{
  "Event": {
    "analysis": "1",
    "date": "2017-06-21",
    "extends_uuid": "",
    "info": "M2M -  Locky 2017-06-21 : Affid=3 : \"Copy of Invoice 87654321\" - \"87654321.zip\"",
    "publish_timestamp": "1498056144",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1498056111",
    "uuid": "594a858a-7bc0-48be-b2b3-2352950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#006c6c",
        "local": false,
        "name": "ecsirt:malicious-code=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Locky\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056074",
        "to_ids": true,
        "type": "md5",
        "uuid": "594a858a-6628-4288-a8e4-47b7950d210f",
        "value": "1518a79521778cde553f121a37287653"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056075",
        "to_ids": true,
        "type": "md5",
        "uuid": "594a858b-2de4-49c6-b5c6-485a950d210f",
        "value": "b02b98e345f5dd4348ac7350640dc289"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056075",
        "to_ids": false,
        "type": "url",
        "uuid": "594a858b-763c-4e39-b8da-42cb950d210f",
        "value": "http://185.115.140.170/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056075",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "594a858b-dbc4-49b6-b24d-427c950d210f",
        "value": "185.115.140.170"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056076",
        "to_ids": true,
        "type": "url",
        "uuid": "594a858c-6f64-4096-9a9d-4f38950d210f",
        "value": "http://emtsgdqsik.pl/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056076",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a858c-e340-45cd-8031-2ad7950d210f",
        "value": "emtsgdqsik.pl"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056076",
        "to_ids": true,
        "type": "url",
        "uuid": "594a858c-3af8-4ade-883a-2309950d210f",
        "value": "http://tqathwvfaqfisj.pl/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056076",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a858c-12e4-49c9-aa01-236d950d210f",
        "value": "tqathwvfaqfisj.pl"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056076",
        "to_ids": true,
        "type": "url",
        "uuid": "594a858c-2828-41a6-9fea-4b2e950d210f",
        "value": "http://dqutujymgc.info/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056077",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a858d-4b30-4d7e-8450-46dc950d210f",
        "value": "dqutujymgc.info"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056077",
        "to_ids": true,
        "type": "url",
        "uuid": "594a858d-6270-4d1c-b0c5-235f950d210f",
        "value": "http://ddgtdcgoysuq.ru/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056077",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a858d-d988-4114-80e9-4a1b950d210f",
        "value": "ddgtdcgoysuq.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056077",
        "to_ids": true,
        "type": "url",
        "uuid": "594a858d-15b0-44ef-8795-4bbb950d210f",
        "value": "http://lrsjplrlaceugxw.work/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056078",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a858e-876c-4264-be07-41d3950d210f",
        "value": "lrsjplrlaceugxw.work"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056078",
        "to_ids": true,
        "type": "url",
        "uuid": "594a858e-8e80-40e5-8e2a-2ae0950d210f",
        "value": "http://cstfxgujaf.biz/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056078",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a858e-49b0-485b-b41a-4e63950d210f",
        "value": "cstfxgujaf.biz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056079",
        "to_ids": true,
        "type": "url",
        "uuid": "594a858f-7bc8-47fc-bd83-2352950d210f",
        "value": "http://gcbdwbtshl.xyz/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056079",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a858f-ef98-48e9-b1b5-236d950d210f",
        "value": "gcbdwbtshl.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056079",
        "to_ids": true,
        "type": "url",
        "uuid": "594a858f-0958-4c36-8f5b-44d4950d210f",
        "value": "http://wxcjqfevrkosp.biz/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056079",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a858f-b9f8-469e-865a-4e5e950d210f",
        "value": "wxcjqfevrkosp.biz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056080",
        "to_ids": true,
        "type": "url",
        "uuid": "594a8590-70a8-456b-a58b-235f950d210f",
        "value": "http://hllfhiqwneuwwx.biz/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056080",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a8590-ebcc-4c60-ad04-475b950d210f",
        "value": "hllfhiqwneuwwx.biz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056080",
        "to_ids": true,
        "type": "url",
        "uuid": "594a8590-c8b4-43ff-bc00-4502950d210f",
        "value": "http://agnfmqvhomsa.work/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056080",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a8590-768c-4d06-af5c-4bef950d210f",
        "value": "agnfmqvhomsa.work"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056080",
        "to_ids": true,
        "type": "url",
        "uuid": "594a8590-6614-4fc5-8991-416f950d210f",
        "value": "http://ythjvjhtgsfgesd.biz/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056081",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a8591-3b68-4fa9-a31c-4c00950d210f",
        "value": "ythjvjhtgsfgesd.biz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056081",
        "to_ids": true,
        "type": "url",
        "uuid": "594a8591-feac-4129-9c5c-2ae0950d210f",
        "value": "http://kabssqyef.info/checkupdate"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498056081",
        "to_ids": true,
        "type": "hostname",
        "uuid": "594a8591-8b20-4e9c-ac7b-478c950d210f",
        "value": "kabssqyef.info"
      }
    ]
  }
}