266 lines
No EOL
8.6 KiB
JSON
266 lines
No EOL
8.6 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2017-08-31",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Active ransomware attack uses impersonation and embedded advanced threats",
|
|
"publish_timestamp": "1514467840",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1513738826",
|
|
"uuid": "5a37887b-efe0-43ba-8542-435c950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#2c4f00",
|
|
"local": false,
|
|
"name": "malware_classification:malware-category=\"Ransomware\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1513594331",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "5a378895-b7d8-49b2-a28c-44ca950d210f",
|
|
"value": "In this attack, the source of the email is a spoofed address, and the attachment name and number is included in the subject line and body of the message. The full subject line in this example is \u00e2\u20ac\u0153Emailing: Payment_201708-6165\u00e2\u20ac\u009d and the number in the attachment name is variable.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1513594331",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5a3788f1-413c-4fb5-aba2-4898950d210f",
|
|
"value": "https://blog.barracuda.com/2017/08/31/active-ransomware-attack-uses-impersonation-and-embedded-advanced-threats/",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "7",
|
|
"timestamp": "1513589237",
|
|
"uuid": "5a3789f2-9004-4a04-a2e8-473b950d210f",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "5a3789f2-9004-4a04-a2e8-473b950d210f",
|
|
"referenced_uuid": "bd9400ef-6830-41e8-bf08-6f8a05193923",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1514467840",
|
|
"uuid": "5a379ddc-38ec-4f08-9690-488602de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1513589234",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5a3789f2-4988-41dd-aa0a-4493950d210f",
|
|
"value": "d5d67631683c9e3d5021334477746a1e64ea2dff"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1513589234",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5a3789f2-4a8c-492b-b682-4096950d210f",
|
|
"value": "87d0d011b8b456ce8fa15afea8df5e5fbf1bad5cb3305272016ca0db9c204d90"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1513589234",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5a3789f2-dab8-4ded-819b-4cda950d210f",
|
|
"value": "fa527ff057e1be5101da4481d38ba968"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1513589234",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5a3789f2-f5ac-40c3-ad1a-4237950d210f",
|
|
"value": "Malicious"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "size-in-bytes",
|
|
"timestamp": "1513589234",
|
|
"to_ids": false,
|
|
"type": "size-in-bytes",
|
|
"uuid": "5a3789f2-80d8-4064-8e0b-4f0f950d210f",
|
|
"value": "20363"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "Email object describing an email with meta-information",
|
|
"meta-category": "network",
|
|
"name": "email",
|
|
"template_uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552",
|
|
"template_version": "7",
|
|
"timestamp": "1513590107",
|
|
"uuid": "5a378d5b-bcac-4fda-816f-48e8950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "number is variable",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "subject",
|
|
"timestamp": "1513590107",
|
|
"to_ids": false,
|
|
"type": "email-subject",
|
|
"uuid": "5a378d5b-d8b4-4f80-9933-41c1950d210f",
|
|
"value": "Emailing: Payment_201708-1160"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "attachment",
|
|
"timestamp": "1513590107",
|
|
"to_ids": true,
|
|
"type": "email-attachment",
|
|
"uuid": "5a378d5b-f760-4ef6-bee5-47c1950d210f",
|
|
"value": "201708-1160.7z"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "send-date",
|
|
"timestamp": "1513590107",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5a378d5b-6eec-49c0-9a98-4079950d210f",
|
|
"value": "2017-08-30T02:13:17"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "1",
|
|
"timestamp": "1513594331",
|
|
"uuid": "bd9400ef-6830-41e8-bf08-6f8a05193923",
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1513594332",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5a379ddc-112c-41c3-ae7e-441602de0b81",
|
|
"value": "https://www.virustotal.com/file/87d0d011b8b456ce8fa15afea8df5e5fbf1bad5cb3305272016ca0db9c204d90/analysis/1505917656/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1513594332",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5a379ddc-e090-4f00-a188-4ad902de0b81",
|
|
"value": "37/59"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1513594332",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5a379ddc-6838-4c7d-92e3-459f02de0b81",
|
|
"value": "2017-09-20T14:27:36"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |