{
  "Event": {
    "analysis": "2",
    "date": "2021-03-12",
    "extends_uuid": "",
    "info": "OSINT - DearCry ransomware (abusing Exchange Server)",
    "publish_timestamp": "1615541662",
    "published": true,
    "threat_level_id": "1",
    "timestamp": "1615541608",
    "uuid": "0165e5d7-51e6-4c2e-a382-1dd1e706f7bb",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "relationship_type": ""
      },
      {
        "colour": "#001cad",
        "local": false,
        "name": "estimative-language:likelihood-probability=\"very-likely\"",
        "relationship_type": ""
      },
      {
        "colour": "#0029ff",
        "local": false,
        "name": "estimative-language:confidence-in-analytic-judgment=\"high\"",
        "relationship_type": ""
      },
      {
        "colour": "#075200",
        "local": false,
        "name": "admiralty-scale:source-reliability=\"b\"",
        "relationship_type": ""
      },
      {
        "colour": "#0fc000",
        "local": false,
        "name": "admiralty-scale:information-credibility=\"2\"",
        "relationship_type": ""
      },
      {
        "colour": "#002642",
        "local": false,
        "name": "osint:source-type=\"microblog-post\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Persistence mechanism",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": false,
        "type": "regkey",
        "uuid": "2bc0505c-6566-416f-9f4b-2a689d78edb8",
        "value": "Files\\Microsoft\\Exchange"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "eebfaac3-846d-4883-a01e-706600c5aab2",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\logout.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "a6e83ff7-f43c-400a-9f85-6f856e537ff2",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\one.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "33d7df07-f728-435d-a4c9-c6dc3bfc58a6",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\one1.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "659fb6ca-6a34-42ae-a798-554150d716dd",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\shel.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "b785388f-7f42-4382-97ab-f5bb8e586793",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\shel2.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "1bf257cf-b1f9-457b-a1d5-ffc08402fe9f",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\shel90.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "385ab9dd-f6f1-435c-a94c-796f27a3475f",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\a.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "ea27a275-6569-4c5c-89ff-2ba423b7ac22",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\default.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "70785d0d-f6b8-471f-9c3d-a4ee4ae7511c",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\shell.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "f9dccc8f-cb0c-43b6-9ff2-fff4711aace3",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\Server.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "b8e0ffb1-7c06-4b51-8f4d-e6d32df77fb4",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\aspnet_client.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "b3f915e3-c214-4f6b-8e5e-0129044c6bab",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\aspnet_iisstart.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "8a3d4a95-0ede-4778-91c3-e25d87b6ff88",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\aspnet_pages.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "1fd1f2ff-d962-438a-a263-639317387e0b",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\aspnet_www.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "49c945e7-bda4-4dbe-97fa-49c5d9bc244f",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\default1.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "e7b12b41-978f-44a0-94aa-f55ed363999c",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\errorcheck.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "487375ca-a928-4e80-a1d4-01a7a2bddb38",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\iispage.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "4b7f848c-acaf-44c3-878c-3e49aecf8b2e",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\s.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "ec2dd593-27fe-42aa-a23d-e603c8d4ca0d",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\session.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538748",
        "to_ids": true,
        "type": "filename",
        "uuid": "baa0ad8b-693e-4e5f-b539-3754c9fdedf6",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\system_web\\log.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "02ae1c30-289a-4d98-8336-d9d18d6afa51",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\xclkmcfldfi948398430fdjkfdkj.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "4ca3f931-8ea7-4de3-bd4a-98047b0d9324",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\xx.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "42011bba-0ed6-4c7b-b31e-ad3d49df36a5",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\discover.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "590576c4-12cf-4306-a9e4-c5182a85a245",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\HttpProxy.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "bc1997bb-17e3-4bfb-833b-1b274e2a82cb",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\OutlookEN.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "5e91ee04-575a-4615-b6fd-53ad330d644f",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\supp0rt.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "0e8c43b8-bd08-4b5b-8aaf-19b0a8d92d22",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\OAB\\log.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "0043684b-9df2-4546-8f05-ef32aac85874",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\log.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "334f2ae3-8046-4b5b-9ff2-0c19fa8a4b48",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\logg.aspx"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "0365e572-3f31-4bc9-aede-e30469650995",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\Current\\google.log"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "72a56236-6e66-4b46-855b-223aeb029f5b",
        "value": "C:\\inetpub\\wwwroot\\aspnet_client\\google.log"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "a720a45a-cc2b-4e27-9e06-224f5dd76644",
        "value": "Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\google.log"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "filename",
        "uuid": "6a5beae0-0706-480e-9340-b5cb8672e518",
        "value": "%PUBLIC%\\opera\\opera_browser.exe"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "sha256",
        "uuid": "43df033b-306b-4455-bfaf-74eb97a2ceb8",
        "value": "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "sha256",
        "uuid": "819aa63f-c38b-4f23-a333-01eab7b6cd40",
        "value": "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1615538749",
        "to_ids": true,
        "type": "sha256",
        "uuid": "2f1d3fa9-b509-4417-b456-d56c5e1639d0",
        "value": "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.",
        "meta-category": "misc",
        "name": "microblog",
        "template_uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60",
        "template_version": "20",
        "timestamp": "1615538857",
        "uuid": "c917ee01-9118-4758-8b0e-a540ac4c5c88",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "archive",
            "timestamp": "1615538857",
            "to_ids": false,
            "type": "link",
            "uuid": "547e8ead-a5cf-45e7-87fb-1657fccf4e13",
            "value": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "archive",
            "timestamp": "1615538857",
            "to_ids": false,
            "type": "link",
            "uuid": "e77e3518-e613-4893-8ea0-4f2a5e3566fd",
            "value": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.json"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "type",
            "timestamp": "1615538857",
            "to_ids": false,
            "type": "text",
            "uuid": "b7d9750f-a60e-41a3-b01b-d86f27e78ac4",
            "value": "Twitter"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "post",
            "timestamp": "1615538857",
            "to_ids": false,
            "type": "text",
            "uuid": "aebf2aec-c108-4ef9-80b4-e94ab02602f8",
            "value": "We've updated our IoC feed to include hashes for #DearCry ransomware\r\n\r\nAccess the feed here:\r\n\r\nJSON: https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.json\r\n\r\nCSV: https://raw.githubusercontent.com/Azure/Azure-Se"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "state",
            "timestamp": "1615538857",
            "to_ids": false,
            "type": "text",
            "uuid": "8e666a82-666c-4062-997b-403895a09b30",
            "value": "Informative"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "verified-username",
            "timestamp": "1615538857",
            "to_ids": false,
            "type": "text",
            "uuid": "36991467-d111-449f-97de-dfddcb130938",
            "value": "Unverified"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "22",
        "timestamp": "1615538888",
        "uuid": "c54f901a-2381-43a4-bb4f-42d1f09a1e4a",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "c54f901a-2381-43a4-bb4f-42d1f09a1e4a",
            "referenced_uuid": "846c7daa-dc4a-4990-9b33-a914529c88f8",
            "relationship_type": "analysed-with",
            "timestamp": "1615538889",
            "uuid": "86f5851f-81e5-4bbd-ab5d-f6ca71c1c02d"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1615538749",
            "to_ids": true,
            "type": "md5",
            "uuid": "0942a810-b3e6-43cc-bbea-692976f2a17b",
            "value": "cdda3913408c4c46a6c575421485fa5b"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1615538749",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4f742241-e30f-4c71-bb09-fcc5814fb7e3",
            "value": "56eec7392297e7301159094d7e461a696fe5b90f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1615538749",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f0c56ba8-403d-4e9b-bfbb-03d4e4c2c8d6",
            "value": "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "3",
        "timestamp": "1615538888",
        "uuid": "846c7daa-dc4a-4990-9b33-a914529c88f8",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1615538749",
            "to_ids": false,
            "type": "datetime",
            "uuid": "89392aa6-f741-4651-ac58-9087c6d9f1f4",
            "value": "2021-03-12T08:23:23+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1615538749",
            "to_ids": false,
            "type": "link",
            "uuid": "1660120c-4d4b-4e7d-b972-6c02945cec53",
            "value": "https://www.virustotal.com/gui/file/e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6/detection/f-e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6-1615537403"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1615538749",
            "to_ids": false,
            "type": "text",
            "uuid": "67ad0ceb-473a-4604-ad34-529e4ef137bd",
            "value": "33/68"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "22",
        "timestamp": "1615538889",
        "uuid": "56459f25-ccd4-4b89-91de-773056bab60f",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "56459f25-ccd4-4b89-91de-773056bab60f",
            "referenced_uuid": "525e04d3-3258-4f44-85b5-74e76f4ed55e",
            "relationship_type": "analysed-with",
            "timestamp": "1615538889",
            "uuid": "9f11b6d2-89fc-4cce-8021-276666e9bc83"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1615538749",
            "to_ids": true,
            "type": "md5",
            "uuid": "63bdaa30-614f-41b9-8f27-d64aac6ba506",
            "value": "c6eeb14485d93f4e30fb79f3a57518fc"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1615538749",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e3560eca-f3d7-4131-b26c-64d06bc0e85a",
            "value": "b7d99521348d319f57d2b2ba7045295fc99cf6a7"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1615538749",
            "to_ids": true,
            "type": "sha256",
            "uuid": "cb018875-32e5-41f5-8229-851afee081cc",
            "value": "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "3",
        "timestamp": "1615538889",
        "uuid": "525e04d3-3258-4f44-85b5-74e76f4ed55e",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1615538749",
            "to_ids": false,
            "type": "datetime",
            "uuid": "27892d2b-fe0a-4efd-9610-45e9d64ab4bf",
            "value": "2021-03-12T08:28:27+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1615538749",
            "to_ids": false,
            "type": "link",
            "uuid": "08e03713-7e15-4afb-af95-c621caa6b004",
            "value": "https://www.virustotal.com/gui/file/feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede/detection/f-feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede-1615537707"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1615538749",
            "to_ids": false,
            "type": "text",
            "uuid": "0a7a9678-69db-4d38-84ee-f3a8187afd88",
            "value": "34/67"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "22",
        "timestamp": "1615538889",
        "uuid": "fe33598b-e5ff-4af5-ae8b-47fed4de0d4e",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "fe33598b-e5ff-4af5-ae8b-47fed4de0d4e",
            "referenced_uuid": "d8bfca0a-f8de-45ed-9a5f-eb88fefe808b",
            "relationship_type": "analysed-with",
            "timestamp": "1615538889",
            "uuid": "a7b4a8f8-e10e-4af5-8a32-54e0427bbbb3"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1615538749",
            "to_ids": true,
            "type": "md5",
            "uuid": "a3168205-0d7c-418d-b161-6a8253cc9662",
            "value": "0e55ead3b8fd305d9a54f78c7b56741a"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1615538749",
            "to_ids": true,
            "type": "sha1",
            "uuid": "250feadb-b0cb-4983-8bf7-ef85b687fb38",
            "value": "f7b084e581a8dcea450c2652f8058d93797413c3"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1615538749",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2b1c73c7-f587-4ed0-9b8d-9dafd1573345",
            "value": "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "3",
        "timestamp": "1615538889",
        "uuid": "d8bfca0a-f8de-45ed-9a5f-eb88fefe808b",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1615538749",
            "to_ids": false,
            "type": "datetime",
            "uuid": "352701e7-8d7b-4934-9a8f-e72fc25966a3",
            "value": "2021-03-12T08:28:47+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1615538749",
            "to_ids": false,
            "type": "link",
            "uuid": "e061d577-1ad8-4024-be7b-f65a599e48ae",
            "value": "https://www.virustotal.com/gui/file/2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff/detection/f-2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff-1615537727"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1615538749",
            "to_ids": false,
            "type": "text",
            "uuid": "1ae336dd-7832-408c-8237-6b7c5a50e451",
            "value": "37/69"
          }
        ]
      }
    ]
  }
}