adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5d9b5933-964c-433c-b84f-4c680a2fe004.json

1119 lines
No EOL
36 KiB
JSON
Raw Blame History

{
"Event": {
"analysis": "1",
"date": "2019-10-07",
"extends_uuid": "",
"info": "Emotet in Depth TTP 10-07-19",
"publish_timestamp": "1592358012",
"published": true,
"threat_level_id": "2",
"timestamp": "1621850615",
"uuid": "5d9b5933-964c-433c-b84f-4c680a2fe004",
"Orgc": {
"name": "MiSOC",
"uuid": "5d49b744-1ef4-4480-b486-40f06b08ac45"
},
"Tag": [
{
"colour": "#4de3bf",
"local": false,
"name": "Emotet",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation - T1047\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Standard Application Layer Protocol - T1071\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"Standard Cryptographic Protocol - T1032\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-tool=\"Empire - S0363\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:tool=\"Emotet\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-tool=\"Cobalt Strike - S0154\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1086\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:mitre-attack-pattern=\"New Service - T1050\"",
"relationship_type": ""
},
{
"colour": "#004646",
"local": false,
"name": "type:OSINT",
"relationship_type": ""
},
{
"colour": "#0071c3",
"local": false,
"name": "osint:lifetime=\"perpetual\"",
"relationship_type": ""
},
{
"colour": "#0087e8",
"local": false,
"name": "osint:certainty=\"50\"",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": false,
"name": "tlp:white",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "Network activity",
"comment": "Maldoc 1st stage Download URL's",
"deleted": false,
"disable_correlation": false,
"timestamp": "1570462687",
"to_ids": true,
"type": "url",
"uuid": "5d9b5bdf-36e8-494f-9bda-4522a63f8736",
"value": "http://dulich.goasiatravel.com/calendar/u8hsm_46c4yi-6024747470/"
},
{
"category": "Network activity",
"comment": "Maldoc 1st stage Download URL's",
"deleted": false,
"disable_correlation": false,
"timestamp": "1570462687",
"to_ids": true,
"type": "url",
"uuid": "5d9b5bdf-b5ac-4550-8ee8-4491a63f8736",
"value": "https://drewnianazagroda.pl/c0nm/PtlOoIWOzs/"
},
{
"category": "Network activity",
"comment": "Maldoc 1st stage Download URL's",
"deleted": false,
"disable_correlation": false,
"timestamp": "1570462687",
"to_ids": true,
"type": "url",
"uuid": "5d9b5bdf-b0a8-4c75-a2b0-49b4a63f8736",
"value": "http://latestgovernment.com/pramodchoudhary.examqualify.com/CKBOIhWtjs/"
},
{
"category": "Network activity",
"comment": "Maldoc 1st stage Download URL's",
"deleted": false,
"disable_correlation": false,
"timestamp": "1570462687",
"to_ids": true,
"type": "url",
"uuid": "5d9b5bdf-b654-4401-9164-4f6ba63f8736",
"value": "https://kurumsalinternetsitesi.com/wp-content/wgSCKDClY/"
},
{
"category": "Network activity",
"comment": "Maldoc 1st stage Download URL's",
"deleted": false,
"disable_correlation": false,
"timestamp": "1570462687",
"to_ids": true,
"type": "url",
"uuid": "5d9b5bdf-9bf0-4a3f-8387-404ca63f8736",
"value": "https://edealsadvisor.com/wp-includes/ZqLAroEkK/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-879c-49ef-846b-315974656a8a",
"value": "http://201.184.105.242/ban/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-325c-4d0b-a401-315974656a8a",
"value": "http://201.184.105.242/cone/dma/arizona/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-7ae4-4276-abff-315974656a8a",
"value": "http://201.184.105.242/health/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-90e4-4122-9476-315974656a8a",
"value": "http://201.184.105.242/iplk/enable/loadan/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-f444-4981-917b-315974656a8a",
"value": "http://201.184.105.242/loadan/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-558c-4548-a83c-315974656a8a",
"value": "http://201.184.105.242/sess/pnp/ringin/merge/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-3d98-416c-9ff5-315974656a8a",
"value": "http://201.184.105.242/site/vermont/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-94f8-4ae2-9a3b-315974656a8a",
"value": "http://201.184.105.242/symbols/schema/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-4208-483c-badc-315974656a8a",
"value": "http://45.123.3.54/badge/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-e7d4-4ece-94ac-315974656a8a",
"value": "http://45.123.3.54/publish/acquire/enabled/merge/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-3188-4a7f-8e13-315974656a8a",
"value": "http://45.123.3.54/site/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-9f88-43a2-9b73-315974656a8a",
"value": "http://80.79.23.144/free/schema/scripts/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-5b0c-49d0-802a-315974656a8a",
"value": "http://80.79.23.144/results/cone/window/merge/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-4e48-4b7d-ba67-315974656a8a",
"value": "http://80.79.23.144/splash/prov/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-47a0-4480-a429-315974656a8a",
"value": "http://104.131.11.150/cookies/usbccid/enabled/merge/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-6acc-48a8-abba-315974656a8a",
"value": "http://104.131.11.150/dma/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-04f8-46df-bf49-315974656a8a",
"value": "http://104.131.11.150/img/enabled/scripts/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-cb88-445a-8eaa-315974656a8a",
"value": "http://142.44.162.209/pnp/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-3910-4501-8065-315974656a8a",
"value": "http://142.44.162.209/report/chunk/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-4910-4e43-9939-315974656a8a",
"value": "http://142.44.162.209/results/glitch/merge/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-55f8-4fd0-807a-315974656a8a",
"value": "http://178.254.6.27/site/results/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-24e0-4062-9bba-315974656a8a",
"value": "http://178.254.6.27/stubs/pnp/window/merge/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-560c-4070-b46f-315974656a8a",
"value": "http://178.254.6.27/taskbar/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-dec8-4574-9ced-315974656a8a",
"value": "http://192.254.173.31/child/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1571266221",
"to_ids": true,
"type": "url",
"uuid": "5da79ead-048c-4da7-92c0-315974656a8a",
"value": "http://192.254.173.31/json/add/"
},
{
"category": "External analysis",
"comment": "Source of the MISP event",
"deleted": false,
"disable_correlation": false,
"timestamp": "1576589797",
"to_ids": false,
"type": "link",
"uuid": "5df8d9e5-f7a0-45b8-87c3-45ea950d210f",
"value": "https://github.com/Hestat/intel-sharing/blob/master/powershell-empire-12-16-19/misp.event.7941.json"
}
],
"Object": [
{
"comment": "Selected Malware Document for sandbox run",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1570462332",
"uuid": "5d9b5a7c-7204-4384-9512-48970a2fe004",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1570462332",
"to_ids": true,
"type": "malware-sample",
"uuid": "5d9b5a7c-2560-44ac-969d-42e60a2fe004",
"value": "SCAN_10079460983_IB_1007.doc|9ce5126ffcbc936ad6c0155763898f19"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1570462332",
"to_ids": false,
"type": "filename",
"uuid": "5d9b5a7c-c814-4b59-903f-4c0e0a2fe004",
"value": "SCAN_10079460983_IB_1007.doc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1570462332",
"to_ids": true,
"type": "md5",
"uuid": "5d9b5a7c-6d60-4555-90a2-42c30a2fe004",
"value": "9ce5126ffcbc936ad6c0155763898f19"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1570462332",
"to_ids": true,
"type": "sha1",
"uuid": "5d9b5a7c-74a0-4902-addb-4afa0a2fe004",
"value": "284534ae3c3ca467f098115d07cd7e14cbec9583"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1570462332",
"to_ids": true,
"type": "sha256",
"uuid": "5d9b5a7c-3ef8-48e9-8671-40760a2fe004",
"value": "dd007df90f91857a9efe65008cf015f7955ff05a5b243017e4931087f5742355"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1570462332",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "5d9b5a7c-4740-4d31-bca2-4f830a2fe004",
"value": "175104"
}
]
},
{
"comment": "Cobalt strike payload called by powershell",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1570462376",
"uuid": "5d9b5aa8-9a10-4649-bfd4-4dff0a2fe004",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1570462376",
"to_ids": true,
"type": "malware-sample",
"uuid": "5d9b5aa8-5124-4bfe-bcc4-446c0a2fe004",
"value": "ikillyou.txt|26017e97acce09276f3b4c6800dec256"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1570462376",
"to_ids": false,
"type": "filename",
"uuid": "5d9b5aa8-6c48-43a7-a725-4a860a2fe004",
"value": "ikillyou.txt"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1570462376",
"to_ids": true,
"type": "md5",
"uuid": "5d9b5aa8-a07c-4401-99ee-44b80a2fe004",
"value": "26017e97acce09276f3b4c6800dec256"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1570462376",
"to_ids": true,
"type": "sha1",
"uuid": "5d9b5aa8-e53c-4d68-a233-4d5f0a2fe004",
"value": "b49b6719495f8398f72e18c0e9450feacb0f9bd9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1570462376",
"to_ids": true,
"type": "sha256",
"uuid": "5d9b5aa8-732c-4ebc-b096-429a0a2fe004",
"value": "3306d41a09840db2e94e7497c911e8d61d15776b44346f02bbb6a88f5bd51caa"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1570462376",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "5d9b5aa8-72c0-4d0f-9783-47980a2fe004",
"value": "2789"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1570467114",
"uuid": "5d9b6d2a-f048-4333-a71b-4f830a2fe004",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1570467114",
"to_ids": true,
"type": "malware-sample",
"uuid": "5d9b6d2a-661c-4c0a-8813-4ab70a2fe004",
"value": "26017e97acce09276f3b4c6800dec256_unzipped_decoded.zip|0e8c5174646dcd87ac893271b80c9633"
}
]
},
{
"comment": "Emotet Exe",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1570472117",
"uuid": "5d9b80b5-67ac-4570-8958-4ea90a2fe004",
"Attribute": [
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1570472117",
"to_ids": true,
"type": "malware-sample",
"uuid": "5d9b80b5-83e8-4811-933f-40dc0a2fe004",
"value": "pixelproc.exe|9afcbf6f4f13a40791d368df767b4304",
"Tag": [
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:tool=\"Emotet\"",
"relationship_type": ""
}
]
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1570472117",
"to_ids": false,
"type": "filename",
"uuid": "5d9b80b5-1bfc-4bbd-aabf-4e400a2fe004",
"value": "pixelproc.exe"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1570472117",
"to_ids": true,
"type": "md5",
"uuid": "5d9b80b5-ff4c-4d46-98ce-40cd0a2fe004",
"value": "9afcbf6f4f13a40791d368df767b4304"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1570472117",
"to_ids": true,
"type": "sha1",
"uuid": "5d9b80b5-c704-4916-a3bb-45780a2fe004",
"value": "019a178ee95b34980a2f07ee624528de5f4eae44"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1570472117",
"to_ids": true,
"type": "sha256",
"uuid": "5d9b80b5-437c-41c1-823b-459c0a2fe004",
"value": "16d007d650d117c68da005747378f16cebe820e75a2565be70602fad2cb6e1fe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1570472117",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "5d9b80b5-e340-4e19-977b-47d30a2fe004",
"value": "221184"
}
]
},
{
"comment": "Trickbot Exe",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1570472258",
"uuid": "5d9b8142-6bd0-484e-8a8f-43410a2fe004",
"Attribute": [
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1570472258",
"to_ids": true,
"type": "malware-sample",
"uuid": "5d9b8142-9654-49da-af32-4ba80a2fe004",
"value": ".exe|9240845226d22642cbe5e0d39205d869"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1570472258",
"to_ids": false,
"type": "filename",
"uuid": "5d9b8142-56b8-49a7-8e90-426d0a2fe004",
"value": ".exe"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1570472258",
"to_ids": true,
"type": "md5",
"uuid": "5d9b8142-3a1c-4760-872c-436f0a2fe004",
"value": "9240845226d22642cbe5e0d39205d869"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1570472258",
"to_ids": true,
"type": "sha1",
"uuid": "5d9b8142-04e4-4ebe-8564-44590a2fe004",
"value": "10dae0bced984456d3d7a2b059cd71a4762f1c5b"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1570472258",
"to_ids": true,
"type": "sha256",
"uuid": "5d9b8142-b590-4445-81b3-4ffb0a2fe004",
"value": "4cbe34dc9928a6b93786a69bea92b3df0e04fd67d116fc1746d817496314de9e"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1570472258",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "5d9b8142-3e88-4463-b633-4ab80a2fe004",
"value": "393309"
}
]
},
{
"comment": "Trickbot artifact",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1570472290",
"uuid": "5d9b8162-9658-45ba-897f-4cdd0a2fe004",
"Attribute": [
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1570472290",
"to_ids": true,
"type": "malware-sample",
"uuid": "5d9b8162-fb20-4ad9-91da-45380a2fe004",
"value": "settings.ini|03dfc482ccecbbbc16c5c208ae55d49a"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1570472290",
"to_ids": false,
"type": "filename",
"uuid": "5d9b8162-0990-4049-848a-459d0a2fe004",
"value": "settings.ini"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1570472290",
"to_ids": true,
"type": "md5",
"uuid": "5d9b8162-b0bc-42c4-8bb8-4d660a2fe004",
"value": "03dfc482ccecbbbc16c5c208ae55d49a"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1570472290",
"to_ids": true,
"type": "sha1",
"uuid": "5d9b8162-cae0-41f9-8933-42050a2fe004",
"value": "46b1ad83e2bbf22b08462656e979bca53afff6ba"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1570472290",
"to_ids": true,
"type": "sha256",
"uuid": "5d9b8162-0efc-48c5-a090-42360a2fe004",
"value": "e23033b26e459f6987fb65b9dd8a975a14c2ea9d903a720d4a67a32d43bff293"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1570472290",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "5d9b8162-9158-4838-8904-44830a2fe004",
"value": "63950"
}
]
},
{
"comment": "Exchange DB file from trickbot",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1570472314",
"uuid": "5d9b817a-8320-4f3b-afee-43650a2fe004",
"Attribute": [
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1570472314",
"to_ids": true,
"type": "malware-sample",
"uuid": "5d9b817a-6ea0-47b0-a1a3-47a00a2fe004",
"value": "grabber_temp.INTEG.RAW|b65e8c666af6ff39c67552e0c98f55d5"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1570472314",
"to_ids": false,
"type": "filename",
"uuid": "5d9b817a-53e4-4d92-9256-4c0c0a2fe004",
"value": "grabber_temp.INTEG.RAW"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1570472314",
"to_ids": true,
"type": "md5",
"uuid": "5d9b817a-44f0-4c37-95f3-46e60a2fe004",
"value": "b65e8c666af6ff39c67552e0c98f55d5"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1570472314",
"to_ids": true,
"type": "sha1",
"uuid": "5d9b817a-6698-4f70-97c0-4a940a2fe004",
"value": "844ce6691b66a81237a592ec6bd2c59c8dbd52a0"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1570472314",
"to_ids": true,
"type": "sha256",
"uuid": "5d9b817a-dedc-4ee0-85b5-46f60a2fe004",
"value": "2826263cc5a3199167970f988c628c177ec45cee60618ae40e9fe84ec9167b73"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1570472314",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "5d9b817a-cc38-4f34-8da2-4e8d0a2fe004",
"value": "138246"
}
]
},
{
"comment": "Cobalt Strike C2 Server",
"deleted": false,
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
"meta-category": "network",
"name": "ip-port",
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
"template_version": "8",
"timestamp": "1570472706",
"uuid": "5d9b8302-b1ec-49b1-8c31-46d50a2fe004",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1570472706",
"to_ids": false,
"type": "port",
"uuid": "5d9b8302-1ecc-493a-b7fd-41d70a2fe004",
"value": "443"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1570472706",
"to_ids": true,
"type": "ip-dst",
"uuid": "5d9b8302-fea8-4074-a5f1-4d020a2fe004",
"value": "144.202.75.93"
}
]
},
{
"comment": "Powershell Empire C2",
"deleted": false,
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
"meta-category": "network",
"name": "ip-port",
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
"template_version": "8",
"timestamp": "1570472771",
"uuid": "5d9b8343-9d98-442f-b331-4a9a0a2fe004",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "dst-port",
"timestamp": "1570472771",
"to_ids": false,
"type": "port",
"uuid": "5d9b8343-c774-4cf8-a1d1-4c930a2fe004",
"value": "443"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1570472771",
"to_ids": true,
"type": "ip-dst",
"uuid": "5d9b8343-6770-4d3d-b8a0-42a60a2fe004",
"value": "91.200.102.245"
}
]
}
]
}
}
Reference in a new issue View git blame Copy permalink