{
  "Event": {
    "analysis": "1",
    "date": "2017-11-09",
    "extends_uuid": "",
    "info": "M2M -  Locky 2017-11-07 : Affid=3, offline, \".asasin\" : \"Invoice #123456789,\" - \"987654321_11_07_2017_12_34_56.doc\"",
    "publish_timestamp": "1510262164",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1510262093",
    "uuid": "5a045167-9e00-4562-95ea-4f67950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#006c6c",
        "local": "0",
        "name": "ecsirt:malicious-code=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": "0",
        "name": "misp-galaxy:ransomware=\"Locky\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "md5",
        "uuid": "5a045167-a8a4-4d58-a2c3-cd7d950d210f",
        "value": "8ac7c66efdeefceea010123faa515cdf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a045168-e9a4-4ac1-a456-cc6f950d210f",
        "value": "grhq.mycompany.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a045168-4500-4189-91fb-cd7d950d210f",
        "value": "http://financeforautos.com/693"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a045168-a0e0-4af5-af18-20a6950d210f",
        "value": "financeforautos.com"
      },
      {
        "category": "Network activity",
        "comment": "financeforautos.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a045169-618c-4b69-ae01-cc6f950d210f",
        "value": "72.4.145.228"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a045169-5560-4fe3-9128-4315950d210f",
        "value": "http://galeona.com/693"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a045169-b658-40e8-9ca3-cd7d950d210f",
        "value": "galeona.com"
      },
      {
        "category": "Network activity",
        "comment": "galeona.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a045169-2a7c-4a2a-b450-20a6950d210f",
        "value": "212.89.16.142"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a045169-eda4-4983-bb25-cc6f950d210f",
        "value": "http://giancarlovaccari.com/693"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a04516a-def4-4074-8f4b-4246950d210f",
        "value": "giancarlovaccari.com"
      },
      {
        "category": "Network activity",
        "comment": "giancarlovaccari.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a04516a-eb1c-4f8a-aa33-75a9950d210f",
        "value": "95.110.147.134"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a04516a-5c68-4abb-a08b-cda3950d210f",
        "value": "http://gotcaughtdui.com/693"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a04516a-a030-41b4-aacd-cc6f950d210f",
        "value": "gotcaughtdui.com"
      },
      {
        "category": "Network activity",
        "comment": "gotcaughtdui.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a04516b-cb10-494d-9fca-75a9950d210f",
        "value": "132.148.21.213"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a04516b-6584-4610-9cd9-cda3950d210f",
        "value": "http://with-hair.co.jp/693"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a04516b-20a4-4618-9057-20a6950d210f",
        "value": "with-hair.co.jp"
      },
      {
        "category": "Network activity",
        "comment": "with-hair.co.jp",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
        "value": "27.85.233.43"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a04516c-4eac-4c79-a45c-20a6950d210f",
        "value": "http://www.test.doctorsordersltd.co.uk/693"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a04516c-5ea4-4eea-bb56-cc6f950d210f",
        "value": "www.test.doctorsordersltd.co.uk"
      },
      {
        "category": "Network activity",
        "comment": "www.test.doctorsordersltd.co.uk",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a04516c-8030-4b0b-9937-cdb1950d210f",
        "value": "46.32.236.13"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a04516c-ed38-4f2f-9d4b-cda3950d210f",
        "value": "http://teesaddiction.com/JHgd3Dees"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a04516d-1c74-41bb-9966-cc6f950d210f",
        "value": "teesaddiction.com"
      },
      {
        "category": "Network activity",
        "comment": "teesaddiction.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a04516d-9360-4210-a21e-cd7d950d210f",
        "value": "217.73.227.10"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a04516d-719c-4749-9186-20a6950d210f",
        "value": "http://christaminiatures.nl/JHgd3Dees"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a04516d-84a0-4cc8-b7fe-cc6f950d210f",
        "value": "christaminiatures.nl"
      },
      {
        "category": "Network activity",
        "comment": "christaminiatures.nl",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a04516d-2e10-4a7b-a9bb-75a9950d210f",
        "value": "37.97.139.59"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a04516e-6ab0-4855-81db-20a6950d210f",
        "value": "http://336.linux1.testsider.dk/JHgd3Dees"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a04516e-3d88-4077-9b82-cdb1950d210f",
        "value": "336.linux1.testsider.dk"
      },
      {
        "category": "Network activity",
        "comment": "336.linux1.testsider.dk",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a04516e-2288-4505-8fa2-4ee1950d210f",
        "value": "77.243.131.16"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262086",
        "to_ids": true,
        "type": "url",
        "uuid": "5a04516e-e63c-4705-9380-75a9950d210f",
        "value": "http://florastor.net/JHgd3Dees"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a04516e-ca4c-4cd8-be82-cdb1950d210f",
        "value": "florastor.net"
      },
      {
        "category": "Network activity",
        "comment": "florastor.net",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a04516f-fd8c-436e-8b40-cc6f950d210f",
        "value": "149.56.65.61"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": true,
        "type": "url",
        "uuid": "5a04516f-7394-4834-923d-4172950d210f",
        "value": "http://heinzig.info/JHgd3Dees"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a04516f-f968-4fc6-bf01-cda3950d210f",
        "value": "heinzig.info"
      },
      {
        "category": "Network activity",
        "comment": "heinzig.info",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "5a045170-8630-4cf2-80c9-cd7d950d210f",
        "value": "46.4.156.11"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": true,
        "type": "url",
        "uuid": "5a045170-0ae0-4d5e-92f4-4cbd950d210f",
        "value": "http://muchinfaket.net/p66/JHgd3Dees"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a045170-837c-4fe2-be39-75a9950d210f",
        "value": "muchinfaket.net"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 8ac7c66efdeefceea010123faa515cdf",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5a04c547-9944-4f2d-a279-f6f702de0b81",
        "value": "28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 8ac7c66efdeefceea010123faa515cdf",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5a04c547-c77c-4644-a98e-f6f702de0b81",
        "value": "961c26caade6bb374efb19319411f04183af2cb0"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 8ac7c66efdeefceea010123faa515cdf",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1510262087",
        "to_ids": false,
        "type": "link",
        "uuid": "5a04c547-c518-48f4-8c57-f6f702de0b81",
        "value": "https://www.virustotal.com/file/28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce/analysis/1510127095/"
      }
    ]
  }
}