{"Event": {"info": "M2M -  Locky Affid=3, \".asasin\"/Trickbot \"mac1\" 2017-10-25\n : \"Invoice AZ123456\" - \"AZ123456.doc\"", "Tag": [{"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#006c6c", "exportable": true, "name": "ecsirt:malicious-code=\"ransomware\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:ransomware=\"Locky\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:tool=\"Trick Bot\""}], "publish_timestamp": "0", "timestamp": "1508934509", "analysis": "1", "Attribute": [{"comment": "", "category": "Artifacts dropped", "uuid": "59f07792-fe9c-4c9f-b4e9-4b6c950d210f", "timestamp": "1508934502", "to_ids": true, "value": "2119cd6480863198437c021b8b3e6339", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Artifacts dropped", "uuid": "59f07792-3a08-4ee0-ac9f-42cf950d210f", "timestamp": "1508934502", "to_ids": true, "value": "4bbfcc1fc86790fb51917c49ff35925c", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Artifacts dropped", "uuid": "59f07792-bf10-498b-9298-4111950d210f", "timestamp": "1508934502", "to_ids": true, "value": "1a500852b5e32a70d9f585884b23ab30", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Network activity", "uuid": "59f07792-c3e0-44ae-a70d-44aa950d210f", "timestamp": "1508934502", "to_ids": true, "value": "http://cirad.or.id/JHGxte633", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f07793-a2cc-49df-97cd-414d950d210f", "timestamp": "1508934502", "to_ids": true, "value": "cirad.or.id", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "cirad.or.id", "category": "Network activity", "uuid": "59f07794-1b28-4646-a73d-4009950d210f", "timestamp": "1508934502", "to_ids": false, "value": "202.145.0.45", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f07794-f1c4-4743-961d-21ef950d210f", "timestamp": "1508934502", "to_ids": true, "value": "http://deroeckrecycling.nl/JHGxte633", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f07795-e734-4ac7-904d-45b7950d210f", "timestamp": "1508934502", "to_ids": true, "value": "deroeckrecycling.nl", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "deroeckrecycling.nl", "category": "Network activity", "uuid": "59f07795-ceac-4673-ab11-4651950d210f", "timestamp": "1508934502", "to_ids": false, "value": "94.126.70.2", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f07795-61b8-4cb8-bd1b-43fd950d210f", "timestamp": "1508934502", "to_ids": true, "value": "http://dnhconsultores.com/JHGxte633", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f07795-9c00-4d70-a466-42be950d210f", "timestamp": "1508934502", "to_ids": true, "value": "dnhconsultores.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "dnhconsultores.com", "category": "Network activity", "uuid": "59f07796-110c-4703-aafc-48a5950d210f", "timestamp": "1508934502", "to_ids": false, "value": "212.227.138.50", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f07796-0364-45d4-b527-2380950d210f", "timestamp": "1508934502", "to_ids": true, "value": "http://clinicapaulocardozo.pt/cjiwgf87634", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f07796-b748-4325-bb69-2277950d210f", "timestamp": "1508934502", "to_ids": true, "value": "clinicapaulocardozo.pt", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "clinicapaulocardozo.pt", "category": "Network activity", "uuid": "59f07797-ad10-424a-8413-2177950d210f", "timestamp": "1508934502", "to_ids": false, "value": "80.172.241.42", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f07797-cfe8-4cbd-907e-45bf950d210f", "timestamp": "1508934502", "to_ids": true, "value": "http://comfortshow.net/cjiwgf87634", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f07797-b770-4afb-b7f9-498e950d210f", "timestamp": "1508934502", "to_ids": true, "value": "comfortshow.net", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "comfortshow.net", "category": "Network activity", "uuid": "59f07798-45fc-4a4c-ba9c-46cc950d210f", "timestamp": "1508934502", "to_ids": false, "value": "185.58.7.116", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f07798-8018-4aa7-b1a1-2183950d210f", "timestamp": "1508934502", "to_ids": true, "value": "http://colegiomayex.es/cjiwgf87634", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f07798-fcd0-402f-8a56-4bfc950d210f", "timestamp": "1508934502", "to_ids": true, "value": "colegiomayex.es", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "colegiomayex.es", "category": "Network activity", "uuid": "59f07798-67ec-48f8-b2cd-4595950d210f", "timestamp": "1508934502", "to_ids": false, "value": "86.109.162.92", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f07799-9b98-41d1-8854-2367950d210f", "timestamp": "1508934502", "to_ids": true, "value": "http://c2bychuchai.com/cjiwgf87634", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f07799-48fc-44c1-9cd9-4eee950d210f", "timestamp": "1508934503", "to_ids": true, "value": "c2bychuchai.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "c2bychuchai.com", "category": "Network activity", "uuid": "59f0779a-bdfc-4ac1-8a17-2177950d210f", "timestamp": "1508934503", "to_ids": false, "value": "52.220.90.147", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779a-90fc-4b14-99e9-21ef950d210f", "timestamp": "1508934503", "to_ids": true, "value": "http://toundlefa.net/", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f0779a-269c-4f5e-98c9-462d950d210f", "timestamp": "1508934503", "to_ids": true, "value": "toundlefa.net", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "toundlefa.net", "category": "Network activity", "uuid": "59f0779b-f988-4beb-945d-45b7950d210f", "timestamp": "1508934503", "to_ids": false, "value": "34.236.147.16", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779c-46cc-4750-b97d-46a1950d210f", "timestamp": "1508934503", "to_ids": true, "value": "http://highlandfamily.org/JHui834.enc", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f0779c-0c18-42c8-bc72-4a3c950d210f", "timestamp": "1508934503", "to_ids": true, "value": "highlandfamily.org", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "highlandfamily.org", "category": "Network activity", "uuid": "59f0779c-5870-4275-809e-2380950d210f", "timestamp": "1508934503", "to_ids": false, "value": "98.124.252.66", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779c-35c8-4180-af3e-4a67950d210f", "timestamp": "1508934503", "to_ids": true, "value": "http://givagarden.com/KJHg7643.enc", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "59f0779d-6158-4b65-9d71-4b8c950d210f", "timestamp": "1508934503", "to_ids": true, "value": "givagarden.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "givagarden.com", "category": "Network activity", "uuid": "59f0779d-afa0-4947-afb7-21ef950d210f", "timestamp": "1508934503", "to_ids": false, "value": "93.186.244.43", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779d-d8b4-43a2-808b-4917950d210f", "timestamp": "1508934503", "to_ids": false, "value": "176.120.126.21", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779d-411c-452f-a3ca-4d27950d210f", "timestamp": "1508934503", "to_ids": false, "value": "156.17.92.161", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779e-fc5c-4445-8582-2183950d210f", "timestamp": "1508934503", "to_ids": false, "value": "178.254.183.34", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779e-c724-4c47-9401-4412950d210f", "timestamp": "1508934503", "to_ids": false, "value": "178.254.183.13", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779e-b658-46f6-8e54-42ee950d210f", "timestamp": "1508934503", "to_ids": false, "value": "94.251.188.225", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779e-0598-4578-95e6-40f8950d210f", "timestamp": "1508934503", "to_ids": false, "value": "178.169.129.202", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779f-7eec-467b-b695-2380950d210f", "timestamp": "1508934503", "to_ids": false, "value": "188.120.249.181", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779f-8760-45f1-9a38-4457950d210f", "timestamp": "1508934503", "to_ids": false, "value": "62.109.9.121", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f0779f-0e88-4764-bd61-2177950d210f", "timestamp": "1508934503", "to_ids": false, "value": "185.34.52.193", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a0-0b64-4c8a-842a-4bde950d210f", "timestamp": "1508934503", "to_ids": false, "value": "62.109.24.224", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a0-66e0-46f7-a52a-4812950d210f", "timestamp": "1508934503", "to_ids": false, "value": "82.146.59.195", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a0-16a0-4060-b7a2-4df0950d210f", "timestamp": "1508934503", "to_ids": false, "value": "80.87.198.199", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a1-c0d8-4e2d-850e-2183950d210f", "timestamp": "1508934503", "to_ids": false, "value": "62.109.26.77", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a1-d140-48eb-90df-42c2950d210f", "timestamp": "1508934503", "to_ids": false, "value": "194.87.234.254", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a1-56a4-4fdc-83f4-4e8b950d210f", "timestamp": "1508934503", "to_ids": false, "value": "194.87.236.14", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a2-65a0-4405-b1f6-2367950d210f", "timestamp": "1508934503", "to_ids": false, "value": "188.120.249.77", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a2-64e8-47df-9409-4dd2950d210f", "timestamp": "1508934503", "to_ids": false, "value": "188.120.249.119", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a2-3ca8-4cfb-b32a-2177950d210f", "timestamp": "1508934503", "to_ids": false, "value": "194.87.238.250", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a3-7ca4-46f3-93d0-212d950d210f", "timestamp": "1508934503", "to_ids": false, "value": "195.133.146.221", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a3-b014-4e2d-b0cd-4cb5950d210f", "timestamp": "1508934503", "to_ids": false, "value": "194.87.102.114", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a3-ca40-492f-9714-404b950d210f", "timestamp": "1508934503", "to_ids": false, "value": "185.80.128.122", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a3-1110-4102-86a6-2183950d210f", "timestamp": "1508934503", "to_ids": false, "value": "188.120.249.190", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a4-1854-4870-9f57-48d8950d210f", "timestamp": "1508934503", "to_ids": false, "value": "194.87.111.202", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a4-f2b8-4864-8e33-40ec950d210f", "timestamp": "1508934503", "to_ids": false, "value": "185.125.46.104", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a5-774c-43af-96d2-2367950d210f", "timestamp": "1508934503", "to_ids": false, "value": "194.87.237.249", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a5-9904-4130-b43f-2380950d210f", "timestamp": "1508934503", "to_ids": false, "value": "62.109.29.243", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a5-0998-45ad-9756-4976950d210f", "timestamp": "1508934503", "to_ids": false, "value": "95.154.199.47", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a5-47d4-4184-954e-21ef950d210f", "timestamp": "1508934503", "to_ids": false, "value": "62.109.17.145", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "59f077a6-5340-4f7b-b7ab-4b44950d210f", "timestamp": "1508934503", "to_ids": false, "value": "185.158.115.7", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "- Xchecked via VT: 4bbfcc1fc86790fb51917c49ff35925c", "category": "Artifacts dropped", "uuid": "59f08367-7b90-4718-a7c6-49f102de0b81", "timestamp": "1508934503", "to_ids": true, "value": "2a4a09ddbaeb53d09a633d3a29c46d661c1504542ff342d4044d56a8f823ad7e", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "- Xchecked via VT: 4bbfcc1fc86790fb51917c49ff35925c", "category": "Artifacts dropped", "uuid": "59f08367-dc14-4f94-a62d-440b02de0b81", "timestamp": "1508934503", "to_ids": true, "value": "ef3e48301e7b339b28ddc5436e4ec15b9726af82", "disable_correlation": false, "object_relation": null, "type": "sha1"}, {"comment": "- Xchecked via VT: 4bbfcc1fc86790fb51917c49ff35925c", "category": "External analysis", "uuid": "59f08367-a400-41cd-8271-4ad002de0b81", "timestamp": "1508934503", "to_ids": false, "value": "https://www.virustotal.com/file/2a4a09ddbaeb53d09a633d3a29c46d661c1504542ff342d4044d56a8f823ad7e/analysis/1508932619/", "disable_correlation": false, "object_relation": null, "type": "link"}, {"comment": "- Xchecked via VT: 2119cd6480863198437c021b8b3e6339", "category": "Artifacts dropped", "uuid": "59f08367-e5f0-4952-957b-458d02de0b81", "timestamp": "1508934503", "to_ids": true, "value": "798aa42748dcb1078824c2027cf6a0d151c14e945cb902382fcd9ae646bfa120", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "- Xchecked via VT: 2119cd6480863198437c021b8b3e6339", "category": "Artifacts dropped", "uuid": "59f08367-e234-4f54-b04c-432502de0b81", "timestamp": "1508934503", "to_ids": true, "value": "4356cedce0409b45348eda0c378783e7bf5ee781", "disable_correlation": false, "object_relation": null, "type": "sha1"}, {"comment": "- Xchecked via VT: 2119cd6480863198437c021b8b3e6339", "category": "External analysis", "uuid": "59f08367-b0f8-41a1-97bf-4b6f02de0b81", "timestamp": "1508934503", "to_ids": false, "value": "https://www.virustotal.com/file/798aa42748dcb1078824c2027cf6a0d151c14e945cb902382fcd9ae646bfa120/analysis/1508932972/", "disable_correlation": false, "object_relation": null, "type": "link"}], "extends_uuid": "", "published": false, "date": "2017-10-25", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "59f07791-b430-4a85-97c8-452d950d210f"}}