859 lines
37 KiB
JSON
859 lines
37 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--584fabab-b03c-404c-8ff8-4433950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:32.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:32.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--584fabab-b03c-404c-8ff8-4433950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:32.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:32.000Z",
|
||
|
|
"name": "OSINT - Windows 10: protection, detection, and response against recent Depriz malware attacks",
|
||
|
|
"published": "2016-12-13T08:16:11Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--584fabb7-4028-4bf3-b6b1-4963950d210f",
|
||
|
|
"url--584fabb7-4028-4bf3-b6b1-4963950d210f",
|
||
|
|
"x-misp-attribute--584fabcb-d218-44f6-ab11-40ab950d210f",
|
||
|
|
"indicator--584fabe5-1424-464d-9330-46ef950d210f",
|
||
|
|
"indicator--584fabe6-f5a8-4ecf-b0a1-4bd5950d210f",
|
||
|
|
"indicator--584fabe6-5698-4cb8-93e8-4920950d210f",
|
||
|
|
"indicator--584fabe6-3374-42f0-9f85-4b16950d210f",
|
||
|
|
"indicator--584fabe6-1e18-4ab7-bea7-42b7950d210f",
|
||
|
|
"indicator--584fac16-f83c-400f-9397-41dc950d210f",
|
||
|
|
"indicator--584fac16-42c0-4af5-8c8d-4910950d210f",
|
||
|
|
"x-misp-attribute--584fac33-c3c0-414a-92fb-464a950d210f",
|
||
|
|
"x-misp-attribute--584fac33-7be4-4f0b-b5ec-4a30950d210f",
|
||
|
|
"x-misp-attribute--584fac33-da00-4a71-92d7-4a09950d210f",
|
||
|
|
"x-misp-attribute--584fac33-885c-41cd-84f8-4eee950d210f",
|
||
|
|
"indicator--584fac80-e698-4685-8173-48f702de0b81",
|
||
|
|
"indicator--584fac80-fa70-4953-a8a3-46f802de0b81",
|
||
|
|
"observed-data--584fac81-86d8-44f1-be73-459502de0b81",
|
||
|
|
"url--584fac81-86d8-44f1-be73-459502de0b81",
|
||
|
|
"indicator--584fac81-38f0-460c-84b9-48d502de0b81",
|
||
|
|
"indicator--584fac81-8a88-4819-8385-454302de0b81",
|
||
|
|
"observed-data--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
|
||
|
|
"url--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
|
||
|
|
"indicator--584fac82-d864-4f8b-a64e-46ff02de0b81",
|
||
|
|
"indicator--584fac82-2588-445b-a0d1-4d1502de0b81",
|
||
|
|
"observed-data--584fac82-d674-48f2-ba3a-40d902de0b81",
|
||
|
|
"url--584fac82-d674-48f2-ba3a-40d902de0b81",
|
||
|
|
"indicator--584fac82-0bb4-4614-a42a-445b02de0b81",
|
||
|
|
"indicator--584fac83-0cd0-4fb9-979e-4e7502de0b81",
|
||
|
|
"observed-data--584fac83-e384-44ab-8511-432d02de0b81",
|
||
|
|
"url--584fac83-e384-44ab-8511-432d02de0b81",
|
||
|
|
"indicator--584fac83-5ef8-402e-ba66-4e0d02de0b81",
|
||
|
|
"indicator--584fac83-3544-4270-9883-4ea502de0b81",
|
||
|
|
"observed-data--584fac84-3308-4c86-b2e5-40e602de0b81",
|
||
|
|
"url--584fac84-3308-4c86-b2e5-40e602de0b81",
|
||
|
|
"indicator--584fac84-4a9c-442c-8fe1-4b8402de0b81",
|
||
|
|
"indicator--584fac84-4b0c-4ffc-8888-4a8a02de0b81",
|
||
|
|
"observed-data--584fac84-032c-4ca0-924d-450602de0b81",
|
||
|
|
"url--584fac84-032c-4ca0-924d-450602de0b81",
|
||
|
|
"indicator--584fac85-ad2c-42d1-890e-4f6202de0b81",
|
||
|
|
"indicator--584fac85-01f4-4220-887d-438f02de0b81",
|
||
|
|
"observed-data--584fac85-5e84-4d1b-b431-4f6902de0b81",
|
||
|
|
"url--584fac85-5e84-4d1b-b431-4f6902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"misp-galaxy:threat-actor=\"TERBIUM\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--584fabb7-4028-4bf3-b6b1-4963950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:05:11.000Z",
|
||
|
|
"modified": "2016-12-13T08:05:11.000Z",
|
||
|
|
"first_observed": "2016-12-13T08:05:11Z",
|
||
|
|
"last_observed": "2016-12-13T08:05:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--584fabb7-4028-4bf3-b6b1-4963950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--584fabb7-4028-4bf3-b6b1-4963950d210f",
|
||
|
|
"value": "https://blogs.technet.microsoft.com/mmpc/2016/12/09/windows-10-protection-detection-and-response-against-recent-attacks/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--584fabcb-d218-44f6-ab11-40ab950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:05:31.000Z",
|
||
|
|
"modified": "2016-12-13T08:05:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "A few weeks ago, multiple organizations in the Middle East fell victim to targeted and destructive attacks that wiped data from computers, and in many cases rendering them unstable and unbootable. Destructive attacks like these have been observed repeatedly over the years and the Windows Defender and Windows Defender Advanced Threat Protection Threat Intelligence teams are working on protection, detection, and response to these threats.\r\n\r\nMicrosoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fabe5-1424-464d-9330-46ef950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:05:57.000Z",
|
||
|
|
"modified": "2016-12-13T08:05:57.000Z",
|
||
|
|
"description": "malicious files",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5c52253b0a2741c4c2e3f1f9a2f82114a254c8d6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:05:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fabe6-f5a8-4ecf-b0a1-4bd5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:05:58.000Z",
|
||
|
|
"modified": "2016-12-13T08:05:58.000Z",
|
||
|
|
"description": "malicious files",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e7c7f41babdb279c099526ece03ede9076edca4e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:05:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fabe6-5698-4cb8-93e8-4920950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:05:58.000Z",
|
||
|
|
"modified": "2016-12-13T08:05:58.000Z",
|
||
|
|
"description": "malicious files",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a2669df6f7615d317f610f731b6a2129fbed4203']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:05:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fabe6-3374-42f0-9f85-4b16950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:05:58.000Z",
|
||
|
|
"modified": "2016-12-13T08:05:58.000Z",
|
||
|
|
"description": "malicious files",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '425f02028dcc4e89a07d2892fef9346dac6c140a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:05:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fabe6-1e18-4ab7-bea7-42b7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:05:58.000Z",
|
||
|
|
"modified": "2016-12-13T08:05:58.000Z",
|
||
|
|
"description": "malicious files",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ad6744c7ea5fee854261efa403ca06b68761e290']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:05:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac16-f83c-400f-9397-41dc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:06:46.000Z",
|
||
|
|
"modified": "2016-12-13T08:06:46.000Z",
|
||
|
|
"description": "legitimate RawDisk drivers",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1292c7dd60214d96a71e7705e519006b9de7968f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:06:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac16-42c0-4af5-8c8d-4910950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:06:46.000Z",
|
||
|
|
"modified": "2016-12-13T08:06:46.000Z",
|
||
|
|
"description": "legitimate RawDisk drivers",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ce549714a11bd43b52be709581c6e144957136ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:06:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--584fac33-c3c0-414a-92fb-464a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:07:15.000Z",
|
||
|
|
"modified": "2016-12-13T08:07:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Trojan:Win32/Depriz.A!dha"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--584fac33-7be4-4f0b-b5ec-4a30950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:07:15.000Z",
|
||
|
|
"modified": "2016-12-13T08:07:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Trojan:Win32/Depriz.B!dha"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--584fac33-da00-4a71-92d7-4a09950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:07:15.000Z",
|
||
|
|
"modified": "2016-12-13T08:07:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Trojan:Win32/Depriz.C!dha"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--584fac33-885c-41cd-84f8-4eee950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:07:15.000Z",
|
||
|
|
"modified": "2016-12-13T08:07:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Trojan:Win32/Depriz.D!dha"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac80-e698-4685-8173-48f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:32.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:32.000Z",
|
||
|
|
"description": "legitimate RawDisk drivers - Xchecked via VT: ce549714a11bd43b52be709581c6e144957136ec",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac80-fa70-4953-a8a3-46f802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:32.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:32.000Z",
|
||
|
|
"description": "legitimate RawDisk drivers - Xchecked via VT: ce549714a11bd43b52be709581c6e144957136ec",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1493d342e7a36553c56b2adea150949e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--584fac81-86d8-44f1-be73-459502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:33.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:33.000Z",
|
||
|
|
"first_observed": "2016-12-13T08:08:33Z",
|
||
|
|
"last_observed": "2016-12-13T08:08:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--584fac81-86d8-44f1-be73-459502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--584fac81-86d8-44f1-be73-459502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6/analysis/1481093448/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac81-38f0-460c-84b9-48d502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:33.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:33.000Z",
|
||
|
|
"description": "legitimate RawDisk drivers - Xchecked via VT: 1292c7dd60214d96a71e7705e519006b9de7968f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac81-8a88-4819-8385-454302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:33.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:33.000Z",
|
||
|
|
"description": "legitimate RawDisk drivers - Xchecked via VT: 1292c7dd60214d96a71e7705e519006b9de7968f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '76c643ab29d497317085e5db8c799960']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:33.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:33.000Z",
|
||
|
|
"first_observed": "2016-12-13T08:08:33Z",
|
||
|
|
"last_observed": "2016-12-13T08:08:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--584fac81-05fc-42e5-ba7d-4dbd02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a/analysis/1480997926/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac82-d864-4f8b-a64e-46ff02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:34.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:34.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: ad6744c7ea5fee854261efa403ca06b68761e290",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac82-2588-445b-a0d1-4d1502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:34.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:34.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: ad6744c7ea5fee854261efa403ca06b68761e290",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2cd0a5f1e9bcce6807e57ec8477d222a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--584fac82-d674-48f2-ba3a-40d902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:34.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:34.000Z",
|
||
|
|
"first_observed": "2016-12-13T08:08:34Z",
|
||
|
|
"last_observed": "2016-12-13T08:08:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--584fac82-d674-48f2-ba3a-40d902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--584fac82-d674-48f2-ba3a-40d902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd/analysis/1481237179/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac82-0bb4-4614-a42a-445b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:34.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:34.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: 425f02028dcc4e89a07d2892fef9346dac6c140a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac83-0cd0-4fb9-979e-4e7502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:35.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:35.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: 425f02028dcc4e89a07d2892fef9346dac6c140a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c843046e54b755ec63ccb09d0a689674']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--584fac83-e384-44ab-8511-432d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:35.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:35.000Z",
|
||
|
|
"first_observed": "2016-12-13T08:08:35Z",
|
||
|
|
"last_observed": "2016-12-13T08:08:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--584fac83-e384-44ab-8511-432d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--584fac83-e384-44ab-8511-432d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a/analysis/1480864286/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac83-5ef8-402e-ba66-4e0d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:35.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:35.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: a2669df6f7615d317f610f731b6a2129fbed4203",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '448ad1bc06ea26f4709159f72ed70ca199ff2176182619afa03435d38cd53237']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac83-3544-4270-9883-4ea502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:35.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:35.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: a2669df6f7615d317f610f731b6a2129fbed4203",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5289f4b806bbd7893fbda3ce4025683e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--584fac84-3308-4c86-b2e5-40e602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:36.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:36.000Z",
|
||
|
|
"first_observed": "2016-12-13T08:08:36Z",
|
||
|
|
"last_observed": "2016-12-13T08:08:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--584fac84-3308-4c86-b2e5-40e602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--584fac84-3308-4c86-b2e5-40e602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/448ad1bc06ea26f4709159f72ed70ca199ff2176182619afa03435d38cd53237/analysis/1481042001/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac84-4a9c-442c-8fe1-4b8402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:36.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:36.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: e7c7f41babdb279c099526ece03ede9076edca4e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac84-4b0c-4ffc-8888-4a8a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:36.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:36.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: e7c7f41babdb279c099526ece03ede9076edca4e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5446f46d89124462ae7aca4fce420423']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--584fac84-032c-4ca0-924d-450602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:36.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:36.000Z",
|
||
|
|
"first_observed": "2016-12-13T08:08:36Z",
|
||
|
|
"last_observed": "2016-12-13T08:08:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--584fac84-032c-4ca0-924d-450602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--584fac84-032c-4ca0-924d-450602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b/analysis/1481303798/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac85-ad2c-42d1-890e-4f6202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:37.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:37.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: 5c52253b0a2741c4c2e3f1f9a2f82114a254c8d6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--584fac85-01f4-4220-887d-438f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:37.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:37.000Z",
|
||
|
|
"description": "malicious files - Xchecked via VT: 5c52253b0a2741c4c2e3f1f9a2f82114a254c8d6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8fbe990c2d493f58a2afa2b746e49c86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-12-13T08:08:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--584fac85-5e84-4d1b-b431-4f6902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-12-13T08:08:37.000Z",
|
||
|
|
"modified": "2016-12-13T08:08:37.000Z",
|
||
|
|
"first_observed": "2016-12-13T08:08:37Z",
|
||
|
|
"last_observed": "2016-12-13T08:08:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--584fac85-5e84-4d1b-b431-4f6902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--584fac85-5e84-4d1b-b431-4f6902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34/analysis/1481303775/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|