{
  "Event": {
    "analysis": "2",
    "date": "2016-10-22",
    "extends_uuid": "",
    "info": "OSINT -  The new .LNK between spam and Locky infection",
    "publish_timestamp": "1477124543",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1477124343",
    "uuid": "580b201b-3e30-4bb1-ac2e-427202de0b81",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#000000",
        "local": false,
        "name": "dnc:malware-type=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#006c6c",
        "local": false,
        "name": "ecsirt:malicious-code=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#39b300",
        "local": false,
        "name": "enisa:nefarious-activity-abuse=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#420053",
        "local": false,
        "name": "ms-caro-malware:malware-type=\"Ransom\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c4f00",
        "local": false,
        "name": "malware_classification:malware-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#00acd1",
        "local": false,
        "name": "veris:action:malware:variety=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#00223b",
        "local": false,
        "name": "osint:source-type=\"blog-post\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124143",
        "to_ids": false,
        "type": "comment",
        "uuid": "580b202f-2940-44d0-ab6c-4eb202de0b81",
        "value": "Just when it seems the Ransom:Win32/Locky activity has slowed down, our continuous monitoring of the ransomware family reveals a new workaround that the authors might be using to keep it going.\r\n\r\nThe decline in Locky activity can be attributed to the slowdown of detections of Nemucod, which Locky uses to infect computers. Nemucod is a .wsf file contained in .zip attachments in spam email (see our Nemucod WSF blog for details). Locky has also been previously distributed by exploit kits and spam email attachments with other extensions such as .js, .hta, etc."
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124156",
        "to_ids": false,
        "type": "link",
        "uuid": "580b203c-83c4-4298-b23b-42fd02de0b81",
        "value": "https://blogs.technet.microsoft.com/mmpc/2016/10/19/the-new-lnk-between-spam-and-locky-infection/"
      },
      {
        "category": "Antivirus detection",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124174",
        "to_ids": false,
        "type": "text",
        "uuid": "580b204e-62e0-47ed-9414-4d0d02de0b81",
        "value": "TrojanDownloader:PowerShell/Ploprolo.A"
      },
      {
        "category": "Network activity",
        "comment": "Hard coded C&C addresses used",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124210",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "580b2072-2bd0-4a88-8f41-4a3702de0b81",
        "value": "93.170.104.126"
      },
      {
        "category": "Network activity",
        "comment": "Hard coded C&C addresses used",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124235",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "580b208b-7124-46a8-83f9-411302de0b81",
        "value": "185.46.11.73"
      },
      {
        "category": "Payload installation",
        "comment": "TrojanDownloader:PowerShell/Ploprolo.A",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124273",
        "to_ids": true,
        "type": "sha1",
        "uuid": "580b20b1-6aac-4a6a-8fc1-4d9102de0b81",
        "value": "3dcf2f116af0a548e88022baa1f41f61f362ae39"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Ransom:Win32/Locky",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124302",
        "to_ids": true,
        "type": "sha1",
        "uuid": "580b20ce-4470-478f-b52a-463702de0b81",
        "value": "c1ee00884c0f872767992d5348e4de576935d8da"
      },
      {
        "category": "Payload installation",
        "comment": "TrojanDownloader:PowerShell/Ploprolo.A - Xchecked via VT: 3dcf2f116af0a548e88022baa1f41f61f362ae39",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124343",
        "to_ids": true,
        "type": "sha256",
        "uuid": "580b20f7-f558-4ece-ac93-406302de0b81",
        "value": "a393cf8d2ec5811d976cff0972069d73a98d33f6d3004b8f11beaf21086ac848"
      },
      {
        "category": "Payload installation",
        "comment": "TrojanDownloader:PowerShell/Ploprolo.A - Xchecked via VT: 3dcf2f116af0a548e88022baa1f41f61f362ae39",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124343",
        "to_ids": true,
        "type": "md5",
        "uuid": "580b20f7-b5c4-4453-b6bf-406a02de0b81",
        "value": "ee0f3310fecae257f1902beabe8b90fd"
      },
      {
        "category": "External analysis",
        "comment": "TrojanDownloader:PowerShell/Ploprolo.A - Xchecked via VT: 3dcf2f116af0a548e88022baa1f41f61f362ae39",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124344",
        "to_ids": false,
        "type": "link",
        "uuid": "580b20f8-76c8-410f-905e-44ae02de0b81",
        "value": "https://www.virustotal.com/file/a393cf8d2ec5811d976cff0972069d73a98d33f6d3004b8f11beaf21086ac848/analysis/1477114649/"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Ransom:Win32/Locky - Xchecked via VT: c1ee00884c0f872767992d5348e4de576935d8da",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124344",
        "to_ids": true,
        "type": "sha256",
        "uuid": "580b20f8-11e0-4df3-b3ed-42d902de0b81",
        "value": "7953b0dbd410a2e216b45671be48a48f472e74fb1a8049afdacaade02e63709b"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Ransom:Win32/Locky - Xchecked via VT: c1ee00884c0f872767992d5348e4de576935d8da",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124344",
        "to_ids": true,
        "type": "md5",
        "uuid": "580b20f8-d5f8-4ac9-916e-42be02de0b81",
        "value": "6f582adb2226db03b8ce9822a0d1b1e8"
      },
      {
        "category": "External analysis",
        "comment": "Ransom:Win32/Locky - Xchecked via VT: c1ee00884c0f872767992d5348e4de576935d8da",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1477124344",
        "to_ids": false,
        "type": "link",
        "uuid": "580b20f8-9078-49f7-94bf-4e2502de0b81",
        "value": "https://www.virustotal.com/file/7953b0dbd410a2e216b45671be48a48f472e74fb1a8049afdacaade02e63709b/analysis/1476852064/"
      }
    ]
  }
}