{
  "Event": {
    "analysis": "2",
    "date": "2017-05-08",
    "extends_uuid": "",
    "info": "OSINT - Windows Defender ATP thwarts Operation WilySupply software supply chain cyberattack",
    "publish_timestamp": "1494224616",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1494224492",
    "uuid": "59100c44-ea98-4024-ab76-485e950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#007c97",
        "local": false,
        "name": "veris:actor:motive=\"Financial\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224492",
        "to_ids": false,
        "type": "link",
        "uuid": "59100c4f-4a94-47ce-ac77-4094950d210f",
        "value": "https://blogs.technet.microsoft.com/mmpc/2017/05/04/windows-defender-atp-thwarts-operation-wilysupply-software-supply-chain-cyberattack/",
        "Tag": [
          {
            "colour": "#00223b",
            "local": false,
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          },
          {
            "colour": "#075200",
            "local": false,
            "name": "admiralty-scale:source-reliability=\"b\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224492",
        "to_ids": false,
        "type": "text",
        "uuid": "59100c72-a814-453d-9ad3-417a950d210f",
        "value": "Several weeks ago, the Windows Defender Advanced Threat Protection (Windows Defender ATP) research team noticed security alerts that demonstrated an intriguing attack pattern. These early alerts uncovered a well-planned, finely orchestrated cyberattack that targeted several high-profile technology and financial organizations. An unknown attacker was taking advantage of a silent yet effective attack vector: the compromised update mechanism or software supply chain for a third-party editing tool. The software vendor that develops the editing tool was unaware of the issue. In fact, while their software supply chain served as a channel for attacking other organizations, they themselves were also under attack.\r\n\r\nThis cyberattack could have been much more problematic if it had gone undetected. Its early discovery allowed incident responders\u00e2\u20ac\u201da collaboration of security experts from the targeted industries and developers working for the third-party software vendor\u00e2\u20ac\u201dto work with Microsoft security researchers to promptly identify and neutralize the activities associated with this cyberespionage campaign.\r\n\r\nThanks to the collaborative response, Microsoft was able to notify known affected parties as well as the third-party software vendor, who then worked around the clock to contain the attempted attack and mitigate potential risks.\r\nInvestigating alert timelines and process trees\r\n\r\nRegardless of how an attack is executed, through sophisticated social engineering or a zero-day exploit, the first stage or the entry vector of a kill chain is often the most challenging aspect to understand about the attack. Windows Defender ATP initially called our attention to alerts flagging suspicious PowerShell scripts, self-deletion of executables, and other suspect activities. A quick check in the Windows Defender ATP console led us to the machine that was under attack. However, the source of the attack remained buried, requiring additional investigative effort to uncover.",
        "Tag": [
          {
            "colour": "#00223b",
            "local": false,
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          },
          {
            "colour": "#075200",
            "local": false,
            "name": "admiralty-scale:source-reliability=\"b\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "(used for initial infection and C&C communication)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224492",
        "to_ids": true,
        "type": "url",
        "uuid": "59100db9-4d28-4a85-a7e1-4da6950d210f",
        "value": "http://5.39.218.205/logo.png"
      },
      {
        "category": "Network activity",
        "comment": "(used for initial infection and C&C communication)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224492",
        "to_ids": true,
        "type": "url",
        "uuid": "59100dba-77c0-4a8b-840e-448a950d210f",
        "value": "http://176.53.118.131/logo.png"
      },
      {
        "category": "Network activity",
        "comment": "used for initial infection and C&C communication",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224492",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "59100dda-f594-411e-b4d8-4f3b950d210f",
        "value": "5.39.218.205"
      },
      {
        "category": "Network activity",
        "comment": "used for initial infection and C&C communication",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224492",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "59100ddb-c4a8-4d9b-b640-489f950d210f",
        "value": "176.53.118.131"
      },
      {
        "category": "Payload delivery",
        "comment": "the malicious sample downloaded through the third-party updater",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224492",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59100e07-8714-4329-8e8a-4ed4950d210f",
        "value": "75edd4ee11e7d3dabd191c316da637f939140e2f"
      },
      {
        "category": "Payload delivery",
        "comment": "the malicious sample downloaded through the third-party updater",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224492",
        "to_ids": true,
        "type": "md5",
        "uuid": "59100e08-e13c-4632-93b8-4f7c950d210f",
        "value": "a34c930506b64f98cdf3ec2a474f5b31"
      },
      {
        "category": "Payload delivery",
        "comment": "the malicious sample downloaded through the third-party updater - Xchecked via VT: 75edd4ee11e7d3dabd191c316da637f939140e2f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224496",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59100e70-60f0-4bae-b77d-459502de0b81",
        "value": "9a4346d7ac23d3fb06050e56ab7376fa56194c21617232574a5dbcb0a4e00a57"
      },
      {
        "category": "External analysis",
        "comment": "the malicious sample downloaded through the third-party updater - Xchecked via VT: 75edd4ee11e7d3dabd191c316da637f939140e2f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1494224496",
        "to_ids": false,
        "type": "link",
        "uuid": "59100e70-de58-4165-beaa-47eb02de0b81",
        "value": "https://www.virustotal.com/file/9a4346d7ac23d3fb06050e56ab7376fa56194c21617232574a5dbcb0a4e00a57/analysis/1494003300/"
      }
    ]
  }
}