{
  "Event": {
    "analysis": "1",
    "date": "2017-09-22",
    "extends_uuid": "",
    "info": "M2M -  Locky 2017-09-20 : Affid=3, offline, \".ykcol\" : \"New voice message...\" - \"msg0321.7z\"",
    "publish_timestamp": "1506339780",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1506339645",
    "uuid": "59c56149-8ec4-4490-996e-df79950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#006c6c",
        "local": false,
        "name": "ecsirt:malicious-code=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Locky\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "md5",
        "uuid": "59c5614a-bfa4-49df-8383-4082950d210f",
        "value": "5dd7d5899168ac90325b350293c49ee2"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c5614a-1d60-4e3c-ad98-454c950d210f",
        "value": "http://121-psychic-reading.co.uk/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c5614a-eea8-49d3-85a8-4eca950d210f",
        "value": "121-psychic-reading.co.uk"
      },
      {
        "category": "Network activity",
        "comment": "121-psychic-reading.co.uk",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c5614b-44a4-4d33-8c04-4782950d210f",
        "value": "217.168.155.63"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c5614b-f5d4-4442-a6ff-df79950d210f",
        "value": "http://2-wave.com/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c5614b-02f8-4282-bfaa-4c2a950d210f",
        "value": "2-wave.com"
      },
      {
        "category": "Network activity",
        "comment": "2-wave.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c5614c-361c-4727-821a-403f950d210f",
        "value": "209.54.62.81"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c5614c-d9a8-4394-ad71-4933950d210f",
        "value": "http://3e.com.pt/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c5614c-0a14-43f5-8bd0-49a5950d210f",
        "value": "3e.com.pt"
      },
      {
        "category": "Network activity",
        "comment": "3e.com.pt",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c5614d-ba5c-43c3-91c7-4424950d210f",
        "value": "174.141.224.179"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c5614d-9c30-4074-af56-46f8950d210f",
        "value": "http://4advice-interactive.be/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c5614d-2fb0-4714-9d76-e0d9950d210f",
        "value": "4advice-interactive.be"
      },
      {
        "category": "Network activity",
        "comment": "4advice-interactive.be",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c5614d-a3c0-4a21-b96e-4a90950d210f",
        "value": "91.121.20.89"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c5614e-6458-4bb4-91be-e0c7950d210f",
        "value": "http://9ninewright.net/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c5614e-c800-47aa-a30e-477e950d210f",
        "value": "9ninewright.net"
      },
      {
        "category": "Network activity",
        "comment": "9ninewright.net",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c5614e-7c70-45b8-acaf-45fc950d210f",
        "value": "98.124.251.65"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c5614e-dd40-46ab-bdc2-4359950d210f",
        "value": "http://adaliyapi.com/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c5614f-20e8-4bc5-925b-4a82950d210f",
        "value": "adaliyapi.com"
      },
      {
        "category": "Network activity",
        "comment": "adaliyapi.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c5614f-1c60-4165-924e-4723950d210f",
        "value": "77.92.99.5"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c5614f-0c14-4b0e-b6fa-4602950d210f",
        "value": "http://ahtwindowcleaning.co.uk/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c5614f-7bfc-4b83-8407-e0d9950d210f",
        "value": "ahtwindowcleaning.co.uk"
      },
      {
        "category": "Network activity",
        "comment": "ahtwindowcleaning.co.uk",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c56150-1a00-4af1-98c1-df79950d210f",
        "value": "81.27.85.25"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c56150-b14c-44a6-be4e-4305950d210f",
        "value": "http://PamelaSparrowChilds.com/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c56150-5c1c-4a31-be36-4aca950d210f",
        "value": "pamelasparrowchilds.com"
      },
      {
        "category": "Network activity",
        "comment": "PamelaSparrowChilds.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c56151-7f1c-44f1-9fbb-4de6950d210f",
        "value": "23.229.153.66"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c56151-fc54-4f31-9f4d-4f3a950d210f",
        "value": "http://rasbery.co.uk/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c56151-9774-4902-a88a-41fb950d210f",
        "value": "rasbery.co.uk"
      },
      {
        "category": "Network activity",
        "comment": "rasbery.co.uk",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c56151-01e8-43fd-af78-4877950d210f",
        "value": "193.189.74.89"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c56152-372c-494d-892b-df79950d210f",
        "value": "http://robinsonfun.pl/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c56152-707c-4ad9-8a1e-4631950d210f",
        "value": "robinsonfun.pl"
      },
      {
        "category": "Network activity",
        "comment": "robinsonfun.pl",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c56152-9410-494e-918b-4cba950d210f",
        "value": "87.98.239.48"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c56152-c7cc-4bf7-a6aa-4a72950d210f",
        "value": "http://ryterorrephat.info/af/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c56152-a71c-4c47-8d14-1330950d210f",
        "value": "ryterorrephat.info"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c56153-0618-45a8-bcb6-4ff8950d210f",
        "value": "http://weddingcarsbury.co.uk/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c56153-0384-4e01-b5ab-e0d9950d210f",
        "value": "weddingcarsbury.co.uk"
      },
      {
        "category": "Network activity",
        "comment": "weddingcarsbury.co.uk",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c56153-92ec-4684-b6c6-44df950d210f",
        "value": "193.189.74.92"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "url",
        "uuid": "59c56153-5aac-4f2e-81a9-4d81950d210f",
        "value": "http://weddingcarsrochdale.co.uk/slehGTexc"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c56154-2150-40d7-b3c8-4ede950d210f",
        "value": "weddingcarsrochdale.co.uk"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 5dd7d5899168ac90325b350293c49ee2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59c56263-8fbc-410d-91e8-133002de0b81",
        "value": "302aabfec6b1696e3019699d6367e4ac9e57037aec6237d9b263ba9a8fbe3418"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 5dd7d5899168ac90325b350293c49ee2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59c56263-2664-4d91-bf06-133002de0b81",
        "value": "6ea25cddbe0957d20d7ddea9efe84d2ba13a84e0"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 5dd7d5899168ac90325b350293c49ee2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108003",
        "to_ids": false,
        "type": "link",
        "uuid": "59c56263-1640-4219-aec2-133002de0b81",
        "value": "https://www.virustotal.com/file/302aabfec6b1696e3019699d6367e4ac9e57037aec6237d9b263ba9a8fbe3418/analysis/1506053356/"
      }
    ]
  }
}