misp-circl-feed/feeds/circl/misp/5888f612-8e50-43d8-9603-4d14950d210f.json

{
  "Event": {
    "analysis": "2",
    "date": "2017-01-25",
    "extends_uuid": "",
    "info": "OSINT - Detecting threat actors in recent German industrial attacks with Windows Defender ATP",
    "publish_timestamp": "1485373971",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1485373965",
    "uuid": "5888f612-8e50-43d8-9603-4d14950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": "0",
        "name": "misp-galaxy:microsoft-activity-group=\"LEAD\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": "0",
        "name": "misp-galaxy:microsoft-activity-group=\"BARIUM\"",
        "relationship_type": ""
      },
      {
        "colour": "#064800",
        "local": "0",
        "name": "misp-galaxy:tool=\"Winnti\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#075200",
        "local": "0",
        "name": "admiralty-scale:source-reliability=\"b\"",
        "relationship_type": ""
      },
      {
        "colour": "#0fc000",
        "local": "0",
        "name": "admiralty-scale:information-credibility=\"2\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Antivirus detection",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485370945",
        "to_ids": false,
        "type": "text",
        "uuid": "5888f641-d0d4-48b5-80d9-4757950d210f",
        "value": "Win32/Barlaiy"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485371195",
        "to_ids": false,
        "type": "link",
        "uuid": "5888f653-6da0-4004-b86b-4063950d210f",
        "value": "https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/",
        "Tag": [
          {
            "colour": "#00223b",
            "local": "0",
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485371204",
        "to_ids": false,
        "type": "text",
        "uuid": "5888f66a-2e6c-4c10-9efe-4df1950d210f",
        "value": "Cybercrime Center banner\r\n\r\nWhen a Germany-based industrial conglomerate disclosed in December 2016 that it was breached early that year, the breach was revealed to be a professionally run industrial espionage attack. According to the German press, the intruders used the Winnti family of malware as their main implant, giving them persistent access to the conglomerate\u00e2\u20ac\u2122s network as early as February 2016.\r\n\r\nIn this blog, we look at the Winnti malware implant as used by two known activity groups BARIUM and LEAD. We look at how these activity groups introduce the implant to various targets and techniques used by Microsoft researchers to track the implant.\r\n\r\nTo show how this breach and similar breaches can be mitigated, we look at how Windows Defender Advanced Threat Protection (Windows Defender ATP) flags activities associated with BARIUM, LEAD, and other known activity groups and how it provides extensive threat intelligence about these groups. We go through the Winnti implant installation process and explore how Windows Defender ATP can capture such attacker methods and tools and provide visualized contextual information that can aid in actual attack investigation and response. We then discuss how centralized response options, provided as enhancements to Windows Defender ATP with the Windows 10 Creators Update, can be used to quickly stop threats, including stopping command and control (C&C) communication and preventing existing implants from installing additional components or from moving laterally to other computers on the network.",
        "Tag": [
          {
            "colour": "#00223b",
            "local": "0",
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485371163",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5888f71b-4428-47c1-9c4e-5bda950d210f",
        "value": "964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485371163",
        "to_ids": true,
        "type": "md5",
        "uuid": "5888f71b-9060-4135-86f9-5bda950d210f",
        "value": "eada46387b377ff07a4f4c36e1778cd2"
      },
      {
        "category": "Payload delivery",
        "comment": "WINNTI / ASPNET_FILTER.DLL",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485371164",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5888f71c-0470-4917-9f46-5bda950d210f",
        "value": "d740674f543565b3616c10c8f9c834ac39bb382f"
      },
      {
        "category": "Payload delivery",
        "comment": "fonfig.exe",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485371165",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5888f71d-fc98-4c85-b5c9-5bda950d210f",
        "value": "56994d107bad32dddf8516351c9c137c3b1d0724"
      },
      {
        "category": "Payload delivery",
        "comment": "NlaifSvc.dll",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485371166",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5888f71e-b0b8-4a22-a0ef-5bda950d210f",
        "value": "07d8314ceff227f32bce19b9a8d33a48eec6c7e7"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485371233",
        "to_ids": false,
        "type": "link",
        "uuid": "5888f761-f828-4fbf-b42e-4bbc02de0b81",
        "value": "https://www.virustotal.com/file/964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5/analysis/1485233046/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1485371317",
        "to_ids": false,
        "type": "link",
        "uuid": "5888f7b5-738c-4861-82e3-47af950d210f",
        "value": "https://blogs.technet.microsoft.com/windowsfurunternehmen/2017/01/25/cyber-angriff-auf-deutsche-industrie-mithilfe-von-windows-defender-atp-aufgedeckt/"
      }
    ]
  }
}