{ "Event": { "analysis": "2", "date": "2015-04-07", "extends_uuid": "", "info": "OSINT Winnti OpSMN new malware RE report by Novetta", "publish_timestamp": "1456150066", "published": true, "threat_level_id": "2", "timestamp": "1429714640", "uuid": "5523e803-a6ac-4679-95ee-4382950d210b", "Orgc": { "name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416584", "to_ids": false, "type": "link", "uuid": "5523e848-294c-4d2b-b8af-7076950d210b", "value": "http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416584", "to_ids": false, "type": "link", "uuid": "5523e848-284c-45e6-b5da-7076950d210b", "value": "http://www.novetta.com/wp-content/uploads/2015/04/nov_winnti_yara.txt" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416584", "to_ids": false, "type": "link", "uuid": "5523e848-f4b0-404e-bc03-7076950d210b", "value": "http://www.novetta.com/wp-content/uploads/2015/04/vt-winnti.txt" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416584", "to_ids": false, "type": "link", "uuid": "5523e848-6a14-4a94-b13f-7076950d210b", "value": "http://www.novetta.com/2015/04/operation-smn-winnti-update/" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416610", "to_ids": true, "type": "sha256", "uuid": "5523e862-3618-48db-b29f-448e950d210b", "value": "0798740771dc8f40a5a45a2f58aeab479e2ead6682d67b24fafc46a7ab40c128" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416610", "to_ids": true, "type": "sha256", "uuid": "5523e862-bf64-40eb-aaf0-48c2950d210b", "value": "0e21bf36ce80687d69caf537ea2a77cd8ef3210fb845256f56b5096efb0f7177" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416610", "to_ids": true, "type": "sha256", "uuid": "5523e862-095c-4ae2-b57c-4924950d210b", "value": "0e258047b5883e8e8841f8649352478bf1ad4362c53b8be082cf701380694fc5" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416610", "to_ids": true, "type": "sha256", "uuid": "5523e862-5adc-4d33-934a-4196950d210b", "value": "0e3d6da65139e01a8f9be0ee63b4510123fc9f644100b00535f7f3b1611ab2ce" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416610", "to_ids": true, "type": "sha256", "uuid": "5523e862-7d20-4493-b1df-43b4950d210b", "value": "1616adcdb750330cdad6223d26311244ce21080fce5ff03203261302d1031249" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416610", "to_ids": true, "type": "sha256", "uuid": "5523e862-1018-4bf6-812b-47ef950d210b", "value": "18c42f98affc8f053d0a20e9bc85786f1cc8c33bd5f7c0080687b5aa8c97f1d7" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416610", "to_ids": true, "type": "sha256", "uuid": "5523e862-a060-4d4b-8323-4011950d210b", "value": "18df4e50d2db8e352755bab86e2aa04ce9dcf2a83bf3e03135abae00ab3d16c2" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416610", "to_ids": true, "type": "sha256", "uuid": "5523e862-9580-48a5-9a73-445b950d210b", "value": "1b0cd7bbd5188798f0bbcebb06afb54f6455a680b061bf32fa43d28e829837b0" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416611", "to_ids": true, "type": "sha256", "uuid": "5523e863-1b58-4e38-95ef-421a950d210b", "value": "21cbd6ba2f1787ebdeac8e6098a94e0e3f8d760bf7277f0e30229d9362cd7689" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416611", "to_ids": true, "type": "sha256", "uuid": "5523e863-2098-4dcc-9287-49f4950d210b", "value": "246feb48f0a8e11b1c0d6cfb1a6fcbcb3b1b6014dc825367e67976cc31d29c37" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416611", "to_ids": true, "type": "sha256", "uuid": "5523e863-3398-43da-80c6-40ea950d210b", "value": "2491fcac659f72cf9f0247e6444f1024e3f93b8684d9129fee61b7fe27ae4848" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416611", "to_ids": true, "type": "sha256", "uuid": "5523e863-7f50-4b32-aa2d-411c950d210b", "value": "288e9ac646b5c42666717326943fcfe90d206a2b29b6bcd46dd0b4a5db683689" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416611", "to_ids": true, "type": "sha256", "uuid": "5523e863-8214-4cec-90dd-45ed950d210b", "value": "29c43ec1a4c4fc823028ee0e5b4ce9e6e5e1217766ee430f663538a60ccf13d4" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416611", "to_ids": true, "type": "sha256", "uuid": "5523e863-fdb8-4550-8855-4a91950d210b", "value": "2c3032b2b19b19369a37c7d60cd850c4208ec042ef32c9870b701f333734ae56" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416611", "to_ids": true, "type": "sha256", "uuid": "5523e863-3430-4b6b-82ea-45b2950d210b", "value": "2e90ec6594eb5fda2cfb6d46b91e13e9ee3f8941de31b57f366dbe254ee9fc32" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416611", "to_ids": true, "type": "sha256", "uuid": "5523e863-bd70-4f8b-b83d-444e950d210b", "value": "2fa4b025c74dec27d2640d441db27601e6d1c7717db90b7e9915f6ef5db92fa3" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e864-31cc-42f6-9e2a-4644950d210b", "value": "2fde6617eaca9e178bd4de52fd55d4bcf211632c004703f31efbd541b3d16319" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e864-c350-46e4-b12c-4d74950d210b", "value": "3087f00b5ef2941ebf3005e9ed46c134a601c629d8dd26e83b25b3e3a4106f77" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e864-2c88-4d16-946c-4e4f950d210b", "value": "316f052a09f1f121cfe70491697048db32612c4a2c4f007748fda9a2b0e56c20" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e864-63ec-46e7-b6d7-4b6c950d210b", "value": "33f8cfb672ab39e7ef1986848b293ade35e08480a8f7d2cbe96195357fb39cfb" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e864-3774-4eec-b4fa-47d0950d210b", "value": "35541d4f586a97d5f4cd0c43436df0cee2944a1a650dd7b9d3f14a63e7f20c8a" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e864-87ac-45c4-879e-4886950d210b", "value": "4466f22fd87e4d7fc875c7e073131cf81635fac48ba0fa7bbcf37f8a2dd0563e" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e864-f500-49ae-8abe-425d950d210b", "value": "47053e77580ef64ca39058f72986c6ff46a81c092027e240916c8bdb42cdfcb6" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e864-9000-4bf9-8771-4ab4950d210b", "value": "4a4e729b5a2212bdcba4314594cbdf8fcbec7146bb1f47b3c99ad6d183bceb38" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e864-b74c-47eb-8dee-4a15950d210b", "value": "4a7e8d72dbaf30ebe2328771381912df9387deea6e240f3ad046ba1154250680" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416612", "to_ids": true, "type": "sha256", "uuid": "5523e865-dca4-49b5-b96e-42b5950d210b", "value": "52ce11b571aacf298c10d6dce47a60c199f6f58a76b901583bde65d86886cf1f" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416613", "to_ids": true, "type": "sha256", "uuid": "5523e865-18f0-4e2a-af25-4a5d950d210b", "value": "5f41b896d76c04677ac400262aae06727771d408b598e870827c2c8f4aac061c" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416613", "to_ids": true, "type": "sha256", "uuid": "5523e865-726c-4594-84e6-41f8950d210b", "value": "62bd0c6eca0c4d562de0d83bbc7ce63fe9bfb3ac149e9a449dd44e2e3165c9dc" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416613", "to_ids": true, "type": "sha256", "uuid": "5523e865-52e0-4bea-9a56-4423950d210b", "value": "6aa66eef38c6fcc2d9ab8034723acdaf2af0195749ff713dddaf414d2caea45f" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416613", "to_ids": true, "type": "sha256", "uuid": "5523e865-8fc4-4970-bb7b-4864950d210b", "value": "6c8347ec0c0a26a8942342e4031cf823332a8637d9a4e7f31bad725edc04a395" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416613", "to_ids": true, "type": "sha256", "uuid": "5523e865-db08-4966-bf61-428b950d210b", "value": "7339fe6a7799ab8369d0dbafed9d7f3b6c81d164b00ec5d3a17d6c69ea52b141" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416613", "to_ids": true, "type": "sha256", "uuid": "5523e865-ad78-4ba1-9e61-45f7950d210b", "value": "7a0fdc652e0ce4d84e9a6fd89343e6d71756c0a8f537276d3aed7388264ddb16" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416613", "to_ids": true, "type": "sha256", "uuid": "5523e865-c518-4a84-8de2-46d1950d210b", "value": "7c09b14a34114e5b6861530ac19ab1aaadf9e8c9a7fbbde96542c21175b094e0" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416613", "to_ids": true, "type": "sha256", "uuid": "5523e865-f2d8-4057-abae-4e2c950d210b", "value": "7c754b0bec42a85f78393082b011e07fb0e964437c0c5c690ccf51d5508ab8b6" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416613", "to_ids": true, "type": "sha256", "uuid": "5523e865-5ac0-4af6-a018-4ef3950d210b", "value": "7d8da529d439e31b917661ae7421ee99b132e995cc78156fdd6e1f7df43ac07c" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416614", "to_ids": true, "type": "sha256", "uuid": "5523e866-ee30-4407-994c-4438950d210b", "value": "823e09d204e3c4d57abcbb23c1db50b0db3d8d4eecde72b0ffefa2f0b6abe904" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416614", "to_ids": true, "type": "sha256", "uuid": "5523e866-9724-4483-9014-4e6e950d210b", "value": "87e4096e3989ae5f047d1ede355e5e95b2eb4ce2fc8fb42a7d8a39f3224d41ab" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416614", "to_ids": true, "type": "sha256", "uuid": "5523e866-ecc8-4499-a19f-45b2950d210b", "value": "890137121b159b0de4b287627a8710605327f8aa0b2e657362b05b793881d87e" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416614", "to_ids": true, "type": "sha256", "uuid": "5523e866-ed94-46a4-9a8b-4c56950d210b", "value": "8ac94fb63d023242e62d08ef7552beed720845266ea884c8d992d2533b81cf12" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416614", "to_ids": true, "type": "sha256", "uuid": "5523e866-2bec-4c82-94e0-4bd3950d210b", "value": "8dcae5e7f13d190ff492687ddca33342450fdef868fbfa92d2ac7b32ffbf7365" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416614", "to_ids": true, "type": "sha256", "uuid": "5523e866-bd20-418c-b82b-4969950d210b", "value": "8f9e875825f498cee1ef74c57829cd367a8b3089fe4e8918449711fa3af0f984" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416614", "to_ids": true, "type": "sha256", "uuid": "5523e866-d278-4cd7-aed3-418b950d210b", "value": "90745e366f46b1065c56a1a3e262e9e1f0f26baf05b6d29e4758dabdc2570d76" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416614", "to_ids": true, "type": "sha256", "uuid": "5523e866-bd44-44ad-8daf-4580950d210b", "value": "92f960ddcfa6ed39289e28f03bb36cd2b6b513f3c3c21ef31ee5f9a8238a8a01" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416615", "to_ids": true, "type": "sha256", "uuid": "5523e867-1368-48ae-bf62-4fa6950d210b", "value": "959630cb90c5e3810a8a02c771f37b46388204d2d99a436463cd87411f961ba0" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416615", "to_ids": true, "type": "sha256", "uuid": "5523e867-ecbc-4e36-91d3-4125950d210b", "value": "970415694f5b1952a45b7c3c776292877738e32b42b23d97e1b5361e0eaf97de" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416615", "to_ids": true, "type": "sha256", "uuid": "5523e867-b2fc-4536-a4c5-4ca8950d210b", "value": "9df413b0da7355bbb203c294ed64c06ec68ab4a00221c8e9a0e635a40a08576d" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416615", "to_ids": true, "type": "sha256", "uuid": "5523e867-3054-4cd3-9eaa-4ff1950d210b", "value": "a679d46a8ce8da6135b0dec9b2632ae41d01629a17f3183f9bcb76debfcecba5" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416615", "to_ids": true, "type": "sha256", "uuid": "5523e867-ecb4-4d12-a7d8-43e8950d210b", "value": "a8f50d0f0c41e83dc3697b6668013e8cff990e5b98b99170c24c57281ff43e09" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416615", "to_ids": true, "type": "sha256", "uuid": "5523e867-1718-41a1-98b9-40cd950d210b", "value": "aa17bce6d8c469ce22ba29f79d2754db5d44096862d7a13be9324121c04a5343" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416615", "to_ids": true, "type": "sha256", "uuid": "5523e867-f9f0-4783-921f-4a6c950d210b", "value": "ad1e7e12607ccdda70197a9cc0fc3df7fb74db540d1a1764da9da7347cbd73e3" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416615", "to_ids": true, "type": "sha256", "uuid": "5523e867-5694-4cc0-b230-4081950d210b", "value": "b21a5ac48502ff75057f9773bf31abd970ef6c75a2c0ea1c871dd4e81ec5a994" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416615", "to_ids": true, "type": "sha256", "uuid": "5523e867-ac38-4bc0-8999-48b5950d210b", "value": "b63407714c73d022b748411df888ccabcca082cf87bc32d53c6a9cfd55f46bda" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416616", "to_ids": true, "type": "sha256", "uuid": "5523e868-bf1c-4d4f-866f-4ebf950d210b", "value": "b9140df8a58f02469f9f5789e1a39e476381855820730c997580f3a49fff1148" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416616", "to_ids": true, "type": "sha256", "uuid": "5523e868-54b0-46df-b5c3-4a6e950d210b", "value": "bdb451dd67a1101f8437a2f4231abac37d8bcc4b7c7b85bc74ace83e31aaa156" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416616", "to_ids": true, "type": "sha256", "uuid": "5523e868-05d8-437d-b16a-4062950d210b", "value": "bf1ac8ab322891defe755552c198891ff28fb2fa57fd36a8b1b5a6b649fbc027" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416616", "to_ids": true, "type": "sha256", "uuid": "5523e868-8500-4bd7-80ae-426e950d210b", "value": "c46bfed74f17b114664adb658c7a10389eceb3c35edbaa472197d32b66bea7ad" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416616", "to_ids": true, "type": "sha256", "uuid": "5523e868-543c-4096-a75f-4075950d210b", "value": "c6791c74cf345c38ff10f04d36c11ad2953eb39bbc95df837dd4bf77176d6322" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416616", "to_ids": true, "type": "sha256", "uuid": "5523e868-8bcc-4b55-8d3c-4793950d210b", "value": "ca0acc09b6b17271bcda7f67eaf9b9a8d8227408e7fd6b0def0f99e501bc179a" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416616", "to_ids": true, "type": "sha256", "uuid": "5523e868-7844-4bbe-8ea7-4136950d210b", "value": "ca6540211b309620c38db716b29d282492c4842d5d6e167ecc3b0707431c491f" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416616", "to_ids": true, "type": "sha256", "uuid": "5523e868-efe8-4bcb-afa9-445b950d210b", "value": "cf15e587ef51527660947510b53f2a7b28da4b5ea02e39ff24c04e7156210612" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416616", "to_ids": true, "type": "sha256", "uuid": "5523e868-3efc-478f-aba5-41cd950d210b", "value": "d11884d05b679e494d8d997784e2d11648946b66d2f04daf3813e57fd1a156fc" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416617", "to_ids": true, "type": "sha256", "uuid": "5523e869-61f4-495e-bc12-483f950d210b", "value": "d173811a545ba495934cb293460bc86b0c6681c2cd98de52b6b10c63e4d3abb3" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416617", "to_ids": true, "type": "sha256", "uuid": "5523e869-29a4-42fa-8e2f-4821950d210b", "value": "d1e1a66afb0e33d865776758abb5869fae5b3deab58e6a9f996253bdaf02a91f" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416617", "to_ids": true, "type": "sha256", "uuid": "5523e869-6efc-477a-ba5b-4b35950d210b", "value": "d6011662c2d1a18c50b02dc6ec5d9650c34bd67083038a9d56d9e0c98b100730" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416617", "to_ids": true, "type": "sha256", "uuid": "5523e869-d24c-4418-918f-4606950d210b", "value": "d72b78c634d9e1c24c90da7badb54a1243573c49dffe43ddb6a14db586b2aaf8" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416617", "to_ids": true, "type": "sha256", "uuid": "5523e869-fe44-4606-8ed5-43ad950d210b", "value": "d929406819df0faaf297e2b2e4253724a9f6fafaafa239c4b90db5ab6e58bd83" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416617", "to_ids": true, "type": "sha256", "uuid": "5523e869-80e0-4ca9-ad99-4e7b950d210b", "value": "da198b32b61d0a5765d2961b1f4a20592a90bd919835bd5cf1f64329ef388a61" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416617", "to_ids": true, "type": "sha256", "uuid": "5523e869-25c0-4fb8-8696-4a7c950d210b", "value": "ddccba1aa87ec9d12a896bed96d2d16465b4b63baefd4580828372971881be00" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416617", "to_ids": true, "type": "sha256", "uuid": "5523e869-27e8-449b-8ea8-4e56950d210b", "value": "dec864735d2017b52accdd5285d24131ee556f9266156c62a83cde0ae8dbd095" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416617", "to_ids": true, "type": "sha256", "uuid": "5523e869-7364-47a7-8cfa-42ca950d210b", "value": "df6e40fb0bea1d00c86e0bca493d05a9318ba8e27b015bcadb2fc1d82fa8af04" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416618", "to_ids": true, "type": "sha256", "uuid": "5523e86a-7104-4c7f-abe7-466b950d210b", "value": "e13c06fa97a3f502edc3aee62b0f6aee174d5ced7a5d0a4dffc7323a9c993347" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416618", "to_ids": true, "type": "sha256", "uuid": "5523e86a-8404-497e-80d1-49a1950d210b", "value": "e82f0bfa09fa9d855a73ae82ca56566c5b59074fa2ad4aad1f6870d5331eede8" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416618", "to_ids": true, "type": "sha256", "uuid": "5523e86a-4c4c-4fcf-9077-43bf950d210b", "value": "e9bfcfe6d1bbfabca1d8c0896b1bcf452000bed161c1eba95bbae2256993f3ab" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416618", "to_ids": true, "type": "sha256", "uuid": "5523e86a-fdc8-433c-8766-48b9950d210b", "value": "eb8d20f3241a702409ef153b9f71c3af4e4f4557371265b86f4edd075c36cb91" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416618", "to_ids": true, "type": "sha256", "uuid": "5523e86a-6c9c-41ce-8a89-4e59950d210b", "value": "ec198eb746eb1d87315e4ce2cb0d960246da4824f4925d340201288947537bfa" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416618", "to_ids": true, "type": "sha256", "uuid": "5523e86a-3880-40cf-b0b4-4330950d210b", "value": "f1c61fd84e925eb42d681755395f20b1adedd4ee43c58e974a32604e953cbbfd" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416618", "to_ids": true, "type": "sha256", "uuid": "5523e86a-6610-44fc-ae7c-4f11950d210b", "value": "f255321e7331ec856bcbf816f4a38371c2311b00d531fdff541fb18496cc0edd" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416618", "to_ids": true, "type": "sha256", "uuid": "5523e86a-36f8-4588-b761-46de950d210b", "value": "f37762bb2199c20d0c5ea0a21774f60bef1fabd7966ee9dc9c67514d5e7ed239" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416618", "to_ids": true, "type": "sha256", "uuid": "5523e86a-a308-44ef-89b0-4a6d950d210b", "value": "f3ccc986dc4922514432440612331e74b1677995258291dd1fb068314e413a75" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416619", "to_ids": true, "type": "sha256", "uuid": "5523e86b-2728-45a8-a484-4f6f950d210b", "value": "f4bf952b5b922a431ad15e4b9a9bc7011a999241187ca93811cec3cdd0a87351" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416619", "to_ids": true, "type": "sha256", "uuid": "5523e86b-afd4-430a-982b-458a950d210b", "value": "f571b27da6fc097bfc7a989fb9b752320f45ded7505125c558851ddd68f01688" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416619", "to_ids": true, "type": "sha256", "uuid": "5523e86b-eb24-4c1c-8e94-43b4950d210b", "value": "f8d6b5995ae855e9cd89194faf0c2f683f8e2d83376bcd4f2da55904d411368c" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416619", "to_ids": true, "type": "sha256", "uuid": "5523e86b-68b8-45c9-9f66-4077950d210b", "value": "f97ba6bdd7893af406d500634d5982184d278b46d392a0f7ad7d7bade0c47fc0" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416619", "to_ids": true, "type": "sha256", "uuid": "5523e86b-db2c-4d73-976e-4326950d210b", "value": "fcc252231ec72ef03fb1309f415fb3f39db5f625925d7b01b8f851f33f506342" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416619", "to_ids": true, "type": "sha256", "uuid": "5523e86b-6bcc-445b-9dfd-41e2950d210b", "value": "fef59f6fc920a7a0ce7f67ec88d7d081a23d5c00aa93a646caa06e0a23bb7639" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416725", "to_ids": true, "type": "yara", "uuid": "5523e8d5-59fc-4e53-8708-401f950d210b", "value": "rule Winnti_Dropper\r\n{\r\n meta:\r\n copyright = \"Novetta Solutions\"\r\n author = \"Novetta Advanced Research Group\"\r\n\r\n strings:\r\n $runner = \"%s\\\\rundll32.exe \\\"%s\\\", DlgProc %s\"\r\n $inflate = \"Copyright 1995-2005 Mark Adler\"\r\n \r\n condition:\r\n $runner and $inflate\r\n\r\n}" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416745", "to_ids": true, "type": "yara", "uuid": "5523e8e9-26ac-4de4-8961-7071950d210b", "value": "rule Winnti_service\r\n{\r\n meta:\r\n copyright = \"Novetta Solutions\"\r\n author = \"Novetta Advanced Research Group\"\r\n\r\n strings:\r\n $newmem = \"new memory failed!\"\r\n $value = \"can not find value %d\\n\"\r\n $onevalue = \"find one value %d\\n\"\r\n $nofile = \"Can not open the file (error %d)\"\r\n \r\n condition:\r\n 3 of ($newmem, $value, $onevalue, $nofile)\r\n\r\n}" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1429714640", "to_ids": true, "type": "yara", "uuid": "5523e901-4c20-4365-8f2e-4953950d210b", "value": "rule Winnti_engine\r\n{\r\n meta:\r\n copyright = \"Novetta Solutions\"\r\n author = \"Novetta Advanced Research Group\"\r\n\r\n strings:\r\n $api1 = \"SHCreateItemFromParsingName\"\r\n $datfile = \"otfkty.dat\"\r\n $workstart = \"work_start\"\r\n $workend = \"work_end\"\r\n \r\n condition:\r\n ($api1 or $datfile) and ($workstart and $workend)\r\n \r\n\r\n}" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416792", "to_ids": true, "type": "yara", "uuid": "5523e918-3a8c-48d5-8b3b-755f950d210b", "value": "rule Winnti_worker\r\n{\r\n meta:\r\n copyright = \"Novetta Solutions\"\r\n author = \"Novetta Advanced Research Group\"\r\n\r\n strings:\r\n $pango = \"pango-basic-win32.dll\"\r\n $tango = \"tango.dll\"\r\n $dat = \"%s\\\\%d%d.dat\"\r\n $cryptobase = \"%s\\\\sysprep\\\\cryptbase.dll\"\r\n \r\n condition:\r\n $pango and $tango and $dat and $cryptobase\r\n\r\n}" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416817", "to_ids": false, "type": "text", "uuid": "5523e931-ac20-4215-a415-7076950d210b", "value": "WinNTI" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416817", "to_ids": false, "type": "text", "uuid": "5523e931-68c4-4dc0-a56e-7076950d210b", "value": "OpSMN" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428416937", "to_ids": false, "type": "text", "uuid": "5523e9a9-2bc4-4eea-8f7f-7071950d210b", "value": "Operation SMN" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428417131", "to_ids": true, "type": "filename", "uuid": "5523ea6b-7d44-483d-98db-755e950d210b", "value": "%SYSDIR%\\otfkyt.dat" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428417131", "to_ids": true, "type": "filename", "uuid": "5523ea6b-7de8-4911-aa6d-755e950d210b", "value": "%SYSDIR%\\wmtsk.dll" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1428417131", "to_ids": true, "type": "filename", "uuid": "5523ea6b-d4d4-4e8f-a502-755e950d210b", "value": "%SYSDIR%\\wmm2.dat" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 0798740771dc8f40a5a45a2f58aeab479e2ead6682d67b24fafc46a7ab40c128)", "deleted": false, "disable_correlation": false, "timestamp": "1455839559", "to_ids": true, "type": "md5", "uuid": "56c65947-8c90-4777-84aa-c652950d210f", "value": "159ad2c7a57687363d27c27bc60f6374" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 0e3d6da65139e01a8f9be0ee63b4510123fc9f644100b00535f7f3b1611ab2ce)", "deleted": false, "disable_correlation": false, "timestamp": "1455839561", "to_ids": true, "type": "md5", "uuid": "56c65949-7bac-4192-a47d-c653950d210f", "value": "4ed9366aed62527c69f61de7bb595af6" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 2e90ec6594eb5fda2cfb6d46b91e13e9ee3f8941de31b57f366dbe254ee9fc32)", "deleted": false, "disable_correlation": false, "timestamp": "1455839564", "to_ids": true, "type": "md5", "uuid": "56c6594c-b568-4637-aa57-59a1950d210f", "value": "0f8fd146ae53c0f0499c8e1ea44d267b" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 4a4e729b5a2212bdcba4314594cbdf8fcbec7146bb1f47b3c99ad6d183bceb38)", "deleted": false, "disable_correlation": false, "timestamp": "1455839566", "to_ids": true, "type": "md5", "uuid": "56c6594e-50f0-442b-b4f2-599c950d210f", "value": "50955f8198bf37025d40a7cdcee7978c" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 4a7e8d72dbaf30ebe2328771381912df9387deea6e240f3ad046ba1154250680)", "deleted": false, "disable_correlation": false, "timestamp": "1455839568", "to_ids": true, "type": "md5", "uuid": "56c65950-c37c-4f92-a973-599f950d210f", "value": "832d56ab2950db6032eda77de2fbe0cd" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 52ce11b571aacf298c10d6dce47a60c199f6f58a76b901583bde65d86886cf1f)", "deleted": false, "disable_correlation": false, "timestamp": "1455839570", "to_ids": true, "type": "md5", "uuid": "56c65952-af10-45a5-b49b-c653950d210f", "value": "a49066ad92a47a2744d142e8c5de892e" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 6aa66eef38c6fcc2d9ab8034723acdaf2af0195749ff713dddaf414d2caea45f)", "deleted": false, "disable_correlation": false, "timestamp": "1455839572", "to_ids": true, "type": "md5", "uuid": "56c65954-2a68-419b-bb46-4dd6950d210f", "value": "b120dab999c4c3edd3628ffca76bc82c" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 959630cb90c5e3810a8a02c771f37b46388204d2d99a436463cd87411f961ba0)", "deleted": false, "disable_correlation": false, "timestamp": "1455839575", "to_ids": true, "type": "md5", "uuid": "56c65957-b2d4-4677-950a-c651950d210f", "value": "3086c619b43e5bdd20188ad594de8c41" }, { "category": "Artifacts dropped", "comment": "Automatically added (via b21a5ac48502ff75057f9773bf31abd970ef6c75a2c0ea1c871dd4e81ec5a994)", "deleted": false, "disable_correlation": false, "timestamp": "1455839578", "to_ids": true, "type": "md5", "uuid": "56c6595a-c8fc-4c65-a4f9-599d950d210f", "value": "437ea3b450fd1043b20553996c8e9e00" }, { "category": "Artifacts dropped", "comment": "Automatically added (via bdb451dd67a1101f8437a2f4231abac37d8bcc4b7c7b85bc74ace83e31aaa156)", "deleted": false, "disable_correlation": false, "timestamp": "1455839580", "to_ids": true, "type": "md5", "uuid": "56c6595c-4154-4897-a5c8-c653950d210f", "value": "937e9a04f082f9f9d5ca6e9a481a8e6f" }, { "category": "Artifacts dropped", "comment": "Automatically added (via df6e40fb0bea1d00c86e0bca493d05a9318ba8e27b015bcadb2fc1d82fa8af04)", "deleted": false, "disable_correlation": false, "timestamp": "1455839583", "to_ids": true, "type": "md5", "uuid": "56c6595f-490c-43f7-9a20-599d950d210f", "value": "2f10e8bbdc38a8ff342e38b0f1e9cc52" }, { "category": "Artifacts dropped", "comment": "Automatically added (via ec198eb746eb1d87315e4ce2cb0d960246da4824f4925d340201288947537bfa)", "deleted": false, "disable_correlation": false, "timestamp": "1455839586", "to_ids": true, "type": "md5", "uuid": "56c65962-ccc0-4d2d-a319-599e950d210f", "value": "d10a1967eee1eadcc010dc89dc2b8925" }, { "category": "Artifacts dropped", "comment": "Automatically added (via f4bf952b5b922a431ad15e4b9a9bc7011a999241187ca93811cec3cdd0a87351)", "deleted": false, "disable_correlation": false, "timestamp": "1455839588", "to_ids": true, "type": "md5", "uuid": "56c65964-4d60-404e-a426-59a3950d210f", "value": "032a234eda612f8474e8dc97829674e8" }, { "category": "Artifacts dropped", "comment": "Automatically added (via f97ba6bdd7893af406d500634d5982184d278b46d392a0f7ad7d7bade0c47fc0)", "deleted": false, "disable_correlation": false, "timestamp": "1455839590", "to_ids": true, "type": "md5", "uuid": "56c65966-9438-4dfa-a2a0-c650950d210f", "value": "e831913787541c94d5d6a25235ce7d84" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 0798740771dc8f40a5a45a2f58aeab479e2ead6682d67b24fafc46a7ab40c128)", "deleted": false, "disable_correlation": false, "timestamp": "1455839560", "to_ids": true, "type": "sha1", "uuid": "56c65948-8a3c-4741-bafb-599d950d210f", "value": "72f3c2155c625784c41cf50bfde4d8dc63424c8e" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 0e3d6da65139e01a8f9be0ee63b4510123fc9f644100b00535f7f3b1611ab2ce)", "deleted": false, "disable_correlation": false, "timestamp": "1455839562", "to_ids": true, "type": "sha1", "uuid": "56c6594a-8134-4c8d-b5c2-5f51950d210f", "value": "cef549547a567db2020af80b1d8e0163f9aa4d65" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 2e90ec6594eb5fda2cfb6d46b91e13e9ee3f8941de31b57f366dbe254ee9fc32)", "deleted": false, "disable_correlation": false, "timestamp": "1455839565", "to_ids": true, "type": "sha1", "uuid": "56c6594d-d1e8-478f-a3cf-59a3950d210f", "value": "f6918d589408209600f1a1ac57f5f610f5bfc90b" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 4a4e729b5a2212bdcba4314594cbdf8fcbec7146bb1f47b3c99ad6d183bceb38)", "deleted": false, "disable_correlation": false, "timestamp": "1455839567", "to_ids": true, "type": "sha1", "uuid": "56c6594f-bbdc-4643-842a-42cb950d210f", "value": "894923f6346506300db5477a8f0057745239cc3b" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 4a7e8d72dbaf30ebe2328771381912df9387deea6e240f3ad046ba1154250680)", "deleted": false, "disable_correlation": false, "timestamp": "1455839569", "to_ids": true, "type": "sha1", "uuid": "56c65951-3188-4296-a453-c651950d210f", "value": "49e0fb0f7bd276afea3f13bcac9dd945c148f6bd" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 52ce11b571aacf298c10d6dce47a60c199f6f58a76b901583bde65d86886cf1f)", "deleted": false, "disable_correlation": false, "timestamp": "1455839570", "to_ids": true, "type": "sha1", "uuid": "56c65952-cf2c-428d-8f95-5f51950d210f", "value": "60aef3264dd2263791afd59652ef4228bac79a29" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 6aa66eef38c6fcc2d9ab8034723acdaf2af0195749ff713dddaf414d2caea45f)", "deleted": false, "disable_correlation": false, "timestamp": "1455839572", "to_ids": true, "type": "sha1", "uuid": "56c65954-f9fc-450a-9d54-4706950d210f", "value": "27976ef26939f0c58a5e2edb222c80761a41e2cf" }, { "category": "Artifacts dropped", "comment": "Automatically added (via 959630cb90c5e3810a8a02c771f37b46388204d2d99a436463cd87411f961ba0)", "deleted": false, "disable_correlation": false, "timestamp": "1455839576", "to_ids": true, "type": "sha1", "uuid": "56c65958-5060-4e01-889d-c652950d210f", "value": "ee83355a6fd69caaedaaa5ef5e44683c0cddf553" }, { "category": "Artifacts dropped", "comment": "Automatically added (via b21a5ac48502ff75057f9773bf31abd970ef6c75a2c0ea1c871dd4e81ec5a994)", "deleted": false, "disable_correlation": false, "timestamp": "1455839578", "to_ids": true, "type": "sha1", "uuid": "56c6595a-8d40-4a3d-8b51-59a1950d210f", "value": "e30014454ec9678426afb3e8e972dc3d063f1358" }, { "category": "Artifacts dropped", "comment": "Automatically added (via bdb451dd67a1101f8437a2f4231abac37d8bcc4b7c7b85bc74ace83e31aaa156)", "deleted": false, "disable_correlation": false, "timestamp": "1455839580", "to_ids": true, "type": "sha1", "uuid": "56c6595c-2c5c-4d5e-932c-c654950d210f", "value": "ca9e770eac54b3b7046e6efdee6e1ebe88a8905f" }, { "category": "Artifacts dropped", "comment": "Automatically added (via df6e40fb0bea1d00c86e0bca493d05a9318ba8e27b015bcadb2fc1d82fa8af04)", "deleted": false, "disable_correlation": false, "timestamp": "1455839584", "to_ids": true, "type": "sha1", "uuid": "56c65960-a020-41f5-903d-5f51950d210f", "value": "7d9b2a9b65a55ecd9c2867f1ea21821d52459d4b" }, { "category": "Artifacts dropped", "comment": "Automatically added (via ec198eb746eb1d87315e4ce2cb0d960246da4824f4925d340201288947537bfa)", "deleted": false, "disable_correlation": false, "timestamp": "1455839586", "to_ids": true, "type": "sha1", "uuid": "56c65962-b6b8-44e7-a2cd-c653950d210f", "value": "f0460290bd8668e94a4c5ad86aa1c487466e8e9d" }, { "category": "Artifacts dropped", "comment": "Automatically added (via f4bf952b5b922a431ad15e4b9a9bc7011a999241187ca93811cec3cdd0a87351)", "deleted": false, "disable_correlation": false, "timestamp": "1455839589", "to_ids": true, "type": "sha1", "uuid": "56c65965-95d4-4f13-a712-599c950d210f", "value": "972da237b66a1239555bd06588039f8b8c03fbe5" }, { "category": "Artifacts dropped", "comment": "Automatically added (via f97ba6bdd7893af406d500634d5982184d278b46d392a0f7ad7d7bade0c47fc0)", "deleted": false, "disable_correlation": false, "timestamp": "1455839591", "to_ids": true, "type": "sha1", "uuid": "56c65967-ac6c-4474-8a25-599f950d210f", "value": "4857e755573822aeef32730a5302cd89c88031db" } ] } }