{"Event": {"info": "M2M -  Locky 2017-11-09 : Affid=3, offline, \".asasin\" : \"Scanned from HP\" - \"image2017-11-09-1234567.doc\"", "Tag": [{"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#006c6c", "exportable": true, "name": "ecsirt:malicious-code=\"ransomware\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:ransomware=\"Locky\""}], "publish_timestamp": "1510258028", "timestamp": "1510258035", "analysis": "1", "Attribute": [{"comment": "", "category": "Artifacts dropped", "uuid": "5a045290-aaa8-4d3e-bf13-4d30950d210f", "timestamp": "1510258028", "to_ids": true, "value": "8fb63c10eb2c656dafe47e854906d29b", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Network activity", "uuid": "5a045290-e234-42ec-a052-75a9950d210f", "timestamp": "1510258028", "to_ids": true, "value": "http://olamoth.com/309", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a045290-f69c-4824-bf5a-20a6950d210f", "timestamp": "1510258028", "to_ids": true, "value": "olamoth.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "olamoth.com", "category": "Network activity", "uuid": "5a045291-d42c-4107-b5e9-cd35950d210f", "timestamp": "1510258028", "to_ids": false, "value": "209.124.66.6", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a045291-ddbc-4428-8967-cdb4950d210f", "timestamp": "1510258028", "to_ids": true, "value": "http://wayfarerbest.com/309", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a045291-b3b0-4226-87bc-4733950d210f", "timestamp": "1510258028", "to_ids": true, "value": "wayfarerbest.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "wayfarerbest.com", "category": "Network activity", "uuid": "5a045291-282c-4c76-babb-41e6950d210f", "timestamp": "1510258028", "to_ids": false, "value": "5.157.2.218", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a045291-4e40-42b8-b340-cdb1950d210f", "timestamp": "1510258028", "to_ids": false, "value": "http://67.199.41.9/hjkdfhJH73td", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a045292-af68-4458-9f6f-434f950d210f", "timestamp": "1510258028", "to_ids": false, "value": "67.199.41.9", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a045292-6808-4665-bc6d-75a9950d210f", "timestamp": "1510258028", "to_ids": true, "value": "http://purenergy.it/hjkdfhJH73td", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a045292-b6d4-482b-9a72-499b950d210f", "timestamp": "1510258028", "to_ids": true, "value": "purenergy.it", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "purenergy.it", "category": "Network activity", "uuid": "5a045292-3028-4c60-931a-4471950d210f", "timestamp": "1510258028", "to_ids": false, "value": "195.110.124.188", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a045292-b938-49d0-9d47-cd35950d210f", "timestamp": "1510258028", "to_ids": true, "value": "http://phonecenter24.de/hjkdfhJH73td", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a045292-e324-434b-8770-46f4950d210f", "timestamp": "1510258028", "to_ids": true, "value": "phonecenter24.de", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "phonecenter24.de", "category": "Network activity", "uuid": "5a045293-82dc-413b-9f2c-436c950d210f", "timestamp": "1510258028", "to_ids": false, "value": "81.169.145.83", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a045293-6ef4-4d26-9b03-45c7950d210f", "timestamp": "1510258028", "to_ids": true, "value": "http://procuradores-elche.com/hjkdfhJH73td", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a045293-ff44-4fc6-8af7-cdb1950d210f", "timestamp": "1510258028", "to_ids": true, "value": "procuradores-elche.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "procuradores-elche.com", "category": "Network activity", "uuid": "5a045293-bb4c-4630-a197-4c44950d210f", "timestamp": "1510258028", "to_ids": false, "value": "81.169.145.94", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a045293-8dd8-4332-997c-75a9950d210f", "timestamp": "1510258028", "to_ids": true, "value": "http://tci.seventhworld.com/hjkdfhJH73td", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a045294-1f30-4464-ae2e-4e34950d210f", "timestamp": "1510258028", "to_ids": true, "value": "tci.seventhworld.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "tci.seventhworld.com", "category": "Network activity", "uuid": "5a045294-0ff8-4288-84ac-4e6e950d210f", "timestamp": "1510258028", "to_ids": false, "value": "192.185.57.176", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "- Xchecked via VT: 8fb63c10eb2c656dafe47e854906d29b", "category": "Artifacts dropped", "uuid": "5a04b56c-4720-440a-870f-f6f702de0b81", "timestamp": "1510258028", "to_ids": true, "value": "48c7a0da6261e557e6cd12e81ba8b577492d477d8d21c0bbd8420dc9cb613867", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "- Xchecked via VT: 8fb63c10eb2c656dafe47e854906d29b", "category": "Artifacts dropped", "uuid": "5a04b56c-4850-494f-a62b-f6f702de0b81", "timestamp": "1510258028", "to_ids": true, "value": "ae45c8e53bbc6e094e12c44bad0da44eb357ca36", "disable_correlation": false, "object_relation": null, "type": "sha1"}, {"comment": "- Xchecked via VT: 8fb63c10eb2c656dafe47e854906d29b", "category": "External analysis", "uuid": "5a04b56c-87b0-4f40-b60d-f6f702de0b81", "timestamp": "1510258028", "to_ids": false, "value": "https://www.virustotal.com/file/48c7a0da6261e557e6cd12e81ba8b577492d477d8d21c0bbd8420dc9cb613867/analysis/1510257694/", "disable_correlation": false, "object_relation": null, "type": "link"}], "extends_uuid": "", "published": false, "date": "2017-11-09", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "5a04528f-44d8-40d0-bbcb-cd35950d210f"}}