2094 lines
No EOL
70 KiB
JSON
2094 lines
No EOL
70 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "0",
|
|
"date": "2021-10-05",
|
|
"extends_uuid": "",
|
|
"info": "UEFI threats moving to the ESP: Introducing ESPecter bootkit",
|
|
"publish_timestamp": "1637336957",
|
|
"published": true,
|
|
"threat_level_id": "1",
|
|
"timestamp": "1637336858",
|
|
"uuid": "5df8df26-fe0e-4858-94a7-6cf71d9519c9",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"local": "0",
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0071c3",
|
|
"local": "0",
|
|
"name": "osint:lifetime=\"perpetual\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0087e8",
|
|
"local": "0",
|
|
"name": "osint:certainty=\"50\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Pre-OS Boot - T1542\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Hidden File System - T1564.005\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Rename System Utilities - T1036.003\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Patch System Image - T1601.001\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1406\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Bootkit - T1542.003\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Code Signing Policy Modification - T1553.006\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#054300",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Time Based Evasion - T1497.003\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#075900",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Application Window Discovery - T1010\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1420\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Peripheral Device Discovery - T1120\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1424\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1426\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"System Time Discovery - T1124\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Data from Removable Media - T1025\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1417\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1513\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#064500",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Multi-Stage Channels - T1104\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Transfer - T1029\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:tool=\"ESPecter bootkit\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636639702",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "2a49a854-10b5-4365-91e9-3f4a585eaf42",
|
|
"value": "EFI/Rootkit.ESPecter"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636639702",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "e4f416a2-85e2-43fd-a0d0-f282188e291e",
|
|
"value": "Win32/Rootkit.ESPecter"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636639702",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "0e1708e4-f25e-4ebe-acc7-e77dc5a906dd",
|
|
"value": "Win64/Rootkit.ESPecter"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C from configurations",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636642000",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "a74af413-79fa-4909-9c0e-5da293a89d14",
|
|
"value": "196.1.2.111"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C from configurations",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636642000",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "ddf93926-3645-4e64-8e21-e3cadcb42dbe",
|
|
"value": "103.212.69.175"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C from configurations",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636642000",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "4822dadc-6680-4b7b-948b-5eb0eecf329c",
|
|
"value": "183.90.187.65"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C from configurations",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636642000",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "cd507edf-d207-4fc8-ab5a-981f43ba2a51",
|
|
"value": "61.178.79.69"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C from configurations",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636642000",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "8ce804d8-0129-47b2-aadb-e794772944d9",
|
|
"value": "swj02.gicp.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C from configurations",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636642000",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "6f4ef921-6bf4-4692-bbad-e48ce05eb228",
|
|
"value": "server.microsoftassistant.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C from configurations",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636642000",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "c2f4e331-a13d-49b0-a01a-bc053da56769",
|
|
"value": "yspark.justdied.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C from configurations",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636642000",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "043a8bb1-1a42-4737-b72c-26c5701aa7f8",
|
|
"value": "crystalnba.com"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Configuration file path",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636707097",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "c3972c5b-f600-426b-8a03-2b82bad6fedb",
|
|
"value": "%windir%\\Temp\\syslog"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Base directory for the collected data (%BaseDir%)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636710373",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "053dfa99-3d2f-4498-ab6a-544bdd2f06f1",
|
|
"value": "%sysdir%\\Media\\NPCSJDLFSD"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Base directory for the collected data (%BaseDir%)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636710373",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "604f4489-cfe4-48b6-a71e-4115cc6e1686",
|
|
"value": "%windir%\\Temp\\NPCSJDLFSD"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Screenshots directory",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712281",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "a41f57f0-b112-4bac-be5d-d079b1ef3654",
|
|
"value": "%BaseDir%\\SSQWCVBER"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Stolen documents directory",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712316",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "a727a6a4-d692-46a6-a471-ca8438b99206",
|
|
"value": "%BaseDir%\\UTXZCZXQ"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Intercepted keyboard logs directory",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712345",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "6bb145ae-a23b-4186-98e6-4af2afe63a85",
|
|
"value": "%BaseDir%\\KLACVSWER"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Encrypted user-mode payloads files",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712375",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "36eab666-2303-41b4-86db-d2d4630b1c4b",
|
|
"value": "%windir%\\Temp\\dd_vcredist"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Encrypted user-mode payloads files",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712375",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5daed22d-ca0c-49d0-af03-d71fc869467b",
|
|
"value": "%windir%\\Temp\\memlog"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Encrypted user-mode payloads files",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712375",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "e7adc49c-33af-4fc7-9111-d8a7a5479dce",
|
|
"value": "%windir%\\Temp\\vmmmlog"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Encrypted user-mode payloads files",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712375",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "53a6c33c-ba99-4e25-9741-bac2877adfe0",
|
|
"value": "%windir%\\Temp\\vmmmmlog"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Decrypted user-mode payloads files",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712399",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "387b69b7-6336-4b2f-aaf2-61ca43c12dbf",
|
|
"value": "%windir%\\Temp\\vmmmlog.exe"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Decrypted user-mode payloads files",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712399",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "f134b566-0efa-4e8d-a0c2-983ab1a10951",
|
|
"value": "%windir%\\Temp\\vmmmmlog.exe"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Decrypted user-mode payloads files",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712399",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "f9fc7f74-52ed-4b13-aa18-cb696b3f71b2",
|
|
"value": "\\SystemRoot\\System32\\Client.dll"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Decrypted user-mode payloads files",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712399",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "f07e6d67-1608-4ecf-841a-beebc4d55450",
|
|
"value": "\\SystemRoot\\System32\\WinSys.dll"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Backed up clean null.sys or beep.sys driver path",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1636712424",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "81db953f-ae79-4e07-95cf-86c9aa5f315b",
|
|
"value": "%windir%\\\\Help\\\\intel.chm"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712659",
|
|
"uuid": "3de8d0d9-4538-4295-86c4-4a8c2115d031",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712659",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "201fdac1-bcda-4361-80f1-8343eb926eba",
|
|
"value": "6b2ad6114029d60f7c40f306271669b3a69ea270"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1636712659",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "81fc1025-f6c3-44e3-a106-fb82503e2642",
|
|
"value": "WinSys.dll"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712641",
|
|
"uuid": "a1e4283a-d00f-4c04-b605-19b4df73fa29",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712641",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "c384ad11-71de-41a0-bf4e-f25b5decc139",
|
|
"value": "0a97efa15a62e90d71f643b693b3dd3cf2657b9f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1636712641",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "85c4cf24-9c78-486f-a50b-c9a7541054a5",
|
|
"value": "WinSys.dll"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712546",
|
|
"uuid": "d3624e94-1ce5-439d-800d-b14cde62ca8c",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712546",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "ec7e1ece-ddbc-4eb8-9f6d-bfb4b0f75eb3",
|
|
"value": "7f501aeb51ce3232a979ccf0e11278346f746d1f"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712624",
|
|
"uuid": "7ed3898f-469c-4503-9ced-31ef0edc4598",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712624",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "71a57b02-a4fb-47c4-8e57-f9451065aaf4",
|
|
"value": "81e6d19865647dc160861e2154d6903fc78c7dfb"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1636712624",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "9fec9793-7957-43a7-9caa-d70d5fd8a73c",
|
|
"value": "WinSys.dll"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712568",
|
|
"uuid": "bdfbf198-91a4-4e34-87fa-20ffbcb938cb",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Kernel drivers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712568",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "f58e6402-e77e-48bb-b650-786c93e15513",
|
|
"value": "cae4b2c049542fd28667ca6e9afa440b3f0138f9"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712677",
|
|
"uuid": "44ecfdbb-15ad-4da5-ae60-ae9e86a8fcbd",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Kernel drivers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712677",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "db633b84-89b5-44aa-ae9d-b18fe09efbb5",
|
|
"value": "09f0f17aeccdef5cb1112bc9bef0fe4f828d6d3b"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712693",
|
|
"uuid": "7c8585c7-f16d-4160-b518-f64330929a65",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Kernel drivers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712693",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "457984b3-27e1-4dc4-9821-178d1d8ee84e",
|
|
"value": "99dc33bedf4cb9bdbdf04cc60e1da55cfbeadc09"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712714",
|
|
"uuid": "6e6295bb-4caa-4c86-9c3b-7982df4b1579",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Kernel drivers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712714",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "e970d552-46ee-4638-9707-1ab6fe61d621",
|
|
"value": "c06eeb1600cf4e8aac91730e00dd7c169738afde"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712725",
|
|
"uuid": "8434d591-d6d9-4043-a68b-b7f7aa7632cb",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712725",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "956aba87-8feb-4624-9428-db302b4ad8d4",
|
|
"value": "dcd42b04705b784ad62bb36e17305b6e6414f033"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712739",
|
|
"uuid": "3a91a09d-baab-4f83-b313-f17e83e6225b",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Kernel drivers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712739",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "60450c05-c377-429d-a1ac-86295ac74734",
|
|
"value": "374d1a399ef44472ee088563d621df28221cbcce"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712757",
|
|
"uuid": "8f23b33c-1f63-4a59-88d5-f1913185f8c2",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Compromised UEFI Windows Boot Manager",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712757",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "820675a1-31fd-442b-a9f3-cd2dadd12ec1",
|
|
"value": "8ab33e432c8bee54ae759dfb5346d21387f26902"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712774",
|
|
"uuid": "5076da52-2497-4dcd-b7eb-6b13bd387df5",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712774",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "ea4d5b00-06ff-4014-9202-11bf04beb033",
|
|
"value": "656c263fa004bb3e6f3ee6ef6767d101869c7f7c"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636712795",
|
|
"uuid": "313ae7bc-b8cb-4fc6-b646-8379f9fb0917",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712795",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "1ccc56d1-2711-40f1-848f-37af88296f77",
|
|
"value": "1d75bfb18ffc0b820cb36acf8707343fa6679863"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636718982",
|
|
"uuid": "0ac2f3e6-37a7-4ad6-ab4b-b6d20c19e775",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Kernel drivers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636718982",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "9aa4c900-1ea6-4847-be0c-b3bb3811e19e",
|
|
"value": "865f5b87b5f6fb75f3ec68ca05a21cc36446812f"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719000",
|
|
"uuid": "8cb316d8-7c13-4d62-ae36-65336aaa80fb",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719000",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "3c747127-2721-41bf-bfa7-ae6080f423e1",
|
|
"value": "9f6df0a011748160b0c18fb2b44ebe9fa9d517e9"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719028",
|
|
"uuid": "d24fb77d-e776-4d2b-9480-4c430733a2d9",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719028",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5ad18bbe-bc0c-4aee-aa08-108f8c6a2943",
|
|
"value": "2c22ae243fdc08b84b38d9580900a9a9e3823acf"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719042",
|
|
"uuid": "3bae573d-d93e-468a-8406-47b55de6e76f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719042",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "7096ce05-0023-4396-9a3c-836bba036a6a",
|
|
"value": "abc03a234233c63330c744fda784385273af395b"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719164",
|
|
"uuid": "436005da-d100-4543-9329-6939546bcd98",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Kernel drivers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719164",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "c5b860ff-2172-4d1d-8d4d-c18b1fdff2ef",
|
|
"value": "7ad4442d3c02fa145bef9bf18c9464c3e4449224"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719178",
|
|
"uuid": "59c35d4e-4420-4266-992f-1aa58906e157",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719178",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "640961ee-8ced-47c7-81fd-5030271f64b2",
|
|
"value": "a8b4fe8a421c86eae060bb8bf525ef1e1fc133b2"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719203",
|
|
"uuid": "2f941274-cb1e-4499-8407-1af90a163231",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719203",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "efd031a7-907c-4082-a074-2d7d5cf1a754",
|
|
"value": "08077d940f2b385fbd287d84edb58493136c8391"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719337",
|
|
"uuid": "0e48addd-4a98-4045-9725-3d43918787c9",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Compromised UEFI Windows Boot Manager",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719337",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "2e39aa21-5745-4fec-9806-f2b2240a658b",
|
|
"value": "27ad0a8a88eab01e2b48ba19d2aaabf360ece5b8"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719408",
|
|
"uuid": "28c3fa40-019d-4de0-b203-eb3b4921cf08",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719408",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "bd087164-c556-4836-8bfd-e93d1f454adf",
|
|
"value": "3ac6f9458a4a1a16390379621fdd230c656fc444"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719452",
|
|
"uuid": "bf9c1674-2f1d-4a0c-8fa6-7efa805f8dd6",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719452",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "c3922256-6777-45c2-a3cb-d0cf8177cf76",
|
|
"value": "37e49dbceb1354d508319548a7efbd149bfa0e8d"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719470",
|
|
"uuid": "e2c5cac5-a603-44ad-a47a-e4e11795d57b",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Kernel drivers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719470",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "26093294-6ca8-4863-b673-e469bc27c83e",
|
|
"value": "ca19347287fce93f2c675efdf88c8b0db4910929"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636719813",
|
|
"uuid": "a88b2df4-d1c2-4ad3-8f92-bca70dca1cc5",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Kernel drivers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719813",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "705b419e-3f71-42a7-a54e-6bf8cc939c62",
|
|
"value": "c8c2c127ec6af87d96b058ff023b534f1237215c"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636720590",
|
|
"uuid": "83cd3826-3f69-48e2-b91d-c319ecd366be",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636720590",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "ab8fad2c-7210-45ed-8285-5be08f14221e",
|
|
"value": "c7fe86e5981b39927275873c3a386cb1d8c93a6b"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1636720590",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "abe194c7-5fae-467d-ba69-ed9a5e16610e",
|
|
"value": "WinSys.dll"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636720773",
|
|
"uuid": "5d3cc885-69a8-44b6-942d-76a205b5b9bf",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636720773",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "96eb5311-75ae-458b-bf8a-0f41664ee161",
|
|
"value": "180b0e6a4a3334aaa4249b3d631695a31eb45d7a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1636720773",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "e6bd4bcf-87ca-40cb-8f3c-b81f71188577",
|
|
"value": "WinSys.dll"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636720803",
|
|
"uuid": "c3680318-bdc8-4e35-9722-7401eac56247",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636720803",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "a0e0d316-bb46-42cf-8595-9dd6f45c61bd",
|
|
"value": "030b97860ed5a3089c5e8efb8edd7cc359134124"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1636720803",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "bda672dc-10f7-4adb-98a9-eeb464ff0dfd",
|
|
"value": "WinSys.dll"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636722478",
|
|
"uuid": "92800ef6-15f8-48b7-90ea-e8a819affda4",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636722478",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "c3901a78-5cfb-47c7-b7e7-40e3acae68ca",
|
|
"value": "26f7757602000bcc3c18a887dbc7416ae43bf61a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1636722478",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "11c77d67-057f-4976-86fe-f404daf14c08",
|
|
"value": "WinSys.dll"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636722428",
|
|
"uuid": "4897f3a4-3ae7-45e3-82a3-b14314cbfc29",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636722428",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "4e95abab-70c2-4dd7-bc13-20582e8f927e",
|
|
"value": "abb410a4f863b101c218990664981914d14f1e58"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1636722428",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "bb9e1c9a-9a59-4632-a4de-1bb4753f5501",
|
|
"value": "WinSys.dll"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1636720564",
|
|
"uuid": "2fe0f668-8003-49d9-98e8-d5123f12a56d",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636720564",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "6de73982-5bdf-46e4-bfac-2b0cead8d79f",
|
|
"value": "0a8a388911a7a368fc1cf111fb26ba92a19fed3e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1636720564",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "6d7845fe-55b9-487b-9ff6-c8aaa3eddc9a",
|
|
"value": "WinSys.dll"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "Metadata used to generate an executive level report",
|
|
"meta-category": "misc",
|
|
"name": "report",
|
|
"template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
|
|
"template_version": "4",
|
|
"timestamp": "1636723218",
|
|
"uuid": "00757583-07b5-44cf-aaf0-7e71aebf60ff",
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "link",
|
|
"timestamp": "1636723218",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "0421b6c2-5056-4448-9950-199a346cada2",
|
|
"value": "https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "summary",
|
|
"timestamp": "1636723218",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "6eb32b17-8975-4ca9-994f-21f4e10f2203",
|
|
"value": "ESET researchers have analyzed a previously undocumented, real-world UEFI bootkit that persists on the EFI System Partition (ESP). The bootkit, which we\u2019ve named ESPecter, can bypass Windows Driver Signature Enforcement to load its own unsigned driver, which facilitates its espionage activities. Alongside Kaspersky\u2019s recent discovery of the unrelated FinSpy bootkit, it is now safe to say that real-world UEFI threats are no longer limited to SPI flash implants, as used by Lojax."
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "type",
|
|
"timestamp": "1636723218",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "66228cc7-a06e-41fe-bc32-f278038eb512",
|
|
"value": "Online Article"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "Metadata used to generate an executive level report",
|
|
"meta-category": "misc",
|
|
"name": "report",
|
|
"template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
|
|
"template_version": "4",
|
|
"timestamp": "1637309504",
|
|
"uuid": "704e5969-5b1d-4325-b7fc-4a6d923bbda5",
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "link",
|
|
"timestamp": "1637309504",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "d1c1cf4e-6d05-4e71-8e8f-fa03cf3a7ae8",
|
|
"value": "https://github.com/eset/malware-ioc/tree/master/especter"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "type",
|
|
"timestamp": "1637309504",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "b86f621a-6a55-4335-85b1-3d118630e883",
|
|
"value": "Report"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1637335864",
|
|
"uuid": "a9021b55-afc0-437c-b972-3079eab113d1",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "a9021b55-afc0-437c-b972-3079eab113d1",
|
|
"referenced_uuid": "7ef11d83-1085-4d24-910e-5f66372ed7ef",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1637335864",
|
|
"uuid": "1f971027-eb1a-45f1-aedf-48f51954d1eb"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1636712795",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "b591f7f1-78ed-41ee-87b2-b11303cb9225",
|
|
"value": "6d1a47574ef7598017c13d64769cccfb"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712795",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "1b29804c-4b2b-41b0-8951-30bc5ed6b689",
|
|
"value": "1d75bfb18ffc0b820cb36acf8707343fa6679863"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1636712795",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "f338c7ef-afd3-439e-a4e5-bcaff1669b23",
|
|
"value": "d61417d72a054d45ee33e395079e9d674f891a42ed0ec5357b5a8d91c69858a6"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "4",
|
|
"timestamp": "1637335864",
|
|
"uuid": "7ef11d83-1085-4d24-910e-5f66372ed7ef",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1636712795",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "05c8364f-3b9f-43a2-bbfa-bc5ec545ceda",
|
|
"value": "2021-10-23T06:24:22+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1636712795",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "517a0bfc-2991-4230-8f32-53ae840b286d",
|
|
"value": "https://www.virustotal.com/gui/file/d61417d72a054d45ee33e395079e9d674f891a42ed0ec5357b5a8d91c69858a6/detection/f-d61417d72a054d45ee33e395079e9d674f891a42ed0ec5357b5a8d91c69858a6-1634970262"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1636712795",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "381a6904-7917-4045-abb1-d935df6f7bde",
|
|
"value": "51/68"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1637335864",
|
|
"uuid": "31bcc06e-f214-4193-bd07-83a32e27ad7d",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "31bcc06e-f214-4193-bd07-83a32e27ad7d",
|
|
"referenced_uuid": "aad7d8b5-905e-4cf6-9e67-6182ce4de562",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1637335864",
|
|
"uuid": "b79f665f-478e-4856-bb2b-eac024f9c385"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1636719028",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "73520d9b-46cb-49a9-ab97-9d99b122643b",
|
|
"value": "3846c93e3f937b2ba156d28943be1bc9"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719028",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "bb3a5601-3e5f-46c2-924a-5783e7a099b5",
|
|
"value": "2c22ae243fdc08b84b38d9580900a9a9e3823acf"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1636719028",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "b1ecd34b-88c4-4fd7-9527-d628d90f16e8",
|
|
"value": "021ec918c30a65a9f93919cedf57e8c935df3e773e03b74704d14fabcab89c5b"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "4",
|
|
"timestamp": "1637335864",
|
|
"uuid": "aad7d8b5-905e-4cf6-9e67-6182ce4de562",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1636719028",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "30970fd5-8c1f-400d-a782-c6fd7f440cf8",
|
|
"value": "2021-10-27T13:27:29+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1636719028",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "dea2c8bd-664a-4cfb-91dc-925ed568a53e",
|
|
"value": "https://www.virustotal.com/gui/file/021ec918c30a65a9f93919cedf57e8c935df3e773e03b74704d14fabcab89c5b/detection/f-021ec918c30a65a9f93919cedf57e8c935df3e773e03b74704d14fabcab89c5b-1635341249"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1636719028",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "fc178cf5-6ef6-4bf9-9647-bf9ad621c001",
|
|
"value": "57/68"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1637335864",
|
|
"uuid": "e69670e4-f98d-4be6-953c-933b681d802b",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "e69670e4-f98d-4be6-953c-933b681d802b",
|
|
"referenced_uuid": "3e418ab5-d67d-46cd-b630-f40b287784b7",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1637335864",
|
|
"uuid": "b94082c1-3884-48b4-89cb-59e322037a9a"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1636720590",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "f56572f3-5194-4a81-83ee-d746b3bbd71d",
|
|
"value": "73ba4d13914f30dd8b36bc2fd561c0df"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636720590",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "38e04073-1f2e-4d55-a44f-6115bde1bdbf",
|
|
"value": "c7fe86e5981b39927275873c3a386cb1d8c93a6b"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1636720590",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "89a7d94f-a6f4-463d-8f3d-46be09162678",
|
|
"value": "e2bb96b57fa337e3ee2f7d26b1710a80e89449c41c77ff58073cd386dbf83b63"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "4",
|
|
"timestamp": "1637335864",
|
|
"uuid": "3e418ab5-d67d-46cd-b630-f40b287784b7",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1636720590",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "42d04113-0f63-403b-a40e-bae622212d24",
|
|
"value": "2021-10-23T05:15:58+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1636720590",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "96171dfc-6935-4a36-ac21-57f3bab010e4",
|
|
"value": "https://www.virustotal.com/gui/file/e2bb96b57fa337e3ee2f7d26b1710a80e89449c41c77ff58073cd386dbf83b63/detection/f-e2bb96b57fa337e3ee2f7d26b1710a80e89449c41c77ff58073cd386dbf83b63-1634966158"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1636720590",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "3adb1480-8bc7-40cc-a306-c0a1f6ffd0ea",
|
|
"value": "50/65"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1637335864",
|
|
"uuid": "0ce970ae-28ab-457c-a377-d083e527e699",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "0ce970ae-28ab-457c-a377-d083e527e699",
|
|
"referenced_uuid": "9c96483f-0733-4016-80cf-7e5a090da564",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1637335865",
|
|
"uuid": "3a4e8a32-c582-4a56-b4d8-9215c7c19ea0"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1636712546",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "bdf72c3c-efe5-445e-a651-08688e3d7679",
|
|
"value": "2025cc89204d851a57c02a9fd441b619"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636712546",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "6b3b1f25-767d-48c5-a29e-c283c10c54cb",
|
|
"value": "7f501aeb51ce3232a979ccf0e11278346f746d1f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1636712546",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "fa7bf2f4-c0d7-4964-8e7a-2ce7b774535c",
|
|
"value": "5ef62c780d7c9f82dea098972f66d5b3367841913444933cdb779adaecd06d1a"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "4",
|
|
"timestamp": "1637335864",
|
|
"uuid": "9c96483f-0733-4016-80cf-7e5a090da564",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1636712546",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "32a4ae15-59c8-4768-b6fc-8beb9fbf0ce0",
|
|
"value": "2021-10-27T13:33:01+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1636712546",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "f4b1d9c6-bb59-4700-8263-7855d059bdeb",
|
|
"value": "https://www.virustotal.com/gui/file/5ef62c780d7c9f82dea098972f66d5b3367841913444933cdb779adaecd06d1a/detection/f-5ef62c780d7c9f82dea098972f66d5b3367841913444933cdb779adaecd06d1a-1635341581"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1636712546",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "1d400c2b-d36d-4506-b05c-897f203ca794",
|
|
"value": "56/67"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1637335864",
|
|
"uuid": "b9b484e5-731d-432a-b5eb-6013142e1fb7",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "b9b484e5-731d-432a-b5eb-6013142e1fb7",
|
|
"referenced_uuid": "6587653a-065f-49f1-958a-83869a219db6",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1637335865",
|
|
"uuid": "cc92de90-731c-4ad9-84fa-1aa570076ac5"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1636719000",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "4f06f034-1e7c-4921-992e-e665de4e0251",
|
|
"value": "64e1aa6f5dca669ba51678157058d54b"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1636719000",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "ea122871-43c7-4959-adfb-47139d7db49b",
|
|
"value": "9f6df0a011748160b0c18fb2b44ebe9fa9d517e9"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1636719000",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "bdeccc71-9d31-4f91-b2a1-66e6eada978c",
|
|
"value": "6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "4",
|
|
"timestamp": "1637335864",
|
|
"uuid": "6587653a-065f-49f1-958a-83869a219db6",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1636719000",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "f97edadd-688f-4cfb-8fb2-b69a83e217f1",
|
|
"value": "2021-10-23T05:36:39+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1636719000",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "3e1531f7-83ed-4473-b620-1096d22a40a6",
|
|
"value": "https://www.virustotal.com/gui/file/6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286/detection/f-6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286-1634967399"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Legacy BIOS version installers",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1636719000",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "b5145342-6351-4be6-ac1b-b467ff01969d",
|
|
"value": "52/68"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |