{
  "Event": {
    "analysis": "1",
    "date": "2017-10-09",
    "extends_uuid": "",
    "info": "M2M -  Locky 2017-10-09 : Affid=3, offline, \".ykcol\" : \"Invoice IP1234567\" - \"Invoice-IP1234567.7z\"",
    "publish_timestamp": "1507837510",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1507837504",
    "uuid": "59db5cbe-a944-425b-b60a-473b950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#006c6c",
        "name": "ecsirt:malicious-code=\"ransomware\""
      },
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:ransomware=\"Locky\""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832370",
        "to_ids": true,
        "type": "md5",
        "uuid": "59db5cbf-bf18-4e2c-b12c-6da8950d210f",
        "value": "3aeeb55f8239b731603f5c907113a34f"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832370",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cbf-2c80-4442-ae71-4b37950d210f",
        "value": "http://amatuermatch.org/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc0-a868-4d49-969e-46d5950d210f",
        "value": "amatuermatch.org"
      },
      {
        "category": "Network activity",
        "comment": "amatuermatch.org",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc0-75b0-4013-9f15-6e8e950d210f",
        "value": "64.50.172.171"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc0-1024-4266-8367-6e74950d210f",
        "value": "http://anderlaw.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc1-ca1c-4011-982e-4a05950d210f",
        "value": "anderlaw.com"
      },
      {
        "category": "Network activity",
        "comment": "anderlaw.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc1-8af0-498c-ad5f-6b90950d210f",
        "value": "98.124.251.69"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc1-c5d4-4ee3-b7ef-4279950d210f",
        "value": "http://cagliaricity.it/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc1-bfb0-4ea3-be93-4a1a950d210f",
        "value": "cagliaricity.it"
      },
      {
        "category": "Network activity",
        "comment": "cagliaricity.it",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc2-f230-4ca6-965f-4b6d950d210f",
        "value": "95.110.196.214"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc2-f9ac-46c2-9d99-43cc950d210f",
        "value": "http://depomedikal.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc2-e604-42fa-b1fa-44be950d210f",
        "value": "depomedikal.com"
      },
      {
        "category": "Network activity",
        "comment": "depomedikal.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc3-b798-4090-9b97-6da8950d210f",
        "value": "82.151.131.234"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc3-b7dc-440d-bcd1-6e50950d210f",
        "value": "http://designordie.ca/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc3-0738-4029-95c5-49b5950d210f",
        "value": "designordie.ca"
      },
      {
        "category": "Network activity",
        "comment": "designordie.ca",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc4-e3c8-4090-90c1-4379950d210f",
        "value": "204.244.185.219"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc4-70e4-4960-a0f1-6e8e950d210f",
        "value": "http://dewekker.nl/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc4-ee9c-4cbb-8463-6e74950d210f",
        "value": "dewekker.nl"
      },
      {
        "category": "Network activity",
        "comment": "dewekker.nl",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc4-b670-44f2-8446-4dcb950d210f",
        "value": "94.126.70.12"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc5-b2a4-4d4f-b004-43ab950d210f",
        "value": "http://drspay.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc5-a8d0-4901-9287-48c2950d210f",
        "value": "drspay.com"
      },
      {
        "category": "Network activity",
        "comment": "drspay.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc5-99f8-4526-8eeb-4107950d210f",
        "value": "68.178.159.168"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc5-72a4-4c14-9c2f-4504950d210f",
        "value": "http://ecotek.me/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc6-a834-4c98-b3d0-4776950d210f",
        "value": "ecotek.me"
      },
      {
        "category": "Network activity",
        "comment": "ecotek.me",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc6-74cc-4919-a72d-6da8950d210f",
        "value": "45.40.135.32"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc6-f370-461e-93ee-6e50950d210f",
        "value": "http://edeldestillerie-mair.at/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc7-a79c-401f-bd8b-4db7950d210f",
        "value": "edeldestillerie-mair.at"
      },
      {
        "category": "Network activity",
        "comment": "edeldestillerie-mair.at",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc7-8364-4c82-ace1-4656950d210f",
        "value": "193.19.92.233"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc7-69b8-4422-bdca-6e8e950d210f",
        "value": "http://hard-grooves.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc7-22d0-4b4f-aac9-47b2950d210f",
        "value": "hard-grooves.com"
      },
      {
        "category": "Network activity",
        "comment": "hard-grooves.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc8-7728-4a33-b014-6b90950d210f",
        "value": "66.36.173.111"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc8-c74c-4415-945a-4b21950d210f",
        "value": "http://intra.cfecgcaquitaine.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc8-8248-451f-b77a-4041950d210f",
        "value": "intra.cfecgcaquitaine.com"
      },
      {
        "category": "Network activity",
        "comment": "intra.cfecgcaquitaine.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cc9-ca90-4365-af8d-468f950d210f",
        "value": "94.247.178.77"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cc9-4c6c-451b-a0b7-4fc3950d210f",
        "value": "http://prova.eshopavant.it/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cc9-9794-42d6-8688-4d02950d210f",
        "value": "prova.eshopavant.it"
      },
      {
        "category": "Network activity",
        "comment": "prova.eshopavant.it",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5cca-563c-4514-83e3-6e50950d210f",
        "value": "217.73.227.30"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5cca-5e14-4900-b480-49da950d210f",
        "value": "http://prueba.depaterna.com/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5cca-a568-4202-9056-4c70950d210f",
        "value": "prueba.depaterna.com"
      },
      {
        "category": "Network activity",
        "comment": "prueba.depaterna.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59db5ccb-7828-4d1c-855d-49dc950d210f",
        "value": "62.113.249.12"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "url",
        "uuid": "59db5ccb-b520-49a3-8a40-6e8e950d210f",
        "value": "http://scottfranch.org/p66/8734gf3hf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59db5ccb-8a5c-483e-9799-6e74950d210f",
        "value": "scottfranch.org"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59dfb233-1588-4d77-9c8f-a10802de0b81",
        "value": "203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59dfb233-1694-47ce-ae43-a10802de0b81",
        "value": "517c3203aed9a4229d6260a796f03e448250e0a3"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1507832371",
        "to_ids": false,
        "type": "link",
        "uuid": "59dfb233-aac8-446e-828f-a10802de0b81",
        "value": "https://www.virustotal.com/file/203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18/analysis/1507550567/"
      }
    ]
  }
}