{ "Event": { "analysis": "1", "date": "2017-10-09", "extends_uuid": "", "info": "M2M - Locky 2017-10-09 : Affid=3, offline, \".ykcol\" : \"Invoice IP1234567\" - \"Invoice-IP1234567.7z\"", "publish_timestamp": "1507832340", "published": true, "threat_level_id": "3", "timestamp": "1507832207", "uuid": "59db9d5b-e49c-455a-8a95-409c950d210f", "Orgc": { "name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" }, "Tag": [ { "colour": "#ffffff", "name": "tlp:white" }, { "colour": "#006c6c", "name": "ecsirt:malicious-code=\"ransomware\"" }, { "colour": "#0088cc", "name": "misp-galaxy:ransomware=\"Locky\"" } ], "Attribute": [ { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "md5", "uuid": "59db9d5c-2b14-40eb-98f7-48c2950d210f", "value": "3aeeb55f8239b731603f5c907113a34f" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d5c-520c-4c2a-8c08-4a3f950d210f", "value": "mail.estudiorrbp.com.uy" }, { "category": "Network activity", "comment": "mail.estudiorrbp.com.uy", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d5d-48e0-4ac8-8e90-47fd950d210f", "value": "50.63.177.206" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d5d-ba60-4133-9603-4370950d210f", "value": "scottfranch.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d7b-9c24-4bda-8762-4a47950d210f", "value": "essenza.co.id" }, { "category": "Network activity", "comment": "essenza.co.id", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d7d-2a48-4c7b-aa72-4d9d950d210f", "value": "202.169.44.141" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d7d-7820-4796-8224-4c66950d210f", "value": "http://121-psychic-reading.co.uk/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d7d-7a84-4eb3-bf75-433c950d210f", "value": "121-psychic-reading.co.uk" }, { "category": "Network activity", "comment": "121-psychic-reading.co.uk", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d7d-725c-4cdf-8788-4eaf950d210f", "value": "217.168.155.63" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d7e-5584-42e8-a96f-4871950d210f", "value": "http://amatuermatch.org/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d7e-7f14-4d00-8cec-4fc9950d210f", "value": "amatuermatch.org" }, { "category": "Network activity", "comment": "amatuermatch.org", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d7f-ae0c-49dd-ad8b-49b3950d210f", "value": "64.50.172.171" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d7f-f344-47e2-b9e0-4037950d210f", "value": "http://anderlaw.com/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d7f-7b48-455d-849d-4d3f950d210f", "value": "anderlaw.com" }, { "category": "Network activity", "comment": "anderlaw.com", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d7f-4518-44ac-9fe8-4d30950d210f", "value": "98.124.251.69" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d80-b1ac-4230-a87d-4eb3950d210f", "value": "http://asesoreszapico.com/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d80-49e8-4c87-924c-47e7950d210f", "value": "asesoreszapico.com" }, { "category": "Network activity", "comment": "asesoreszapico.com", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d80-57e0-4069-b822-468c950d210f", "value": "212.89.16.142" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d80-ef58-47c1-b2b5-4003950d210f", "value": "http://cagliaricity.it/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d81-2bf0-422e-a21e-44a3950d210f", "value": "cagliaricity.it" }, { "category": "Network activity", "comment": "cagliaricity.it", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d81-5388-4ff0-bfd2-4660950d210f", "value": "95.110.196.214" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d81-fbac-4650-929b-46d4950d210f", "value": "http://cfai66.fr/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d82-ad64-41b4-bd80-4d40950d210f", "value": "cfai66.fr" }, { "category": "Network activity", "comment": "cfai66.fr", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d82-3874-4e0a-b6df-46f9950d210f", "value": "87.252.5.144" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d82-3928-4d1e-8190-4f74950d210f", "value": "http://depomedikal.com/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d82-d3d0-4b4f-8deb-4a09950d210f", "value": "depomedikal.com" }, { "category": "Network activity", "comment": "depomedikal.com", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d83-df20-4a3f-b834-4009950d210f", "value": "82.151.131.234" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d83-9660-44c4-a5eb-475f950d210f", "value": "http://designordie.ca/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d83-af84-4437-a220-4089950d210f", "value": "designordie.ca" }, { "category": "Network activity", "comment": "designordie.ca", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d84-987c-4a74-949d-47a1950d210f", "value": "204.244.185.219" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d84-a5d0-4145-b1a1-47a8950d210f", "value": "http://dewekker.nl/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d84-0cb0-4886-bc4d-4232950d210f", "value": "dewekker.nl" }, { "category": "Network activity", "comment": "dewekker.nl", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d84-5cd4-4831-ae61-4f7a950d210f", "value": "94.126.70.12" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d85-9c8c-4ca1-a5dd-43c7950d210f", "value": "http://domke-engineering.de/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d85-2c80-48f7-8d71-4e64950d210f", "value": "domke-engineering.de" }, { "category": "Network activity", "comment": "domke-engineering.de", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d85-cc1c-4821-9041-48ce950d210f", "value": "213.185.128.116" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d85-3da0-44d3-b1de-442c950d210f", "value": "http://drspay.com/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d85-0980-4dd6-9a4c-47e3950d210f", "value": "drspay.com" }, { "category": "Network activity", "comment": "drspay.com", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d86-ccb0-45b7-8767-40e1950d210f", "value": "68.178.159.168" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d86-bebc-46fa-bdc3-4f45950d210f", "value": "http://easyhousedev.gr/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d86-7fc8-4869-805e-4d91950d210f", "value": "easyhousedev.gr" }, { "category": "Network activity", "comment": "easyhousedev.gr", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d87-838c-4401-b045-425f950d210f", "value": "149.56.223.252" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d87-51f4-48ca-bd67-48ee950d210f", "value": "http://ecotek.me/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "hostname", "uuid": "59db9d87-c4c8-41a5-8098-4828950d210f", "value": "ecotek.me" }, { "category": "Network activity", "comment": "ecotek.me", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": false, "type": "ip-dst", "uuid": "59db9d88-dc04-4ce8-8595-4ba6950d210f", "value": "45.40.135.32" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832174", "to_ids": true, "type": "url", "uuid": "59db9d88-2c68-447b-85d2-4b7a950d210f", "value": "http://edeldestillerie-mair.at/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "hostname", "uuid": "59db9d88-af3c-414f-b15c-45e4950d210f", "value": "edeldestillerie-mair.at" }, { "category": "Network activity", "comment": "edeldestillerie-mair.at", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": false, "type": "ip-dst", "uuid": "59db9d88-e754-4d1d-9b2f-481c950d210f", "value": "193.19.92.233" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "url", "uuid": "59db9d89-8d5c-44ed-9f02-4e1d950d210f", "value": "http://hard-grooves.com/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "hostname", "uuid": "59db9d89-6ae0-480f-9ba2-4be4950d210f", "value": "hard-grooves.com" }, { "category": "Network activity", "comment": "hard-grooves.com", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": false, "type": "ip-dst", "uuid": "59db9d89-0e0c-4599-8045-402e950d210f", "value": "66.36.173.111" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "url", "uuid": "59db9d8a-6720-45ba-8c82-4465950d210f", "value": "http://hellonwheelsthemovie.com/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "hostname", "uuid": "59db9d8a-6c58-47b5-86f4-4cb5950d210f", "value": "hellonwheelsthemovie.com" }, { "category": "Network activity", "comment": "hellonwheelsthemovie.com", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": false, "type": "ip-dst", "uuid": "59db9d8a-c4fc-4ce7-aadc-42ad950d210f", "value": "66.36.165.149" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "url", "uuid": "59db9d8a-a474-4386-9530-4a2a950d210f", "value": "http://intra.cfecgcaquitaine.com/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "hostname", "uuid": "59db9d8b-a250-408e-bc24-4c9c950d210f", "value": "intra.cfecgcaquitaine.com" }, { "category": "Network activity", "comment": "intra.cfecgcaquitaine.com", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": false, "type": "ip-dst", "uuid": "59db9d8b-eee8-43db-99cb-4d43950d210f", "value": "94.247.178.77" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "url", "uuid": "59db9d8b-0ab4-4315-b0b8-475e950d210f", "value": "http://miyatakewind.com/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "hostname", "uuid": "59db9d8b-fae8-4dee-b698-4831950d210f", "value": "miyatakewind.com" }, { "category": "Network activity", "comment": "miyatakewind.com", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": false, "type": "ip-dst", "uuid": "59db9d8c-4968-46ad-b5a5-42eb950d210f", "value": "216.194.66.48" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "url", "uuid": "59db9d8c-b070-4a61-9216-471a950d210f", "value": "http://prova.eshopavant.it/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "hostname", "uuid": "59db9d8c-2ae8-4c15-8796-436c950d210f", "value": "prova.eshopavant.it" }, { "category": "Network activity", "comment": "prova.eshopavant.it", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": false, "type": "ip-dst", "uuid": "59db9d8d-d3a8-4313-a775-4abf950d210f", "value": "217.73.227.30" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "url", "uuid": "59db9d8d-efd0-47d3-886f-4f62950d210f", "value": "http://prueba.depaterna.com/8734gf3hf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "hostname", "uuid": "59db9d8d-7884-410e-9e8b-4706950d210f", "value": "prueba.depaterna.com" }, { "category": "Network activity", "comment": "prueba.depaterna.com", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": false, "type": "ip-dst", "uuid": "59db9d8d-a970-47e4-bf54-49ec950d210f", "value": "62.113.249.12" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "url", "uuid": "59db9d8e-13f8-4d72-997a-4ca7950d210f", "value": "http://scottfranch.org/p66/8734gf3hf" }, { "category": "Artifacts dropped", "comment": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "sha256", "uuid": "59dfb16f-79d4-4108-a8de-48a402de0b81", "value": "203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18" }, { "category": "Artifacts dropped", "comment": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": true, "type": "sha1", "uuid": "59dfb16f-d15c-4a16-8a9d-418202de0b81", "value": "517c3203aed9a4229d6260a796f03e448250e0a3" }, { "category": "External analysis", "comment": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f", "deleted": false, "disable_correlation": false, "timestamp": "1507832175", "to_ids": false, "type": "link", "uuid": "59dfb16f-043c-4b3d-8724-428c02de0b81", "value": "https://www.virustotal.com/file/203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18/analysis/1507550567/" } ] } }