{ "Event": { "analysis": "1", "date": "2017-06-21", "extends_uuid": "", "info": "M2M - Locky 2017-06-21 : Affid=3 : \"Copy of Invoice 87654321\" - \"87654321.zip\"", "publish_timestamp": "1498056144", "published": true, "threat_level_id": "3", "timestamp": "1498056111", "uuid": "594a858a-7bc0-48be-b2b3-2352950d210f", "Orgc": { "name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" }, "Tag": [ { "colour": "#ffffff", "local": "0", "name": "tlp:white", "relationship_type": "" }, { "colour": "#006c6c", "local": "0", "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": "" }, { "colour": "#0088cc", "local": "0", "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": "" } ], "Attribute": [ { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056074", "to_ids": true, "type": "md5", "uuid": "594a858a-6628-4288-a8e4-47b7950d210f", "value": "1518a79521778cde553f121a37287653" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056075", "to_ids": true, "type": "md5", "uuid": "594a858b-2de4-49c6-b5c6-485a950d210f", "value": "b02b98e345f5dd4348ac7350640dc289" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056075", "to_ids": false, "type": "url", "uuid": "594a858b-763c-4e39-b8da-42cb950d210f", "value": "http://185.115.140.170/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056075", "to_ids": false, "type": "ip-dst", "uuid": "594a858b-dbc4-49b6-b24d-427c950d210f", "value": "185.115.140.170" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056076", "to_ids": true, "type": "url", "uuid": "594a858c-6f64-4096-9a9d-4f38950d210f", "value": "http://emtsgdqsik.pl/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056076", "to_ids": true, "type": "hostname", "uuid": "594a858c-e340-45cd-8031-2ad7950d210f", "value": "emtsgdqsik.pl" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056076", "to_ids": true, "type": "url", "uuid": "594a858c-3af8-4ade-883a-2309950d210f", "value": "http://tqathwvfaqfisj.pl/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056076", "to_ids": true, "type": "hostname", "uuid": "594a858c-12e4-49c9-aa01-236d950d210f", "value": "tqathwvfaqfisj.pl" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056076", "to_ids": true, "type": "url", "uuid": "594a858c-2828-41a6-9fea-4b2e950d210f", "value": "http://dqutujymgc.info/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056077", "to_ids": true, "type": "hostname", "uuid": "594a858d-4b30-4d7e-8450-46dc950d210f", "value": "dqutujymgc.info" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056077", "to_ids": true, "type": "url", "uuid": "594a858d-6270-4d1c-b0c5-235f950d210f", "value": "http://ddgtdcgoysuq.ru/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056077", "to_ids": true, "type": "hostname", "uuid": "594a858d-d988-4114-80e9-4a1b950d210f", "value": "ddgtdcgoysuq.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056077", "to_ids": true, "type": "url", "uuid": "594a858d-15b0-44ef-8795-4bbb950d210f", "value": "http://lrsjplrlaceugxw.work/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056078", "to_ids": true, "type": "hostname", "uuid": "594a858e-876c-4264-be07-41d3950d210f", "value": "lrsjplrlaceugxw.work" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056078", "to_ids": true, "type": "url", "uuid": "594a858e-8e80-40e5-8e2a-2ae0950d210f", "value": "http://cstfxgujaf.biz/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056078", "to_ids": true, "type": "hostname", "uuid": "594a858e-49b0-485b-b41a-4e63950d210f", "value": "cstfxgujaf.biz" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056079", "to_ids": true, "type": "url", "uuid": "594a858f-7bc8-47fc-bd83-2352950d210f", "value": "http://gcbdwbtshl.xyz/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056079", "to_ids": true, "type": "hostname", "uuid": "594a858f-ef98-48e9-b1b5-236d950d210f", "value": "gcbdwbtshl.xyz" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056079", "to_ids": true, "type": "url", "uuid": "594a858f-0958-4c36-8f5b-44d4950d210f", "value": "http://wxcjqfevrkosp.biz/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056079", "to_ids": true, "type": "hostname", "uuid": "594a858f-b9f8-469e-865a-4e5e950d210f", "value": "wxcjqfevrkosp.biz" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056080", "to_ids": true, "type": "url", "uuid": "594a8590-70a8-456b-a58b-235f950d210f", "value": "http://hllfhiqwneuwwx.biz/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056080", "to_ids": true, "type": "hostname", "uuid": "594a8590-ebcc-4c60-ad04-475b950d210f", "value": "hllfhiqwneuwwx.biz" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056080", "to_ids": true, "type": "url", "uuid": "594a8590-c8b4-43ff-bc00-4502950d210f", "value": "http://agnfmqvhomsa.work/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056080", "to_ids": true, "type": "hostname", "uuid": "594a8590-768c-4d06-af5c-4bef950d210f", "value": "agnfmqvhomsa.work" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056080", "to_ids": true, "type": "url", "uuid": "594a8590-6614-4fc5-8991-416f950d210f", "value": "http://ythjvjhtgsfgesd.biz/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056081", "to_ids": true, "type": "hostname", "uuid": "594a8591-3b68-4fa9-a31c-4c00950d210f", "value": "ythjvjhtgsfgesd.biz" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056081", "to_ids": true, "type": "url", "uuid": "594a8591-feac-4129-9c5c-2ae0950d210f", "value": "http://kabssqyef.info/checkupdate" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1498056081", "to_ids": true, "type": "hostname", "uuid": "594a8591-8b20-4e9c-ac7b-478c950d210f", "value": "kabssqyef.info" } ] } }