1430 lines
No EOL
49 KiB
JSON
1430 lines
No EOL
49 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2015-04-07",
|
|
"extends_uuid": "",
|
|
"info": "OSINT Winnti OpSMN new malware RE report by Novetta",
|
|
"publish_timestamp": "1456150066",
|
|
"published": true,
|
|
"threat_level_id": "2",
|
|
"timestamp": "1429714640",
|
|
"uuid": "5523e803-a6ac-4679-95ee-4382950d210b",
|
|
"Orgc": {
|
|
"name": "CthulhuSPRL.be",
|
|
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416584",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5523e848-294c-4d2b-b8af-7076950d210b",
|
|
"value": "http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416584",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5523e848-284c-45e6-b5da-7076950d210b",
|
|
"value": "http://www.novetta.com/wp-content/uploads/2015/04/nov_winnti_yara.txt"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416584",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5523e848-f4b0-404e-bc03-7076950d210b",
|
|
"value": "http://www.novetta.com/wp-content/uploads/2015/04/vt-winnti.txt"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416584",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5523e848-6a14-4a94-b13f-7076950d210b",
|
|
"value": "http://www.novetta.com/2015/04/operation-smn-winnti-update/"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416610",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e862-3618-48db-b29f-448e950d210b",
|
|
"value": "0798740771dc8f40a5a45a2f58aeab479e2ead6682d67b24fafc46a7ab40c128"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416610",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e862-bf64-40eb-aaf0-48c2950d210b",
|
|
"value": "0e21bf36ce80687d69caf537ea2a77cd8ef3210fb845256f56b5096efb0f7177"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416610",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e862-095c-4ae2-b57c-4924950d210b",
|
|
"value": "0e258047b5883e8e8841f8649352478bf1ad4362c53b8be082cf701380694fc5"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416610",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e862-5adc-4d33-934a-4196950d210b",
|
|
"value": "0e3d6da65139e01a8f9be0ee63b4510123fc9f644100b00535f7f3b1611ab2ce"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416610",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e862-7d20-4493-b1df-43b4950d210b",
|
|
"value": "1616adcdb750330cdad6223d26311244ce21080fce5ff03203261302d1031249"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416610",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e862-1018-4bf6-812b-47ef950d210b",
|
|
"value": "18c42f98affc8f053d0a20e9bc85786f1cc8c33bd5f7c0080687b5aa8c97f1d7"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416610",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e862-a060-4d4b-8323-4011950d210b",
|
|
"value": "18df4e50d2db8e352755bab86e2aa04ce9dcf2a83bf3e03135abae00ab3d16c2"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416610",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e862-9580-48a5-9a73-445b950d210b",
|
|
"value": "1b0cd7bbd5188798f0bbcebb06afb54f6455a680b061bf32fa43d28e829837b0"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416611",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e863-1b58-4e38-95ef-421a950d210b",
|
|
"value": "21cbd6ba2f1787ebdeac8e6098a94e0e3f8d760bf7277f0e30229d9362cd7689"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416611",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e863-2098-4dcc-9287-49f4950d210b",
|
|
"value": "246feb48f0a8e11b1c0d6cfb1a6fcbcb3b1b6014dc825367e67976cc31d29c37"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416611",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e863-3398-43da-80c6-40ea950d210b",
|
|
"value": "2491fcac659f72cf9f0247e6444f1024e3f93b8684d9129fee61b7fe27ae4848"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416611",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e863-7f50-4b32-aa2d-411c950d210b",
|
|
"value": "288e9ac646b5c42666717326943fcfe90d206a2b29b6bcd46dd0b4a5db683689"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416611",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e863-8214-4cec-90dd-45ed950d210b",
|
|
"value": "29c43ec1a4c4fc823028ee0e5b4ce9e6e5e1217766ee430f663538a60ccf13d4"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416611",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e863-fdb8-4550-8855-4a91950d210b",
|
|
"value": "2c3032b2b19b19369a37c7d60cd850c4208ec042ef32c9870b701f333734ae56"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416611",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e863-3430-4b6b-82ea-45b2950d210b",
|
|
"value": "2e90ec6594eb5fda2cfb6d46b91e13e9ee3f8941de31b57f366dbe254ee9fc32"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416611",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e863-bd70-4f8b-b83d-444e950d210b",
|
|
"value": "2fa4b025c74dec27d2640d441db27601e6d1c7717db90b7e9915f6ef5db92fa3"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e864-31cc-42f6-9e2a-4644950d210b",
|
|
"value": "2fde6617eaca9e178bd4de52fd55d4bcf211632c004703f31efbd541b3d16319"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e864-c350-46e4-b12c-4d74950d210b",
|
|
"value": "3087f00b5ef2941ebf3005e9ed46c134a601c629d8dd26e83b25b3e3a4106f77"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e864-2c88-4d16-946c-4e4f950d210b",
|
|
"value": "316f052a09f1f121cfe70491697048db32612c4a2c4f007748fda9a2b0e56c20"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e864-63ec-46e7-b6d7-4b6c950d210b",
|
|
"value": "33f8cfb672ab39e7ef1986848b293ade35e08480a8f7d2cbe96195357fb39cfb"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e864-3774-4eec-b4fa-47d0950d210b",
|
|
"value": "35541d4f586a97d5f4cd0c43436df0cee2944a1a650dd7b9d3f14a63e7f20c8a"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e864-87ac-45c4-879e-4886950d210b",
|
|
"value": "4466f22fd87e4d7fc875c7e073131cf81635fac48ba0fa7bbcf37f8a2dd0563e"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e864-f500-49ae-8abe-425d950d210b",
|
|
"value": "47053e77580ef64ca39058f72986c6ff46a81c092027e240916c8bdb42cdfcb6"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e864-9000-4bf9-8771-4ab4950d210b",
|
|
"value": "4a4e729b5a2212bdcba4314594cbdf8fcbec7146bb1f47b3c99ad6d183bceb38"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e864-b74c-47eb-8dee-4a15950d210b",
|
|
"value": "4a7e8d72dbaf30ebe2328771381912df9387deea6e240f3ad046ba1154250680"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416612",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-dca4-49b5-b96e-42b5950d210b",
|
|
"value": "52ce11b571aacf298c10d6dce47a60c199f6f58a76b901583bde65d86886cf1f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416613",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-18f0-4e2a-af25-4a5d950d210b",
|
|
"value": "5f41b896d76c04677ac400262aae06727771d408b598e870827c2c8f4aac061c"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416613",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-726c-4594-84e6-41f8950d210b",
|
|
"value": "62bd0c6eca0c4d562de0d83bbc7ce63fe9bfb3ac149e9a449dd44e2e3165c9dc"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416613",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-52e0-4bea-9a56-4423950d210b",
|
|
"value": "6aa66eef38c6fcc2d9ab8034723acdaf2af0195749ff713dddaf414d2caea45f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416613",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-8fc4-4970-bb7b-4864950d210b",
|
|
"value": "6c8347ec0c0a26a8942342e4031cf823332a8637d9a4e7f31bad725edc04a395"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416613",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-db08-4966-bf61-428b950d210b",
|
|
"value": "7339fe6a7799ab8369d0dbafed9d7f3b6c81d164b00ec5d3a17d6c69ea52b141"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416613",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-ad78-4ba1-9e61-45f7950d210b",
|
|
"value": "7a0fdc652e0ce4d84e9a6fd89343e6d71756c0a8f537276d3aed7388264ddb16"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416613",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-c518-4a84-8de2-46d1950d210b",
|
|
"value": "7c09b14a34114e5b6861530ac19ab1aaadf9e8c9a7fbbde96542c21175b094e0"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416613",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-f2d8-4057-abae-4e2c950d210b",
|
|
"value": "7c754b0bec42a85f78393082b011e07fb0e964437c0c5c690ccf51d5508ab8b6"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416613",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e865-5ac0-4af6-a018-4ef3950d210b",
|
|
"value": "7d8da529d439e31b917661ae7421ee99b132e995cc78156fdd6e1f7df43ac07c"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416614",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e866-ee30-4407-994c-4438950d210b",
|
|
"value": "823e09d204e3c4d57abcbb23c1db50b0db3d8d4eecde72b0ffefa2f0b6abe904"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416614",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e866-9724-4483-9014-4e6e950d210b",
|
|
"value": "87e4096e3989ae5f047d1ede355e5e95b2eb4ce2fc8fb42a7d8a39f3224d41ab"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416614",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e866-ecc8-4499-a19f-45b2950d210b",
|
|
"value": "890137121b159b0de4b287627a8710605327f8aa0b2e657362b05b793881d87e"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416614",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e866-ed94-46a4-9a8b-4c56950d210b",
|
|
"value": "8ac94fb63d023242e62d08ef7552beed720845266ea884c8d992d2533b81cf12"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416614",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e866-2bec-4c82-94e0-4bd3950d210b",
|
|
"value": "8dcae5e7f13d190ff492687ddca33342450fdef868fbfa92d2ac7b32ffbf7365"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416614",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e866-bd20-418c-b82b-4969950d210b",
|
|
"value": "8f9e875825f498cee1ef74c57829cd367a8b3089fe4e8918449711fa3af0f984"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416614",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e866-d278-4cd7-aed3-418b950d210b",
|
|
"value": "90745e366f46b1065c56a1a3e262e9e1f0f26baf05b6d29e4758dabdc2570d76"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416614",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e866-bd44-44ad-8daf-4580950d210b",
|
|
"value": "92f960ddcfa6ed39289e28f03bb36cd2b6b513f3c3c21ef31ee5f9a8238a8a01"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416615",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e867-1368-48ae-bf62-4fa6950d210b",
|
|
"value": "959630cb90c5e3810a8a02c771f37b46388204d2d99a436463cd87411f961ba0"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416615",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e867-ecbc-4e36-91d3-4125950d210b",
|
|
"value": "970415694f5b1952a45b7c3c776292877738e32b42b23d97e1b5361e0eaf97de"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416615",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e867-b2fc-4536-a4c5-4ca8950d210b",
|
|
"value": "9df413b0da7355bbb203c294ed64c06ec68ab4a00221c8e9a0e635a40a08576d"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416615",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e867-3054-4cd3-9eaa-4ff1950d210b",
|
|
"value": "a679d46a8ce8da6135b0dec9b2632ae41d01629a17f3183f9bcb76debfcecba5"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416615",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e867-ecb4-4d12-a7d8-43e8950d210b",
|
|
"value": "a8f50d0f0c41e83dc3697b6668013e8cff990e5b98b99170c24c57281ff43e09"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416615",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e867-1718-41a1-98b9-40cd950d210b",
|
|
"value": "aa17bce6d8c469ce22ba29f79d2754db5d44096862d7a13be9324121c04a5343"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416615",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e867-f9f0-4783-921f-4a6c950d210b",
|
|
"value": "ad1e7e12607ccdda70197a9cc0fc3df7fb74db540d1a1764da9da7347cbd73e3"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416615",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e867-5694-4cc0-b230-4081950d210b",
|
|
"value": "b21a5ac48502ff75057f9773bf31abd970ef6c75a2c0ea1c871dd4e81ec5a994"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416615",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e867-ac38-4bc0-8999-48b5950d210b",
|
|
"value": "b63407714c73d022b748411df888ccabcca082cf87bc32d53c6a9cfd55f46bda"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416616",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e868-bf1c-4d4f-866f-4ebf950d210b",
|
|
"value": "b9140df8a58f02469f9f5789e1a39e476381855820730c997580f3a49fff1148"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416616",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e868-54b0-46df-b5c3-4a6e950d210b",
|
|
"value": "bdb451dd67a1101f8437a2f4231abac37d8bcc4b7c7b85bc74ace83e31aaa156"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416616",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e868-05d8-437d-b16a-4062950d210b",
|
|
"value": "bf1ac8ab322891defe755552c198891ff28fb2fa57fd36a8b1b5a6b649fbc027"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416616",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e868-8500-4bd7-80ae-426e950d210b",
|
|
"value": "c46bfed74f17b114664adb658c7a10389eceb3c35edbaa472197d32b66bea7ad"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416616",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e868-543c-4096-a75f-4075950d210b",
|
|
"value": "c6791c74cf345c38ff10f04d36c11ad2953eb39bbc95df837dd4bf77176d6322"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416616",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e868-8bcc-4b55-8d3c-4793950d210b",
|
|
"value": "ca0acc09b6b17271bcda7f67eaf9b9a8d8227408e7fd6b0def0f99e501bc179a"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416616",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e868-7844-4bbe-8ea7-4136950d210b",
|
|
"value": "ca6540211b309620c38db716b29d282492c4842d5d6e167ecc3b0707431c491f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416616",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e868-efe8-4bcb-afa9-445b950d210b",
|
|
"value": "cf15e587ef51527660947510b53f2a7b28da4b5ea02e39ff24c04e7156210612"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416616",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e868-3efc-478f-aba5-41cd950d210b",
|
|
"value": "d11884d05b679e494d8d997784e2d11648946b66d2f04daf3813e57fd1a156fc"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416617",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e869-61f4-495e-bc12-483f950d210b",
|
|
"value": "d173811a545ba495934cb293460bc86b0c6681c2cd98de52b6b10c63e4d3abb3"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416617",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e869-29a4-42fa-8e2f-4821950d210b",
|
|
"value": "d1e1a66afb0e33d865776758abb5869fae5b3deab58e6a9f996253bdaf02a91f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416617",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e869-6efc-477a-ba5b-4b35950d210b",
|
|
"value": "d6011662c2d1a18c50b02dc6ec5d9650c34bd67083038a9d56d9e0c98b100730"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416617",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e869-d24c-4418-918f-4606950d210b",
|
|
"value": "d72b78c634d9e1c24c90da7badb54a1243573c49dffe43ddb6a14db586b2aaf8"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416617",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e869-fe44-4606-8ed5-43ad950d210b",
|
|
"value": "d929406819df0faaf297e2b2e4253724a9f6fafaafa239c4b90db5ab6e58bd83"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416617",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e869-80e0-4ca9-ad99-4e7b950d210b",
|
|
"value": "da198b32b61d0a5765d2961b1f4a20592a90bd919835bd5cf1f64329ef388a61"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416617",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e869-25c0-4fb8-8696-4a7c950d210b",
|
|
"value": "ddccba1aa87ec9d12a896bed96d2d16465b4b63baefd4580828372971881be00"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416617",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e869-27e8-449b-8ea8-4e56950d210b",
|
|
"value": "dec864735d2017b52accdd5285d24131ee556f9266156c62a83cde0ae8dbd095"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416617",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e869-7364-47a7-8cfa-42ca950d210b",
|
|
"value": "df6e40fb0bea1d00c86e0bca493d05a9318ba8e27b015bcadb2fc1d82fa8af04"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416618",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86a-7104-4c7f-abe7-466b950d210b",
|
|
"value": "e13c06fa97a3f502edc3aee62b0f6aee174d5ced7a5d0a4dffc7323a9c993347"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416618",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86a-8404-497e-80d1-49a1950d210b",
|
|
"value": "e82f0bfa09fa9d855a73ae82ca56566c5b59074fa2ad4aad1f6870d5331eede8"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416618",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86a-4c4c-4fcf-9077-43bf950d210b",
|
|
"value": "e9bfcfe6d1bbfabca1d8c0896b1bcf452000bed161c1eba95bbae2256993f3ab"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416618",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86a-fdc8-433c-8766-48b9950d210b",
|
|
"value": "eb8d20f3241a702409ef153b9f71c3af4e4f4557371265b86f4edd075c36cb91"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416618",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86a-6c9c-41ce-8a89-4e59950d210b",
|
|
"value": "ec198eb746eb1d87315e4ce2cb0d960246da4824f4925d340201288947537bfa"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416618",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86a-3880-40cf-b0b4-4330950d210b",
|
|
"value": "f1c61fd84e925eb42d681755395f20b1adedd4ee43c58e974a32604e953cbbfd"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416618",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86a-6610-44fc-ae7c-4f11950d210b",
|
|
"value": "f255321e7331ec856bcbf816f4a38371c2311b00d531fdff541fb18496cc0edd"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416618",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86a-36f8-4588-b761-46de950d210b",
|
|
"value": "f37762bb2199c20d0c5ea0a21774f60bef1fabd7966ee9dc9c67514d5e7ed239"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416618",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86a-a308-44ef-89b0-4a6d950d210b",
|
|
"value": "f3ccc986dc4922514432440612331e74b1677995258291dd1fb068314e413a75"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416619",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86b-2728-45a8-a484-4f6f950d210b",
|
|
"value": "f4bf952b5b922a431ad15e4b9a9bc7011a999241187ca93811cec3cdd0a87351"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416619",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86b-afd4-430a-982b-458a950d210b",
|
|
"value": "f571b27da6fc097bfc7a989fb9b752320f45ded7505125c558851ddd68f01688"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416619",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86b-eb24-4c1c-8e94-43b4950d210b",
|
|
"value": "f8d6b5995ae855e9cd89194faf0c2f683f8e2d83376bcd4f2da55904d411368c"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416619",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86b-68b8-45c9-9f66-4077950d210b",
|
|
"value": "f97ba6bdd7893af406d500634d5982184d278b46d392a0f7ad7d7bade0c47fc0"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416619",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86b-db2c-4d73-976e-4326950d210b",
|
|
"value": "fcc252231ec72ef03fb1309f415fb3f39db5f625925d7b01b8f851f33f506342"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416619",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5523e86b-6bcc-445b-9dfd-41e2950d210b",
|
|
"value": "fef59f6fc920a7a0ce7f67ec88d7d081a23d5c00aa93a646caa06e0a23bb7639"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416725",
|
|
"to_ids": true,
|
|
"type": "yara",
|
|
"uuid": "5523e8d5-59fc-4e53-8708-401f950d210b",
|
|
"value": "rule Winnti_Dropper\r\n{\r\n meta:\r\n copyright = \"Novetta Solutions\"\r\n author = \"Novetta Advanced Research Group\"\r\n\r\n strings:\r\n $runner = \"%s\\\\rundll32.exe \\\"%s\\\", DlgProc %s\"\r\n $inflate = \"Copyright 1995-2005 Mark Adler\"\r\n \r\n condition:\r\n $runner and $inflate\r\n\r\n}"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416745",
|
|
"to_ids": true,
|
|
"type": "yara",
|
|
"uuid": "5523e8e9-26ac-4de4-8961-7071950d210b",
|
|
"value": "rule Winnti_service\r\n{\r\n meta:\r\n copyright = \"Novetta Solutions\"\r\n author = \"Novetta Advanced Research Group\"\r\n\r\n strings:\r\n $newmem = \"new memory failed!\"\r\n $value = \"can not find value %d\\n\"\r\n $onevalue = \"find one value %d\\n\"\r\n $nofile = \"Can not open the file (error %d)\"\r\n \r\n condition:\r\n 3 of ($newmem, $value, $onevalue, $nofile)\r\n\r\n}"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1429714640",
|
|
"to_ids": true,
|
|
"type": "yara",
|
|
"uuid": "5523e901-4c20-4365-8f2e-4953950d210b",
|
|
"value": "rule Winnti_engine\r\n{\r\n meta:\r\n copyright = \"Novetta Solutions\"\r\n author = \"Novetta Advanced Research Group\"\r\n\r\n strings:\r\n $api1 = \"SHCreateItemFromParsingName\"\r\n $datfile = \"otfkty.dat\"\r\n $workstart = \"work_start\"\r\n $workend = \"work_end\"\r\n \r\n condition:\r\n ($api1 or $datfile) and ($workstart and $workend)\r\n \r\n\r\n}"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416792",
|
|
"to_ids": true,
|
|
"type": "yara",
|
|
"uuid": "5523e918-3a8c-48d5-8b3b-755f950d210b",
|
|
"value": "rule Winnti_worker\r\n{\r\n meta:\r\n copyright = \"Novetta Solutions\"\r\n author = \"Novetta Advanced Research Group\"\r\n\r\n strings:\r\n $pango = \"pango-basic-win32.dll\"\r\n $tango = \"tango.dll\"\r\n $dat = \"%s\\\\%d%d.dat\"\r\n $cryptobase = \"%s\\\\sysprep\\\\cryptbase.dll\"\r\n \r\n condition:\r\n $pango and $tango and $dat and $cryptobase\r\n\r\n}"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416817",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5523e931-ac20-4215-a415-7076950d210b",
|
|
"value": "WinNTI"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416817",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5523e931-68c4-4dc0-a56e-7076950d210b",
|
|
"value": "OpSMN"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428416937",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5523e9a9-2bc4-4eea-8f7f-7071950d210b",
|
|
"value": "Operation SMN"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428417131",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5523ea6b-7d44-483d-98db-755e950d210b",
|
|
"value": "%SYSDIR%\\otfkyt.dat"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428417131",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5523ea6b-7de8-4911-aa6d-755e950d210b",
|
|
"value": "%SYSDIR%\\wmtsk.dll"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1428417131",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5523ea6b-d4d4-4e8f-a502-755e950d210b",
|
|
"value": "%SYSDIR%\\wmm2.dat"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 0798740771dc8f40a5a45a2f58aeab479e2ead6682d67b24fafc46a7ab40c128)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839559",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65947-8c90-4777-84aa-c652950d210f",
|
|
"value": "159ad2c7a57687363d27c27bc60f6374"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 0e3d6da65139e01a8f9be0ee63b4510123fc9f644100b00535f7f3b1611ab2ce)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839561",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65949-7bac-4192-a47d-c653950d210f",
|
|
"value": "4ed9366aed62527c69f61de7bb595af6"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 2e90ec6594eb5fda2cfb6d46b91e13e9ee3f8941de31b57f366dbe254ee9fc32)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839564",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c6594c-b568-4637-aa57-59a1950d210f",
|
|
"value": "0f8fd146ae53c0f0499c8e1ea44d267b"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 4a4e729b5a2212bdcba4314594cbdf8fcbec7146bb1f47b3c99ad6d183bceb38)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839566",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c6594e-50f0-442b-b4f2-599c950d210f",
|
|
"value": "50955f8198bf37025d40a7cdcee7978c"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 4a7e8d72dbaf30ebe2328771381912df9387deea6e240f3ad046ba1154250680)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839568",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65950-c37c-4f92-a973-599f950d210f",
|
|
"value": "832d56ab2950db6032eda77de2fbe0cd"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 52ce11b571aacf298c10d6dce47a60c199f6f58a76b901583bde65d86886cf1f)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839570",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65952-af10-45a5-b49b-c653950d210f",
|
|
"value": "a49066ad92a47a2744d142e8c5de892e"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 6aa66eef38c6fcc2d9ab8034723acdaf2af0195749ff713dddaf414d2caea45f)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839572",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65954-2a68-419b-bb46-4dd6950d210f",
|
|
"value": "b120dab999c4c3edd3628ffca76bc82c"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 959630cb90c5e3810a8a02c771f37b46388204d2d99a436463cd87411f961ba0)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839575",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65957-b2d4-4677-950a-c651950d210f",
|
|
"value": "3086c619b43e5bdd20188ad594de8c41"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via b21a5ac48502ff75057f9773bf31abd970ef6c75a2c0ea1c871dd4e81ec5a994)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839578",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c6595a-c8fc-4c65-a4f9-599d950d210f",
|
|
"value": "437ea3b450fd1043b20553996c8e9e00"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via bdb451dd67a1101f8437a2f4231abac37d8bcc4b7c7b85bc74ace83e31aaa156)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839580",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c6595c-4154-4897-a5c8-c653950d210f",
|
|
"value": "937e9a04f082f9f9d5ca6e9a481a8e6f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via df6e40fb0bea1d00c86e0bca493d05a9318ba8e27b015bcadb2fc1d82fa8af04)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839583",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c6595f-490c-43f7-9a20-599d950d210f",
|
|
"value": "2f10e8bbdc38a8ff342e38b0f1e9cc52"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via ec198eb746eb1d87315e4ce2cb0d960246da4824f4925d340201288947537bfa)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839586",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65962-ccc0-4d2d-a319-599e950d210f",
|
|
"value": "d10a1967eee1eadcc010dc89dc2b8925"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via f4bf952b5b922a431ad15e4b9a9bc7011a999241187ca93811cec3cdd0a87351)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839588",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65964-4d60-404e-a426-59a3950d210f",
|
|
"value": "032a234eda612f8474e8dc97829674e8"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via f97ba6bdd7893af406d500634d5982184d278b46d392a0f7ad7d7bade0c47fc0)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839590",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65966-9438-4dfa-a2a0-c650950d210f",
|
|
"value": "e831913787541c94d5d6a25235ce7d84"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 0798740771dc8f40a5a45a2f58aeab479e2ead6682d67b24fafc46a7ab40c128)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839560",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65948-8a3c-4741-bafb-599d950d210f",
|
|
"value": "72f3c2155c625784c41cf50bfde4d8dc63424c8e"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 0e3d6da65139e01a8f9be0ee63b4510123fc9f644100b00535f7f3b1611ab2ce)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839562",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c6594a-8134-4c8d-b5c2-5f51950d210f",
|
|
"value": "cef549547a567db2020af80b1d8e0163f9aa4d65"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 2e90ec6594eb5fda2cfb6d46b91e13e9ee3f8941de31b57f366dbe254ee9fc32)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839565",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c6594d-d1e8-478f-a3cf-59a3950d210f",
|
|
"value": "f6918d589408209600f1a1ac57f5f610f5bfc90b"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 4a4e729b5a2212bdcba4314594cbdf8fcbec7146bb1f47b3c99ad6d183bceb38)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839567",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c6594f-bbdc-4643-842a-42cb950d210f",
|
|
"value": "894923f6346506300db5477a8f0057745239cc3b"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 4a7e8d72dbaf30ebe2328771381912df9387deea6e240f3ad046ba1154250680)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839569",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65951-3188-4296-a453-c651950d210f",
|
|
"value": "49e0fb0f7bd276afea3f13bcac9dd945c148f6bd"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 52ce11b571aacf298c10d6dce47a60c199f6f58a76b901583bde65d86886cf1f)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839570",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65952-cf2c-428d-8f95-5f51950d210f",
|
|
"value": "60aef3264dd2263791afd59652ef4228bac79a29"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 6aa66eef38c6fcc2d9ab8034723acdaf2af0195749ff713dddaf414d2caea45f)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839572",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65954-f9fc-450a-9d54-4706950d210f",
|
|
"value": "27976ef26939f0c58a5e2edb222c80761a41e2cf"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 959630cb90c5e3810a8a02c771f37b46388204d2d99a436463cd87411f961ba0)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839576",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65958-5060-4e01-889d-c652950d210f",
|
|
"value": "ee83355a6fd69caaedaaa5ef5e44683c0cddf553"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via b21a5ac48502ff75057f9773bf31abd970ef6c75a2c0ea1c871dd4e81ec5a994)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839578",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c6595a-8d40-4a3d-8b51-59a1950d210f",
|
|
"value": "e30014454ec9678426afb3e8e972dc3d063f1358"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via bdb451dd67a1101f8437a2f4231abac37d8bcc4b7c7b85bc74ace83e31aaa156)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839580",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c6595c-2c5c-4d5e-932c-c654950d210f",
|
|
"value": "ca9e770eac54b3b7046e6efdee6e1ebe88a8905f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via df6e40fb0bea1d00c86e0bca493d05a9318ba8e27b015bcadb2fc1d82fa8af04)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839584",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65960-a020-41f5-903d-5f51950d210f",
|
|
"value": "7d9b2a9b65a55ecd9c2867f1ea21821d52459d4b"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via ec198eb746eb1d87315e4ce2cb0d960246da4824f4925d340201288947537bfa)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839586",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65962-b6b8-44e7-a2cd-c653950d210f",
|
|
"value": "f0460290bd8668e94a4c5ad86aa1c487466e8e9d"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via f4bf952b5b922a431ad15e4b9a9bc7011a999241187ca93811cec3cdd0a87351)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839589",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65965-95d4-4f13-a712-599c950d210f",
|
|
"value": "972da237b66a1239555bd06588039f8b8c03fbe5"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via f97ba6bdd7893af406d500634d5982184d278b46d392a0f7ad7d7bade0c47fc0)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455839591",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65967-ac6c-4474-8a25-599f950d210f",
|
|
"value": "4857e755573822aeef32730a5302cd89c88031db"
|
|
}
|
|
]
|
|
}
|
|
} |