{
  "Event": {
    "analysis": "2",
    "date": "2016-04-19",
    "extends_uuid": "",
    "info": "OSINT - New Crypto-Ransomware JIGSAW Plays Nasty Games",
    "publish_timestamp": "1461159822",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1461159444",
    "uuid": "5717777b-a8b4-4876-b060-4339950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#2c4f00",
        "local": "0",
        "name": "malware_classification:malware-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": "0",
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461155734",
        "to_ids": false,
        "type": "link",
        "uuid": "57177796-cd7c-4b46-a680-4827950d210f",
        "value": "http://blog.trendmicro.com/trendlabs-security-intelligence/jigsaw-ransomware-plays-games-victims/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461155758",
        "to_ids": false,
        "type": "comment",
        "uuid": "571777ae-4f00-4231-8d8e-4796950d210f",
        "value": "The evolution of crypto-ransomware in terms of behavior takes a step forward, and a creepy one at that. We have recently encountered a nasty crypto-ransomware variant called JIGSAW. Reminiscent to the horror film Saw, this malware toys with users by locking and deleting their files incrementally. To an extent, it instills fear and pressures users into paying the ransom. It even comes with an image of Saw\u00e2\u20ac\u2122s very own Billy the puppet, and the red analog clock to boot.\r\n\r\nIt\u00e2\u20ac\u2122s no longer a surprise that crypto-ransomware is the prevalent threat in today\u00e2\u20ac\u2122s computing landscape, given its promise of quick ROI for the cybercriminals behind it. It\u00e2\u20ac\u2122s also not surprising that many have joined this bandwagon.  These days, the name of the crypto-ransomware game is to add \u00e2\u20ac\u0153unique\u00e2\u20ac\u009d features or \u00e2\u20ac\u0153creative\u00e2\u20ac\u009d ways to instill fear and put more pressure to users to pay up, despite the fact that, when it comes to their technical routines, there\u00e2\u20ac\u2122s not much difference among these malware. JIGSAW joins notable families like PETYA and CERBER that have emerged in the past couple of months alone."
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156175",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "5717794f-427c-4971-94ca-47bf950d210f",
        "value": "Ransom_JIGSAW.A|0c269c5a641fd479269c2f353841a5bf9910888b"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156175",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "5717794f-0c2c-4338-87a6-4d0e950d210f",
        "value": "Ransom_JIGSAW.A|dc307a673aa5eecb5c1400f1d342e03697564f98"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156176",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "57177950-ec94-43ac-a41e-4c54950d210f",
        "value": "Ransom_JIGSAW.A|ce42e2c694ca4737ae68d3c9e333554c55afee27"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156177",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "57177951-809c-4786-9ec1-4811950d210f",
        "value": "Ransom_JIGSAW.B|1ad9f8695c10adb69bdebd6bdc39b119707d500e"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156177",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "57177951-d710-4bb8-a20d-4f46950d210f",
        "value": "Ransom_JIGSAW.C|ca40233610d40258539da0212a06af29b07c13f6"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156178",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "57177952-8580-4612-9c15-4335950d210f",
        "value": "Ransom_JIGSAW.C|f8431cf0a73e4ede5b4b38185d73d8472cfe2ae7"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156179",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "57177953-74fc-41bd-a542-4398950d210f",
        "value": "Ransom_JIGSAW.D|dce911b1c05da965c8733935723b88bc29d12756"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156179",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "57177953-5220-4571-8029-4538950d210f",
        "value": "Ransom_JIGSAW.E|3f6e3e5126c837f46a18ee988dbf5756c2b856aa"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156180",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "57177954-d174-401f-a3f4-4209950d210f",
        "value": "Ransom_JIGSAW.E|92620194a581a91874a5284a775014e0d71a9db1"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156414",
        "to_ids": false,
        "type": "url",
        "uuid": "57177a3e-6b44-4c2d-b80d-49a4950d210f",
        "value": "http://waldorftrust.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461156415",
        "to_ids": false,
        "type": "domain",
        "uuid": "57177a3f-2c24-44ec-88d4-4858950d210f",
        "value": "1fichier.com"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: 92620194a581a91874a5284a775014e0d71a9db1",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159445",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57178615-9754-4898-8b08-400802de0b81",
        "value": "4cd26e0d543e7da413bff2d85a18d1fd18164059c68996049da570f9bdeb6c42"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: 92620194a581a91874a5284a775014e0d71a9db1",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159445",
        "to_ids": true,
        "type": "md5",
        "uuid": "57178615-2894-45d4-9c9c-4fdd02de0b81",
        "value": "473807de0d05cd6149060403ad01b658"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159445",
        "to_ids": false,
        "type": "link",
        "uuid": "57178615-4ccc-4cb3-ba9f-4e5d02de0b81",
        "value": "https://www.virustotal.com/file/4cd26e0d543e7da413bff2d85a18d1fd18164059c68996049da570f9bdeb6c42/analysis/1461138833/"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: 3f6e3e5126c837f46a18ee988dbf5756c2b856aa",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159446",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57178616-8334-49a1-894b-47b002de0b81",
        "value": "773295583998b76b4e24b562f85fa685577067614133db4a7df3d2a28cb4cc3a"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: 3f6e3e5126c837f46a18ee988dbf5756c2b856aa",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159446",
        "to_ids": true,
        "type": "md5",
        "uuid": "57178616-2f48-49c5-b09f-43a102de0b81",
        "value": "89d6fc6c1a51cef335f7ee2bc2aa60ae"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159446",
        "to_ids": false,
        "type": "link",
        "uuid": "57178616-c38c-41e1-8153-427302de0b81",
        "value": "https://www.virustotal.com/file/773295583998b76b4e24b562f85fa685577067614133db4a7df3d2a28cb4cc3a/analysis/1461097304/"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: dce911b1c05da965c8733935723b88bc29d12756",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159447",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57178617-f8f4-4418-9175-4c7802de0b81",
        "value": "a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: dce911b1c05da965c8733935723b88bc29d12756",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159447",
        "to_ids": true,
        "type": "md5",
        "uuid": "57178617-772c-419a-a05c-4ac202de0b81",
        "value": "3bee1d24189d4941f68b96da6e207be4"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159447",
        "to_ids": false,
        "type": "link",
        "uuid": "57178617-7e78-4d57-b580-4ff702de0b81",
        "value": "https://www.virustotal.com/file/a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710/analysis/1461135574/"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: f8431cf0a73e4ede5b4b38185d73d8472cfe2ae7",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159448",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57178618-2640-429a-9dfb-444602de0b81",
        "value": "9580e6c4deba3bd46419a402b6309f77c2ed47ad62299c82ec8578400c2a3a64"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: f8431cf0a73e4ede5b4b38185d73d8472cfe2ae7",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159448",
        "to_ids": true,
        "type": "md5",
        "uuid": "57178618-ec14-4daa-8a55-4db802de0b81",
        "value": "64e7c95aefe82efb39185321a6cdd5c4"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159448",
        "to_ids": false,
        "type": "link",
        "uuid": "57178618-842c-4ff0-b9b4-4d3602de0b81",
        "value": "https://www.virustotal.com/file/9580e6c4deba3bd46419a402b6309f77c2ed47ad62299c82ec8578400c2a3a64/analysis/1461138863/"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: ca40233610d40258539da0212a06af29b07c13f6",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159449",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57178619-addc-4013-afec-4bb102de0b81",
        "value": "d41b5d3d0c6c0e8e9c850eaedf84623f48ba8e72f3867e57b0d94ddaaca738ee"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: ca40233610d40258539da0212a06af29b07c13f6",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159449",
        "to_ids": true,
        "type": "md5",
        "uuid": "57178619-42e0-4a5e-b2d3-472302de0b81",
        "value": "4fe313da6d94379f996c31754df8eb30"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159449",
        "to_ids": false,
        "type": "link",
        "uuid": "57178619-654c-44e2-9428-438c02de0b81",
        "value": "https://www.virustotal.com/file/d41b5d3d0c6c0e8e9c850eaedf84623f48ba8e72f3867e57b0d94ddaaca738ee/analysis/1460698641/"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: 1ad9f8695c10adb69bdebd6bdc39b119707d500e",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159450",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5717861a-8e9c-47e1-84c8-494702de0b81",
        "value": "917809beb6566079dbb6b686107756d9eb3ff4543f6b41ef327cea7497118457"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: 1ad9f8695c10adb69bdebd6bdc39b119707d500e",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159450",
        "to_ids": true,
        "type": "md5",
        "uuid": "5717861a-3d08-457e-be9c-480c02de0b81",
        "value": "6984a724843fb60130a965a9fc317f2d"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159450",
        "to_ids": false,
        "type": "link",
        "uuid": "5717861a-3ab0-4f6d-8331-407602de0b81",
        "value": "https://www.virustotal.com/file/917809beb6566079dbb6b686107756d9eb3ff4543f6b41ef327cea7497118457/analysis/1461128493/"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: ce42e2c694ca4737ae68d3c9e333554c55afee27",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159451",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5717861b-7674-4714-b055-4ecb02de0b81",
        "value": "31823040d8ccb20eab0b8653d01af370a6537017e69ead69f6f7b73d6ef7ac14"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: ce42e2c694ca4737ae68d3c9e333554c55afee27",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159451",
        "to_ids": true,
        "type": "md5",
        "uuid": "5717861b-f874-4e76-b5a2-40e702de0b81",
        "value": "4c153eacdfa8807f1c8fd98e5267da4b"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159451",
        "to_ids": false,
        "type": "link",
        "uuid": "5717861b-b2fc-4335-9464-418e02de0b81",
        "value": "https://www.virustotal.com/file/31823040d8ccb20eab0b8653d01af370a6537017e69ead69f6f7b73d6ef7ac14/analysis/1460584418/"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: dc307a673aa5eecb5c1400f1d342e03697564f98",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159452",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5717861c-d81c-455a-97a2-477902de0b81",
        "value": "80a6681b00056a487bba1b66c046b798dfe18bf37aa30d8a4a1be968b9add997"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: dc307a673aa5eecb5c1400f1d342e03697564f98",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159452",
        "to_ids": true,
        "type": "md5",
        "uuid": "5717861c-56f4-4465-ae03-4a2402de0b81",
        "value": "1e0812fbdaa20a2b9aaddf531daed935"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159452",
        "to_ids": false,
        "type": "link",
        "uuid": "5717861c-20c0-438e-b295-489a02de0b81",
        "value": "https://www.virustotal.com/file/80a6681b00056a487bba1b66c046b798dfe18bf37aa30d8a4a1be968b9add997/analysis/1461138898/"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: 0c269c5a641fd479269c2f353841a5bf9910888b",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159452",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5717861c-d06c-475f-bb8f-47eb02de0b81",
        "value": "bc83ef30422eb7b0c8903d3b4f1d4258e25cf78e9357a30dac773f8d2c17aa28"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the freetext import. - Xchecked via VT: 0c269c5a641fd479269c2f353841a5bf9910888b",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159453",
        "to_ids": true,
        "type": "md5",
        "uuid": "5717861d-adf0-4e8c-8670-4d5202de0b81",
        "value": "5a9bd3d7f1534431a396a033d16ca496"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461159453",
        "to_ids": false,
        "type": "link",
        "uuid": "5717861d-48a0-448a-a172-431402de0b81",
        "value": "https://www.virustotal.com/file/bc83ef30422eb7b0c8903d3b4f1d4258e25cf78e9357a30dac773f8d2c17aa28/analysis/1460698688/"
      }
    ]
  }
}