{
  "Event": {
    "analysis": "1",
    "date": "2017-10-10",
    "extends_uuid": "",
    "info": "M2M -  Locky 2017-10-10 : Affid=3, offline, \".asasin\" : \"Document ... is complete\" - \"invoice_1234_sign_and_return.7z\"",
    "publish_timestamp": "1507832164",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1507830375",
    "uuid": "59dc90da-d970-4168-901d-45c3950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#006c6c",
        "local": false,
        "name": "ecsirt:malicious-code=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Locky\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "md5",
        "uuid": "59dc90db-2fe4-4682-86e1-48da950d210f",
        "value": "11166f884550390d27c26a893506657a"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90dc-aa78-4949-83ec-4450950d210f",
        "value": "http://agrourbis.com/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90dc-92b8-448e-a3ff-4b3b950d210f",
        "value": "agrourbis.com"
      },
      {
        "category": "Network activity",
        "comment": "agrourbis.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90dc-ecbc-48d6-b525-4cce950d210f",
        "value": "86.109.170.66"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90dc-df80-4019-bcf5-4b4d950d210f",
        "value": "http://axtes.com/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90dc-2944-47d8-83e4-4be3950d210f",
        "value": "axtes.com"
      },
      {
        "category": "Network activity",
        "comment": "axtes.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90dd-1b54-4cfc-af6d-41d6950d210f",
        "value": "37.59.210.47"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90dd-a2c8-4b58-914a-4adc950d210f",
        "value": "http://deltasec.net/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90dd-d33c-40a1-87c0-46c5950d210f",
        "value": "deltasec.net"
      },
      {
        "category": "Network activity",
        "comment": "deltasec.net",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90dd-8e7c-45df-8d8c-4817950d210f",
        "value": "86.109.170.20"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90dd-1280-4139-a9e8-405e950d210f",
        "value": "http://dueeffepromotion.com/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90de-9c4c-49bd-ae20-4185950d210f",
        "value": "dueeffepromotion.com"
      },
      {
        "category": "Network activity",
        "comment": "dueeffepromotion.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90de-2f14-4c3b-aef3-491c950d210f",
        "value": "89.96.90.14"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90de-e3ac-4d89-968d-4bf5950d210f",
        "value": "http://henweekendsbirmingham.co.uk/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90de-0b84-4351-9ca3-47d2950d210f",
        "value": "henweekendsbirmingham.co.uk"
      },
      {
        "category": "Network activity",
        "comment": "henweekendsbirmingham.co.uk",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90de-3168-40ca-8df6-4e1b950d210f",
        "value": "91.192.195.226"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90df-40ec-46e5-b53a-4e8d950d210f",
        "value": "http://likiihillschool.com/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90df-e7a8-4d81-9af2-4256950d210f",
        "value": "likiihillschool.com"
      },
      {
        "category": "Network activity",
        "comment": "likiihillschool.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90df-6634-4097-88a0-4d41950d210f",
        "value": "41.207.64.13"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90e0-8d34-401a-913a-4e7e950d210f",
        "value": "http://mastertenniscoach.com/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90e0-5f70-4388-ac77-40ea950d210f",
        "value": "mastertenniscoach.com"
      },
      {
        "category": "Network activity",
        "comment": "mastertenniscoach.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90e0-6f3c-4b5f-a982-48e7950d210f",
        "value": "67.227.187.239"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90e1-12fc-4e14-9358-40d5950d210f",
        "value": "http://shahanabiomedicals.com/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90e1-c8e4-4648-a409-497d950d210f",
        "value": "shahanabiomedicals.com"
      },
      {
        "category": "Network activity",
        "comment": "shahanabiomedicals.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90e1-2100-437a-9d7e-4902950d210f",
        "value": "208.85.1.220"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90e1-3d7c-49e2-968c-44fc950d210f",
        "value": "http://test.sisap.ro/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90e2-60c8-4cb0-8fd8-4576950d210f",
        "value": "test.sisap.ro"
      },
      {
        "category": "Network activity",
        "comment": "test.sisap.ro",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90e2-4428-4249-92ff-454e950d210f",
        "value": "91.210.80.160"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90e2-7d20-4719-9f2d-4931950d210f",
        "value": "http://xploramail.com/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90e2-a4b0-4201-9f96-4c41950d210f",
        "value": "xploramail.com"
      },
      {
        "category": "Network activity",
        "comment": "xploramail.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59dc90e2-2964-4617-a9e0-4dc8950d210f",
        "value": "185.57.172.213"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "url",
        "uuid": "59dc90e3-76a4-4769-ac76-49b8950d210f",
        "value": "http://nsaflow.info/p66/iugftrs2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59dc90e3-6e68-48b2-91e8-4df0950d210f",
        "value": "nsaflow.info"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 11166f884550390d27c26a893506657a",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59dfaa3c-a11c-4231-9212-4b4002de0b81",
        "value": "3037b1b587eac2080d8c95d05cc5545f43128b2a69a08aa27e6058f7306b3c9b"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 11166f884550390d27c26a893506657a",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59dfaa3c-7d4c-44b6-bbf1-428302de0b81",
        "value": "cf0c629de9a31e27b672e8898139123aed3bda0d"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 11166f884550390d27c26a893506657a",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507830332",
        "to_ids": false,
        "type": "link",
        "uuid": "59dfaa3c-24e4-4934-982b-471e02de0b81",
        "value": "https://www.virustotal.com/file/3037b1b587eac2080d8c95d05cc5545f43128b2a69a08aa27e6058f7306b3c9b/analysis/1507636989/"
      }
    ]
  }
}