adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/621f4e53-cd54-4194-8d8f-4a6e0abe1822.json

650 lines
22 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"Event": {
"analysis": "0",
"date": "2022-03-02",
"extends_uuid": "",
"info": "[ESET] IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine",
"publish_timestamp": "1646300422",
"published": true,
"threat_level_id": "4",
"timestamp": "1664880655",
"uuid": "621f4e53-cd54-4194-8d8f-4a6e0abe1822",
"Orgc": {
"name": "CERT-FR_1510",
"uuid": "56bdf779-46f8-4353-bdf9-2bb95bce2212"
},
"Tag": [
{
"colour": "#ff1f00",
"local": "0",
"name": "fr-classif:non-classifiees=\"NON-CLASSIFIEES\"",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": "0",
"name": "cossi:TLP=\"white\"",
"relationship_type": ""
},
{
"colour": "#008e63",
"local": "0",
"name": "cossi:RechercheSourceOuverte=\"Autorisee\"",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": "0",
"name": "tlp:white",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1646218835",
"to_ids": true,
"type": "comment",
"uuid": "8ff8162a-1965-4bfb-bc15-d49b47d66c4d",
"value": "Marqueurs issus d'un blog post pr\u00e9sentant un maliciel destructeur, IsaacWiper, ainsi qu'un m\u00e9canisme de propagation utilis\u00e9 par HermeticWiper utilisant notamment du WMI et du SMB.",
"Tag": [
{
"colour": "#00ae7a",
"local": "0",
"name": "DescriptionTechnique",
"relationship_type": ""
}
]
}
],
"Object": [
{
"comment": "HermeticWizard",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "15",
"timestamp": "1646218835",
"uuid": "3d6dc0a1-13a0-4271-83e2-8a7f772feb8a",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1646218835",
"to_ids": true,
"type": "sha1",
"uuid": "bf214b29-e720-4658-9ea1-10ffc6ecf7ba",
"value": "3c54c9a49a8ddca02189fe15fea52fe24f41a86f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1646218835",
"to_ids": true,
"type": "filename",
"uuid": "eff74508-bc1f-4d7b-9a67-d43c4afb66e4",
"value": "c9EEAF78C9A12.dat"
}
]
},
{
"comment": "IsaacWiper",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "15",
"timestamp": "1646218835",
"uuid": "e1aa2325-e0e4-46b3-ab9e-970f7e5913c7",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1646218836",
"to_ids": true,
"type": "sha1",
"uuid": "d16c5377-af31-4925-af75-2a2864d7eadc",
"value": "ad602039c6f0237d4a997d5640e92ce5e2b3bba3"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1646218836",
"to_ids": true,
"type": "filename",
"uuid": "2d9cd875-84b1-4aef-86ff-8a7800388390",
"value": "cl64.dll"
}
]
},
{
"comment": "IsaacWiper",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "15",
"timestamp": "1646218836",
"uuid": "4a2b5c85-f132-4cb3-8416-657cfe948d39",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1646218836",
"to_ids": true,
"type": "sha1",
"uuid": "da31c834-8652-4b2a-a605-eb46acc8d980",
"value": "736a4cfad1ed83a6a0b75b0474d5e01a3a36f950"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1646218836",
"to_ids": true,
"type": "filename",
"uuid": "b7a75870-4d7c-4ce2-b4a0-8055cc9070ec",
"value": "cld.dll"
}
]
},
{
"comment": "IsaacWiper",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "15",
"timestamp": "1646218836",
"uuid": "b14c46e5-412f-4630-99b6-4c69e850267d",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1646218836",
"to_ids": true,
"type": "sha1",
"uuid": "ab5ccfbc-94be-429b-81bc-7e72472a3abd",
"value": "e9b96e9b86fad28d950ca428879168e0894d854f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1646218836",
"to_ids": true,
"type": "filename",
"uuid": "eb61c1dc-6966-4538-adc5-5c7d999e62e2",
"value": "clean.exe"
}
]
},
{
"comment": "HermeticRansom",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "15",
"timestamp": "1646218883",
"uuid": "20e73d21-8aed-43e2-b5bb-1fb549206762",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1646218937",
"to_ids": true,
"type": "filename",
"uuid": "50743f35-c60e-4ff2-b6d7-9d8401f1c3e0",
"value": "cc2.exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1646218884",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "3b12b2b7-74c6-430f-9e26-88eee1bab178",
"value": "3295232"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1646218884",
"to_ids": false,
"type": "float",
"uuid": "2305d8d6-d8fb-4b95-89b8-36e15271f952",
"value": "5.9679556846481"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1646218884",
"to_ids": true,
"type": "md5",
"uuid": "42b6f944-fd1c-428c-bc34-ad11d8a11621",
"value": "d5d2c4ac6c724cd63b69ca054713e278"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1646218884",
"to_ids": true,
"type": "sha1",
"uuid": "b1eb340c-4a14-458b-b4e8-ec02a6fcee53",
"value": "f32d791ec9e6385a91b45942c230f52aff1626df"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1646218884",
"to_ids": true,
"type": "sha256",
"uuid": "4ca9b4f9-995b-433a-80c9-fe6e28b3bf99",
"value": "4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1646218884",
"to_ids": true,
"type": "sha512",
"uuid": "0fa5805b-e6a0-48a5-be4a-a3d6f8ac7397",
"value": "9c2e86ff9da4e8b8e7caa62cd298f5725a459151dc655845fe614bf33639ed975850b3e9ae204d8a9d145a86214c35a486c06787a7ad8a88a85d121d3ee50c91"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1646218884",
"to_ids": false,
"type": "mime-type",
"uuid": "82390b03-78ef-47fb-9143-d098c2604f98",
"value": "PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows"
}
]
},
{
"comment": "HermeticWiper",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "15",
"timestamp": "1646218885",
"uuid": "e0bfa427-7b38-41bb-ae0a-80e4825e1f0e",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1646218945",
"to_ids": true,
"type": "filename",
"uuid": "08738c9f-c9c7-469e-8284-e52b97187ede",
"value": "conhosts.exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1646218885",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "96909c29-eccb-4dfc-85f0-d20552fb7102",
"value": "117000"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1646218885",
"to_ids": false,
"type": "float",
"uuid": "2de25a3e-492f-479d-a25a-a5f03a6458a9",
"value": "6.3853905802374"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1646218885",
"to_ids": true,
"type": "md5",
"uuid": "a15cc3f6-3950-43ab-ad74-ee43ff4e02e5",
"value": "3f4a16b29f2f0532b7ce3e7656799125"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1646218885",
"to_ids": true,
"type": "sha1",
"uuid": "fe83632b-d138-45d8-820b-27283d887fa9",
"value": "61b25d11392172e587d8da3045812a66c3385451"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1646218885",
"to_ids": true,
"type": "sha256",
"uuid": "567d67ab-aa98-47f1-8c6f-379b4540f3db",
"value": "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1646218885",
"to_ids": true,
"type": "sha512",
"uuid": "5aeda0d8-83ca-4ad2-a6d6-d5997d6c2b5b",
"value": "32acaceda42128ef9e0a9f36ee2678d2fc296fda2df38629eb223939c8a9352b3bb2b7021bb84e9f223a4a26df57b528a711447b1451213a013fe00f9b971d80"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1646218885",
"to_ids": false,
"type": "mime-type",
"uuid": "3d8f6a4f-69c7-4f0d-8105-ba6e46ee8d26",
"value": "PE32 executable (GUI) Intel 80386, for MS Windows"
}
]
},
{
"comment": "HermeticWiper",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "15",
"timestamp": "1646218886",
"uuid": "710d4708-ecbb-4073-a348-9a1824802410",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1646218954",
"to_ids": true,
"type": "filename",
"uuid": "c75fb0c7-8c9a-4db1-a4da-c368152fc84a",
"value": "com.exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1646218886",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "2f785669-b877-485d-b6bd-154b8794ee7f",
"value": "117000"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1646218886",
"to_ids": false,
"type": "float",
"uuid": "7d4d4d09-4d93-4e6a-9cb1-eb67d6f87426",
"value": "6.3817850700557"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1646218886",
"to_ids": true,
"type": "md5",
"uuid": "c1cca7db-ac97-443d-a327-463e895589ca",
"value": "84ba0197920fd3e2b7dfa719fee09d2f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1646218886",
"to_ids": true,
"type": "sha1",
"uuid": "2b33d285-5b76-4a80-96f0-8d7f7dfaef5f",
"value": "912342f1c840a42f6b74132f8a7c4ffe7d40fb77"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1646218886",
"to_ids": true,
"type": "sha256",
"uuid": "5d1c54ff-f680-481c-9dc7-d299743743e5",
"value": "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1646218886",
"to_ids": true,
"type": "sha512",
"uuid": "72d5872f-399b-44fd-a158-c2b2bf694ad8",
"value": "bbd4f0263abc71311404c55cb3e4711b707a71e28dcc1f08abd533a4c7f151db9cc40697105d76f1c978000e8fa7aa219adb65b31fb196b08f1ae003e04b9d23"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1646218886",
"to_ids": false,
"type": "mime-type",
"uuid": "26ef0810-4b94-427b-961f-b7bfd599861c",
"value": "PE32 executable (GUI) Intel 80386, for MS Windows"
}
]
},
{
"comment": "Legitimate RemCom remote access tool",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "15",
"timestamp": "1646218888",
"uuid": "d26acfcb-6054-44d8-a31d-17e9551336b9",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1646218962",
"to_ids": true,
"type": "filename",
"uuid": "a433d4ab-0a79-46ae-a103-8db64b298bfb",
"value": "XqoYMlBX.exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1646218888",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "e70005b0-4b1f-47da-a3ab-37b54463e26e",
"value": "56320"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1646218888",
"to_ids": false,
"type": "float",
"uuid": "0e3aff89-906b-4529-9fe3-c549b6e22098",
"value": "6.2650543077112"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1646218888",
"to_ids": true,
"type": "md5",
"uuid": "1f2fba04-ba42-4353-b288-02ef713162c9",
"value": "6983f7001de10f4d19fc2d794c3eb534"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1646218888",
"to_ids": true,
"type": "sha1",
"uuid": "8119aebc-3e6b-4f5f-96b8-7c99ff58649b",
"value": "23873bf2670cf64c2440058130548d4e4da412dd"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1646218888",
"to_ids": true,
"type": "sha256",
"uuid": "f8f2570d-ee10-4ad9-887d-3464f8a23670",
"value": "3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1646218888",
"to_ids": true,
"type": "sha512",
"uuid": "6c3f15ff-b4ff-423d-8d78-abf4cf5c2069",
"value": "0b04be07d5b3a6b9526a4ae8050861d260bd5334b5320a6d7e6d0f7016199c98d82e5e520fe489e13b0db5146579037c24a22ae6674e9e7b6749b9bf90ad02aa"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1646218888",
"to_ids": false,
"type": "mime-type",
"uuid": "e0a40612-bc54-4c73-a950-e1200bbf87a5",
"value": "PE32 executable (console) Intel 80386, for MS Windows"
}
]
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
chg: [gen] updated
2023-12-14 14:30:15 +00:00
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
}
Reference in a new issue Copy permalink