{ "id": "46cea0b8-e35e-48de-862a-1dd27b46759d", "name": "PCAP verified workflow 2022-01-07 20260919", "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.", "status": "active", "domain": "enterprise-attack", "actor_ids": [], "technique_ids": [ "T1012", "T1018", "T1027", "T1036", "T1053", "T1055", "T1056", "T1057", "T1059", "T1059.007", "T1071", "T1071.001", "T1071.004", "T1082", "T1095", "T1102", "T1104", "T1105", "T1114", "T1129", "T1140", "T1146", "T1213", "T1218", "T1218.011", "T1497", "T1518", "T1518.001", "T1543", "T1543.003", "T1553", "T1560", "T1562", "T1562.001", "T1574", "T1574.002" ], "report_ids": [ "144ab9a0-2681-49f4-a410-b126d75d334d", "2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "6f1651e0-2db5-42f4-9749-2e0f20d3b464", "7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "evidence_nodes": [ { "id": "log-pcap:6e50c68f-5552-400c-9835-15867ddb022d", "type": "log-pcap-analysis", "label": "2022-01-07-traffic-analysis-exercise.pcap", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2022-01-07-traffic-analysis-exercise.pcap\nCapture SHA-256: `a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b`\nSemantic result SHA-256: `d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 5880 packets across 27 IP endpoints and 157 transport flows. Observed 88 DNS events, 24 HTTP requests, 24 TLS ClientHello events, and 14 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 2 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 5880\n- Duration: 1172563861.65932 seconds\n- Captured bytes: 4628888\n- Endpoints: 27\n- Flows: 157\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 5309 / TCP stream 76, frame 5315 / TCP stream 76, frame 5317 / TCP stream 76, frame 5636 / TCP stream 76.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":307634,\"destination\":\"192.168.1.216\",\"response_count\":2,\"source\":\"23.38.189.225\",\"uri\":\"/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 5313 / TCP stream 77, frame 5316 / TCP stream 77.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":2,\"destination\":\"192.168.1.216\",\"response_count\":1,\"source\":\"23.38.189.201\",\"uri\":\"/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 246 / TCP stream 6, frame 253 / TCP stream 6, frame 254 / TCP stream 10, frame 257 / TCP stream 6, frame 262 / TCP stream 6.\n\nMetrics: `{\"destination\":\"192.168.1.216\",\"event_count\":30,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"192.168.1.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 29 / TCP stream 0, frame 191 / TCP stream 15, frame 213 / TCP stream 15, frame 219 / TCP stream 15, frame 221 / TCP stream 15.\n\nMetrics: `{\"destination\":\"192.168.1.216\",\"event_count\":47,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"192.168.1.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 931 / TCP stream 43, frame 933 / TCP stream 43, frame 935 / TCP stream 43, frame 937 / TCP stream 43, frame 939 / TCP stream 43.\n\nMetrics: `{\"destination\":\"192.168.1.216\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"192.168.1.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 241 / TCP stream 6, frame 251 / TCP stream 6, frame 252 / TCP stream 10, frame 255 / TCP stream 6, frame 256 / TCP stream 10.\n\nMetrics: `{\"destination\":\"192.168.1.2\",\"event_count\":30,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"192.168.1.216\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 27 / TCP stream 0, frame 189 / TCP stream 15, frame 210 / TCP stream 15, frame 218 / TCP stream 15, frame 220 / TCP stream 15.\n\nMetrics: `{\"destination\":\"192.168.1.2\",\"event_count\":58,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"192.168.1.216\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 930 / TCP stream 43, frame 932 / TCP stream 43, frame 934 / TCP stream 43, frame 936 / TCP stream 43, frame 938 / TCP stream 43.\n\nMetrics: `{\"destination\":\"192.168.1.2\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"192.168.1.216\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `desktop-gxmyno2$`; client IPs: 192.168.1.216; frames: 75, 108, 126, 127, 129\n- account: `steve.smith`; client IPs: 192.168.1.216; frames: 829, 837, 839, 851, 891\n- domain: `SPOONWATCH`; client IPs: 192.168.1.216; frames: 914\n- full-name: `Steve Smith`; client IPs: 192.168.1.216; frames: 945\n- hostname: `DESKTOP-GXMYNO2`; client IPs: 192.168.1.216; frames: 1, 694, 756, 757, 914\n- hostname: `DESKTOP-GXNYNO2`; client IPs: 192.168.1.216; frames: 35, 51, 367, 395, 595\n- netbios-group: `SPOONWATCH`; client IPs: unbound subject; frames: 34, 366, 581, 596, 598\n\n## IOC and artifact candidates\n\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `au.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `cp801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `geo.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `kv801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `pti.store.microsoft.com`; roles: dns-query, tls-sni\n- domain: `self.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settingsfd-geo.trafficmanager.net`; roles: dns-cname\n- domain: `spoonwatch-dc.spoonwatch.net`; roles: dns-query\n- domain: `spoonwatch.net`; roles: dns-query\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.spoonwatch.net`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `104.212.67.47`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `184.50.62.43`; roles: dns-answer, network-endpoint\n- ipv4: `192.168.1.1`; roles: network-endpoint\n- ipv4: `192.168.1.2`; roles: dns-answer, network-endpoint\n- ipv4: `192.168.1.216`; roles: network-endpoint\n- ipv4: `192.168.1.255`; roles: network-endpoint\n- ipv4: `2.56.57.108`; roles: http-host, network-endpoint\n- ipv4: `20.189.173.1`; roles: dns-answer, network-endpoint\n- ipv4: `20.50.80.210`; roles: dns-answer, network-endpoint\n- ipv4: `20.54.89.15`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.38.189.201`; roles: dns-answer, network-endpoint\n- ipv4: `23.38.189.225`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.83.240.146`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.112.67`; roles: dns-answer, network-endpoint\n- ipv4: `52.178.17.2`; roles: dns-answer, network-endpoint\n- ipv4: `52.179.216.235`; roles: dns-answer, network-endpoint\n- ipv4: `52.183.220.149`; roles: dns-answer, network-endpoint\n- ipv4: `52.238.248.1`; roles: dns-answer\n- ipv4: `52.249.36.204`; roles: dns-answer, network-endpoint\n- ipv4: `67.27.123.126`; roles: dns-answer\n- ipv4: `8.240.136.254`; roles: dns-answer\n- ipv4: `8.249.3.254`; roles: dns-answer\n- ipv4: `8.249.7.254`; roles: dns-answer\n- ipv4: `8.253.189.126`; roles: dns-answer, network-endpoint\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2`; roles: exported-object\n- sha256: `16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660`; roles: exported-object\n- sha256: `18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082`; roles: exported-object\n- sha256: `1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f`; roles: exported-object\n- sha256: `334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`; roles: exported-object\n- sha256: `3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd`; roles: exported-object\n- sha256: `43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083`; roles: exported-object\n- sha256: `6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9`; roles: exported-object\n- sha256: `7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14`; roles: exported-object\n- sha256: `835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7`; roles: exported-object\n- sha256: `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; roles: exported-object\n- sha256: `a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba`; roles: exported-object\n- sha256: `c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`; roles: exported-object\n- sha256: `e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78`; roles: exported-object\n- url: `http://2.56.57.108/osk/`; roles: http-request\n- url: `http://2.56.57.108/osk//1.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//2.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//3.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//4.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//5.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//6.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//7.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//main.php`; roles: http-request\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab`; roles: http-request\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Microsoft-Delivery-Optimization/10.0`; roles: http-client\n- user_agent: `Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32`; roles: http-client\n- exported object `5(1).jpg`; SHA-256 `e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78`; size 1246160 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `1(1).jpg`; SHA-256 `16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660`; size 645592 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `4(1).jpg`; SHA-256 `334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`; size 440120 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `2(1).jpg`; SHA-256 `a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba`; size 334288 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(2).exe`; SHA-256 `6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9`; size 307632 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `6(1).jpg`; SHA-256 `43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083`; size 144848 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[{\"excerpt\":\"IEX\",\"feature\":\"dynamic-evaluation\",\"offset\":135147}],\"inspected_bytes\":144848,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `3(1).jpg`; SHA-256 `3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd`; size 137168 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[{\"excerpt\":\"IEX\",\"feature\":\"dynamic-evaluation\",\"offset\":126724}],\"inspected_bytes\":137168,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `7(1).jpg`; SHA-256 `c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`; size 83784 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":83784,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `osk`; SHA-256 `1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f`; size 379629 bytes\n- exported object `35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab`; SHA-256 `18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082`; size 10885 bytes\n- exported object `35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab`; SHA-256 `0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2`; size 7317 bytes\n- exported object `35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab`; SHA-256 `835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7`; size 7313 bytes\n- exported object `1.jpg`; SHA-256 `7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14`; size 25 bytes\n- exported object `am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(1).exe`; SHA-256 `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; size 2 bytes\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `4775c16cd4ef1258e6af0730109f96f3ed0ac43a533ee465dd460c85c852613e`; recorded 2026-09-19T12:09:31.260950+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":94,\"observable_limit\":5000,\"observables_checked\":94,\"observables_total\":94,\"prior_case_limit_reached\":false,\"prior_cases_checked\":12,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 27 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 21 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":14,\"exported_objects\":22,\"hashed_bytes\":3744940,\"hashed_objects\":22,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":14,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":14}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 7/7, observables 94/94, artifacts 14/14. Full returned inventory is in the JSON result.\n", "summary": "Decoded 5880 packets across 27 IP endpoints and 157 transport flows. Observed 88 DNS events, 24 HTTP requests, 24 TLS ClientHello events, and 14 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 2 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "observables": [ { "type": "domain", "value": "api.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1061 / UDP stream 42, frame 1062 / UDP stream 42, frame 1066 / TCP stream 52" }, { "type": "domain", "value": "au.download.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 5302 / UDP stream 61, frame 5303 / UDP stream 61, frame 5309 / TCP stream 76, frame 5313 / TCP stream 77, frame 5317 / TCP stream 76" }, { "type": "domain", "value": "client.wns.windows.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1429 / UDP stream 51, frame 1430 / UDP stream 51, frame 1435 / TCP stream 63" }, { "type": "domain", "value": "cp801.prod.do.dsp.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 5282 / UDP stream 60, frame 5283 / UDP stream 60, frame 5287 / TCP stream 75" }, { "type": "domain", "value": "ctldl.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 5774 / UDP stream 65, frame 5775 / UDP stream 65, frame 5779 / TCP stream 83" }, { "type": "domain", "value": "dns.msftncsi.com", "confidence": 1, "description": "dns-query; frame 49 / UDP stream 11, frame 50 / UDP stream 11" }, { "type": "domain", "value": "download.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 5042 / UDP stream 55, frame 5043 / UDP stream 55, frame 5047 / TCP stream 69, frame 5058 / TCP stream 69, frame 5069 / TCP stream 69" }, { "type": "domain", "value": "fe2cr.update.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 4936 / UDP stream 54, frame 4937 / UDP stream 54, frame 4941 / TCP stream 68" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 5148 / UDP stream 57, frame 5149 / UDP stream 57, frame 5153 / TCP stream 71" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 5235 / UDP stream 58, frame 5236 / UDP stream 58, frame 5240 / TCP stream 73" }, { "type": "domain", "value": "kv801.prod.do.dsp.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 5259 / UDP stream 59, frame 5260 / UDP stream 59, frame 5266 / TCP stream 74" }, { "type": "domain", "value": "pti.store.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1432 / UDP stream 52, frame 1437 / UDP stream 52, frame 1447 / TCP stream 64" }, { "type": "domain", "value": "self.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 760 / UDP stream 36, frame 761 / UDP stream 36, frame 770 / TCP stream 38, frame 4851 / TCP stream 66" }, { "type": "domain", "value": "settings-win.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1143 / UDP stream 44, frame 1144 / UDP stream 44, frame 4908 / UDP stream 53, frame 4909 / UDP stream 53, frame 1148 / TCP stream 54 +3 more" }, { "type": "domain", "value": "settingsfd-geo.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 1144 / UDP stream 44, frame 4909 / UDP stream 53" }, { "type": "domain", "value": "spoonwatch-dc.spoonwatch.net", "confidence": 1, "description": "dns-query; frame 18 / UDP stream 5, frame 19 / UDP stream 5, frame 369 / UDP stream 28, frame 374 / UDP stream 28" }, { "type": "domain", "value": "spoonwatch.net", "confidence": 1, "description": "dns-query; frame 863 / UDP stream 40, frame 864 / UDP stream 40" }, { "type": "domain", "value": "v10.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1351 / UDP stream 50, frame 1352 / UDP stream 50, frame 5083 / UDP stream 56, frame 5084 / UDP stream 56, frame 5638 / UDP stream 62 +9 more" }, { "type": "domain", "value": "v20.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1037 / UDP stream 41, frame 1038 / UDP stream 41, frame 1042 / TCP stream 51" }, { "type": "domain", "value": "wns.notify.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 1430 / UDP stream 51" }, { "type": "domain", "value": "wpad.localdomain", "confidence": 1, "description": "dns-query; frame 58 / UDP stream 15, frame 59 / UDP stream 15, frame 806 / UDP stream 38, frame 807 / UDP stream 38, frame 1218 / UDP stream 46 +3 more" }, { "type": "domain", "value": "wpad.spoonwatch.net", "confidence": 1, "description": "dns-query; frame 56 / UDP stream 14, frame 57 / UDP stream 14, frame 804 / UDP stream 37, frame 805 / UDP stream 37, frame 1216 / UDP stream 45 +3 more" }, { "type": "domain", "value": "www.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1085 / UDP stream 43, frame 1086 / UDP stream 43, frame 1226 / UDP stream 47, frame 1227 / UDP stream 47, frame 5820 / UDP stream 69 +4 more" }, { "type": "ipv4", "value": "0.0.0.0", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "104.212.67.47", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1437 / UDP stream 52" }, { "type": "ipv4", "value": "13.107.21.200", "confidence": 1, "description": "dns-answer; frame 1086 / UDP stream 43, frame 1227 / UDP stream 47, frame 5821 / UDP stream 69" }, { "type": "ipv4", "value": "131.107.255.255", "confidence": 1, "description": "dns-answer; frame 50 / UDP stream 11" }, { "type": "ipv4", "value": "184.50.62.43", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5260 / UDP stream 59, frame 5283 / UDP stream 60" }, { "type": "ipv4", "value": "192.168.1.1", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "192.168.1.2", "confidence": 1, "description": "dns-answer, network-endpoint; frame 17 / UDP stream 4, frame 19 / UDP stream 5, frame 53 / UDP stream 12, frame 55 / UDP stream 13, frame 223 / UDP stream 22 +6 more" }, { "type": "ipv4", "value": "192.168.1.216", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "192.168.1.255", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "2.56.57.108", "confidence": 1, "description": "http-host, network-endpoint; frame 1501 / TCP stream 65, frame 1641 / TCP stream 65, frame 2225 / TCP stream 65, frame 2541 / TCP stream 65, frame 2691 / TCP stream 65 +4 more" }, { "type": "ipv4", "value": "20.189.173.1", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1352 / UDP stream 50" }, { "type": "ipv4", "value": "20.50.80.210", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1038 / UDP stream 41" }, { "type": "ipv4", "value": "20.54.89.15", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5149 / UDP stream 57" }, { "type": "ipv4", "value": "204.79.197.200", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1086 / UDP stream 43, frame 1227 / UDP stream 47, frame 5821 / UDP stream 69" }, { "type": "ipv4", "value": "204.79.197.203", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1062 / UDP stream 42" }, { "type": "ipv4", "value": "224.0.0.22", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "224.0.0.251", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "224.0.0.252", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "23.38.189.201", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5043 / UDP stream 55, frame 5303 / UDP stream 61" }, { "type": "ipv4", "value": "23.38.189.225", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5043 / UDP stream 55, frame 5303 / UDP stream 61" }, { "type": "ipv4", "value": "239.255.255.250", "confidence": 1, "description": "http-host, network-endpoint; frame 5688, frame 5689, frame 5690, frame 5691, frame 5692 +3 more" }, { "type": "ipv4", "value": "255.255.255.255", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "40.83.240.146", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1430 / UDP stream 51" }, { "type": "ipv4", "value": "52.168.112.67", "confidence": 1, "description": "dns-answer, network-endpoint; frame 761 / UDP stream 36" }, { "type": "ipv4", "value": "52.178.17.2", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5084 / UDP stream 56, frame 5639 / UDP stream 62, frame 5717 / UDP stream 64" }, { "type": "ipv4", "value": "52.179.216.235", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5236 / UDP stream 58" }, { "type": "ipv4", "value": "52.183.220.149", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1144 / UDP stream 44, frame 4909 / UDP stream 53" }, { "type": "ipv4", "value": "52.238.248.1", "confidence": 1, "description": "dns-answer; frame 4937 / UDP stream 54" }, { "type": "ipv4", "value": "52.249.36.204", "confidence": 1, "description": "dns-answer, network-endpoint; frame 4937 / UDP stream 54" }, { "type": "ipv4", "value": "67.27.123.126", "confidence": 1, "description": "dns-answer; frame 5775 / UDP stream 65" }, { "type": "ipv4", "value": "8.240.136.254", "confidence": 1, "description": "dns-answer; frame 5775 / UDP stream 65" }, { "type": "ipv4", "value": "8.249.3.254", "confidence": 1, "description": "dns-answer; frame 5775 / UDP stream 65" }, { "type": "ipv4", "value": "8.249.7.254", "confidence": 1, "description": "dns-answer; frame 5775 / UDP stream 65" }, { "type": "ipv4", "value": "8.253.189.126", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5775 / UDP stream 65" }, { "type": "ja3", "value": "28a2c9bd18a11de089ef85a160da29e4", "confidence": 1, "description": "tls-client-fingerprint; frame 1042 / TCP stream 51, frame 1165 / TCP stream 55, frame 1356 / TCP stream 62, frame 1447 / TCP stream 64, frame 4913 / TCP stream 67 +10 more" }, { "type": "ja3", "value": "37f463bf4616ecd445d4a1937da06e19", "confidence": 1, "description": "tls-client-fingerprint; frame 1066 / TCP stream 52" }, { "type": "ja3", "value": "3b5074b1b5d032e5620f69f9f700ff0e", "confidence": 1, "description": "tls-client-fingerprint; frame 1435 / TCP stream 63" }, { "type": "ja3", "value": "6271f898ce5be7dd52b0fc260d0662b3", "confidence": 1, "description": "tls-client-fingerprint; frame 1090 / TCP stream 53, frame 1232 / TCP stream 57, frame 5825 / TCP stream 85" }, { "type": "ja3", "value": "a0e9f5d64349fb13191bc781f81f42e1", "confidence": 1, "description": "tls-client-fingerprint; frame 770 / TCP stream 38, frame 1148 / TCP stream 54, frame 1189 / TCP stream 56, frame 4851 / TCP stream 66" }, { "type": "sha256", "value": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "url", "value": "http://2.56.57.108/osk/", "confidence": 1, "description": "http-request; frame 4816 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//1.jpg", "confidence": 1, "description": "http-request; frame 1641 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//2.jpg", "confidence": 1, "description": "http-request; frame 2225 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//3.jpg", "confidence": 1, "description": "http-request; frame 2541 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//4.jpg", "confidence": 1, "description": "http-request; frame 2691 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//5.jpg", "confidence": 1, "description": "http-request; frame 3054 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//6.jpg", "confidence": 1, "description": "http-request; frame 1501 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//7.jpg", "confidence": 1, "description": "http-request; frame 4194 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//main.php", "confidence": 1, "description": "http-request; frame 4275 / TCP stream 65" }, { "type": "url", "value": "http://239.255.255.250:1900*", "confidence": 1, "description": "http-request; frame 5688, frame 5689, frame 5690, frame 5691, frame 5692 +3 more" }, { "type": "url", "value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "confidence": 1, "description": "http-request; frame 5309 / TCP stream 76, frame 5313 / TCP stream 77, frame 5317 / TCP stream 76" }, { "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d", "confidence": 1, "description": "http-request; frame 5779 / TCP stream 83" }, { "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "confidence": 1, "description": "http-request; frame 5058 / TCP stream 69" }, { "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "confidence": 1, "description": "http-request; frame 5047 / TCP stream 69" }, { "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "confidence": 1, "description": "http-request; frame 5069 / TCP stream 69" }, { "type": "user_agent", "value": "Microsoft-CryptoAPI/10.0", "confidence": 1, "description": "http-client; frame 5779 / TCP stream 83" }, { "type": "user_agent", "value": "Microsoft-Delivery-Optimization/10.0", "confidence": 1, "description": "http-client; frame 5309 / TCP stream 76, frame 5313 / TCP stream 77, frame 5317 / TCP stream 76" }, { "type": "user_agent", "value": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32", "confidence": 1, "description": "http-client; frame 5047 / TCP stream 69, frame 5058 / TCP stream 69, frame 5069 / TCP stream 69" } ], "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap" ], "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "semantic_sha256": "d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482", "observable_count": 94, "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis", "source_analysis_ref": "/api/pcap/analyses/6e50c68f-5552-400c-9835-15867ddb022d", "suspicious_findings": [ { "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v3; confidence 86%.", "category": "Script, archive, or executable transfer candidate", "evidence": "frame 5309 / TCP stream 76, frame 5315 / TCP stream 76, frame 5317 / TCP stream 76, frame 5636 / TCP stream 76", "severity": "medium" }, { "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v3; confidence 86%.", "category": "Script, archive, or executable transfer candidate", "evidence": "frame 5313 / TCP stream 77, frame 5316 / TCP stream 77", "severity": "medium" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 246 / TCP stream 6, frame 253 / TCP stream 6, frame 254 / TCP stream 10, frame 257 / TCP stream 6, frame 262 / TCP stream 6 +25 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 29 / TCP stream 0, frame 191 / TCP stream 15, frame 213 / TCP stream 15, frame 219 / TCP stream 15, frame 221 / TCP stream 15 +42 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 931 / TCP stream 43, frame 933 / TCP stream 43, frame 935 / TCP stream 43, frame 937 / TCP stream 43, frame 939 / TCP stream 43 +10 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 241 / TCP stream 6, frame 251 / TCP stream 6, frame 252 / TCP stream 10, frame 255 / TCP stream 6, frame 256 / TCP stream 10 +25 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 27 / TCP stream 0, frame 189 / TCP stream 15, frame 210 / TCP stream 15, frame 218 / TCP stream 15, frame 220 / TCP stream 15 +53 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 930 / TCP stream 43, frame 932 / TCP stream 43, frame 934 / TCP stream 43, frame 936 / TCP stream 43, frame 938 / TCP stream 43 +10 more", "severity": "low" } ], "observables_truncated": false, "actor_similarity_leads": [ { "status": "ttp-overlap-not-attribution", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "group_attack_id": "G0123", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "group_attack_id": "G0044", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "group_attack_id": "G0130", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "group_attack_id": "G0136", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "group_attack_id": "G0133", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0107", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G1013", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0066", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0075", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "group_attack_id": "G0120", "shared_techniques": [ "T1105" ] } ], "expected_suspicious_behaviors": [] }, { "id": "ttp-evidence:6e50c68f-5552-400c-9835-15867ddb022d:T1105", "type": "ttp-evidence", "label": "T1105 Ingress Tool Transfer", "source": "log-pcap-analysis", "status": "suggested", "tactic": "command-and-control", "evidence": "T1105 Ingress Tool Transfer", "attack_id": "T1105", "confidence": 0.8, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:api.msn.com", "type": "ioc", "value": "api.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1061 / UDP stream 42, frame 1062 / UDP stream 42, frame 1066 / TCP stream 52", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:au.download.windowsupdate.com", "type": "ioc", "value": "au.download.windowsupdate.com", "source": "ioc-investigation", "verdict": "needs review", "ioc_type": "domain", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "au.download.windowsupdate.com was classified as domain. Investigation verdict is needs review with score 34/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation" ], "suspicion_score": 34 }, { "id": "ioc:client.wns.windows.com", "type": "ioc", "value": "client.wns.windows.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1429 / UDP stream 51, frame 1430 / UDP stream 51, frame 1435 / TCP stream 63", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:cp801.prod.do.dsp.mp.microsoft.com", "type": "ioc", "value": "cp801.prod.do.dsp.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 5282 / UDP stream 60, frame 5283 / UDP stream 60, frame 5287 / TCP stream 75", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ctldl.windowsupdate.com", "type": "ioc", "value": "ctldl.windowsupdate.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, http-host; frame 5774 / UDP stream 65, frame 5775 / UDP stream 65, frame 5779 / TCP stream 83", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:dns.msftncsi.com", "type": "ioc", "value": "dns.msftncsi.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 49 / UDP stream 11, frame 50 / UDP stream 11", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:download.windowsupdate.com", "type": "ioc", "value": "download.windowsupdate.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, http-host; frame 5042 / UDP stream 55, frame 5043 / UDP stream 55, frame 5047 / TCP stream 69, frame 5058 / TCP stream 69, frame 5069 / TCP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe2cr.update.microsoft.com", "type": "ioc", "value": "fe2cr.update.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 4936 / UDP stream 54, frame 4937 / UDP stream 54, frame 4941 / TCP stream 68", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe3cr.delivery.mp.microsoft.com", "type": "ioc", "value": "fe3cr.delivery.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 5148 / UDP stream 57, frame 5149 / UDP stream 57, frame 5153 / TCP stream 71", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:geo.prod.do.dsp.mp.microsoft.com", "type": "ioc", "value": "geo.prod.do.dsp.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 5235 / UDP stream 58, frame 5236 / UDP stream 58, frame 5240 / TCP stream 73", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:kv801.prod.do.dsp.mp.microsoft.com", "type": "ioc", "value": "kv801.prod.do.dsp.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 5259 / UDP stream 59, frame 5260 / UDP stream 59, frame 5266 / TCP stream 74", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:pti.store.microsoft.com", "type": "ioc", "value": "pti.store.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1432 / UDP stream 52, frame 1437 / UDP stream 52, frame 1447 / TCP stream 64", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:self.events.data.microsoft.com", "type": "ioc", "value": "self.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 760 / UDP stream 36, frame 761 / UDP stream 36, frame 770 / TCP stream 38, frame 4851 / TCP stream 66", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:settings-win.data.microsoft.com", "type": "ioc", "value": "settings-win.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1143 / UDP stream 44, frame 1144 / UDP stream 44, frame 4908 / UDP stream 53, frame 4909 / UDP stream 53, frame 1148 / TCP stream 54 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:settingsfd-geo.trafficmanager.net", "type": "ioc", "value": "settingsfd-geo.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-cname; frame 1144 / UDP stream 44, frame 4909 / UDP stream 53", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:spoonwatch-dc.spoonwatch.net", "type": "ioc", "value": "spoonwatch-dc.spoonwatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 18 / UDP stream 5, frame 19 / UDP stream 5, frame 369 / UDP stream 28, frame 374 / UDP stream 28", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:spoonwatch.net", "type": "ioc", "value": "spoonwatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 863 / UDP stream 40, frame 864 / UDP stream 40", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:v10.events.data.microsoft.com", "type": "ioc", "value": "v10.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1351 / UDP stream 50, frame 1352 / UDP stream 50, frame 5083 / UDP stream 56, frame 5084 / UDP stream 56, frame 5638 / UDP stream 62 +9 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:v20.events.data.microsoft.com", "type": "ioc", "value": "v20.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1037 / UDP stream 41, frame 1038 / UDP stream 41, frame 1042 / TCP stream 51", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wns.notify.trafficmanager.net", "type": "ioc", "value": "wns.notify.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-cname; frame 1430 / UDP stream 51", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wpad.localdomain", "type": "ioc", "value": "wpad.localdomain", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 58 / UDP stream 15, frame 59 / UDP stream 15, frame 806 / UDP stream 38, frame 807 / UDP stream 38, frame 1218 / UDP stream 46 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wpad.spoonwatch.net", "type": "ioc", "value": "wpad.spoonwatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 56 / UDP stream 14, frame 57 / UDP stream 14, frame 804 / UDP stream 37, frame 805 / UDP stream 37, frame 1216 / UDP stream 45 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.bing.com", "type": "ioc", "value": "www.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1085 / UDP stream 43, frame 1086 / UDP stream 43, frame 1226 / UDP stream 47, frame 1227 / UDP stream 47, frame 5820 / UDP stream 69 +4 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:0.0.0.0", "type": "ioc", "value": "0.0.0.0", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:104.212.67.47", "type": "ioc", "value": "104.212.67.47", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1437 / UDP stream 52", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.21.200", "type": "ioc", "value": "13.107.21.200", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 1086 / UDP stream 43, frame 1227 / UDP stream 47, frame 5821 / UDP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:131.107.255.255", "type": "ioc", "value": "131.107.255.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 50 / UDP stream 11", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:184.50.62.43", "type": "ioc", "value": "184.50.62.43", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5260 / UDP stream 59, frame 5283 / UDP stream 60", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:192.168.1.1", "type": "ioc", "value": "192.168.1.1", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:192.168.1.2", "type": "ioc", "value": "192.168.1.2", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 17 / UDP stream 4, frame 19 / UDP stream 5, frame 53 / UDP stream 12, frame 55 / UDP stream 13, frame 223 / UDP stream 22 +6 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:192.168.1.216", "type": "ioc", "value": "192.168.1.216", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:192.168.1.255", "type": "ioc", "value": "192.168.1.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:2.56.57.108", "type": "ioc", "value": "2.56.57.108", "source": "ioc-investigation", "verdict": "highly suspicious", "ioc_type": "ip", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "2.56.57.108 was classified as ip. Investigation verdict is highly suspicious with score 79/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 2 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation" ], "suspicion_score": 79 }, { "id": "ioc:20.189.173.1", "type": "ioc", "value": "20.189.173.1", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1352 / UDP stream 50", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.50.80.210", "type": "ioc", "value": "20.50.80.210", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1038 / UDP stream 41", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.54.89.15", "type": "ioc", "value": "20.54.89.15", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5149 / UDP stream 57", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:204.79.197.200", "type": "ioc", "value": "204.79.197.200", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1086 / UDP stream 43, frame 1227 / UDP stream 47, frame 5821 / UDP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:204.79.197.203", "type": "ioc", "value": "204.79.197.203", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1062 / UDP stream 42", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:224.0.0.22", "type": "ioc", "value": "224.0.0.22", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:224.0.0.251", "type": "ioc", "value": "224.0.0.251", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:224.0.0.252", "type": "ioc", "value": "224.0.0.252", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.38.189.201", "type": "ioc", "value": "23.38.189.201", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5043 / UDP stream 55, frame 5303 / UDP stream 61", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.38.189.225", "type": "ioc", "value": "23.38.189.225", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5043 / UDP stream 55, frame 5303 / UDP stream 61", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:239.255.255.250", "type": "ioc", "value": "239.255.255.250", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-host, network-endpoint; frame 5688, frame 5689, frame 5690, frame 5691, frame 5692 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:255.255.255.255", "type": "ioc", "value": "255.255.255.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:40.83.240.146", "type": "ioc", "value": "40.83.240.146", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1430 / UDP stream 51", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.168.112.67", "type": "ioc", "value": "52.168.112.67", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 761 / UDP stream 36", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.178.17.2", "type": "ioc", "value": "52.178.17.2", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5084 / UDP stream 56, frame 5639 / UDP stream 62, frame 5717 / UDP stream 64", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.179.216.235", "type": "ioc", "value": "52.179.216.235", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5236 / UDP stream 58", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.183.220.149", "type": "ioc", "value": "52.183.220.149", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1144 / UDP stream 44, frame 4909 / UDP stream 53", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.238.248.1", "type": "ioc", "value": "52.238.248.1", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 4937 / UDP stream 54", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.249.36.204", "type": "ioc", "value": "52.249.36.204", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 4937 / UDP stream 54", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:67.27.123.126", "type": "ioc", "value": "67.27.123.126", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:8.240.136.254", "type": "ioc", "value": "8.240.136.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:8.249.3.254", "type": "ioc", "value": "8.249.3.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:8.249.7.254", "type": "ioc", "value": "8.249.7.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:8.253.189.126", "type": "ioc", "value": "8.253.189.126", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:28a2c9bd18a11de089ef85a160da29e4", "type": "ioc", "value": "28a2c9bd18a11de089ef85a160da29e4", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 1042 / TCP stream 51, frame 1165 / TCP stream 55, frame 1356 / TCP stream 62, frame 1447 / TCP stream 64, frame 4913 / TCP stream 67 +10 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:37f463bf4616ecd445d4a1937da06e19", "type": "ioc", "value": "37f463bf4616ecd445d4a1937da06e19", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 1066 / TCP stream 52", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:3b5074b1b5d032e5620f69f9f700ff0e", "type": "ioc", "value": "3b5074b1b5d032e5620f69f9f700ff0e", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 1435 / TCP stream 63", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:6271f898ce5be7dd52b0fc260d0662b3", "type": "ioc", "value": "6271f898ce5be7dd52b0fc260d0662b3", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 1090 / TCP stream 53, frame 1232 / TCP stream 57, frame 5825 / TCP stream 85", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a0e9f5d64349fb13191bc781f81f42e1", "type": "ioc", "value": "a0e9f5d64349fb13191bc781f81f42e1", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 770 / TCP stream 38, frame 1148 / TCP stream 54, frame 1189 / TCP stream 56, frame 4851 / TCP stream 66", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "type": "ioc", "value": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "type": "ioc", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "source": "ioc-investigation", "verdict": "suspicious", "ioc_type": "hash", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660 was classified as hash. Investigation verdict is suspicious with score 53/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 24 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ], "suspicion_score": 53 }, { "id": "ioc:18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "type": "ioc", "value": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "type": "ioc", "value": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "type": "ioc", "value": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "type": "ioc", "value": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "type": "ioc", "value": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "type": "ioc", "value": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "type": "ioc", "value": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "type": "ioc", "value": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "type": "ioc", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "type": "ioc", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "source": "ioc-investigation", "verdict": "suspicious", "ioc_type": "hash", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba was classified as hash. Investigation verdict is suspicious with score 53/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 32 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ], "suspicion_score": 53 }, { "id": "ioc:c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "type": "ioc", "value": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "type": "ioc", "value": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk/", "type": "ioc", "value": "http://2.56.57.108/osk/", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 4816 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//1.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//1.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 1641 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//2.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//2.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 2225 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//3.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//3.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 2541 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//4.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//4.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 2691 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//5.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//5.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 3054 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//6.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//6.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 1501 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//7.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//7.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 4194 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//main.php", "type": "ioc", "value": "http://2.56.57.108/osk//main.php", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 4275 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://239.255.255.250:1900*", "type": "ioc", "value": "http://239.255.255.250:1900*", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5688, frame 5689, frame 5690, frame 5691, frame 5692 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "type": "ioc", "value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5309 / TCP stream 76, frame 5313 / TCP stream 77, frame 5317 / TCP stream 76", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d", "type": "ioc", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5779 / TCP stream 83", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "type": "ioc", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5058 / TCP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "type": "ioc", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5047 / TCP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "type": "ioc", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5069 / TCP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "finding-d7b07e629e8e0f6702dd148e", "type": "pcap-finding", "label": "Script, archive, or executable transfer candidate", "source": "deterministic-pcap-analysis", "metrics": { "uri": "/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "source": "23.38.189.225", "destination": "192.168.1.216", "content_type": "application/octet-stream", "response_count": 2, "declared_body_bytes": 307634 }, "rule_id": "script-or-executable-transfer", "severity": "medium", "confidence": 0.86, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 76, "frame_number": 5309, "display_filter": "frame.number == 5309", "timestamp_epoch": "1641572062.462443000" }, { "tcp_stream": 76, "frame_number": 5315, "display_filter": "frame.number == 5315", "timestamp_epoch": "1641572062.488577000" }, { "tcp_stream": 76, "frame_number": 5317, "display_filter": "frame.number == 5317", "timestamp_epoch": "1641572062.491933000" }, { "tcp_stream": 76, "frame_number": 5636, "display_filter": "frame.number == 5636", "timestamp_epoch": "1641572062.587068000" } ] }, { "id": "finding-a5d772a1518cadd8ca9a6ccd", "type": "pcap-finding", "label": "Script, archive, or executable transfer candidate", "source": "deterministic-pcap-analysis", "metrics": { "uri": "/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "source": "23.38.189.201", "destination": "192.168.1.216", "content_type": "application/octet-stream", "response_count": 1, "declared_body_bytes": 2 }, "rule_id": "script-or-executable-transfer", "severity": "medium", "confidence": 0.86, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 77, "frame_number": 5313, "display_filter": "frame.number == 5313", "timestamp_epoch": "1641572062.465939000" }, { "tcp_stream": 77, "frame_number": 5316, "display_filter": "frame.number == 5316", "timestamp_epoch": "1641572062.488580000" } ] }, { "id": "finding-2629b43176825e7ba8783aaf", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.2", "protocol": "drsuapi", "destination": "192.168.1.216", "event_count": 30, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 6, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1641571451.003845000" }, { "tcp_stream": 6, "frame_number": 253, "display_filter": "frame.number == 253", "timestamp_epoch": "1641571451.004569000" }, { "tcp_stream": 10, "frame_number": 254, "display_filter": "frame.number == 254", "timestamp_epoch": "1641571451.004734000" }, { "tcp_stream": 6, "frame_number": 257, "display_filter": "frame.number == 257", "timestamp_epoch": "1641571451.005072000" }, { "tcp_stream": 6, "frame_number": 262, "display_filter": "frame.number == 262", "timestamp_epoch": "1641571451.005520000" }, { "tcp_stream": 10, "frame_number": 263, "display_filter": "frame.number == 263", "timestamp_epoch": "1641571451.005596000" }, { "tcp_stream": 10, "frame_number": 265, "display_filter": "frame.number == 265", "timestamp_epoch": "1641571451.005981000" }, { "tcp_stream": 6, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1641571451.008749000" }, { "tcp_stream": 6, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1641571451.011706000" }, { "tcp_stream": 6, "frame_number": 286, "display_filter": "frame.number == 286", "timestamp_epoch": "1641571451.014021000" }, { "tcp_stream": 19, "frame_number": 330, "display_filter": "frame.number == 330", "timestamp_epoch": "1641571451.128893000" }, { "tcp_stream": 19, "frame_number": 337, "display_filter": "frame.number == 337", "timestamp_epoch": "1641571451.129893000" }, { "tcp_stream": 19, "frame_number": 339, "display_filter": "frame.number == 339", "timestamp_epoch": "1641571451.130453000" }, { "tcp_stream": 19, "frame_number": 341, "display_filter": "frame.number == 341", "timestamp_epoch": "1641571451.130833000" }, { "tcp_stream": 31, "frame_number": 622, "display_filter": "frame.number == 622", "timestamp_epoch": "1641571454.555556000" }, { "tcp_stream": 31, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1641571454.556869000" }, { "tcp_stream": 31, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1641571454.557533000" }, { "tcp_stream": 31, "frame_number": 630, "display_filter": "frame.number == 630", "timestamp_epoch": "1641571454.559408000" }, { "tcp_stream": 31, "frame_number": 632, "display_filter": "frame.number == 632", "timestamp_epoch": "1641571454.559994000" }, { "tcp_stream": 31, "frame_number": 634, "display_filter": "frame.number == 634", "timestamp_epoch": "1641571454.560773000" }, { "tcp_stream": 10, "frame_number": 903, "display_filter": "frame.number == 903", "timestamp_epoch": "1641571491.751288000" }, { "tcp_stream": 10, "frame_number": 905, "display_filter": "frame.number == 905", "timestamp_epoch": "1641571491.751833000" }, { "tcp_stream": 10, "frame_number": 907, "display_filter": "frame.number == 907", "timestamp_epoch": "1641571491.752292000" }, { "tcp_stream": 10, "frame_number": 910, "display_filter": "frame.number == 910", "timestamp_epoch": "1641571491.752713000" }, { "tcp_stream": 59, "frame_number": 1283, "display_filter": "frame.number == 1283", "timestamp_epoch": "1641571552.683126000" }, { "tcp_stream": 59, "frame_number": 1285, "display_filter": "frame.number == 1285", "timestamp_epoch": "1641571552.683986000" }, { "tcp_stream": 59, "frame_number": 1287, "display_filter": "frame.number == 1287", "timestamp_epoch": "1641571552.684546000" }, { "tcp_stream": 59, "frame_number": 1291, "display_filter": "frame.number == 1291", "timestamp_epoch": "1641571552.686361000" }, { "tcp_stream": 59, "frame_number": 1293, "display_filter": "frame.number == 1293", "timestamp_epoch": "1641571552.687064000" }, { "tcp_stream": 59, "frame_number": 1295, "display_filter": "frame.number == 1295", "timestamp_epoch": "1641571552.687556000" } ] }, { "id": "finding-9db47598ea52192f7844b3b1", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.2", "protocol": "ldap", "destination": "192.168.1.216", "event_count": 47, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 29, "display_filter": "frame.number == 29", "timestamp_epoch": "1641571449.760917000" }, { "tcp_stream": 15, "frame_number": 191, "display_filter": "frame.number == 191", "timestamp_epoch": "1641571450.989667000" }, { "tcp_stream": 15, "frame_number": 213, "display_filter": "frame.number == 213", "timestamp_epoch": "1641571450.993333000" }, { "tcp_stream": 15, "frame_number": 219, "display_filter": "frame.number == 219", "timestamp_epoch": "1641571450.994494000" }, { "tcp_stream": 15, "frame_number": 221, "display_filter": "frame.number == 221", "timestamp_epoch": "1641571450.995376000" }, { "tcp_stream": 0, "frame_number": 266, "display_filter": "frame.number == 266", "timestamp_epoch": "1641571451.006109000" }, { "tcp_stream": 15, "frame_number": 336, "display_filter": "frame.number == 336", "timestamp_epoch": "1641571451.129832000" }, { "tcp_stream": 15, "frame_number": 357, "display_filter": "frame.number == 357", "timestamp_epoch": "1641571451.296908000" }, { "tcp_stream": 15, "frame_number": 373, "display_filter": "frame.number == 373", "timestamp_epoch": "1641571451.429677000" }, { "tcp_stream": 15, "frame_number": 382, "display_filter": "frame.number == 382", "timestamp_epoch": "1641571451.460801000" }, { "tcp_stream": 15, "frame_number": 384, "display_filter": "frame.number == 384", "timestamp_epoch": "1641571451.461821000" }, { "tcp_stream": 25, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1641571452.071453000" }, { "tcp_stream": 25, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1641571452.073968000" }, { "tcp_stream": 25, "frame_number": 422, "display_filter": "frame.number == 422", "timestamp_epoch": "1641571452.365154000" }, { "tcp_stream": 27, "frame_number": 429, "display_filter": "frame.number == 429", "timestamp_epoch": "1641571452.369088000" }, { "tcp_stream": 27, "frame_number": 431, "display_filter": "frame.number == 431", "timestamp_epoch": "1641571452.369795000" }, { "tcp_stream": 27, "frame_number": 433, "display_filter": "frame.number == 433", "timestamp_epoch": "1641571452.370428000" }, { "tcp_stream": 25, "frame_number": 435, "display_filter": "frame.number == 435", "timestamp_epoch": "1641571452.371863000" }, { "tcp_stream": 32, "frame_number": 640, "display_filter": "frame.number == 640", "timestamp_epoch": "1641571454.565359000" }, { "tcp_stream": 32, "frame_number": 645, "display_filter": "frame.number == 645", "timestamp_epoch": "1641571454.567281000" }, { "tcp_stream": 32, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1641571454.568025000" }, { "tcp_stream": 32, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1641571454.568648000" }, { "tcp_stream": 32, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1641571454.569313000" }, { "tcp_stream": 33, "frame_number": 658, "display_filter": "frame.number == 658", "timestamp_epoch": "1641571454.575321000" }, { "tcp_stream": 33, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1641571454.576692000" }, { "tcp_stream": 33, "frame_number": 665, "display_filter": "frame.number == 665", "timestamp_epoch": "1641571454.577451000" }, { "tcp_stream": 34, "frame_number": 706, "display_filter": "frame.number == 706", "timestamp_epoch": "1641571460.157120000" }, { "tcp_stream": 34, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1641571460.159345000" }, { "tcp_stream": 34, "frame_number": 713, "display_filter": "frame.number == 713", "timestamp_epoch": "1641571460.162077000" }, { "tcp_stream": 34, "frame_number": 715, "display_filter": "frame.number == 715", "timestamp_epoch": "1641571460.162667000" }, { "tcp_stream": 34, "frame_number": 717, "display_filter": "frame.number == 717", "timestamp_epoch": "1641571460.163177000" }, { "tcp_stream": 34, "frame_number": 719, "display_filter": "frame.number == 719", "timestamp_epoch": "1641571460.163665000" }, { "tcp_stream": 34, "frame_number": 721, "display_filter": "frame.number == 721", "timestamp_epoch": "1641571460.164190000" }, { "tcp_stream": 49, "frame_number": 1009, "display_filter": "frame.number == 1009", "timestamp_epoch": "1641571492.072146000" }, { "tcp_stream": 49, "frame_number": 1011, "display_filter": "frame.number == 1011", "timestamp_epoch": "1641571492.078889000" }, { "tcp_stream": 50, "frame_number": 1018, "display_filter": "frame.number == 1018", "timestamp_epoch": "1641571492.088787000" }, { "tcp_stream": 50, "frame_number": 1020, "display_filter": "frame.number == 1020", "timestamp_epoch": "1641571492.090063000" }, { "tcp_stream": 50, "frame_number": 1022, "display_filter": "frame.number == 1022", "timestamp_epoch": "1641571492.090556000" }, { "tcp_stream": 49, "frame_number": 1024, "display_filter": "frame.number == 1024", "timestamp_epoch": "1641571492.091320000" }, { "tcp_stream": 60, "frame_number": 1301, "display_filter": "frame.number == 1301", "timestamp_epoch": "1641571552.690387000" }, { "tcp_stream": 60, "frame_number": 1306, "display_filter": "frame.number == 1306", "timestamp_epoch": "1641571552.692352000" }, { "tcp_stream": 60, "frame_number": 1308, "display_filter": "frame.number == 1308", "timestamp_epoch": "1641571552.693351000" }, { "tcp_stream": 60, "frame_number": 1310, "display_filter": "frame.number == 1310", "timestamp_epoch": "1641571552.693923000" }, { "tcp_stream": 60, "frame_number": 1312, "display_filter": "frame.number == 1312", "timestamp_epoch": "1641571552.694537000" }, { "tcp_stream": 61, "frame_number": 1319, "display_filter": "frame.number == 1319", "timestamp_epoch": "1641571552.698593000" }, { "tcp_stream": 61, "frame_number": 1323, "display_filter": "frame.number == 1323", "timestamp_epoch": "1641571552.699332000" }, { "tcp_stream": 61, "frame_number": 1326, "display_filter": "frame.number == 1326", "timestamp_epoch": "1641571552.700008000" } ] }, { "id": "finding-91ee3e149e111692dc445e62", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.2", "protocol": "samr", "destination": "192.168.1.216", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 43, "frame_number": 931, "display_filter": "frame.number == 931", "timestamp_epoch": "1641571491.762873000" }, { "tcp_stream": 43, "frame_number": 933, "display_filter": "frame.number == 933", "timestamp_epoch": "1641571491.763490000" }, { "tcp_stream": 43, "frame_number": 935, "display_filter": "frame.number == 935", "timestamp_epoch": "1641571491.764023000" }, { "tcp_stream": 43, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1641571491.765022000" }, { "tcp_stream": 43, "frame_number": 939, "display_filter": "frame.number == 939", "timestamp_epoch": "1641571491.765641000" }, { "tcp_stream": 43, "frame_number": 941, "display_filter": "frame.number == 941", "timestamp_epoch": "1641571491.766298000" }, { "tcp_stream": 43, "frame_number": 943, "display_filter": "frame.number == 943", "timestamp_epoch": "1641571491.766964000" }, { "tcp_stream": 43, "frame_number": 945, "display_filter": "frame.number == 945", "timestamp_epoch": "1641571491.767646000" }, { "tcp_stream": 43, "frame_number": 947, "display_filter": "frame.number == 947", "timestamp_epoch": "1641571491.768351000" }, { "tcp_stream": 43, "frame_number": 949, "display_filter": "frame.number == 949", "timestamp_epoch": "1641571491.769000000" }, { "tcp_stream": 43, "frame_number": 951, "display_filter": "frame.number == 951", "timestamp_epoch": "1641571491.769604000" }, { "tcp_stream": 43, "frame_number": 953, "display_filter": "frame.number == 953", "timestamp_epoch": "1641571491.770231000" }, { "tcp_stream": 43, "frame_number": 955, "display_filter": "frame.number == 955", "timestamp_epoch": "1641571491.770746000" }, { "tcp_stream": 43, "frame_number": 957, "display_filter": "frame.number == 957", "timestamp_epoch": "1641571491.771295000" }, { "tcp_stream": 43, "frame_number": 959, "display_filter": "frame.number == 959", "timestamp_epoch": "1641571491.771855000" } ] }, { "id": "finding-f921ff23cf0e8136c3155ef5", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.216", "protocol": "drsuapi", "destination": "192.168.1.2", "event_count": 30, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 6, "frame_number": 241, "display_filter": "frame.number == 241", "timestamp_epoch": "1641571451.003468000" }, { "tcp_stream": 6, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1641571451.004195000" }, { "tcp_stream": 10, "frame_number": 252, "display_filter": "frame.number == 252", "timestamp_epoch": "1641571451.004462000" }, { "tcp_stream": 6, "frame_number": 255, "display_filter": "frame.number == 255", "timestamp_epoch": "1641571451.004759000" }, { "tcp_stream": 10, "frame_number": 256, "display_filter": "frame.number == 256", "timestamp_epoch": "1641571451.005062000" }, { "tcp_stream": 6, "frame_number": 261, "display_filter": "frame.number == 261", "timestamp_epoch": "1641571451.005293000" }, { "tcp_stream": 10, "frame_number": 264, "display_filter": "frame.number == 264", "timestamp_epoch": "1641571451.005796000" }, { "tcp_stream": 6, "frame_number": 279, "display_filter": "frame.number == 279", "timestamp_epoch": "1641571451.008528000" }, { "tcp_stream": 6, "frame_number": 283, "display_filter": "frame.number == 283", "timestamp_epoch": "1641571451.011418000" }, { "tcp_stream": 6, "frame_number": 285, "display_filter": "frame.number == 285", "timestamp_epoch": "1641571451.013823000" }, { "tcp_stream": 19, "frame_number": 329, "display_filter": "frame.number == 329", "timestamp_epoch": "1641571451.128651000" }, { "tcp_stream": 19, "frame_number": 331, "display_filter": "frame.number == 331", "timestamp_epoch": "1641571451.129114000" }, { "tcp_stream": 19, "frame_number": 338, "display_filter": "frame.number == 338", "timestamp_epoch": "1641571451.130065000" }, { "tcp_stream": 19, "frame_number": 340, "display_filter": "frame.number == 340", "timestamp_epoch": "1641571451.130682000" }, { "tcp_stream": 31, "frame_number": 621, "display_filter": "frame.number == 621", "timestamp_epoch": "1641571454.554962000" }, { "tcp_stream": 31, "frame_number": 623, "display_filter": "frame.number == 623", "timestamp_epoch": "1641571454.556207000" }, { "tcp_stream": 31, "frame_number": 625, "display_filter": "frame.number == 625", "timestamp_epoch": "1641571454.557228000" }, { "tcp_stream": 31, "frame_number": 629, "display_filter": "frame.number == 629", "timestamp_epoch": "1641571454.559129000" }, { "tcp_stream": 31, "frame_number": 631, "display_filter": "frame.number == 631", "timestamp_epoch": "1641571454.559666000" }, { "tcp_stream": 31, "frame_number": 633, "display_filter": "frame.number == 633", "timestamp_epoch": "1641571454.560505000" }, { "tcp_stream": 10, "frame_number": 902, "display_filter": "frame.number == 902", "timestamp_epoch": "1641571491.751061000" }, { "tcp_stream": 10, "frame_number": 904, "display_filter": "frame.number == 904", "timestamp_epoch": "1641571491.751508000" }, { "tcp_stream": 10, "frame_number": 906, "display_filter": "frame.number == 906", "timestamp_epoch": "1641571491.752019000" }, { "tcp_stream": 10, "frame_number": 908, "display_filter": "frame.number == 908", "timestamp_epoch": "1641571491.752465000" }, { "tcp_stream": 59, "frame_number": 1282, "display_filter": "frame.number == 1282", "timestamp_epoch": "1641571552.682757000" }, { "tcp_stream": 59, "frame_number": 1284, "display_filter": "frame.number == 1284", "timestamp_epoch": "1641571552.683595000" }, { "tcp_stream": 59, "frame_number": 1286, "display_filter": "frame.number == 1286", "timestamp_epoch": "1641571552.684309000" }, { "tcp_stream": 59, "frame_number": 1290, "display_filter": "frame.number == 1290", "timestamp_epoch": "1641571552.686083000" }, { "tcp_stream": 59, "frame_number": 1292, "display_filter": "frame.number == 1292", "timestamp_epoch": "1641571552.686716000" }, { "tcp_stream": 59, "frame_number": 1294, "display_filter": "frame.number == 1294", "timestamp_epoch": "1641571552.687333000" } ] }, { "id": "finding-9d5591aa667e378ce0d979d4", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.216", "protocol": "ldap", "destination": "192.168.1.2", "event_count": 58, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 27, "display_filter": "frame.number == 27", "timestamp_epoch": "1641571449.760632000" }, { "tcp_stream": 15, "frame_number": 189, "display_filter": "frame.number == 189", "timestamp_epoch": "1641571450.989411000" }, { "tcp_stream": 15, "frame_number": 210, "display_filter": "frame.number == 210", "timestamp_epoch": "1641571450.992655000" }, { "tcp_stream": 15, "frame_number": 218, "display_filter": "frame.number == 218", "timestamp_epoch": "1641571450.994306000" }, { "tcp_stream": 15, "frame_number": 220, "display_filter": "frame.number == 220", "timestamp_epoch": "1641571450.995080000" }, { "tcp_stream": 0, "frame_number": 259, "display_filter": "frame.number == 259", "timestamp_epoch": "1641571451.005120000" }, { "tcp_stream": 0, "frame_number": 274, "display_filter": "frame.number == 274", "timestamp_epoch": "1641571451.007930000" }, { "tcp_stream": 15, "frame_number": 333, "display_filter": "frame.number == 333", "timestamp_epoch": "1641571451.129551000" }, { "tcp_stream": 15, "frame_number": 354, "display_filter": "frame.number == 354", "timestamp_epoch": "1641571451.296482000" }, { "tcp_stream": 15, "frame_number": 370, "display_filter": "frame.number == 370", "timestamp_epoch": "1641571451.429300000" }, { "tcp_stream": 15, "frame_number": 379, "display_filter": "frame.number == 379", "timestamp_epoch": "1641571451.460400000" }, { "tcp_stream": 15, "frame_number": 383, "display_filter": "frame.number == 383", "timestamp_epoch": "1641571451.461512000" }, { "tcp_stream": 15, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1641571451.462109000" }, { "tcp_stream": 25, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1641571452.071100000" }, { "tcp_stream": 25, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1641571452.073024000" }, { "tcp_stream": 25, "frame_number": 421, "display_filter": "frame.number == 421", "timestamp_epoch": "1641571452.364742000" }, { "tcp_stream": 27, "frame_number": 427, "display_filter": "frame.number == 427", "timestamp_epoch": "1641571452.367990000" }, { "tcp_stream": 27, "frame_number": 430, "display_filter": "frame.number == 430", "timestamp_epoch": "1641571452.369578000" }, { "tcp_stream": 27, "frame_number": 432, "display_filter": "frame.number == 432", "timestamp_epoch": "1641571452.370081000" }, { "tcp_stream": 25, "frame_number": 434, "display_filter": "frame.number == 434", "timestamp_epoch": "1641571452.371397000" }, { "tcp_stream": 27, "frame_number": 586, "display_filter": "frame.number == 586", "timestamp_epoch": "1641571452.658399000" }, { "tcp_stream": 25, "frame_number": 591, "display_filter": "frame.number == 591", "timestamp_epoch": "1641571452.719218000" }, { "tcp_stream": 32, "frame_number": 638, "display_filter": "frame.number == 638", "timestamp_epoch": "1641571454.564967000" }, { "tcp_stream": 32, "frame_number": 643, "display_filter": "frame.number == 643", "timestamp_epoch": "1641571454.566408000" }, { "tcp_stream": 32, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1641571454.567691000" }, { "tcp_stream": 32, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1641571454.568306000" }, { "tcp_stream": 32, "frame_number": 650, "display_filter": "frame.number == 650", "timestamp_epoch": "1641571454.568981000" }, { "tcp_stream": 33, "frame_number": 656, "display_filter": "frame.number == 656", "timestamp_epoch": "1641571454.574377000" }, { "tcp_stream": 33, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1641571454.576382000" }, { "tcp_stream": 33, "frame_number": 664, "display_filter": "frame.number == 664", "timestamp_epoch": "1641571454.577162000" }, { "tcp_stream": 33, "frame_number": 666, "display_filter": "frame.number == 666", "timestamp_epoch": "1641571454.577816000" }, { "tcp_stream": 32, "frame_number": 670, "display_filter": "frame.number == 670", "timestamp_epoch": "1641571454.578524000" }, { "tcp_stream": 34, "frame_number": 704, "display_filter": "frame.number == 704", "timestamp_epoch": "1641571460.156613000" }, { "tcp_stream": 34, "frame_number": 709, "display_filter": "frame.number == 709", "timestamp_epoch": "1641571460.158393000" }, { "tcp_stream": 34, "frame_number": 712, "display_filter": "frame.number == 712", "timestamp_epoch": "1641571460.161773000" }, { "tcp_stream": 34, "frame_number": 714, "display_filter": "frame.number == 714", "timestamp_epoch": "1641571460.162404000" }, { "tcp_stream": 34, "frame_number": 716, "display_filter": "frame.number == 716", "timestamp_epoch": "1641571460.162900000" }, { "tcp_stream": 34, "frame_number": 718, "display_filter": "frame.number == 718", "timestamp_epoch": "1641571460.163374000" }, { "tcp_stream": 34, "frame_number": 720, "display_filter": "frame.number == 720", "timestamp_epoch": "1641571460.163945000" }, { "tcp_stream": 34, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1641571460.176928000" }, { "tcp_stream": 49, "frame_number": 1007, "display_filter": "frame.number == 1007", "timestamp_epoch": "1641571492.071286000" }, { "tcp_stream": 49, "frame_number": 1010, "display_filter": "frame.number == 1010", "timestamp_epoch": "1641571492.078435000" }, { "tcp_stream": 50, "frame_number": 1016, "display_filter": "frame.number == 1016", "timestamp_epoch": "1641571492.087887000" }, { "tcp_stream": 50, "frame_number": 1019, "display_filter": "frame.number == 1019", "timestamp_epoch": "1641571492.089840000" }, { "tcp_stream": 50, "frame_number": 1021, "display_filter": "frame.number == 1021", "timestamp_epoch": "1641571492.090311000" }, { "tcp_stream": 49, "frame_number": 1023, "display_filter": "frame.number == 1023", "timestamp_epoch": "1641571492.090801000" }, { "tcp_stream": 50, "frame_number": 1027, "display_filter": "frame.number == 1027", "timestamp_epoch": "1641571492.410630000" }, { "tcp_stream": 49, "frame_number": 1031, "display_filter": "frame.number == 1031", "timestamp_epoch": "1641571492.418679000" }, { "tcp_stream": 60, "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1641571552.690072000" }, { "tcp_stream": 60, "frame_number": 1304, "display_filter": "frame.number == 1304", "timestamp_epoch": "1641571552.691378000" }, { "tcp_stream": 60, "frame_number": 1307, "display_filter": "frame.number == 1307", "timestamp_epoch": "1641571552.692973000" }, { "tcp_stream": 60, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1641571552.693680000" }, { "tcp_stream": 60, "frame_number": 1311, "display_filter": "frame.number == 1311", "timestamp_epoch": "1641571552.694215000" }, { "tcp_stream": 61, "frame_number": 1317, "display_filter": "frame.number == 1317", "timestamp_epoch": "1641571552.697751000" }, { "tcp_stream": 61, "frame_number": 1320, "display_filter": "frame.number == 1320", "timestamp_epoch": "1641571552.699027000" }, { "tcp_stream": 61, "frame_number": 1325, "display_filter": "frame.number == 1325", "timestamp_epoch": "1641571552.699715000" }, { "tcp_stream": 61, "frame_number": 1327, "display_filter": "frame.number == 1327", "timestamp_epoch": "1641571552.700270000" }, { "tcp_stream": 60, "frame_number": 1330, "display_filter": "frame.number == 1330", "timestamp_epoch": "1641571552.700472000" } ] }, { "id": "finding-e15ebfc8332800559cc11421", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.216", "protocol": "samr", "destination": "192.168.1.2", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 43, "frame_number": 930, "display_filter": "frame.number == 930", "timestamp_epoch": "1641571491.762466000" }, { "tcp_stream": 43, "frame_number": 932, "display_filter": "frame.number == 932", "timestamp_epoch": "1641571491.763188000" }, { "tcp_stream": 43, "frame_number": 934, "display_filter": "frame.number == 934", "timestamp_epoch": "1641571491.763726000" }, { "tcp_stream": 43, "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1641571491.764652000" }, { "tcp_stream": 43, "frame_number": 938, "display_filter": "frame.number == 938", "timestamp_epoch": "1641571491.765254000" }, { "tcp_stream": 43, "frame_number": 940, "display_filter": "frame.number == 940", "timestamp_epoch": "1641571491.765851000" }, { "tcp_stream": 43, "frame_number": 942, "display_filter": "frame.number == 942", "timestamp_epoch": "1641571491.766518000" }, { "tcp_stream": 43, "frame_number": 944, "display_filter": "frame.number == 944", "timestamp_epoch": "1641571491.767254000" }, { "tcp_stream": 43, "frame_number": 946, "display_filter": "frame.number == 946", "timestamp_epoch": "1641571491.767888000" }, { "tcp_stream": 43, "frame_number": 948, "display_filter": "frame.number == 948", "timestamp_epoch": "1641571491.768616000" }, { "tcp_stream": 43, "frame_number": 950, "display_filter": "frame.number == 950", "timestamp_epoch": "1641571491.769247000" }, { "tcp_stream": 43, "frame_number": 952, "display_filter": "frame.number == 952", "timestamp_epoch": "1641571491.769906000" }, { "tcp_stream": 43, "frame_number": 954, "display_filter": "frame.number == 954", "timestamp_epoch": "1641571491.770452000" }, { "tcp_stream": 43, "frame_number": 956, "display_filter": "frame.number == 956", "timestamp_epoch": "1641571491.770996000" }, { "tcp_stream": 43, "frame_number": 958, "display_filter": "frame.number == 958", "timestamp_epoch": "1641571491.771531000" } ] }, { "id": "identity-abb2d446808afab74c49aa3a", "type": "identity", "label": "account: desktop-gxmyno2$", "value": "desktop-gxmyno2$", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 2, "frame_number": 75, "display_filter": "frame.number == 75", "timestamp_epoch": "1641571450.952502000" }, { "tcp_stream": 7, "frame_number": 108, "display_filter": "frame.number == 108", "timestamp_epoch": "1641571450.966124000" }, { "tcp_stream": 9, "frame_number": 126, "display_filter": "frame.number == 126", "timestamp_epoch": "1641571450.978225000" }, { "tcp_stream": 8, "frame_number": 127, "display_filter": "frame.number == 127", "timestamp_epoch": "1641571450.978271000" }, { "tcp_stream": 8, "frame_number": 129, "display_filter": "frame.number == 129", "timestamp_epoch": "1641571450.978973000" }, { "tcp_stream": 9, "frame_number": 131, "display_filter": "frame.number == 131", "timestamp_epoch": "1641571450.979011000" }, { "tcp_stream": 11, "frame_number": 147, "display_filter": "frame.number == 147", "timestamp_epoch": "1641571450.983292000" }, { "tcp_stream": 12, "frame_number": 155, "display_filter": "frame.number == 155", "timestamp_epoch": "1641571450.984540000" }, { "tcp_stream": 12, "frame_number": 157, "display_filter": "frame.number == 157", "timestamp_epoch": "1641571450.985092000" }, { "tcp_stream": 13, "frame_number": 175, "display_filter": "frame.number == 175", "timestamp_epoch": "1641571450.987159000" }, { "tcp_stream": 14, "frame_number": 177, "display_filter": "frame.number == 177", "timestamp_epoch": "1641571450.987278000" }, { "tcp_stream": 16, "frame_number": 200, "display_filter": "frame.number == 200", "timestamp_epoch": "1641571450.991397000" }, { "tcp_stream": 17, "frame_number": 243, "display_filter": "frame.number == 243", "timestamp_epoch": "1641571451.003567000" }, { "tcp_stream": 20, "frame_number": 318, "display_filter": "frame.number == 318", "timestamp_epoch": "1641571451.124781000" }, { "tcp_stream": 26, "frame_number": 416, "display_filter": "frame.number == 416", "timestamp_epoch": "1641571452.357882000" }, { "tcp_stream": 28, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1641571452.580512000" }, { "tcp_stream": 29, "frame_number": 457, "display_filter": "frame.number == 457", "timestamp_epoch": "1641571452.582126000" }, { "tcp_stream": 35, "frame_number": 725, "display_filter": "frame.number == 725", "timestamp_epoch": "1641571460.169844000" }, { "tcp_stream": 36, "frame_number": 733, "display_filter": "frame.number == 733", "timestamp_epoch": "1641571460.171188000" }, { "tcp_stream": 36, "frame_number": 735, "display_filter": "frame.number == 735", "timestamp_epoch": "1641571460.171965000" } ] }, { "id": "identity-365401ea82bb1bcf88b24846", "type": "identity", "label": "account: steve.smith", "value": "steve.smith", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 39, "frame_number": 829, "display_filter": "frame.number == 829", "timestamp_epoch": "1641571491.641944000" }, { "tcp_stream": 40, "frame_number": 837, "display_filter": "frame.number == 837", "timestamp_epoch": "1641571491.650430000" }, { "tcp_stream": 40, "frame_number": 839, "display_filter": "frame.number == 839", "timestamp_epoch": "1641571491.651134000" }, { "tcp_stream": 41, "frame_number": 851, "display_filter": "frame.number == 851", "timestamp_epoch": "1641571491.653884000" }, { "tcp_stream": 45, "frame_number": 891, "display_filter": "frame.number == 891", "timestamp_epoch": "1641571491.749061000" }, { "tcp_stream": 43, "frame_number": 914, "display_filter": "frame.number == 914", "timestamp_epoch": "1641571491.757908000" }, { "tcp_stream": 43, "frame_number": 945, "display_filter": "frame.number == 945", "timestamp_epoch": "1641571491.767646000" }, { "tcp_stream": 47, "frame_number": 976, "display_filter": "frame.number == 976", "timestamp_epoch": "1641571491.976783000" }, { "tcp_stream": 48, "frame_number": 988, "display_filter": "frame.number == 988", "timestamp_epoch": "1641571491.978061000" } ] }, { "id": "identity-5bd6742609b9581037c4c48a", "type": "identity", "label": "domain: SPOONWATCH", "value": "SPOONWATCH", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "domain", "frame_evidence": [ { "tcp_stream": 43, "frame_number": 914, "display_filter": "frame.number == 914", "timestamp_epoch": "1641571491.757908000" } ] }, { "id": "identity-6dae22143111db7ea808966a", "type": "identity", "label": "full-name: Steve Smith", "value": "Steve Smith", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "full-name", "frame_evidence": [ { "tcp_stream": 43, "frame_number": 945, "display_filter": "frame.number == 945", "timestamp_epoch": "1641571491.767646000" } ] }, { "id": "identity-39f8d603084a921de3d8af92", "type": "identity", "label": "hostname: DESKTOP-GXMYNO2", "value": "DESKTOP-GXMYNO2", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1641571449.195191000" }, { "udp_stream": 32, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1641571458.269061000" }, { "udp_stream": 32, "frame_number": 756, "display_filter": "frame.number == 756", "timestamp_epoch": "1641571460.439069000" }, { "udp_stream": 32, "frame_number": 757, "display_filter": "frame.number == 757", "timestamp_epoch": "1641571460.447405000" }, { "tcp_stream": 43, "frame_number": 914, "display_filter": "frame.number == 914", "timestamp_epoch": "1641571491.757908000" }, { "udp_stream": 32, "frame_number": 4898, "display_filter": "frame.number == 4898", "timestamp_epoch": "1641571941.773819000" }, { "udp_stream": 32, "frame_number": 5789, "display_filter": "frame.number == 5789", "timestamp_epoch": "1641572165.411535000" }, { "tcp_stream": 84, "frame_number": 5804, "display_filter": "frame.number == 5804", "timestamp_epoch": "1641572169.963306000" }, { "udp_stream": 32, "frame_number": 5810, "display_filter": "frame.number == 5810", "timestamp_epoch": "1641572169.966188000" }, { "udp_stream": 32, "frame_number": 5813, "display_filter": "frame.number == 5813", "timestamp_epoch": "1641572169.974570000" }, { "tcp_stream": 86, "frame_number": 5870, "display_filter": "frame.number == 5870", "timestamp_epoch": "1641572199.980643000" }, { "udp_stream": 32, "frame_number": 5876, "display_filter": "frame.number == 5876", "timestamp_epoch": "1641572199.983522000" }, { "udp_stream": 32, "frame_number": 5879, "display_filter": "frame.number == 5879", "timestamp_epoch": "1641572199.992120000" } ] }, { "id": "identity-02fbdd3de412f87f2ca963b7", "type": "identity", "label": "hostname: DESKTOP-GXNYNO2", "value": "DESKTOP-GXNYNO2", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 9, "frame_number": 35, "display_filter": "frame.number == 35", "timestamp_epoch": "1641571449.914853000" }, { "udp_stream": 9, "frame_number": 51, "display_filter": "frame.number == 51", "timestamp_epoch": "1641571450.508277000" }, { "udp_stream": 9, "frame_number": 367, "display_filter": "frame.number == 367", "timestamp_epoch": "1641571451.419654000" }, { "udp_stream": 9, "frame_number": 395, "display_filter": "frame.number == 395", "timestamp_epoch": "1641571452.013737000" }, { "udp_stream": 9, "frame_number": 595, "display_filter": "frame.number == 595", "timestamp_epoch": "1641571452.919844000" }, { "udp_stream": 9, "frame_number": 597, "display_filter": "frame.number == 597", "timestamp_epoch": "1641571453.529149000" }, { "udp_stream": 31, "frame_number": 604, "display_filter": "frame.number == 604", "timestamp_epoch": "1641571454.466774000" }, { "udp_stream": 31, "frame_number": 676, "display_filter": "frame.number == 676", "timestamp_epoch": "1641571455.091589000" }, { "udp_stream": 31, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1641571455.216798000" }, { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1641571455.858375000" }, { "udp_stream": 31, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1641571455.967816000" }, { "udp_stream": 31, "frame_number": 688, "display_filter": "frame.number == 688", "timestamp_epoch": "1641571456.655208000" }, { "udp_stream": 31, "frame_number": 689, "display_filter": "frame.number == 689", "timestamp_epoch": "1641571456.732270000" }, { "udp_stream": 31, "frame_number": 692, "display_filter": "frame.number == 692", "timestamp_epoch": "1641571457.421213000" } ] }, { "id": "identity-5eddb325abca3c4744cca6ba", "type": "identity", "label": "netbios-group: SPOONWATCH", "value": "SPOONWATCH", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [], "identity_type": "netbios-group", "frame_evidence": [ { "udp_stream": 9, "frame_number": 34, "display_filter": "frame.number == 34", "timestamp_epoch": "1641571449.914575000" }, { "udp_stream": 9, "frame_number": 366, "display_filter": "frame.number == 366", "timestamp_epoch": "1641571451.419583000" }, { "udp_stream": 9, "frame_number": 581, "display_filter": "frame.number == 581", "timestamp_epoch": "1641571452.634484000" }, { "udp_stream": 9, "frame_number": 596, "display_filter": "frame.number == 596", "timestamp_epoch": "1641571452.919945000" }, { "udp_stream": 9, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1641571454.122849000" }, { "udp_stream": 31, "frame_number": 603, "display_filter": "frame.number == 603", "timestamp_epoch": "1641571454.466709000" }, { "udp_stream": 31, "frame_number": 678, "display_filter": "frame.number == 678", "timestamp_epoch": "1641571455.217047000" }, { "udp_stream": 9, "frame_number": 684, "display_filter": "frame.number == 684", "timestamp_epoch": "1641571455.669911000" }, { "udp_stream": 31, "frame_number": 686, "display_filter": "frame.number == 686", "timestamp_epoch": "1641571455.967670000" }, { "udp_stream": 31, "frame_number": 690, "display_filter": "frame.number == 690", "timestamp_epoch": "1641571456.732412000" }, { "udp_stream": 31, "frame_number": 691, "display_filter": "frame.number == 691", "timestamp_epoch": "1641571457.280575000" }, { "udp_stream": 31, "frame_number": 693, "display_filter": "frame.number == 693", "timestamp_epoch": "1641571458.061405000" }, { "udp_stream": 31, "frame_number": 695, "display_filter": "frame.number == 695", "timestamp_epoch": "1641571458.842505000" }, { "udp_stream": 31, "frame_number": 698, "display_filter": "frame.number == 698", "timestamp_epoch": "1641571459.639695000" } ] }, { "id": "artifact-d97603f25e66cddb706fcb20", "type": "file-artifact", "label": "5(1).jpg", "value": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "sha256": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "source": "deterministic-pcap-analysis", "size_bytes": 1246160, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-ba77ea8a3332a19a181b9027", "type": "file-artifact", "label": "1(1).jpg", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "sha256": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "source": "deterministic-pcap-analysis", "size_bytes": 645592, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-8b9b0493a287d17c5f1eecc5", "type": "file-artifact", "label": "4(1).jpg", "value": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "sha256": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "source": "deterministic-pcap-analysis", "size_bytes": 440120, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-bd16fd17c273bd4649e10555", "type": "file-artifact", "label": "2(1).jpg", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "sha256": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "source": "deterministic-pcap-analysis", "size_bytes": 334288, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-30b70f8f317e596afba72144", "type": "file-artifact", "label": "am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(2).exe", "value": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "sha256": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "source": "deterministic-pcap-analysis", "size_bytes": 307632, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-3df279c0ad09da471f95cba4", "type": "file-artifact", "label": "6(1).jpg", "value": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "sha256": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "source": "deterministic-pcap-analysis", "size_bytes": 144848, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-b63db24888c4d881e4ad1cb1", "type": "file-artifact", "label": "3(1).jpg", "value": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "sha256": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "source": "deterministic-pcap-analysis", "size_bytes": 137168, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-2b220b474ce8fb1830deb524", "type": "file-artifact", "label": "7(1).jpg", "value": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "sha256": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "source": "deterministic-pcap-analysis", "size_bytes": 83784, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-c63ac0bd2578aef5d655ca36", "type": "file-artifact", "label": "osk", "value": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "sha256": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "source": "deterministic-pcap-analysis", "size_bytes": 379629, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-4eba74982d2765516cf1de50", "type": "file-artifact", "label": "35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "value": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "sha256": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "source": "deterministic-pcap-analysis", "size_bytes": 10885, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-cf32cd5e7ba8303d854bb0db", "type": "file-artifact", "label": "35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "value": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "sha256": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "source": "deterministic-pcap-analysis", "size_bytes": 7317, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-be106ab865a5b9976c83cb52", "type": "file-artifact", "label": "35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "value": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "sha256": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "source": "deterministic-pcap-analysis", "size_bytes": 7313, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-d36bed8c61ca4d283e8647d0", "type": "file-artifact", "label": "1.jpg", "value": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "sha256": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "source": "deterministic-pcap-analysis", "size_bytes": 25, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-5f9d35a4b989c4ac72ebc230", "type": "file-artifact", "label": "am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(1).exe", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "sha256": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "source": "deterministic-pcap-analysis", "size_bytes": 2, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "type": "ioc-investigation", "label": "au.download.windowsupdate.com", "value": "au.download.windowsupdate.com", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "No malicious detections in last analysis; 60 harmless, 29 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "skipped", "summary": "MalwareBazaar is hash-focused; input is not a hash." }, { "source": "otx", "status": "ok", "summary": "OTX returned 0 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 10 scan result(s). urlscan activity analysis found 2 suspicious pattern(s)." }, { "source": "greynoise", "status": "skipped", "summary": "GreyNoise is IP-focused; input is not an IP." }, { "source": "abuseipdb", "status": "skipped", "summary": "AbuseIPDB is IP-focused; input is not an IP." }, { "source": "shodan", "status": "skipped", "summary": "Shodan host lookup is IP-focused; input is not an IP." }, { "source": "censys", "status": "ok", "summary": "Censys web property lookup returned 2 record(s) for au.download.windowsupdate.com. Broader Censys search requires an organization-enabled account and API role." } ], "summary": "au.download.windowsupdate.com was classified as domain. Investigation verdict is needs review with score 34/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "needs review", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "actor_leads": [], "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation" ], "artifact_type": "domain", "review_status": "unreviewed-provider-context", "suspicion_score": 34, "actor_lead_count": 0, "graph_edge_count": 36, "graph_node_count": 32, "source_analysis_ref": "/api/ioc/investigations/144ab9a0-2681-49f4-a410-b126d75d334d", "graph_preview_truncated": false, "graph_preview_edge_count": 36, "graph_preview_node_count": 32 }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "kind": "artifact", "tier": 0, "type": "domain", "value": "au.download.windowsupdate.com", "sources": [ "input", "virustotal", "urlscan", "censys" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:2.au.download.windowsupdate.com", "kind": "relationship", "tier": 1, "type": "domain", "value": "2.au.download.windowsupdate.com", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:4.au.download.windowsupdate.com", "kind": "relationship", "tier": 1, "type": "domain", "value": "4.au.download.windowsupdate.com", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:a767.dspw65.akamai.net", "kind": "relationship", "tier": 1, "type": "domain", "value": "a767.dspw65.akamai.net", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com.delivery.microsoft.com", "kind": "relationship", "tier": 1, "type": "domain", "value": "au.download.windowsupdate.com.delivery.microsoft.com", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:bg.microsoft.map.fastly.net", "kind": "relationship", "tier": 1, "type": "domain", "value": "bg.microsoft.map.fastly.net", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:cl-glcb907925.gcdn.co", "kind": "relationship", "tier": 1, "type": "domain", "value": "cl-glcb907925.gcdn.co", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:download.windowsupdate.com.edgesuite.net", "kind": "relationship", "tier": 1, "type": "domain", "value": "download.windowsupdate.com.edgesuite.net", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:fe2.update.microsoft.com", "kind": "relationship", "tier": 1, "type": "domain", "value": "fe2.update.microsoft.com", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:wu-b-net.trafficmanager.net", "kind": "relationship", "tier": 1, "type": "domain", "value": "wu-b-net.trafficmanager.net", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:132.196.74.208", "kind": "relationship", "tier": 1, "type": "ip", "value": "132.196.74.208", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:132.196.74.212", "kind": "relationship", "tier": 1, "type": "ip", "value": "132.196.74.212", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:134.33.185.100", "kind": "relationship", "tier": 1, "type": "ip", "value": "134.33.185.100", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.67", "kind": "relationship", "tier": 1, "type": "ip", "value": "172.184.231.67", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.68", "kind": "relationship", "tier": 1, "type": "ip", "value": "172.184.231.68", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.69", "kind": "relationship", "tier": 1, "type": "ip", "value": "172.184.231.69", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:184.84.165.90", "kind": "relationship", "tier": 1, "type": "ip", "value": "184.84.165.90", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:199.232.210.172", "kind": "relationship", "tier": 1, "type": "ip", "value": "199.232.210.172", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:199.232.214.172", "kind": "relationship", "tier": 1, "type": "ip", "value": "199.232.214.172", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:2600:1407:3c00:12::b819:719a", "kind": "relationship", "tier": 1, "type": "ip", "value": "2600:1407:3c00:12::b819:719a", "sources": [ "censys" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:2a03:90c0:9996::6", "kind": "relationship", "tier": 1, "type": "ip", "value": "2a03:90c0:9996::6", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:92.223.96.6", "kind": "relationship", "tier": 1, "type": "ip", "value": "92.223.96.6", "sources": [ "urlscan", "censys" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://15.au.download.windowsupdate.com/", "kind": "relationship", "tier": 1, "type": "url", "value": "http://15.au.download.windowsupdate.com/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://2.au.download.windowsupdate.com/", "kind": "relationship", "tier": 1, "type": "url", "value": "http://2.au.download.windowsupdate.com/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe", "kind": "relationship", "tier": 1, "type": "url", "value": "http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/", "kind": "relationship", "tier": 1, "type": "url", "value": "http://au.download.windowsupdate.com/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe", "kind": "relationship", "tier": 1, "type": "url", "value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://2.au.download.windowsupdate.com/", "kind": "relationship", "tier": 1, "type": "url", "value": "https://2.au.download.windowsupdate.com/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe", "kind": "relationship", "tier": 1, "type": "url", "value": "https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://4.au.download.windowsupdate.com/", "kind": "relationship", "tier": 1, "type": "url", "value": "https://4.au.download.windowsupdate.com/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://au.download.windowsupdate.com/", "kind": "relationship", "tier": 1, "type": "url", "value": "https://au.download.windowsupdate.com/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://fe2.update.microsoft.com/", "kind": "relationship", "tier": 1, "type": "url", "value": "https://fe2.update.microsoft.com/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "suspicious": 60, "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "type": "ioc-investigation", "label": "2.56.57.108", "value": "2.56.57.108", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "2 engines marked malicious and 1 suspicious; 53 harmless, 33 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "skipped", "summary": "MalwareBazaar is hash-focused; input is not a hash." }, { "source": "otx", "status": "ok", "summary": "OTX returned 5 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 5 scan result(s). urlscan activity analysis found 3 suspicious pattern(s)." }, { "source": "greynoise", "status": "not_found", "summary": "GreyNoise classification: unknown." }, { "source": "abuseipdb", "status": "ok", "summary": "AbuseIPDB confidence score: 0/100." }, { "source": "shodan", "status": "not_found", "summary": "Shodan returned 0 open port(s)." }, { "source": "censys", "status": "ok", "summary": "Censys host lookup returned 0 service(s)." } ], "summary": "2.56.57.108 was classified as ip. Investigation verdict is highly suspicious with score 79/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 2 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "highly suspicious", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "actor_leads": [], "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation" ], "artifact_type": "ip", "review_status": "unreviewed-provider-context", "suspicion_score": 79, "actor_lead_count": 0, "graph_edge_count": 14, "graph_node_count": 10, "source_analysis_ref": "/api/ioc/investigations/6f1651e0-2db5-42f4-9749-2e0f20d3b464", "graph_preview_truncated": false, "graph_preview_edge_count": 14, "graph_preview_node_count": 10 }, { "id": "ttp-evidence:6f1651e0-2db5-42f4-9749-2e0f20d3b464:T1102", "type": "ttp-evidence", "label": "T1102 Web Service", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1102", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation" ] }, { "id": "ttp-evidence:6f1651e0-2db5-42f4-9749-2e0f20d3b464:T1560", "type": "ttp-evidence", "label": "T1560 Archive Collected Data", "source": "ioc-investigation", "tactic": "collection", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1560", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation" ] }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "kind": "artifact", "tier": 0, "type": "ip", "value": "2.56.57.108", "sources": [ "input", "otx", "urlscan", "abuseipdb" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 79, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:collection:Arkei Variants: From Vidar to Mars Stealer", "kind": "relationship", "tier": 1, "type": "collection", "value": "Arkei Variants: From Vidar to Mars Stealer", "sources": [ "otx" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 60, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:collection:Arkei Variants: From Vidar to Mars Stealer - SANS Internet Storm Center", "kind": "relationship", "tier": 1, "type": "collection", "value": "Arkei Variants: From Vidar to Mars Stealer - SANS Internet Storm Center", "sources": [ "otx" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 60, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:collection:Vidar, Mars, Oski Stealers IOCs", "kind": "relationship", "tier": 1, "type": "collection", "value": "Vidar, Mars, Oski Stealers IOCs", "sources": [ "otx" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 60, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:domain:2.56.57.108", "kind": "relationship", "tier": 1, "type": "domain", "value": "2.56.57.108", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 60, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:domain:singtel.com", "kind": "relationship", "tier": 1, "type": "domain", "value": "singtel.com", "sources": [ "abuseipdb" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 60, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/", "kind": "relationship", "tier": 1, "type": "url", "value": "http://2.56.57.108/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 60, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/osk", "kind": "relationship", "tier": 1, "type": "url", "value": "http://2.56.57.108/osk", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 60, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/osk/", "kind": "relationship", "tier": 1, "type": "url", "value": "http://2.56.57.108/osk/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 60, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/osk/login.php", "kind": "relationship", "tier": 1, "type": "url", "value": "http://2.56.57.108/osk/login.php", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "suspicious": 60, "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "type": "ioc-investigation", "label": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "No malicious detections in last analysis; 0 harmless, 45 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "ok", "summary": "MalwareBazaar returned 1 sample record(s)." }, { "source": "otx", "status": "ok", "summary": "OTX returned 17 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern." }, { "source": "greynoise", "status": "skipped", "summary": "GreyNoise is IP-focused; input is not an IP." }, { "source": "abuseipdb", "status": "skipped", "summary": "AbuseIPDB is IP-focused; input is not an IP." }, { "source": "shodan", "status": "skipped", "summary": "Shodan host lookup is IP-focused; input is not an IP." }, { "source": "censys", "status": "skipped", "summary": "Censys host and search pivots support IP, domain, and URL inputs." } ], "summary": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660 was classified as hash. Investigation verdict is suspicious with score 53/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 24 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "suspicious", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "actor_leads": [], "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ], "artifact_type": "hash", "review_status": "unreviewed-provider-context", "suspicion_score": 53, "actor_lead_count": 0, "graph_edge_count": 15, "graph_node_count": 15, "source_analysis_ref": "/api/ioc/investigations/7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "graph_preview_truncated": false, "graph_preview_edge_count": 15, "graph_preview_node_count": 15 }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1012", "type": "ttp-evidence", "label": "T1012 Query Registry", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1012", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1018", "type": "ttp-evidence", "label": "T1018 Remote System Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1018", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1027", "type": "ttp-evidence", "label": "T1027 Obfuscated Files or Information", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1027", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1036", "type": "ttp-evidence", "label": "T1036 Masquerading", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1036", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1055", "type": "ttp-evidence", "label": "T1055 Process Injection", "source": "ioc-investigation", "tactic": "stealth, privilege-escalation", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1055", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1071", "type": "ttp-evidence", "label": "T1071 Application Layer Protocol", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof); otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1071", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1071.001", "type": "ttp-evidence", "label": "T1071.001 Web Protocols", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof); otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1071.001", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1082", "type": "ttp-evidence", "label": "T1082 System Information Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1082", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1095", "type": "ttp-evidence", "label": "T1095 Non-Application Layer Protocol", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1095", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1129", "type": "ttp-evidence", "label": "T1129 Shared Modules", "source": "ioc-investigation", "tactic": "execution", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1129", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1213", "type": "ttp-evidence", "label": "T1213 Data from Information Repositories", "source": "ioc-investigation", "tactic": "collection", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1213", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1218", "type": "ttp-evidence", "label": "T1218 System Binary Proxy Execution", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1218", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1218.011", "type": "ttp-evidence", "label": "T1218.011 Rundll32", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1218.011", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1497", "type": "ttp-evidence", "label": "T1497 Virtualization/Sandbox Evasion", "source": "ioc-investigation", "tactic": "stealth, discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1497", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1518", "type": "ttp-evidence", "label": "T1518 Software Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1518", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1518.001", "type": "ttp-evidence", "label": "T1518.001 Security Software Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1518.001", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1102", "type": "ttp-evidence", "label": "T1102 Web Service", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1102", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1104", "type": "ttp-evidence", "label": "T1104 Multi-Stage Channels", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1104", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1553", "type": "ttp-evidence", "label": "T1553 Subvert Trust Controls", "source": "ioc-investigation", "tactic": "defense-impairment", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1553", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1105", "type": "ttp-evidence", "label": "T1105 Ingress Tool Transfer", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1105", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1146", "type": "ttp-evidence", "label": "T1146 Technique lead", "source": "ioc-investigation", "tactic": "", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1146", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1114", "type": "ttp-evidence", "label": "T1114 Email Collection", "source": "ioc-investigation", "tactic": "collection", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1114", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1071.004", "type": "ttp-evidence", "label": "T1071.004 DNS", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1071.004", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ttp-evidence:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:T1059.007", "type": "ttp-evidence", "label": "T1059.007 JavaScript", "source": "ioc-investigation", "tactic": "execution", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1059.007", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation" ] }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "kind": "artifact", "tier": 0, "type": "hash", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "sources": [ "input", "malwarebazaar", "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:DEV-0537 alias LAPSUS$ -hashes from the report by kpmg(.)com - thanks!", "kind": "relationship", "tier": 1, "type": "collection", "value": "DEV-0537 alias LAPSUS$ -hashes from the report by kpmg(.)com - thanks!", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:DISCORD - Bruteforce Login Attacker", "kind": "relationship", "tier": 1, "type": "collection", "value": "DISCORD - Bruteforce Login Attacker", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:EMOTET Spreader", "kind": "relationship", "tier": 1, "type": "collection", "value": "EMOTET Spreader", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Malvertising", "kind": "relationship", "tier": 1, "type": "collection", "value": "Malvertising", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Malvertising ", "kind": "relationship", "tier": 1, "type": "collection", "value": "Malvertising ", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Malware bazaar 6", "kind": "relationship", "tier": 1, "type": "collection", "value": "Malware bazaar 6", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Smishing ", "kind": "relationship", "tier": 1, "type": "collection", "value": "Smishing ", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Tommy shop still up", "kind": "relationship", "tier": 1, "type": "collection", "value": "Tommy shop still up", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Vida Malware", "kind": "relationship", "tier": 1, "type": "collection", "value": "Vida Malware", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "kind": "relationship", "tier": 1, "type": "collection", "value": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "kind": "relationship", "tier": 1, "type": "collection", "value": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "sources": [ "otx" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:file:1.dll", "kind": "relationship", "tier": 1, "type": "file", "value": "1.dll", "sources": [ "malwarebazaar" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:e477a96c8f2b18d6b5c27bde49c990bf", "kind": "relationship", "tier": 1, "type": "hash", "value": "e477a96c8f2b18d6b5c27bde49c990bf", "sources": [ "malwarebazaar" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:e980c9bf41330d1e5bd04556db4646a0210f7409", "kind": "relationship", "tier": 1, "type": "hash", "value": "e980c9bf41330d1e5bd04556db4646a0210f7409", "sources": [ "malwarebazaar" ], "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "suspicious": 60, "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "type": "ioc-investigation", "label": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "No malicious detections in last analysis; 0 harmless, 43 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "ok", "summary": "MalwareBazaar returned 1 sample record(s)." }, { "source": "otx", "status": "ok", "summary": "OTX returned 18 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern." }, { "source": "greynoise", "status": "skipped", "summary": "GreyNoise is IP-focused; input is not an IP." }, { "source": "abuseipdb", "status": "skipped", "summary": "AbuseIPDB is IP-focused; input is not an IP." }, { "source": "shodan", "status": "skipped", "summary": "Shodan host lookup is IP-focused; input is not an IP." }, { "source": "censys", "status": "skipped", "summary": "Censys host and search pivots support IP, domain, and URL inputs." } ], "summary": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba was classified as hash. Investigation verdict is suspicious with score 53/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 32 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "suspicious", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "actor_leads": [], "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ], "artifact_type": "hash", "review_status": "unreviewed-provider-context", "suspicion_score": 53, "actor_lead_count": 0, "graph_edge_count": 16, "graph_node_count": 16, "source_analysis_ref": "/api/ioc/investigations/2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "graph_preview_truncated": false, "graph_preview_edge_count": 16, "graph_preview_node_count": 16 }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1018", "type": "ttp-evidence", "label": "T1018 Remote System Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1018", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1027", "type": "ttp-evidence", "label": "T1027 Obfuscated Files or Information", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1027", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1036", "type": "ttp-evidence", "label": "T1036 Masquerading", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1036", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1053", "type": "ttp-evidence", "label": "T1053 Scheduled Task/Job", "source": "ioc-investigation", "tactic": "execution, persistence, privilege-escalation", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1053", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1055", "type": "ttp-evidence", "label": "T1055 Process Injection", "source": "ioc-investigation", "tactic": "stealth, privilege-escalation", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1055", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1056", "type": "ttp-evidence", "label": "T1056 Input Capture", "source": "ioc-investigation", "tactic": "collection, credential-access", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1056", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1057", "type": "ttp-evidence", "label": "T1057 Process Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1057", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1059", "type": "ttp-evidence", "label": "T1059 Command and Scripting Interpreter", "source": "ioc-investigation", "tactic": "execution", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1059", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1071", "type": "ttp-evidence", "label": "T1071 Application Layer Protocol", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof); otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1071", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1082", "type": "ttp-evidence", "label": "T1082 System Information Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1082", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1095", "type": "ttp-evidence", "label": "T1095 Non-Application Layer Protocol", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1095", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1140", "type": "ttp-evidence", "label": "T1140 Deobfuscate/Decode Files or Information", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1140", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1218", "type": "ttp-evidence", "label": "T1218 System Binary Proxy Execution", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1218", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1218.011", "type": "ttp-evidence", "label": "T1218.011 Rundll32", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1218.011", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1497", "type": "ttp-evidence", "label": "T1497 Virtualization/Sandbox Evasion", "source": "ioc-investigation", "tactic": "stealth, discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1497", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1518", "type": "ttp-evidence", "label": "T1518 Software Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1518", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1518.001", "type": "ttp-evidence", "label": "T1518.001 Security Software Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1518.001", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1543", "type": "ttp-evidence", "label": "T1543 Create or Modify System Process", "source": "ioc-investigation", "tactic": "persistence, privilege-escalation", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1543", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1543.003", "type": "ttp-evidence", "label": "T1543.003 Windows Service", "source": "ioc-investigation", "tactic": "persistence, privilege-escalation", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1543.003", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1562", "type": "ttp-evidence", "label": "T1562 Technique lead", "source": "ioc-investigation", "tactic": "", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1562", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1562.001", "type": "ttp-evidence", "label": "T1562.001 Technique lead", "source": "ioc-investigation", "tactic": "", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1562.001", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1574", "type": "ttp-evidence", "label": "T1574 Hijack Execution Flow", "source": "ioc-investigation", "tactic": "stealth, execution", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1574", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1574.002", "type": "ttp-evidence", "label": "T1574.002 Technique lead", "source": "ioc-investigation", "tactic": "", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1574.002", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1102", "type": "ttp-evidence", "label": "T1102 Web Service", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1102", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1104", "type": "ttp-evidence", "label": "T1104 Multi-Stage Channels", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1104", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1553", "type": "ttp-evidence", "label": "T1553 Subvert Trust Controls", "source": "ioc-investigation", "tactic": "defense-impairment", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1553", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1105", "type": "ttp-evidence", "label": "T1105 Ingress Tool Transfer", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1105", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1146", "type": "ttp-evidence", "label": "T1146 Technique lead", "source": "ioc-investigation", "tactic": "", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1146", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1114", "type": "ttp-evidence", "label": "T1114 Email Collection", "source": "ioc-investigation", "tactic": "collection", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1114", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1071.004", "type": "ttp-evidence", "label": "T1071.004 DNS", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1071.004", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1059.007", "type": "ttp-evidence", "label": "T1059.007 JavaScript", "source": "ioc-investigation", "tactic": "execution", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1059.007", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ttp-evidence:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:T1071.001", "type": "ttp-evidence", "label": "T1071.001 Web Protocols", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1071.001", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation" ] }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "kind": "artifact", "tier": 0, "type": "hash", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "sources": [ "input", "malwarebazaar", "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:DISCORD - Bruteforce Login Attacker", "kind": "relationship", "tier": 1, "type": "collection", "value": "DISCORD - Bruteforce Login Attacker", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:EMOTET Spreader", "kind": "relationship", "tier": 1, "type": "collection", "value": "EMOTET Spreader", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Malvertising", "kind": "relationship", "tier": 1, "type": "collection", "value": "Malvertising", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Malvertising ", "kind": "relationship", "tier": 1, "type": "collection", "value": "Malvertising ", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Malware bazaar 6", "kind": "relationship", "tier": 1, "type": "collection", "value": "Malware bazaar 6", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Mini Peek", "kind": "relationship", "tier": 1, "type": "collection", "value": "Mini Peek", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Smishing ", "kind": "relationship", "tier": 1, "type": "collection", "value": "Smishing ", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Tommy shop still up", "kind": "relationship", "tier": 1, "type": "collection", "value": "Tommy shop still up", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Vida Malware", "kind": "relationship", "tier": 1, "type": "collection", "value": "Vida Malware", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "kind": "relationship", "tier": 1, "type": "collection", "value": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "kind": "relationship", "tier": 1, "type": "collection", "value": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Worm:Win32/Benjamin IoC's", "kind": "relationship", "tier": 1, "type": "collection", "value": "Worm:Win32/Benjamin IoC's", "sources": [ "otx" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:file:2.dll", "kind": "relationship", "tier": 1, "type": "file", "value": "2.dll", "sources": [ "malwarebazaar" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:5be8c1e73a21b49f353c2ecfa4108e43a883cb7b", "kind": "relationship", "tier": 1, "type": "hash", "value": "5be8c1e73a21b49f353c2ecfa4108e43a883cb7b", "sources": [ "malwarebazaar" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:ef2834ac4ee7d6724f255beaf527e635", "kind": "relationship", "tier": 1, "type": "hash", "value": "ef2834ac4ee7d6724f255beaf527e635", "sources": [ "malwarebazaar" ], "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "suspicious": 60, "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641" ], "review_status": "unreviewed-provider-context" }, { "id": "pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-3a3131a2a6b154c019e38ae1", "type": "pcap-observable", "value": "2.56.57.108", "ioc_type": "ipv4", "source_ref": "pcap-analysis:6e50c68f-5552-400c-9835-15867ddb022d", "artifact_refs": [], "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [ { "tcp_stream": 65, "frame_number": 1501, "display_filter": "frame.number == 1501", "timestamp_epoch": "1641571652.212441000" }, { "tcp_stream": 65, "frame_number": 1641, "display_filter": "frame.number == 1641", "timestamp_epoch": "1641571652.751829000" }, { "tcp_stream": 65, "frame_number": 2225, "display_filter": "frame.number == 2225", "timestamp_epoch": "1641571653.452444000" }, { "tcp_stream": 65, "frame_number": 2541, "display_filter": "frame.number == 2541", "timestamp_epoch": "1641571653.743431000" }, { "tcp_stream": 65, "frame_number": 2691, "display_filter": "frame.number == 2691", "timestamp_epoch": "1641571653.942407000" }, { "tcp_stream": 65, "frame_number": 3054, "display_filter": "frame.number == 3054", "timestamp_epoch": "1641571654.219054000" }, { "tcp_stream": 65, "frame_number": 4194, "display_filter": "frame.number == 4194", "timestamp_epoch": "1641571654.755050000" }, { "tcp_stream": 65, "frame_number": 4275, "display_filter": "frame.number == 4275", "timestamp_epoch": "1641571655.625187000" }, { "tcp_stream": 65, "frame_number": 4816, "display_filter": "frame.number == 4816", "timestamp_epoch": "1641571656.376674000" } ], "semantic_sha256": "d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482", "provenance_basis": "observable-frame-evidence", "source_analysis_ref": "/api/pcap/analyses/6e50c68f-5552-400c-9835-15867ddb022d", "evidence_frame_count": 9, "evidence_frames_truncated": false }, { "id": "pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-58e69b1eb81703a31486bd29", "type": "pcap-observable", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "ioc_type": "sha256", "source_ref": "pcap-analysis:6e50c68f-5552-400c-9835-15867ddb022d", "artifact_refs": [ { "sha256": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "filename": "1(1).jpg", "size_bytes": 645592, "artifact_id": "artifact-ba77ea8a3332a19a181b9027", "extraction_method": "tshark-http-export-objects" } ], "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [], "semantic_sha256": "d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482", "provenance_basis": "capture-exported-object; exact frame mapping unavailable", "source_analysis_ref": "/api/pcap/analyses/6e50c68f-5552-400c-9835-15867ddb022d", "evidence_frame_count": 0, "evidence_frames_truncated": false }, { "id": "pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-f370d76bc73c22258da95714", "type": "pcap-observable", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "ioc_type": "sha256", "source_ref": "pcap-analysis:6e50c68f-5552-400c-9835-15867ddb022d", "artifact_refs": [ { "sha256": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "filename": "2(1).jpg", "size_bytes": 334288, "artifact_id": "artifact-bd16fd17c273bd4649e10555", "extraction_method": "tshark-http-export-objects" } ], "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [], "semantic_sha256": "d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482", "provenance_basis": "capture-exported-object; exact frame mapping unavailable", "source_analysis_ref": "/api/pcap/analyses/6e50c68f-5552-400c-9835-15867ddb022d", "evidence_frame_count": 0, "evidence_frames_truncated": false }, { "id": "pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-f430733d136e7bbeb2e37fc1", "type": "pcap-observable", "value": "au.download.windowsupdate.com", "ioc_type": "domain", "source_ref": "pcap-analysis:6e50c68f-5552-400c-9835-15867ddb022d", "artifact_refs": [], "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [ { "udp_stream": 61, "frame_number": 5302, "display_filter": "frame.number == 5302", "timestamp_epoch": "1641572062.424316000" }, { "udp_stream": 61, "frame_number": 5303, "display_filter": "frame.number == 5303", "timestamp_epoch": "1641572062.424599000" }, { "tcp_stream": 76, "frame_number": 5309, "display_filter": "frame.number == 5309", "timestamp_epoch": "1641572062.462443000" }, { "tcp_stream": 77, "frame_number": 5313, "display_filter": "frame.number == 5313", "timestamp_epoch": "1641572062.465939000" }, { "tcp_stream": 76, "frame_number": 5317, "display_filter": "frame.number == 5317", "timestamp_epoch": "1641572062.491933000" } ], "semantic_sha256": "d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482", "provenance_basis": "observable-frame-evidence", "source_analysis_ref": "/api/pcap/analyses/6e50c68f-5552-400c-9835-15867ddb022d", "evidence_frame_count": 5, "evidence_frames_truncated": false } ], "evidence_edges": [ { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:download.windowsupdate.com.edgesuite.net:virustotal", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:download.windowsupdate.com.edgesuite.net", "evidence": "DNS record", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "download.windowsupdate.com.edgesuite.net", "evidence_source": "virustotal" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:au.download.windowsupdate.com.delivery.microsoft.com:virustotal", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com.delivery.microsoft.com", "evidence": "DNS record", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "au.download.windowsupdate.com.delivery.microsoft.com", "evidence_source": "virustotal" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:wu-b-net.trafficmanager.net:virustotal", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:wu-b-net.trafficmanager.net", "evidence": "DNS record", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "wu-b-net.trafficmanager.net", "evidence_source": "virustotal" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:bg.microsoft.map.fastly.net:virustotal", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:bg.microsoft.map.fastly.net", "evidence": "DNS record", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "bg.microsoft.map.fastly.net", "evidence_source": "virustotal" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:2a03:90c0:9996::6:virustotal", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:2a03:90c0:9996::6", "evidence": "DNS record", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "2a03:90c0:9996::6", "evidence_source": "virustotal" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:199.232.210.172:virustotal", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:199.232.210.172", "evidence": "DNS record", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "199.232.210.172", "evidence_source": "virustotal" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:199.232.214.172:virustotal", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:199.232.214.172", "evidence": "DNS record", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "199.232.214.172", "evidence_source": "virustotal" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:cl-glcb907925.gcdn.co:virustotal", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:cl-glcb907925.gcdn.co", "evidence": "DNS record", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "cl-glcb907925.gcdn.co", "evidence_source": "virustotal" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:a767.dspw65.akamai.net:virustotal", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:a767.dspw65.akamai.net", "evidence": "DNS record", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "a767.dspw65.akamai.net", "evidence_source": "virustotal" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:au.download.windowsupdate.com:urlscan", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "evidence": "urlscan page domain", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "au.download.windowsupdate.com", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:92.223.96.6:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:92.223.96.6", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "92.223.96.6", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe:urlscan:evidence:12", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:2.au.download.windowsupdate.com:urlscan", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:2.au.download.windowsupdate.com", "evidence": "urlscan page domain", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "2.au.download.windowsupdate.com", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:184.84.165.90:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:184.84.165.90", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "184.84.165.90", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:4.au.download.windowsupdate.com:urlscan", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:4.au.download.windowsupdate.com", "evidence": "urlscan page domain", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "4.au.download.windowsupdate.com", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://4.au.download.windowsupdate.com/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://4.au.download.windowsupdate.com/", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "https://4.au.download.windowsupdate.com/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://4.au.download.windowsupdate.com/:urlscan:evidence:19", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://4.au.download.windowsupdate.com/", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "https://4.au.download.windowsupdate.com/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:fe2.update.microsoft.com:urlscan", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:fe2.update.microsoft.com", "evidence": "urlscan page domain", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "fe2.update.microsoft.com", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:132.196.74.208:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:132.196.74.208", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "132.196.74.208", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://fe2.update.microsoft.com/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://fe2.update.microsoft.com/", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "https://fe2.update.microsoft.com/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://15.au.download.windowsupdate.com/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://15.au.download.windowsupdate.com/", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "http://15.au.download.windowsupdate.com/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:172.184.231.68:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.68", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "172.184.231.68", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:134.33.185.100:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:134.33.185.100", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "134.33.185.100", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://au.download.windowsupdate.com/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://au.download.windowsupdate.com/", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "https://au.download.windowsupdate.com/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:132.196.74.212:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:132.196.74.212", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "132.196.74.212", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://2.au.download.windowsupdate.com/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://2.au.download.windowsupdate.com/", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "https://2.au.download.windowsupdate.com/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:172.184.231.67:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.67", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "172.184.231.67", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://au.download.windowsupdate.com/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "http://au.download.windowsupdate.com/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:172.184.231.69:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.69", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "172.184.231.69", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://2.au.download.windowsupdate.com/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://2.au.download.windowsupdate.com/", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "http://2.au.download.windowsupdate.com/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:au.download.windowsupdate.com:censys", "tier": 1, "type": "domain", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "evidence": "Censys web property hostname", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "au.download.windowsupdate.com", "evidence_source": "censys" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:2600:1407:3c00:12::b819:719a:censys", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:2600:1407:3c00:12::b819:719a", "evidence": "Censys web property IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "2600:1407:3c00:12::b819:719a", "evidence_source": "censys" }, { "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:92.223.96.6:censys", "tier": 1, "type": "ip", "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:92.223.96.6", "evidence": "Censys web property IP", "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "source_refs": [ "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com" ], "source_value": "au.download.windowsupdate.com", "target_value": "92.223.96.6", "evidence_source": "censys" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->collection:Arkei Variants: From Vidar to Mars Stealer:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:collection:Arkei Variants: From Vidar to Mars Stealer", "evidence": "OTX pulse", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "Arkei Variants: From Vidar to Mars Stealer", "evidence_source": "otx" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->collection:Arkei Variants: From Vidar to Mars Stealer - SANS Internet Storm Center:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:collection:Arkei Variants: From Vidar to Mars Stealer - SANS Internet Storm Center", "evidence": "OTX pulse", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "Arkei Variants: From Vidar to Mars Stealer - SANS Internet Storm Center", "evidence_source": "otx" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->collection:Vidar, Mars, Oski Stealers IOCs:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:collection:Vidar, Mars, Oski Stealers IOCs", "evidence": "OTX pulse", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "Vidar, Mars, Oski Stealers IOCs", "evidence_source": "otx" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->domain:2.56.57.108:urlscan", "tier": 1, "type": "domain", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:domain:2.56.57.108", "evidence": "urlscan page domain", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "2.56.57.108", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->ip:2.56.57.108:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "2.56.57.108", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->url:http://2.56.57.108/osk:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/osk", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "http://2.56.57.108/osk", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->url:http://2.56.57.108/osk:urlscan:evidence:6", "tier": 1, "type": "url", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/osk", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "http://2.56.57.108/osk", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->url:http://2.56.57.108/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "http://2.56.57.108/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->url:http://2.56.57.108/:urlscan:evidence:8", "tier": 1, "type": "url", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "http://2.56.57.108/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->url:http://2.56.57.108/osk/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/osk/", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "http://2.56.57.108/osk/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->url:http://2.56.57.108/osk/:urlscan:evidence:10", "tier": 1, "type": "url", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/osk/", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "http://2.56.57.108/osk/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->url:http://2.56.57.108/osk/login.php:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/osk/login.php", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "http://2.56.57.108/osk/login.php", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->url:http://2.56.57.108/osk/login.php:urlscan:evidence:12", "tier": 1, "type": "url", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:url:http://2.56.57.108/osk/login.php", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "http://2.56.57.108/osk/login.php", "evidence_source": "urlscan" }, { "id": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:edge:ip:2.56.57.108->domain:singtel.com:abuseipdb", "tier": 1, "type": "domain", "source": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:domain:singtel.com", "evidence": "AbuseIPDB domain", "source_ref": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "source_refs": [ "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464:node:ip:2.56.57.108" ], "source_value": "2.56.57.108", "target_value": "singtel.com", "evidence_source": "abuseipdb" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660:malwarebazaar", "tier": 1, "type": "hash", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "evidence": "malwarebazaar field sha256_hash", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->hash:e980c9bf41330d1e5bd04556db4646a0210f7409:malwarebazaar", "tier": 1, "type": "hash", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:e980c9bf41330d1e5bd04556db4646a0210f7409", "evidence": "malwarebazaar field sha1_hash", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "e980c9bf41330d1e5bd04556db4646a0210f7409", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->hash:e477a96c8f2b18d6b5c27bde49c990bf:malwarebazaar", "tier": 1, "type": "hash", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:e477a96c8f2b18d6b5c27bde49c990bf", "evidence": "malwarebazaar field md5_hash", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "e477a96c8f2b18d6b5c27bde49c990bf", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->file:1.dll:malwarebazaar", "tier": 1, "type": "file", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:file:1.dll", "evidence": "malwarebazaar field file_name", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "1.dll", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:DEV-0537 alias LAPSUS$ -hashes from the report by kpmg(.)com - thanks!:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:DEV-0537 alias LAPSUS$ -hashes from the report by kpmg(.)com - thanks!", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "DEV-0537 alias LAPSUS$ -hashes from the report by kpmg(.)com - thanks!", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:Malware bazaar 6:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Malware bazaar 6", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "Malware bazaar 6", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:DISCORD - Bruteforce Login Attacker:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:DISCORD - Bruteforce Login Attacker", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "DISCORD - Bruteforce Login Attacker", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:Malvertising:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Malvertising", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "Malvertising", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:Malvertising :otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Malvertising ", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "Malvertising ", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:Smishing :otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Smishing ", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "Smishing ", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:EMOTET Spreader:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:EMOTET Spreader", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "EMOTET Spreader", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:Vida Malware:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Vida Malware", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "Vida Malware", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "evidence_source": "otx" }, { "id": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:edge:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660->collection:Tommy shop still up:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:collection:Tommy shop still up", "evidence": "OTX pulse", "source_ref": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "source_refs": [ "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41:node:hash:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660" ], "source_value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "target_value": "Tommy shop still up", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba:malwarebazaar", "tier": 1, "type": "hash", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "evidence": "malwarebazaar field sha256_hash", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->hash:5be8c1e73a21b49f353c2ecfa4108e43a883cb7b:malwarebazaar", "tier": 1, "type": "hash", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:5be8c1e73a21b49f353c2ecfa4108e43a883cb7b", "evidence": "malwarebazaar field sha1_hash", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "5be8c1e73a21b49f353c2ecfa4108e43a883cb7b", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->hash:ef2834ac4ee7d6724f255beaf527e635:malwarebazaar", "tier": 1, "type": "hash", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:ef2834ac4ee7d6724f255beaf527e635", "evidence": "malwarebazaar field md5_hash", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "ef2834ac4ee7d6724f255beaf527e635", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->file:2.dll:malwarebazaar", "tier": 1, "type": "file", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:file:2.dll", "evidence": "malwarebazaar field file_name", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "2.dll", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Mini Peek:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Mini Peek", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Mini Peek", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Worm:Win32/Benjamin IoC's:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Worm:Win32/Benjamin IoC's", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Worm:Win32/Benjamin IoC's", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Malware bazaar 6:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Malware bazaar 6", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Malware bazaar 6", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:DISCORD - Bruteforce Login Attacker:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:DISCORD - Bruteforce Login Attacker", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "DISCORD - Bruteforce Login Attacker", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Malvertising:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Malvertising", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Malvertising", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Smishing :otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Smishing ", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Smishing ", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Malvertising :otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Malvertising ", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Malvertising ", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:EMOTET Spreader:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:EMOTET Spreader", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "EMOTET Spreader", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Vida Malware:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Vida Malware", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Vida Malware", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "evidence_source": "otx" }, { "id": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:edge:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba->collection:Tommy shop still up:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:collection:Tommy shop still up", "evidence": "OTX pulse", "source_ref": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "source_refs": [ "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641:node:hash:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba" ], "source_value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "target_value": "Tommy shop still up", "evidence_source": "otx" }, { "id": "packet-enrichment:pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-3a3131a2a6b154c019e38ae1:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-3a3131a2a6b154c019e38ae1", "target": "ioc-investigation:6f1651e0-2db5-42f4-9749-2e0f20d3b464", "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.", "source_ref": "pcap-analysis:6e50c68f-5552-400c-9835-15867ddb022d", "evidence_source": "native-packet-observable-and-saved-provider-result" }, { "id": "packet-enrichment:pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-58e69b1eb81703a31486bd29:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-58e69b1eb81703a31486bd29", "target": "ioc-investigation:7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.", "source_ref": "pcap-analysis:6e50c68f-5552-400c-9835-15867ddb022d", "evidence_source": "native-packet-observable-and-saved-provider-result" }, { "id": "packet-enrichment:pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-f370d76bc73c22258da95714:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-f370d76bc73c22258da95714", "target": "ioc-investigation:2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.", "source_ref": "pcap-analysis:6e50c68f-5552-400c-9835-15867ddb022d", "evidence_source": "native-packet-observable-and-saved-provider-result" }, { "id": "packet-enrichment:pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-f430733d136e7bbeb2e37fc1:144ab9a0-2681-49f4-a410-b126d75d334d", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:6e50c68f-5552-400c-9835-15867ddb022d:observable-f430733d136e7bbeb2e37fc1", "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d", "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.", "source_ref": "pcap-analysis:6e50c68f-5552-400c-9835-15867ddb022d", "evidence_source": "native-packet-observable-and-saved-provider-result" } ], "timeline": [ { "at": "2026-09-19T12:50:08.997Z", "event": "Added Log/PCAP analysis 2022-01-07-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2022-01-07-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 1 }, { "at": "2026-09-19T12:57:57.926Z", "event": "Added Log/PCAP analysis 2022-01-07-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2022-01-07-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 1 }, { "at": "2026-09-19T13:57:38.522Z", "event": "Added IOC investigation for au.download.windowsupdate.com", "source": "IOC investigation au.download.windowsupdate.com", "actor_count": 0, "report_count": 1, "technique_count": 0 }, { "at": "2026-09-19T14:06:57.651Z", "event": "Added IOC investigation for 2.56.57.108", "source": "IOC investigation 2.56.57.108", "actor_count": 0, "report_count": 1, "technique_count": 2 }, { "at": "2026-09-19T14:07:00.285Z", "event": "Added IOC investigation for 16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "source": "IOC investigation 16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "actor_count": 0, "report_count": 1, "technique_count": 24 }, { "at": "2026-09-19T14:07:21.696Z", "event": "Added IOC investigation for a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "source": "IOC investigation a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "actor_count": 0, "report_count": 1, "technique_count": 32 }, { "at": "2026-09-19T14:29:10.646429+00:00", "event": "Linked approved passive lookups to exact typed, capture-backed PCAP observables. Frames retained where available; object hashes retain capture-export provenance. All context remains unreviewed." } ], "created_at": "2026-09-19T12:50:05.686337+00:00", "updated_at": "2026-09-19T14:29:10.674108+00:00" }