{
  "Event": {
    "analysis": "1",
    "date": "2017-10-09",
    "extends_uuid": "",
    "info": "M2M -  Locky 2017-10-09 : Affid=3, offline, \".ykcol\" : \"Invoice IP1234567\" - \"Invoice-IP1234567.7z\"",
    "publish_timestamp": "1507832340",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1507832207",
    "uuid": "59db9d5b-e49c-455a-8a95-409c950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#006c6c",
        "local": false,
        "name": "ecsirt:malicious-code=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Locky\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "md5",
        "uuid": "59db9d5c-2b14-40eb-98f7-48c2950d210f",
        "value": "3aeeb55f8239b731603f5c907113a34f"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d5c-520c-4c2a-8c08-4a3f950d210f",
        "value": "mail.estudiorrbp.com.uy"
      },
      {
        "category": "Network activity",
        "comment": "mail.estudiorrbp.com.uy",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d5d-48e0-4ac8-8e90-47fd950d210f",
        "value": "50.63.177.206"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d5d-ba60-4133-9603-4370950d210f",
        "value": "scottfranch.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d7b-9c24-4bda-8762-4a47950d210f",
        "value": "essenza.co.id"
      },
      {
        "category": "Network activity",
        "comment": "essenza.co.id",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d7d-2a48-4c7b-aa72-4d9d950d210f",
        "value": "202.169.44.141"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d7d-7820-4796-8224-4c66950d210f",
        "value": "http://121-psychic-reading.co.uk/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d7d-7a84-4eb3-bf75-433c950d210f",
        "value": "121-psychic-reading.co.uk"
      },
      {
        "category": "Network activity",
        "comment": "121-psychic-reading.co.uk",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d7d-725c-4cdf-8788-4eaf950d210f",
        "value": "217.168.155.63"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d7e-5584-42e8-a96f-4871950d210f",
        "value": "http://amatuermatch.org/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d7e-7f14-4d00-8cec-4fc9950d210f",
        "value": "amatuermatch.org"
      },
      {
        "category": "Network activity",
        "comment": "amatuermatch.org",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d7f-ae0c-49dd-ad8b-49b3950d210f",
        "value": "64.50.172.171"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d7f-f344-47e2-b9e0-4037950d210f",
        "value": "http://anderlaw.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d7f-7b48-455d-849d-4d3f950d210f",
        "value": "anderlaw.com"
      },
      {
        "category": "Network activity",
        "comment": "anderlaw.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d7f-4518-44ac-9fe8-4d30950d210f",
        "value": "98.124.251.69"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d80-b1ac-4230-a87d-4eb3950d210f",
        "value": "http://asesoreszapico.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d80-49e8-4c87-924c-47e7950d210f",
        "value": "asesoreszapico.com"
      },
      {
        "category": "Network activity",
        "comment": "asesoreszapico.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d80-57e0-4069-b822-468c950d210f",
        "value": "212.89.16.142"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d80-ef58-47c1-b2b5-4003950d210f",
        "value": "http://cagliaricity.it/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d81-2bf0-422e-a21e-44a3950d210f",
        "value": "cagliaricity.it"
      },
      {
        "category": "Network activity",
        "comment": "cagliaricity.it",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d81-5388-4ff0-bfd2-4660950d210f",
        "value": "95.110.196.214"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d81-fbac-4650-929b-46d4950d210f",
        "value": "http://cfai66.fr/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d82-ad64-41b4-bd80-4d40950d210f",
        "value": "cfai66.fr"
      },
      {
        "category": "Network activity",
        "comment": "cfai66.fr",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d82-3874-4e0a-b6df-46f9950d210f",
        "value": "87.252.5.144"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d82-3928-4d1e-8190-4f74950d210f",
        "value": "http://depomedikal.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d82-d3d0-4b4f-8deb-4a09950d210f",
        "value": "depomedikal.com"
      },
      {
        "category": "Network activity",
        "comment": "depomedikal.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d83-df20-4a3f-b834-4009950d210f",
        "value": "82.151.131.234"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d83-9660-44c4-a5eb-475f950d210f",
        "value": "http://designordie.ca/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d83-af84-4437-a220-4089950d210f",
        "value": "designordie.ca"
      },
      {
        "category": "Network activity",
        "comment": "designordie.ca",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d84-987c-4a74-949d-47a1950d210f",
        "value": "204.244.185.219"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d84-a5d0-4145-b1a1-47a8950d210f",
        "value": "http://dewekker.nl/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d84-0cb0-4886-bc4d-4232950d210f",
        "value": "dewekker.nl"
      },
      {
        "category": "Network activity",
        "comment": "dewekker.nl",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d84-5cd4-4831-ae61-4f7a950d210f",
        "value": "94.126.70.12"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d85-9c8c-4ca1-a5dd-43c7950d210f",
        "value": "http://domke-engineering.de/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d85-2c80-48f7-8d71-4e64950d210f",
        "value": "domke-engineering.de"
      },
      {
        "category": "Network activity",
        "comment": "domke-engineering.de",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d85-cc1c-4821-9041-48ce950d210f",
        "value": "213.185.128.116"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d85-3da0-44d3-b1de-442c950d210f",
        "value": "http://drspay.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d85-0980-4dd6-9a4c-47e3950d210f",
        "value": "drspay.com"
      },
      {
        "category": "Network activity",
        "comment": "drspay.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d86-ccb0-45b7-8767-40e1950d210f",
        "value": "68.178.159.168"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d86-bebc-46fa-bdc3-4f45950d210f",
        "value": "http://easyhousedev.gr/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d86-7fc8-4869-805e-4d91950d210f",
        "value": "easyhousedev.gr"
      },
      {
        "category": "Network activity",
        "comment": "easyhousedev.gr",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d87-838c-4401-b045-425f950d210f",
        "value": "149.56.223.252"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d87-51f4-48ca-bd67-48ee950d210f",
        "value": "http://ecotek.me/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d87-c4c8-41a5-8098-4828950d210f",
        "value": "ecotek.me"
      },
      {
        "category": "Network activity",
        "comment": "ecotek.me",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d88-dc04-4ce8-8595-4ba6950d210f",
        "value": "45.40.135.32"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832174",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d88-2c68-447b-85d2-4b7a950d210f",
        "value": "http://edeldestillerie-mair.at/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d88-af3c-414f-b15c-45e4950d210f",
        "value": "edeldestillerie-mair.at"
      },
      {
        "category": "Network activity",
        "comment": "edeldestillerie-mair.at",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d88-e754-4d1d-9b2f-481c950d210f",
        "value": "193.19.92.233"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d89-8d5c-44ed-9f02-4e1d950d210f",
        "value": "http://hard-grooves.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d89-6ae0-480f-9ba2-4be4950d210f",
        "value": "hard-grooves.com"
      },
      {
        "category": "Network activity",
        "comment": "hard-grooves.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d89-0e0c-4599-8045-402e950d210f",
        "value": "66.36.173.111"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d8a-6720-45ba-8c82-4465950d210f",
        "value": "http://hellonwheelsthemovie.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d8a-6c58-47b5-86f4-4cb5950d210f",
        "value": "hellonwheelsthemovie.com"
      },
      {
        "category": "Network activity",
        "comment": "hellonwheelsthemovie.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d8a-c4fc-4ce7-aadc-42ad950d210f",
        "value": "66.36.165.149"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d8a-a474-4386-9530-4a2a950d210f",
        "value": "http://intra.cfecgcaquitaine.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d8b-a250-408e-bc24-4c9c950d210f",
        "value": "intra.cfecgcaquitaine.com"
      },
      {
        "category": "Network activity",
        "comment": "intra.cfecgcaquitaine.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d8b-eee8-43db-99cb-4d43950d210f",
        "value": "94.247.178.77"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d8b-0ab4-4315-b0b8-475e950d210f",
        "value": "http://miyatakewind.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d8b-fae8-4dee-b698-4831950d210f",
        "value": "miyatakewind.com"
      },
      {
        "category": "Network activity",
        "comment": "miyatakewind.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d8c-4968-46ad-b5a5-42eb950d210f",
        "value": "216.194.66.48"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d8c-b070-4a61-9216-471a950d210f",
        "value": "http://prova.eshopavant.it/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d8c-2ae8-4c15-8796-436c950d210f",
        "value": "prova.eshopavant.it"
      },
      {
        "category": "Network activity",
        "comment": "prova.eshopavant.it",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d8d-d3a8-4313-a775-4abf950d210f",
        "value": "217.73.227.30"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d8d-efd0-47d3-886f-4f62950d210f",
        "value": "http://prueba.depaterna.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db9d8d-7884-410e-9e8b-4706950d210f",
        "value": "prueba.depaterna.com"
      },
      {
        "category": "Network activity",
        "comment": "prueba.depaterna.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db9d8d-a970-47e4-bf54-49ec950d210f",
        "value": "62.113.249.12"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "url",
        "uuid": "59db9d8e-13f8-4d72-997a-4ca7950d210f",
        "value": "http://scottfranch.org/p66/8734gf3hf"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59dfb16f-79d4-4108-a8de-48a402de0b81",
        "value": "203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59dfb16f-d15c-4a16-8a9d-418202de0b81",
        "value": "517c3203aed9a4229d6260a796f03e448250e0a3"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832175",
        "to_ids": false,
        "type": "link",
        "uuid": "59dfb16f-043c-4b3d-8724-428c02de0b81",
        "value": "https://www.virustotal.com/file/203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18/analysis/1507550567/"
      }
    ]
  }
}