec69509-17fb-4ac7-955c-f4fd91b4bcdd" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1529821080" ,
"uuid" : "5b2f3798-01ec-40a6-bc20-424d02de0b81"
}
] ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1529821071" ,
"uuid" : "7ec69509-17fb-4ac7-955c-f4fd91b4bcdd" ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1529821075" ,
"uuid" : "c59716a3-9bf9-4f46-9de2-2a9c8c2a5dac" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "c59716a3-9bf9-4f46-9de2-2a9c8c2a5dac" ,
"referenced_uuid" : "a1a68b9a-e4fc-4510-b173-d6053aaa5dff" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1529821080" ,
"uuid" : "5b2f3798-e4dc-4eb7-8462-468602de0b81"
}
] ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1529821073" ,
"uuid" : "a1a68b9a-e4fc-4510-b173-d6053aaa5dff" ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1529821077" ,
"uuid" : "84296bb9-543b-4a24-8a5f-ae3a78732236" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "84296bb9-543b-4a24-8a5f-ae3a78732236" ,
"referenced_uuid" : "7ef213a8-48cd-4ed4-9025-e4d3bc89f628" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1529821080" ,
"uuid" : "5b2f3798-41d0-4f09-bae0-4e4802de0b81"
}
] ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1529821076" ,
"uuid" : "7ef213a8-48cd-4ed4-9025-e4d3bc89f628" ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1529821080" ,
"uuid" : "284023d6-8a13-480c-83d9-772fac6b2da9" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "284023d6-8a13-480c-83d9-772fac6b2da9" ,
"referenced_uuid" : "37a1e511-2dff-44eb-81ba-31e9e3b687c2" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1529821080" ,
"uuid" : "5b2f3798-9cdc-4fd1-b9e0-4dcf02de0b81"
}
] ,
"Attribute" : [ ]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1529821078" ,
"uuid" : "37a1e511-2dff-44eb-81ba-31e9e3b687c2" ,
"Attribute" : [ ]
}
]
}
}
