{ "type": "bundle", "spec_version": "2.1", "id": "bundle--f58bd60b-1e66-457a-a98f-d036ea7b53b0", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "objects": [ { "type": "malware", "spec_version": "2.1", "id": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Busy Buzzard", "description": "Four samples were uploaded to Virus Total, by a user in Vietnam, in August 2021. The naming convention indicated that these files were memory dumps, uploaded in two parts, from two separate processes. The first memory dump for each process contained the same shellcode loader stub, immediately followed by the same malicious Windows 64-bit DLL (decrypted and running in memory). This DLL was identified as the Busy Buzzard malware. The second memory dump for each process was found to contain a suspected Windows 64-bit shellcode plugin for the Busy Buzzard malware.\n\nFurther searches in Virus Total identified two separate variants of the Busy Buzzard malware, one of which uses raw TCP-based command and control (C2) communications, and the other of which uses HTTPS-based C2 communications. Compilation timestamps indicate that the Busy Buzzard malware may have been in use since at least 2016.", "malware_types": [ "remote-access-trojan" ], "is_family": false, "capabilities": [ "anti-debugging", "anti-vm", "communicates-with-c2", "fingerprints-host", "hides-executing-code" ], "architecture_execution_envs": [ "x86", "x86-64" ], "implementation_languages": [ "c++", "x86-64", "x86-32" ], "x_operating_systems": [ "windows" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--074a2ea5-a746-4bc2-9fd7-dd8853066817", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Shared Modules as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "Busy Buzzard uses the LoadLibraryW and GetProcAddress API functions to load additional modules and execute functions from them." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5f40fa4-6755-4632-9882-d3e8008f82b7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--074a2ea5-a746-4bc2-9fd7-dd8853066817", "target_ref": "attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--01733bcc-8fce-4188-ba75-70a34cbfe22d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--074a2ea5-a746-4bc2-9fd7-dd8853066817" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8a15e062-877a-41a2-acc0-15e23f725e3e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Native API as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "Busy Buzzard uses the VirtualAlloc and CreateThread API functions to inject and execute shellcode plugins." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5008e49-7e1d-44bc-bc2f-643bbf7fbade", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--8a15e062-877a-41a2-acc0-15e23f725e3e", "target_ref": "attack-pattern--391d824f-0ef1-47a0-b0ee-c59a75e27670" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e986d895-3902-48f7-a405-b21ee9c9a669", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--8a15e062-877a-41a2-acc0-15e23f725e3e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--edcfcf53-1cfa-44ca-90eb-c67656bf31c2", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Process Injection: Proc Memory as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Busy Buzzard is injected into the memory of a process, with additional shellcode modules also injected into the memory of the same process." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df79ba47-df51-4818-b46d-cdbbda6eec99", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--edcfcf53-1cfa-44ca-90eb-c67656bf31c2", "target_ref": "attack-pattern--d201d4cc-214d-4a74-a1ba-b3fa09fd4591" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c82ffaf6-de81-4426-86ce-09ea55f6e141", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--edcfcf53-1cfa-44ca-90eb-c67656bf31c2" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1e3118fe-f00c-4351-849f-81f6f92e1007", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Virtualization/Sandbox Evasion: System Checks as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Busy Buzzard tests the Windows Registry for the presence of a key associated with VMware. The HTTPS variant also tests for the presence of the VMXh port (associated with VMware), using the IN assembly instruction." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c8920dbf-17ec-443e-9fbe-477b91a5c640", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--1e3118fe-f00c-4351-849f-81f6f92e1007", "target_ref": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b8aaefb2-4cc8-472d-8b05-a9e43f48e74d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--1e3118fe-f00c-4351-849f-81f6f92e1007" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a34df58c-a83a-482b-adc0-5b1cb3f6824a", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "File and Directory Discovery as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "description": "The Busy Buzzard shellcode plugin provides the capability to browse files and directories." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--363f72cf-ae77-4ec1-b9f4-49c46d1b653c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--a34df58c-a83a-482b-adc0-5b1cb3f6824a", "target_ref": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c28d4592-8c8a-47b9-8ba4-ce504189f395", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--a34df58c-a83a-482b-adc0-5b1cb3f6824a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a4ad54dd-c927-42ef-848f-2f6c1031bac4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "System Information Discovery as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "description": "The Busy Buzzard beacon contains OS, username, hostname and process information." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf517389-18df-4903-a276-df3721968cc1", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--a4ad54dd-c927-42ef-848f-2f6c1031bac4", "target_ref": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2a46a38c-c227-4ba5-9713-6aa2a0c17300", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--a4ad54dd-c927-42ef-848f-2f6c1031bac4" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fe929bf5-13a4-4f7c-b576-5404147ffc70", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "System Network Configuration Discovery as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "description": "The Busy Buzzard beacon contains the victim IP address." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6c2e66a-2e93-4594-b550-785fbee79b10", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--fe929bf5-13a4-4f7c-b576-5404147ffc70", "target_ref": "attack-pattern--707399d6-ab3e-4963-9315-d9d3818cd6a0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--81a15411-6571-45b8-875b-84ab82c1b0da", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--fe929bf5-13a4-4f7c-b576-5404147ffc70" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--88a6761e-32d4-45d4-97da-0a6853af25c5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "System Time Discovery as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "description": "The Busy Buzzard beacon contains the time at which the implant was started." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f5591375-c0e2-4b88-bd89-18d5e8ecab0b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--88a6761e-32d4-45d4-97da-0a6853af25c5", "target_ref": "attack-pattern--f3c544dc-673c-4ef3-accb-53229f1ae077" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--02d137d9-81eb-4975-867a-01a27b25ee95", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--88a6761e-32d4-45d4-97da-0a6853af25c5" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d0b11c53-1969-44a2-81bd-292d8fb17bb7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Application Layer Protocol: Web Protocols as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Busy Buzzard (HTTPS variant) uses HTTPS protocol for C2 communication." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b4ff5032-f787-459a-a38d-958faa0cebb6", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--d0b11c53-1969-44a2-81bd-292d8fb17bb7", "target_ref": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5d77aeee-bcf4-433e-a080-fd9d202012f2", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--d0b11c53-1969-44a2-81bd-292d8fb17bb7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5ddc3e85-6f73-4c49-b6d9-a2dd42c4405e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Non-Application Layer Protocol as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Busy Buzzard (TCP variant) uses raw TCP protocol for C2 communication." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--95135466-276d-4729-b4c6-7d7dbb8ccc47", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--5ddc3e85-6f73-4c49-b6d9-a2dd42c4405e", "target_ref": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d9a38b4f-63a9-4e38-9d5c-fa3314ae4a2f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--5ddc3e85-6f73-4c49-b6d9-a2dd42c4405e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d6c465d2-153d-40b8-8c58-4f9e6782eb1c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Encrypted Channel as used by Busy Buzzard", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "The Busy Buzzard beacon is RSA-encrypted using a hard-coded public key. Other C2 communications are RC4-encrypted using a shared, randomly generated, key." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be5851df-532f-4d12-a01f-34c55559d9fe", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--d6c465d2-153d-40b8-8c58-4f9e6782eb1c", "target_ref": "attack-pattern--b8902400-e6c5-4ba2-95aa-2d35b442b118" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2e770af9-b11c-4da6-ab1e-e6e02d71a644", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "target_ref": "attack-pattern--d6c465d2-153d-40b8-8c58-4f9e6782eb1c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--89bb26f4-a359-4b00-9a44-2a865a08ecf7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--edc526c7-c7c0-4dcc-bb6e-436e105ca59c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--805e45bb-5c23-46d4-82e3-d17b79d699d2", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--294f4c68-a281-468a-b254-0c3f9fa05cd4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b81753e7-d8fc-46b8-a3be-5444cc55095d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3ac8d626-78b2-4128-886e-56af9c479b55", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--35e0357c-a1e6-4b8b-bc65-59809ed3cd33", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--6a2cb23f-9ad2-4838-b3c3-4a64385a59de", "target_ref": "indicator--9da79ab3-fb8e-4acc-bd28-7cc80307eb1f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f6dd5e2d-b739-41d0-aba8-a9fbd668666f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--6a2cb23f-9ad2-4838-b3c3-4a64385a59de", "target_ref": "indicator--62b54e67-569f-4c72-9fd5-7f1145bb7be5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--108c50cb-10ef-4a4f-8bfa-b55947d60db5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--9da79ab3-fb8e-4acc-bd28-7cc80307eb1f", "target_ref": "indicator--6a2cb23f-9ad2-4838-b3c3-4a64385a59de" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f12b58b7-4b0b-4bf8-8f6e-7015e8b80fd1", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--9da79ab3-fb8e-4acc-bd28-7cc80307eb1f", "target_ref": "indicator--62b54e67-569f-4c72-9fd5-7f1145bb7be5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9fdcec7d-2a13-4958-ade5-f84876be8024", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--62b54e67-569f-4c72-9fd5-7f1145bb7be5", "target_ref": "indicator--6a2cb23f-9ad2-4838-b3c3-4a64385a59de" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--83ff43a8-bfbc-445f-bcd1-a3dc63c74d35", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--62b54e67-569f-4c72-9fd5-7f1145bb7be5", "target_ref": "indicator--9da79ab3-fb8e-4acc-bd28-7cc80307eb1f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d2c112f1-9f70-4e51-b500-78750b58398f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--529deb5a-aa6f-4280-a9d6-c075ebf515fa", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--31f6c434-8870-4d95-8dfa-c1f9f1284312", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e94a94dd-4203-43e8-a20c-de223a443cb9", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--14b8c02d-056e-440e-b7a8-6ce12b2985a3", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--202447a1-f24b-4d56-b9b0-b359468eb78b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7ccedce4-6f73-40cf-873b-df9d8f555b5b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d2e9a9c6-1eab-49c7-aeb4-4c59a2f3d5c4", "target_ref": "indicator--72eee5d1-ad56-4ca4-8903-b4f3d1b5526b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5616b3e-685c-4550-8f62-947e3c945d23", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d2e9a9c6-1eab-49c7-aeb4-4c59a2f3d5c4", "target_ref": "indicator--7c066000-76e8-44ef-8fce-80c93e276d8e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2f456858-6170-453b-bbc0-bbb09b4540b5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--72eee5d1-ad56-4ca4-8903-b4f3d1b5526b", "target_ref": "indicator--d2e9a9c6-1eab-49c7-aeb4-4c59a2f3d5c4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--93ad5bce-8254-4239-a7d8-93eed047b7c3", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--72eee5d1-ad56-4ca4-8903-b4f3d1b5526b", "target_ref": "indicator--7c066000-76e8-44ef-8fce-80c93e276d8e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bfa68883-ec3b-4aca-ac84-c51589d41906", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--7c066000-76e8-44ef-8fce-80c93e276d8e", "target_ref": "indicator--d2e9a9c6-1eab-49c7-aeb4-4c59a2f3d5c4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5f92ef79-93ae-45db-978e-570379d698d8", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--7c066000-76e8-44ef-8fce-80c93e276d8e", "target_ref": "indicator--72eee5d1-ad56-4ca4-8903-b4f3d1b5526b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb13f970-1428-441f-8390-74905580c4e9", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4", "target_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0877651b-b8a5-414a-891c-bc9e41c0eed8", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4", "target_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aafc0e99-5973-4739-b124-e0ff6f5ade34", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382", "target_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--acc5beb9-4786-4a61-945e-484ae9333819", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382", "target_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a1e17fb4-698f-402b-9c1c-c9f34d7af7ab", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3", "target_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9bd4451b-58ae-4bea-8b81-d550b34e6341", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3", "target_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d2ff7650-b0ae-4ce2-9374-0f6325f22470", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--44a4ef45-b9dd-4177-9abc-b86f72626865", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--099271d0-97cf-4f1d-82da-58269a7ef6ce", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ba696afb-7796-48fd-9f4a-a8f7e7dcee23", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--53df7c38-c002-4430-bb42-afb17911f4ba", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6aef9595-48b0-49fa-8bbf-108ffbe3cfee", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7ed294b0-9544-4461-b253-7512304db37b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4069a0a1-4370-4b58-8f56-568ead7a3d49", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5132dd39-00fb-451a-b7d6-a317b36b448c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e85b14b-d8af-497c-9e42-4260437931f3", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0d553233-7334-4366-922a-b8a5ffdaf69a", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--69dc0b76-2b02-4039-b75e-00c3b295a5f5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3bb2a1e7-6d25-4f78-b737-4f68ee54d0a4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05", "target_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b9df7b80-1086-424c-95b3-a81f11d7ebea", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05", "target_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be34a197-0861-45f1-be90-4e1a9fe13691", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1", "target_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3124d52-2cc2-44db-ade0-bad3c7167fd8", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1", "target_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b920ec2-14f8-497f-8dbb-c43c1c751b1e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba", "target_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--10d082f7-98cb-4b7b-a0dd-cddcf6ab5a3c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba", "target_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'bbc49eac5b7c30708704233416694591']", "description": "Process memory dump comprising shellcode loader stub and Busy Buzzard implant DLL (TCP variant)", "valid_from": "2022-03-25T11:19:06.090Z", "name": "Busy Buzzard sample (MD5: bbc49eac5b7c30708704233416694591 Filename: 'process.0xffffa88b75bfd840.0x2b28af80000.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d754b27-3c85-43c6-96a8-ff540ace7aa6", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '8fd99d9066020003358aa3e23c9af3d4911ce979']", "description": "Process memory dump comprising shellcode loader stub and Busy Buzzard implant DLL (TCP variant)", "valid_from": "2022-03-25T11:19:06.090Z", "name": "Busy Buzzard sample (SHA-1: bbc49eac5b7c30708704233416694591 Filename: 'process.0xffffa88b75bfd840.0x2b28af80000.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf8c1de3-ed96-4ca6-8487-c90ecebe1886", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '41daf4c86e14da87bf2f94b36115a1e7da76d14af0aba0c251bb3e9dbfb40bad']", "description": "Process memory dump comprising shellcode loader stub and Busy Buzzard implant DLL (TCP variant)", "valid_from": "2022-03-25T11:19:06.090Z", "name": "Busy Buzzard sample (SHA-256: bbc49eac5b7c30708704233416694591 Filename: 'process.0xffffa88b75bfd840.0x2b28af80000.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--454c1a9d-5116-4506-8819-6d5f58fd69f9", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6a2cb23f-9ad2-4838-b3c3-4a64385a59de", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'c5af2332d8f7bdd56ed2ae0091422153']", "description": "Busy Buzzard shellcode module", "valid_from": "2022-03-25T11:19:06.090Z", "name": "Busy Buzzard sample (MD5: c5af2332d8f7bdd56ed2ae0091422153 Filename: 'process.0xffffa88b75bfd840.0x2b28b200000.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5ba8d6f0-a2ed-4cd4-a9fe-3071db768405", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--6a2cb23f-9ad2-4838-b3c3-4a64385a59de", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9da79ab3-fb8e-4acc-bd28-7cc80307eb1f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'f737067d41bc77dc7dd09ecb6eb710619bc2dfde']", "description": "Busy Buzzard shellcode module", "valid_from": "2022-03-25T11:19:06.090Z", "name": "Busy Buzzard sample (SHA-1: c5af2332d8f7bdd56ed2ae0091422153 Filename: 'process.0xffffa88b75bfd840.0x2b28b200000.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0fbfa17f-73bf-4f24-abd1-a3ae4e3c0664", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--9da79ab3-fb8e-4acc-bd28-7cc80307eb1f", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--62b54e67-569f-4c72-9fd5-7f1145bb7be5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '6cf6d1a9caee970bcb393a085d1dbb1f01a81fa684f6faf7ddbf0253302e1a4e']", "description": "Busy Buzzard shellcode module", "valid_from": "2022-03-25T11:19:06.090Z", "name": "Busy Buzzard sample (SHA-256: c5af2332d8f7bdd56ed2ae0091422153 Filename: 'process.0xffffa88b75bfd840.0x2b28b200000.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--291a899a-dd78-4885-b25f-f6adb50ce890", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--62b54e67-569f-4c72-9fd5-7f1145bb7be5", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'd40a4f0b426b5500d0e7e331f99c6aca']", "description": "Process memory dump comprising shellcode loader stub and Busy Buzzard implant DLL (TCP variant)", "valid_from": "2022-03-25T11:19:06.091Z", "name": "Busy Buzzard sample (MD5: d40a4f0b426b5500d0e7e331f99c6aca Filename: 'svchost.exe.3016.2b28af80000-2b28af92fff.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--32151297-d414-4b4e-a6d8-d8ff66e8c40d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '266852db4ad2d293469515820fd5e7c228cd4b3e']", "description": "Process memory dump comprising shellcode loader stub and Busy Buzzard implant DLL (TCP variant)", "valid_from": "2022-03-25T11:19:06.091Z", "name": "Busy Buzzard sample (SHA-1: d40a4f0b426b5500d0e7e331f99c6aca Filename: 'svchost.exe.3016.2b28af80000-2b28af92fff.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eaac3146-7daf-4d3a-a136-03ec182db915", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '79024943b61d9c7fe7f8e225f2825ee4fbdeb6dcf2ecdfda3f6414bd6f87bf32']", "description": "Process memory dump comprising shellcode loader stub and Busy Buzzard implant DLL (TCP variant)", "valid_from": "2022-03-25T11:19:06.091Z", "name": "Busy Buzzard sample (SHA-256: d40a4f0b426b5500d0e7e331f99c6aca Filename: 'svchost.exe.3016.2b28af80000-2b28af92fff.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1852e01e-d464-459e-94e9-0863cf908348", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d2e9a9c6-1eab-49c7-aeb4-4c59a2f3d5c4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'f11471c0667eb010a319bb4765ed72c7']", "description": "Busy Buzzard shellcode module", "valid_from": "2022-03-25T11:19:06.091Z", "name": "Busy Buzzard sample (MD5: f11471c0667eb010a319bb4765ed72c7 Filename: 'svchost.exe.3016.2b28b200000-2b28b202fff.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4890911f-77e3-43fb-bf81-b5e1fd301ccc", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--d2e9a9c6-1eab-49c7-aeb4-4c59a2f3d5c4", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--72eee5d1-ad56-4ca4-8903-b4f3d1b5526b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'cf6339501de54590f8bbbc3cfb8051b95f6a1a42']", "description": "Busy Buzzard shellcode module", "valid_from": "2022-03-25T11:19:06.091Z", "name": "Busy Buzzard sample (SHA-1: f11471c0667eb010a319bb4765ed72c7 Filename: 'svchost.exe.3016.2b28b200000-2b28b202fff.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6b73170e-4f17-4e88-a0c8-284a7d775de9", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--72eee5d1-ad56-4ca4-8903-b4f3d1b5526b", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7c066000-76e8-44ef-8fce-80c93e276d8e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'bd6992029c879b74b255aeb3549b8da487aff75d3f614832c23b4cd3717a067b']", "description": "Busy Buzzard shellcode module", "valid_from": "2022-03-25T11:19:06.091Z", "name": "Busy Buzzard sample (SHA-256: f11471c0667eb010a319bb4765ed72c7 Filename: 'svchost.exe.3016.2b28b200000-2b28b202fff.dmp')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f855800-7b4e-412d-b477-e31ca421dc74", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7c066000-76e8-44ef-8fce-80c93e276d8e", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'c0e649fa591ed6c5746d394cb2de3c72']", "description": "Busy Buzzard implant DLL (TCP variant)", "valid_from": "2022-03-25T11:19:06.092Z", "name": "Busy Buzzard sample (MD5: c0e649fa591ed6c5746d394cb2de3c72 Filename: '83030f299a776114878bcd2ade585d97836ef4ddb6943cb796be2c88bcb83a83.sample')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--24d8deed-5f52-47e5-a3f8-199159f5862e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--13142f32-8876-4585-bd63-456ee83d6382", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'd2b8f4fe6eedb8b87521772fc823da596f2403b7']", "description": "Busy Buzzard implant DLL (TCP variant)", "valid_from": "2022-03-25T11:19:06.092Z", "name": "Busy Buzzard sample (SHA-1: c0e649fa591ed6c5746d394cb2de3c72 Filename: '83030f299a776114878bcd2ade585d97836ef4ddb6943cb796be2c88bcb83a83.sample')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5454f21c-5ba0-41e4-b344-9884f7610773", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '83030f299a776114878bcd2ade585d97836ef4ddb6943cb796be2c88bcb83a83']", "description": "Busy Buzzard implant DLL (TCP variant)", "valid_from": "2022-03-25T11:19:06.092Z", "name": "Busy Buzzard sample (SHA-256: c0e649fa591ed6c5746d394cb2de3c72 Filename: '83030f299a776114878bcd2ade585d97836ef4ddb6943cb796be2c88bcb83a83.sample')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b9521258-29eb-4e69-934f-12549222991e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '0b182464a2351a9d79c1222bb1fdf35e']", "description": "Busy Buzzard implant DLL (HTTPS variant)", "valid_from": "2022-03-25T11:19:06.092Z", "name": "Busy Buzzard sample (MD5: 0b182464a2351a9d79c1222bb1fdf35e Filename: '0b182464a2351a9d79c1222bb1fdf35e.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d0f71fcb-93aa-4369-a980-bfbc4409a82c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '6a673508d46c0bbff74ee24384c8bc841c11ea4d']", "description": "Busy Buzzard implant DLL (HTTPS variant)", "valid_from": "2022-03-25T11:19:06.092Z", "name": "Busy Buzzard sample (SHA-1: 0b182464a2351a9d79c1222bb1fdf35e Filename: '0b182464a2351a9d79c1222bb1fdf35e.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--57b03155-b34b-4131-892e-51e66f162110", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '6b52fd7ee1442b4ed2c675f958a42a6c793bfe14a75de0988c4381367284f085']", "description": "Busy Buzzard implant DLL (HTTPS variant)", "valid_from": "2022-03-25T11:19:06.092Z", "name": "Busy Buzzard sample (SHA-256: 0b182464a2351a9d79c1222bb1fdf35e Filename: '0b182464a2351a9d79c1222bb1fdf35e.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f6c0bf0b-2e73-4ae2-9a9c-4db58552cb40", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '037261d5571813b9640921afac8aafbe']", "description": "Busy Buzzard implant DLL (HTTPS variant)", "valid_from": "2022-03-25T11:19:06.092Z", "name": "Busy Buzzard sample (MD5: 037261d5571813b9640921afac8aafbe Filename: '10000000.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c4029cb6-01a2-42db-97ba-c4d10e99cfdb", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--addadd5e-bf78-4843-a8f4-133896c43666", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'e74affd6c766156e3fe803917f28da08fe7000ef']", "description": "Busy Buzzard implant DLL (HTTPS variant)", "valid_from": "2022-03-25T11:19:06.092Z", "name": "Busy Buzzard sample (SHA-1: 037261d5571813b9640921afac8aafbe Filename: '10000000.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bb613cdf-20a7-4411-a1e1-92d58de10e6d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '9d6e14cd244f6c49e11d2b47f12116b5848aaed7a6aaa218fb023b33f7c12a3b']", "description": "Busy Buzzard implant DLL (HTTPS variant)", "valid_from": "2022-03-25T11:19:06.093Z", "name": "Busy Buzzard sample (SHA-256: 037261d5571813b9640921afac8aafbe Filename: '10000000.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c17be231-7ee4-48f4-a443-27271c493da5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'c5994f9fe4f58c38a8d2af3021028310']", "description": "Busy Buzzard implant DLL (HTTPS variant)", "valid_from": "2022-03-25T11:19:06.093Z", "name": "Busy Buzzard sample (MD5: c5994f9fe4f58c38a8d2af3021028310 Filename: '80f55.rec.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9ef06e3b-5cec-4852-8994-fcc6296f10db", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '48152eeb1d74a84ba86b34f419cf1c7a105e41ff']", "description": "Busy Buzzard implant DLL (HTTPS variant)", "valid_from": "2022-03-25T11:19:06.093Z", "name": "Busy Buzzard sample (SHA-1: c5994f9fe4f58c38a8d2af3021028310 Filename: '80f55.rec.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9cf1fab9-bfbb-43a3-afd1-d4615888e163", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'ca9bcf268330a4fffcec025920514e0071651c35895b15b2f1dab8813c8b8e99']", "description": "Busy Buzzard implant DLL (HTTPS variant)", "valid_from": "2022-03-25T11:19:06.093Z", "name": "Busy Buzzard sample (SHA-256: c5994f9fe4f58c38a8d2af3021028310 Filename: '80f55.rec.dll')", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--91b321a8-a0a2-4f33-a9cc-e7e8f4dcf4f4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule BusyBuzzard_command_switching_and_ok_response\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects code bytes used by Busy Buzzard to switch between the different commands, as well as a test for an 'ok' response from the C2 server\"\r\n date = \"2022-03-25\"\r\n hash1 = \"8fd99d9066020003358aa3e23c9af3d4911ce979\"\r\n hash2 = \"266852db4ad2d293469515820fd5e7c228cd4b3e\"\r\n hash3 = \"d2b8f4fe6eedb8b87521772fc823da596f2403b7\"\r\n hash4 = \"6a673508d46c0bbff74ee24384c8bc841c11ea4d\"\r\n hash5 = \"e74affd6c766156e3fe803917f28da08fe7000ef\"\r\n hash6 = \"48152eeb1d74a84ba86b34f419cf1c7a105e41ff\"\r\n\r\n strings:\r\n // switch between 'd', 'f', 'l', 's' commands (TCP variant)\r\n $tcp = {3C 64 74 ?? 3C 66 74 ?? 3C 6C 74 ?? 3C 73 75 ?? 8D 57 FB 48 8D 4B 05 E8}\r\n // switch between 'd', 's' commands only (HTTPS variant)\r\n $http1 = {3C 64 74 ?? 3C 73}\r\n // test for 'ok' response from C2 server (HTTPS variant)\r\n $http2 = {80 3B 6F 75 ?? 80 7B 01 6B 74}\r\n\r\n condition:\r\n $tcp or (all of ($http*))\r\n}", "description": "Detects code bytes used by Busy Buzzard to switch between the different commands, as well as a test for an \"ok\" response from the C2 server", "valid_from": "2022-03-25T11:19:06.095Z", "name": "YARA: BusyBuzzard_command_switching_and_ok_response", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a8c6e96-eadc-4a95-8318-28b1a75fcb54", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c731664-2d6f-4671-bbf5-f6b968bbc065", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b426302-1b82-46cd-8738-fad759c9c820", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0cafd7f-b827-444a-8f89-4435f8fd3f5e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--163d4df8-cb14-4d40-b2d5-ea17db9558bd", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d54355f1-f976-4df6-8bb1-fe424ff145ed", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee4884ed-03f7-49a9-8a4a-ea379888e0e4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1eba4394-13cf-4f78-b2e2-ec20040fb326", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e7807bf3-f106-4a70-9739-853c3de013b5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7a3fe3f4-f8dd-4be9-a7b5-478cec906348", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8e7f7131-79b1-408a-b14e-595f11b14efe", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--00d1343d-31fa-4a50-9059-096b10f8a674", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4f91d2d2-0b48-44fb-ae1f-c4b530091dcf", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--62d3c4a6-70f5-4d44-9138-d0027ce853d9", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e111459-1d0a-4943-8fb2-2e84daecdb88", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--26b3aeba-75c2-4845-9af0-f096e5dc3aff", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--061b513d-d666-4572-a914-aaf94820b354", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--34409221-c08d-4677-94c3-0ca4b69c8801", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--71109a28-0c9b-4d41-84f5-5085603f6ca4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "target_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule BusyBuzzard_convert_crc32_to_mutex_name\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects code bytes used by the TCP variant of Busy Buzzard to convert a CRC32 value to its hex string representation in reverse-nibble order\"\r\n date = \"2022-03-25\"\r\n hash1 = \"8fd99d9066020003358aa3e23c9af3d4911ce979\"\r\n hash2 = \"266852db4ad2d293469515820fd5e7c228cd4b3e\"\r\n hash3 = \"d2b8f4fe6eedb8b87521772fc823da596f2403b7\"\r\n\r\n strings:\r\n // loop that converts a 4-byte value to its hex string\r\n // representation (in reverse)\r\n $ = {0F B6 C2 24 0F 3C 09 76 02 04 07 04 30 48 FF C1 C1 EA 04 49 FF C8 88 41 FF 75 E5}\r\n\r\n condition:\r\n all of them\r\n}", "description": "Detects code bytes used by the TCP variant of Busy Buzzard to convert a CRC32 value to its hex string representation in reverse-nibble order", "valid_from": "2022-03-25T11:19:06.096Z", "name": "YARA: BusyBuzzard_convert_crc32_to_mutex_name", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df318e7d-adfd-4941-a86b-557963b25a2a", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5ebe906f-4f02-4abd-8fc4-96b48014d1cf", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db80f563-e17e-45d5-a1a9-2ee259b0e1a5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--69c34b56-0585-45a1-b9b6-0f072d1a205d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9dcd8155-398d-4058-8762-411507af9296", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb9804fc-0073-4be2-b86a-35ed70402493", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aeb59e97-91b4-478c-97d0-14b5d3413284", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e8985e16-1ab0-4ef7-b8d1-e3758b65d7a9", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--21b4c75e-6a08-4a0b-a3df-28d7b368c108", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--44334344-7a58-48ec-a8cb-5963ad8f8b5b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "target_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule BusyBuzzard_original_dll_names\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Busy Buzzard original DLL names embedded within the binary\"\r\n date = \"2022-03-25\"\r\n hash1 = \"8fd99d9066020003358aa3e23c9af3d4911ce979\"\r\n hash2 = \"266852db4ad2d293469515820fd5e7c228cd4b3e\"\r\n hash3 = \"6a673508d46c0bbff74ee24384c8bc841c11ea4d\"\r\n hash4 = \"e74affd6c766156e3fe803917f28da08fe7000ef\"\r\n hash5 = \"48152eeb1d74a84ba86b34f419cf1c7a105e41ff\"\r\n\r\n strings:\r\n $ = \"httpsWin32.dll\\x00\"\r\n $ = \"tcpcX64.dll\\x00\"\r\n\r\n condition:\r\n any of them\r\n}", "description": "Detects Busy Buzzard original DLL names embedded within the binary", "valid_from": "2022-03-25T11:19:06.096Z", "name": "YARA: BusyBuzzard_original_dll_names", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1bdf2d8e-eed8-4b33-84ca-d7fadf3ed454", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--18e70cb1-29d0-4fc9-bb12-6ea5c078250f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5256f33f-4a8b-4fad-86d5-4fba81166748", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6b95853d-3396-48de-8d3d-6cc4af6b95df", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f9a49907-d6db-4f8b-b78a-dbf03ba6e767", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--47183a09-3775-44d4-a51d-7f370ce6f458", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9bbf57e2-9a5d-4af4-9eef-c5be0fea3369", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bc54b0a3-38e2-4f6c-994f-ba2985e1c1de", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--41ad3357-308d-414c-b4be-551ba81f70cf", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--29058fe2-80eb-46cc-8fb5-19bb88535e58", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a23ae13f-0459-4c8c-aa84-eab92f7aa4ab", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8dfe68c5-f3d8-413a-9dfd-65c4c8df06a4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6083247-404b-422b-bcf2-310f3bb0b757", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7eb3bfb1-a231-4f2a-b706-d7974112bc37", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--779b0d65-a0cd-452f-9722-57eea899dde1", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c7ccf755-056e-430f-bb04-8d2c94f4e50e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "target_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule BusyBuzzard_random_rc4_key_generator\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects code bytes used by Busy Buzzard to generate the randomised RC4 key\"\r\n date = \"2022-03-25\"\r\n hash1 = \"8fd99d9066020003358aa3e23c9af3d4911ce979\"\r\n hash2 = \"266852db4ad2d293469515820fd5e7c228cd4b3e\"\r\n hash3 = \"d2b8f4fe6eedb8b87521772fc823da596f2403b7\"\r\n hash4 = \"6a673508d46c0bbff74ee24384c8bc841c11ea4d\"\r\n hash5 = \"e74affd6c766156e3fe803917f28da08fe7000ef\"\r\n hash6 = \"48152eeb1d74a84ba86b34f419cf1c7a105e41ff\"\r\n\r\n strings:\r\n // x86\r\n $ = {99 B9 3E 00 00 00 F7 F9 83 FA 0A 73 05 83 C2 30 EB 0D 83 FA 25 73 05 83 C2 37 EB 03 83 C2 3C 8B 03 88 14 06 46 3B F7}\r\n // x64\r\n $ = {44 8B D8 B8 43 08 21 84 41 F7 EB 41 03 D3 C1 FA 05 8B CA C1 E9 1F 03 D1 6B D2 3E 44 2B DA 41 83 FB 0A 7D 06 41 83 C3 30 EB 10 41 83 FB 25 7D 06 41 83 C3 37 EB 04 41 83 C3 3C 48 8B 4D 00 48 FF C3 48 FF CE 44 88 5C 0B FF 75 B0}\r\n\r\n condition:\r\n any of them\r\n}", "description": "Detects code bytes used by Busy Buzzard to generate the randomised RC4 key", "valid_from": "2022-03-25T11:19:06.097Z", "name": "YARA: BusyBuzzard_random_rc4_key_generator", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c87a8b9-1922-4403-86cf-203cefe71cd8", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9cd0bf12-156c-469a-8300-c3cd36db5ebb", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6afe4f8b-8a3f-4169-a0e2-4474a175c5de", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e0b43089-e6ea-48d9-a77c-ec45d460adf4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6db867d4-bddb-44a8-90ac-5e134bc55788", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58e03659-c606-4f2c-9a6c-69568381166e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4bebc3ff-af47-42ea-89a9-e69334b06999", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee2d7e43-256a-4b2e-a8ea-6b72979eed5e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70a51dc3-45e4-4bf9-9468-1e9a6c5abe66", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b28ccae6-4937-4411-b877-be780ea33700", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--929e4e64-269d-4502-9bdb-41a225f2269c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0eb3ff90-70e9-441d-8b8a-50edb09302fe", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a93b3f3b-9845-4414-a52c-b0f16dcebe71", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--629c92f7-5edd-4592-aac2-b73191733918", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a572f2c8-3f7d-4798-a2b5-5a0be8017885", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ed73e469-94e3-401b-bc3f-eaad1aa1410c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--42ad486e-348f-4bce-bdcc-a09dabf2eb75", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--30d0f1f4-9985-453b-a334-8e1d9d915833", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5e1db025-7652-45e4-b30c-b824af756bf2", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "target_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule BusyBuzzard_https_cmd_response_stack_strings\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects command response strings, built on the stack, used by the HTTPS variant of Busy Buzzard\"\r\n date = \"2022-03-25\"\r\n hash1 = \"6a673508d46c0bbff74ee24384c8bc841c11ea4d\"\r\n hash2 = \"e74affd6c766156e3fe803917f28da08fe7000ef\"\r\n hash3 = \"48152eeb1d74a84ba86b34f419cf1c7a105e41ff\"\r\n\r\n strings:\r\n // \"cmd=\"\r\n $ = {C7 (45 ?? | 85 ?? ?? ?? ??) 63 6D 64 3D}\r\n // \"&type=\"\r\n $ = {C7 (45 ?? | 85 ?? ?? ?? ??) 26 74 79 70 66 C7 (45 ?? | 85 ?? ?? ?? ??) 65 3D}\r\n // \"&ret=\"\r\n $ = {C7 (45 ?? | 85 ?? ?? ?? ??) 26 72 65 74 66 C7 (45 ?? | 85 ?? ?? ?? ??) 3D 00}\r\n\r\n condition:\r\n all of them\r\n}", "description": "Detects command response strings, built on the stack, used by the HTTPS variant of Busy Buzzard", "valid_from": "2022-03-25T11:19:06.098Z", "name": "YARA: BusyBuzzard_https_cmd_response_stack_strings", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--744a25f2-00cb-4d4f-acb0-e1d50ed08343", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c5f884a-926e-4c1f-9179-8e9184882c8e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2950c448-433c-4748-80eb-723acd0b4c40", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1ef688b1-e444-4d1c-a575-c8c1329aa1b2", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--588b82a7-a460-4ec0-9062-eb90fa5fdab7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--64d3680d-d69f-4e0f-a2ec-4c37e8f4c7ac", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a316a36e-5b14-464b-a7e7-ba4b3d8bf1ac", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e54d4b4c-89af-4edb-9198-5af74a1ef2fc", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be627f36-257e-40b8-a9ea-dec78b86363f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f7246fd-bd12-4a92-b9da-ed26fc2daaa7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--43a16033-2665-4d5a-8728-827609e0827d", "target_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bca2f1a7-10ef-490e-ae7c-6712e0c6747a", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "\r\nrule BusyBuzzard_plugin_helper_functions\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects code bytes used by Busy Buzzard shellcode plugin helper functions\"\r\n date = \"2022-03-25\"\r\n hash1 = \"f737067d41bc77dc7dd09ecb6eb710619bc2dfde\"\r\n hash2 = \"cf6339501de54590f8bbbc3cfb8051b95f6a1a42\"\r\n\r\n strings:\r\n $ = {56 48 8B F4 48 83 E4 F0 48 83 EC 20 E8 F7 DF FF FF 48 8B E6 5E C3 48 C7 C0 30 00 00 00 65 48 8B 00 48 8B 40 60 48 8B 40 18 48 8B 40 10 48 8B 00 48 8B 00 48 8B 40 30 C3}\r\n\r\n condition:\r\n (all of them) and (filesize < 20KB)\r\n}", "description": "Detects code bytes used by Busy Buzzard shellcode plugin helper functions", "valid_from": "2022-03-25T11:19:06.099Z", "name": "YARA: BusyBuzzard_plugin_helper_functions", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0023e79c-cf61-4846-bf52-9af1909020b9", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--bca2f1a7-10ef-490e-ae7c-6712e0c6747a", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e6717c89-aae6-4d91-a109-c05b8ed06757", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bca2f1a7-10ef-490e-ae7c-6712e0c6747a", "target_ref": "indicator--6a2cb23f-9ad2-4838-b3c3-4a64385a59de" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5c68ae0f-8141-4745-8bdf-50eaeabe8295", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bca2f1a7-10ef-490e-ae7c-6712e0c6747a", "target_ref": "indicator--9da79ab3-fb8e-4acc-bd28-7cc80307eb1f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--edc0377b-4806-40a9-80c3-02c0acdd412f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bca2f1a7-10ef-490e-ae7c-6712e0c6747a", "target_ref": "indicator--62b54e67-569f-4c72-9fd5-7f1145bb7be5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--65aaeba0-3f3d-411e-899d-63eac1efe112", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bca2f1a7-10ef-490e-ae7c-6712e0c6747a", "target_ref": "indicator--d2e9a9c6-1eab-49c7-aeb4-4c59a2f3d5c4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--89abe5a3-b34e-4625-b0e4-ad4229c78115", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bca2f1a7-10ef-490e-ae7c-6712e0c6747a", "target_ref": "indicator--72eee5d1-ad56-4ca4-8903-b4f3d1b5526b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bb962bc6-0f98-4896-9e38-bc22c4e1be87", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bca2f1a7-10ef-490e-ae7c-6712e0c6747a", "target_ref": "indicator--7c066000-76e8-44ef-8fce-80c93e276d8e" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d1cdcf17-5d5c-433e-94b6-0132cd306c2f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule BusyBuzzard_shellcode_loader_x64\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects code bytes used for resolving function addresses in the Busy Buzzard shellcode loader\"\r\n date = \"2022-03-25\"\r\n hash1 = \"8fd99d9066020003358aa3e23c9af3d4911ce979\"\r\n hash2 = \"266852db4ad2d293469515820fd5e7c228cd4b3e\"\r\n\r\n strings:\r\n // resolving GetProcAddress\r\n $ = {3D 67 65 74 70}\r\n $ = {3D 64 64 72 65}\r\n // function name \"IsBadReadPtr\" built on stack\r\n $ = {C7 45 50 49 73 42 61}\r\n $ = {C7 45 54 64 52 65 61}\r\n $ = {C7 45 58 64 50 74 72}\r\n // function name \"ImageRvaToVa\" built on stack\r\n $ = {C7 45 20 49 6D 61 67}\r\n $ = {C7 45 24 65 52 76 61}\r\n $ = {C7 45 28 54 6F 56 61}\r\n // resolving kernel32 base address\r\n $ = {48 C7 C0 30 00 00 00 65 48 8B 00 48 8B 40 60 48 8B 40 18 48 8B 40 10 48 8B 00 48 8B 00 48 8B 40 30 C3}\r\n\r\n condition:\r\n all of them\r\n}", "description": "Detects code bytes used for resolving function addresses in the Busy Buzzard shellcode loader", "valid_from": "2022-03-25T11:19:06.099Z", "name": "YARA: BusyBuzzard_shellcode_loader_x64", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b34cedf-1f69-464d-9036-0d8009bd8425", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--d1cdcf17-5d5c-433e-94b6-0132cd306c2f", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--41e79adc-5cd9-4a46-95d7-5592d7eea2ee", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d1cdcf17-5d5c-433e-94b6-0132cd306c2f", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--295131e7-09ec-4b4d-b62d-9058f1d015ca", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d1cdcf17-5d5c-433e-94b6-0132cd306c2f", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f2343d9-0d5e-453e-8167-f2b2f75e31de", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d1cdcf17-5d5c-433e-94b6-0132cd306c2f", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c8085b13-0608-48cf-90be-19290ae7e539", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d1cdcf17-5d5c-433e-94b6-0132cd306c2f", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d3e0cfa8-bf59-41a8-aec6-d5fbb01b366f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d1cdcf17-5d5c-433e-94b6-0132cd306c2f", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--19633280-92a9-4619-844c-a0d15422df03", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d1cdcf17-5d5c-433e-94b6-0132cd306c2f", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule BusyBuzzard_rsa_public_keys\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects hard-coded RSA public keys used by both the TCP and HTTPS variants of Busy Buzzard\"\r\n date = \"2022-03-25\"\r\n hash1 = \"8fd99d9066020003358aa3e23c9af3d4911ce979\"\r\n hash2 = \"266852db4ad2d293469515820fd5e7c228cd4b3e\"\r\n hash3 = \"d2b8f4fe6eedb8b87521772fc823da596f2403b7\"\r\n hash4 = \"6a673508d46c0bbff74ee24384c8bc841c11ea4d\"\r\n hash5 = \"e74affd6c766156e3fe803917f28da08fe7000ef\"\r\n hash6 = \"48152eeb1d74a84ba86b34f419cf1c7a105e41ff\"\r\n\r\n strings:\r\n // Hard-coded RSA public keys used by Busy Buzzard samples\r\n $rsa1 = \"MIGJAoGBANYrLIbgWsKfJOnWnk/YUJmgFxI5PMK31Rnj7AOR37VM66baxx/6+03/IbT4oe/Py9YBYUIILhZTcCGOjv/KW+nZoQ4gdkDXexP7kD2YuwEKQZB1WSG3MTPNLCWANvGMrX+Cb/9H3qJ/mmIYrygcLmzj4E2rSxJfdZ3YaYI1IX/vAgMBAAE=\\x00\"\r\n $rsa2 = \"MIGJAoGBAK7mh7RSMtisKLn+Jfkq9AUlOHqUe4zjTLVC89k+sPux5ZMr9ndtjzdx8bCcSfCQtemKrR2LY4lRr5cZs3jgwaBbHS2SdCezUuNUdrEEsfWX8BlK13G8djFmmYZqKeQFnUrKZn+uA0A4nIGPRFKB2fKfBjh4Y5qN2IoyV9Y0e8HHAgMBAAE=\\x00\"\r\n $rsa3 = \"MIGJAoGBALkXcETCNbKRUMlz0Bkl8Mr/Jm1A4VKxdLBlDXCtD/9fCrfSDl2z/JhykFJik787pT05QuKIsLWZLv2/lqMlDxnKEPEQRDBdm900If27xShcK/qRoSOO8edUD44PphF5cMfK16VMoN9e3DEVeP4zduCanP4vbFpH3vwaTI1Or1QRAgMBAAE=\\x00\"\r\n\r\n condition:\r\n (1 of ($rsa*))\r\n}", "description": "Detects hard-coded RSA public keys used by both the TCP and HTTPS variants of Busy Buzzard", "valid_from": "2022-03-25T11:19:06.099Z", "name": "YARA: BusyBuzzard_rsa_public_keys", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--178a3734-89da-4c45-9239-3b5b2f073e03", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eea589d6-5220-4930-b4c1-d4d3cb948ed4", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--795a5783-0baf-4ceb-b27f-9d375c8c779e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--24314b97-5ade-45ec-a554-3f8c4aab60c1", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8f49362d-bcc5-4a60-947c-4c4a6e2882c3", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9d5f5df9-46a7-4df3-8769-021acd0873b7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b2950129-beb3-4aa3-86d6-4b96e6d2a171", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2af77212-9ca2-45e5-b4bf-e44969b86aac", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--382b81c1-c970-4622-81fd-9e8e9a42cb46", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1b505a87-5a99-42d6-9da6-9ee8bd71ba49", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f89fcef-556c-4570-a168-e434e8c277bf", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e84c75f0-86d1-492f-bc89-ae46e70696bc", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--764cd961-404c-4df7-b0b9-391eeddb8d47", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d19d3b68-8fdd-4250-ba0d-d21de8db21c1", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f36ba82-301b-47d4-884a-e88e975ba9f0", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d192c3e2-6713-4b78-a268-fd9cc3d21f53", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9849491e-928b-4257-901e-dd996ee81caa", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d12f6e6f-eacd-40d0-9bfb-4498b596c779", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--81058a78-a919-454a-b6c7-8238ee8b83d6", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "target_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule BusyBuzzard_mutex_random_bytes \r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects additional random bytes used by TCP variants of Busy Buzzard to generate a unique mutex name\"\r\n date = \"2022-03-25\"\r\n hash1 = \"8fd99d9066020003358aa3e23c9af3d4911ce979\"\r\n hash2 = \"266852db4ad2d293469515820fd5e7c228cd4b3e\"\r\n hash3 = \"d2b8f4fe6eedb8b87521772fc823da596f2403b7\"\r\n\r\n strings:\r\n // Additional random bytes used by TCP variants of Busy Buzzard to generate a unique mutex name \r\n $rand1 = {61 87 67 6C 6A DB 4A C6 58 D1 61} \r\n $rand2 = {CF 4F 26 6A 57 77 5B B7 AB D4 29} \r\n\r\n condition:\r\n (1 of ($rand*)) \r\n}", "description": "Detects additional random bytes used by TCP variants of Busy Buzzard to generate a unique mutex name", "valid_from": "2022-03-25T11:19:06.100Z", "name": "YARA: BusyBuzzard_mutex_random_bytes", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--89303a39-43c2-4504-b30f-fc6189bd4a07", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--795653e8-860e-4ed5-ba19-5276eb5b7607", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ba7f57a-bf0d-4118-ae58-7ee63a485a41", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e366d769-1412-4898-a4ef-f0838e334047", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--283029d5-b905-4d73-8561-5ec8e874e801", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--39e216ab-a381-40a0-bfb8-2ef6b508fa2f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b72d9704-0714-4710-a056-1dfc54a4d031", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b7a58c72-0076-4163-93c9-7ee381faefba", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e40a0a2-7491-48bb-8fbc-e7662cfae6ce", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d0947563-0e1d-4197-b0b9-2ef496c0f85d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "target_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[domain-name:value = 'www.rare-coisns.com']", "description": "C2 server domain", "valid_from": "2022-03-25T11:19:06.101Z", "name": "Domain Name: www.rare-coisns.com", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf2d6e70-0d09-4a0e-87e7-53322d15e435", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e63bd7dc-7593-4b00-bccd-11a76af00f2e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "attack-pattern--d0b11c53-1969-44a2-81bd-292d8fb17bb7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86a85eb7-60e7-417d-a4bc-86dd5a5fa276", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--71776180-7619-46dd-9dee-c06048c259f0", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d1732061-c8f9-4f66-966d-323894e71836", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0413f629-0efd-4306-942f-75d7ce00f6d8", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dc16ef8a-b05b-4218-b5de-24d35bc29501", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--37a59a9c-db7d-4bba-bf2c-b55426790e4e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ebe91ad1-f268-480d-a4f9-e85b53c8c2e3", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee2217f7-1c12-44ee-b8d8-12ab12ebaaa7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--84e1c819-8db3-43c3-8cfd-9b6ea814540d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "target_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '206.189.46.22']", "description": "C2 server IP address", "valid_from": "2022-03-25T11:19:06.102Z", "name": "IPv4: 206.189.46.22", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a6ebab7e-f9d7-4a46-a010-d33ca9d3de79", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eef4fc5c-6078-411c-81db-d77513e47f5b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "target_ref": "attack-pattern--5ddc3e85-6f73-4c49-b6d9-a2dd42c4405e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c89309d-98b4-49e4-8cf6-56c6423c7677", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d665fe7-52c1-4e51-9675-770edbe406b9", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d7d1777f-e288-4b1a-86af-900329b30dd8", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aad34fd8-5908-4244-b703-901175f0f4bb", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1f6c4388-2e23-4309-ab12-000ab5ac60d0", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--577a712d-62aa-4c73-9dc2-c3865d0f67aa", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74fdd642-1f6e-435d-98c7-9fde0f52c27e", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '88.198.101.58']", "description": "C2 server IP address", "valid_from": "2022-03-25T11:19:06.102Z", "name": "IPv4: 88.198.101.58", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9a240bee-9d49-4b73-81df-98a59378db09", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--74fdd642-1f6e-435d-98c7-9fde0f52c27e", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e4a9b138-3b54-4521-8587-04a89f2a5a80", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--74fdd642-1f6e-435d-98c7-9fde0f52c27e", "target_ref": "attack-pattern--5ddc3e85-6f73-4c49-b6d9-a2dd42c4405e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ffea1c37-8f52-493a-925d-920f2c0bbe8f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--74fdd642-1f6e-435d-98c7-9fde0f52c27e", "target_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7273221d-67bc-4eeb-8ae1-dcc4a6d37999", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--74fdd642-1f6e-435d-98c7-9fde0f52c27e", "target_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4e7cfee0-8cb2-4bd9-b77d-e328f9f0d046", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--74fdd642-1f6e-435d-98c7-9fde0f52c27e", "target_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[url:value = 'https://www.rare-coisns.com/image/look/javascript/index.php']", "description": "C2 URL", "valid_from": "2022-03-25T11:19:06.102Z", "name": "URL: https://www.rare-coisns.com/image/look/javascript/index.php", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b332d0a6-3e17-4a04-b947-197411c65593", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad487278-8168-4e21-b5e5-cf476c1e8955", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "attack-pattern--d0b11c53-1969-44a2-81bd-292d8fb17bb7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--79a00ea8-587c-4a59-9ff4-720dcbbdf85d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7d53366a-9287-40ee-b97d-53eeed16bfd2", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b21f36b2-526c-4868-9b3b-9dc0c94f0120", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8a323342-067d-49a3-853a-fcd3c12b364f", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--07123dcd-1713-4341-b4f7-b7dee1eedf48", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--88c34d27-4a07-406c-bc96-88c3c6840fd1", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5817bd6c-1473-4caf-be32-f9f8f65139c9", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "indicator--f07a863c-c053-4b8f-93a9-596b62078f05" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6deb48ff-4f60-41bf-a80b-d73269a5c182", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "indicator--8899a809-e680-4b49-a434-b5fd68d044b1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--548169cb-c32d-43db-8731-ac030294876c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "target_ref": "indicator--1e4f95eb-f588-407e-acc8-3a777801feba" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[network-traffic:extensions.'http-request-ext'.request_header.'User-Agent' = 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)']", "description": "Busy Buzzard User-Agent", "valid_from": "2022-03-25T11:19:06.103Z", "name": "User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8d51e683-3bf3-4419-9268-f8e1af1a4a38", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--67a57f9b-76ab-4c07-92b0-3dedafaf94b8", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "target_ref": "attack-pattern--d0b11c53-1969-44a2-81bd-292d8fb17bb7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--94482097-b05c-462e-98b9-c58c2364f4b5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "target_ref": "indicator--39f0766c-5cfc-426f-8407-f9371b81856f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e06f1c77-9ab7-4090-b0c9-6d37a6335475", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "target_ref": "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b75f0548-78bc-4ad6-a111-e983189446d5", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "target_ref": "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3462eaa6-7bc2-4b4e-aa3a-0fe7820dd31a", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "target_ref": "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--45d4e479-ec8e-47d2-a772-b16100cca193", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "target_ref": "indicator--addadd5e-bf78-4843-a8f4-133896c43666" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3e540978-631d-45de-ad24-da18d629687b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "target_ref": "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--238d090f-db94-4b98-bc81-20815930663d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[mutex:name = '0A463B5B\\\\x01']", "description": "Busy Buzzard mutex", "valid_from": "2022-03-25T11:19:06.103Z", "name": "Mutex: 0A463B5B\\x01", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--34912968-ccf1-407a-a9fd-bae79dc60b95", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--238d090f-db94-4b98-bc81-20815930663d", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f32f27cd-6533-4c02-94f2-a2bc45f422b1", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--238d090f-db94-4b98-bc81-20815930663d", "target_ref": "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6d7e073a-ad05-4ff8-8c93-74bb3d8e6dce", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--238d090f-db94-4b98-bc81-20815930663d", "target_ref": "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0fc10381-68ad-46ad-a817-0b0ee5c3a254", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--238d090f-db94-4b98-bc81-20815930663d", "target_ref": "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--72fe8881-0d1f-4c76-89ea-1e44d2d0291d", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--238d090f-db94-4b98-bc81-20815930663d", "target_ref": "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6084125c-9e21-44f8-8181-8bf60db61fbd", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--238d090f-db94-4b98-bc81-20815930663d", "target_ref": "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9bb286f8-567d-4b40-9123-7ab6ea5bc549", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--238d090f-db94-4b98-bc81-20815930663d", "target_ref": "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--78adcb14-b181-4a17-aa87-b95586175a22", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[mutex:name = '51A50CE6\\\\x01']", "description": "Busy Buzzard mutex", "valid_from": "2022-03-25T11:19:06.104Z", "name": "Mutex: 51A50CE6\\x01", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cb04bce6-e0d7-4b73-838f-be6bafa48668", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--78adcb14-b181-4a17-aa87-b95586175a22", "target_ref": "malware--219357af-b2d8-4d88-8141-840bf4c7ed91" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c707765c-7b07-4a93-95cc-350692bfb691", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--78adcb14-b181-4a17-aa87-b95586175a22", "target_ref": "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--89f685d6-98a7-4de3-a1d4-a7662e956492", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--78adcb14-b181-4a17-aa87-b95586175a22", "target_ref": "indicator--13142f32-8876-4585-bd63-456ee83d6382" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee7e7b1e-1870-4058-9930-ec50432bef7c", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--78adcb14-b181-4a17-aa87-b95586175a22", "target_ref": "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", "created": "2022-10-01T00:00:00.000Z", "modified": "2022-10-01T00:00:00.000Z", "name": "TLP:CLEAR", "extensions": { "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": { "extension_type": "property-extension", "tlp_2_0" : "clear" } } }, { "type": "identity", "spec_version": "2.1", "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "created": "2021-05-20T12:00:00.000Z", "modified": "2021-05-20T12:00:00.000Z", "name": "NCSC", "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Shared Modules", "x_mitre_data_sources": [ "Process: OS API Execution", "Module: Module Load" ], "x_mitre_version": "2.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "x_mitre_platforms": [ "Windows" ], "x_mitre_is_subtechnique": false, "x_mitre_permissions_required": [ "User" ], "description": "Adversaries may execute malicious payloads via loading shared modules. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like CreateProcess, LoadLibrary, etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, malware may execute share modules to load additional components or features.", "x_mitre_contributors": [ "Stefan Kanthak" ], "x_mitre_detection": "Monitoring DLL module loads may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances, since benign use of Windows modules load functions are common and may be difficult to distinguish from malicious behavior. Legitimate software will likely only need to load routine, bundled DLL modules or Windows system DLLs such that deviation from known module loads may be suspicious. Limiting DLL module loads to %SystemRoot% and %ProgramFiles% directories will protect against module loads from unsafe paths. \n\nCorrelation of other events with behavior surrounding module loads using API monitoring and suspicious DLLs written to disk will provide additional context to an event that may assist in determining if it is due to malicious behavior.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1129", "external_id": "T1129", "source_name": "mitre-attack" }, { "source_name": "Wikipedia Windows Library Files", "description": "Wikipedia. (2017, January 31). Microsoft Windows library files. Retrieved February 13, 2017.", "url": "https://en.wikipedia.org/wiki/Microsoft_Windows_library_files" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--391d824f-0ef1-47a0-b0ee-c59a75e27670", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Native API", "x_mitre_data_sources": [ "Process: OS API Execution", "Module: Module Load" ], "x_mitre_version": "2.1", "x_mitre_remote_support": false, "x_mitre_platforms": [ "Windows", "macOS", "Linux" ], "x_mitre_is_subtechnique": false, "x_mitre_permissions_required": [ "User" ], "description": "Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\n\nNative API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries. (Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\n\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\n\nAdversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. While invoking API functions, adversaries may also attempt to bypass defensive tools (ex: unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001)).", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "x_mitre_contributors": [ "Gordon Long, Box, Inc., @ethicalhax", "Stefan Kanthak" ], "x_mitre_detection": "Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior. Correlation of other events with behavior surrounding API function calls using API monitoring will provide additional context to an event that may assist in determining if it is due to malicious behavior. Correlation of activity by process lineage by process ID may be sufficient. \n\nUtilization of the Windows APIs may involve processes loading/accessing system DLLs associated with providing called functions (ex: ntdll.dll, kernel32.dll, advapi32.dll, user32.dll, and gdi32.dll). Monitoring for DLL loads, especially to abnormal/unusual or potentially malicious processes, may indicate abuse of the Windows API. Though noisy, this data can be combined with other indicators to identify adversary activity. ", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1106", "external_id": "T1106", "source_name": "mitre-attack" }, { "url": "https://undocumented.ntinternals.net/", "description": "The NTinterlnals.net team. (n.d.). Nowak, T. Retrieved June 25, 2020.", "source_name": "NT API Windows" }, { "url": "https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html", "description": "Linux Kernel Organization, Inc. (n.d.). The Linux Kernel API. Retrieved June 25, 2020.", "source_name": "Linux Kernel API" }, { "url": "https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/", "description": "de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021.", "source_name": "OutFlank System Calls" }, { "url": "https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/", "description": "Gavriel, H. (2018, November 27). Malware Mitigation when Direct System Calls are Used. Retrieved September 29, 2021.", "source_name": "CyberBit System Calls" }, { "url": "https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/", "description": "MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.", "source_name": "MDSec System Calls" }, { "source_name": "Microsoft CreateProcess", "description": "Microsoft. (n.d.). CreateProcess function. Retrieved December 5, 2014.", "url": "http://msdn.microsoft.com/en-us/library/ms682425" }, { "url": "https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html", "description": "Free Software Foundation, Inc.. (2020, June 18). Creating a Process. Retrieved June 25, 2020.", "source_name": "GNU Fork" }, { "url": "https://docs.microsoft.com/en-us/windows/win32/api/", "description": "Microsoft. (n.d.). Programming reference for the Win32 API. Retrieved March 15, 2020.", "source_name": "Microsoft Win32" }, { "url": "https://man7.org/linux/man-pages//man7/libc.7.html", "description": "Kerrisk, M. (2016, December 12). libc(7) — Linux manual page. Retrieved June 25, 2020.", "source_name": "LIBC" }, { "url": "https://www.gnu.org/software/libc/", "description": "glibc developer community. (2020, February 1). The GNU C Library (glibc). Retrieved June 25, 2020.", "source_name": "GLIBC" }, { "url": "https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework", "description": "Microsoft. (n.d.). What is .NET Framework?. Retrieved March 15, 2020.", "source_name": "Microsoft NET" }, { "url": "https://developer.apple.com/documentation/coreservices", "description": "Apple. (n.d.). Core Services. Retrieved June 25, 2020.", "source_name": "Apple Core Services" }, { "url": "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CocoaApplicationLayer/CocoaApplicationLayer.html#//apple_ref/doc/uid/TP40001067-CH274-SW1", "description": "Apple. (2015, September 16). Cocoa Application Layer. Retrieved June 25, 2020.", "source_name": "MACOS Cocoa" }, { "url": "https://developer.apple.com/documentation/foundation", "description": "Apple. (n.d.). Foundation. Retrieved July 1, 2020.", "source_name": "macOS Foundation" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d201d4cc-214d-4a74-a1ba-b3fa09fd4591", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1055.009", "url": "https://attack.mitre.org/techniques/T1055/009" }, { "url": "http://hick.org/code/skape/papers/needle.txt", "description": "skape. (2003, January 19). Linux x86 run-time process manipulation. Retrieved December 20, 2017.", "source_name": "Uninformed Needle" }, { "source_name": "GDS Linux Injection", "url": "https://blog.gdssecurity.com/labs/2017/9/5/linux-based-inter-process-code-injection-without-ptrace2.html", "description": "McNamara, R. (2017, September 5). Linux Based Inter-Process Code Injection Without Ptrace(2). Retrieved February 21, 2020." }, { "source_name": "DD Man", "url": "http://man7.org/linux/man-pages/man1/dd.1.html", "description": "Kerrisk, M. (2020, February 2). DD(1) User Commands. Retrieved February 21, 2020." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Proc Memory", "description": "Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Proc memory injection is a method of executing arbitrary code in the address space of a separate live process. \n\nProc memory injection involves enumerating the memory of a process via the /proc filesystem (/proc/[pid]) then crafting a return-oriented programming (ROP) payload with available gadgets/instructions. Each running process has its own directory, which includes memory mappings. Proc memory injection is commonly performed by overwriting the target processes’ stack using memory mappings provided by the /proc filesystem. This information can be used to enumerate offsets (including the stack) and gadgets (or instructions within the program that can be used to build a malicious payload) otherwise hidden by process memory protections such as address space layout randomization (ASLR). Once enumerated, the target processes’ memory map within /proc/[pid]/maps can be overwritten using dd.(Citation: Uninformed Needle)(Citation: GDS Linux Injection)(Citation: DD Man) \n\nOther techniques such as [Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) may be used to populate a target process with more available gadgets. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), proc memory injection may target child processes (such as a backgrounded copy of sleep).(Citation: GDS Linux Injection) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via proc memory injection may also evade detection from security products since the execution is masked under a legitimate process. ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" }, { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ], "x_mitre_defense_bypassed": [ "Application control", "Anti-virus" ], "x_mitre_data_sources": [ "File: File Modification" ], "x_mitre_detection": "File system monitoring can determine if /proc files are being modified. Users should not have permission to modify these in most cases. \n\nAnalyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. ", "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_platforms": [ "Linux" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "name": "System Checks", "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "2.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" }, { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_defense_bypassed": [ "Static File Analysis", "Signature-based detection", "Host forensic analysis", "Anti-virus" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": true, "description": "Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)\n\nSpecific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. \n\nChecks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. \n\nOther common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. \n \nHardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_contributors": [ "Deloitte Threat Library Team" ], "x_mitre_detection": "Virtualization/sandbox related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1497/001", "external_id": "T1497.001", "source_name": "mitre-attack" }, { "url": "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc", "description": "Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021.", "source_name": "Deloitte Environment Awareness" }, { "url": "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/", "description": "Roccia, T. (2017, January 19). Stopping Malware With a Fake Virtual Machine. Retrieved April 17, 2019.", "source_name": "McAfee Virtual Jan 2017" }, { "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/", "description": "Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.", "source_name": "Unit 42 OilRig Sept 2018" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "File and Directory Discovery", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1083", "external_id": "T1083", "source_name": "mitre-attack" }, { "url": "https://capec.mitre.org/data/definitions/127.html", "external_id": "CAPEC-127", "source_name": "capec" }, { "url": "https://capec.mitre.org/data/definitions/497.html", "external_id": "CAPEC-497", "source_name": "capec" }, { "source_name": "Windows Commands JPCERT", "description": "Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.", "url": "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html" } ], "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "1.3", "x_mitre_system_requirements": [ "Some folders may require Administrator, SYSTEM or specific user depending on permission levels and access controls" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": false, "x_mitre_permissions_required": [ "User", "Administrator", "SYSTEM" ], "description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106).", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "System Information Discovery", "x_mitre_data_sources": [ "Instance: Instance Metadata", "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "2.3", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_platforms": [ "Windows", "IaaS", "Linux", "macOS" ], "x_mitre_is_subtechnique": false, "x_mitre_permissions_required": [ "User" ], "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nTools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)\n\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)", "x_mitre_contributors": [ "Maril Vernon @shewhohacks", "Praetorian" ], "x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nIn cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be useful due to benign use during normal operations.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1082", "external_id": "T1082", "source_name": "mitre-attack" }, { "url": "https://capec.mitre.org/data/definitions/312.html", "external_id": "CAPEC-312", "source_name": "capec" }, { "url": "https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/", "description": "Phile Stokes. (2018, September 20). On the Trail of OSX.FairyTale | Adware Playing at Malware. Retrieved August 24, 2021.", "source_name": "OSX.FairyTale" }, { "url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/", "description": "Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.", "source_name": "20 macOS Common Tools and Techniques" }, { "url": "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html", "description": "Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.", "source_name": "Amazon Describe Instance" }, { "url": "https://cloud.google.com/compute/docs/reference/rest/v1/instances", "description": "Google. (n.d.). Rest Resource: instance. Retrieved March 3, 2020.", "source_name": "Google Instances Resource" }, { "source_name": "Microsoft Virutal Machine API", "description": "Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved October 8, 2019.", "url": "https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--707399d6-ab3e-4963-9315-d9d3818cd6a0", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "System Network Configuration Discovery", "x_mitre_data_sources": [ "Process: Process Creation", "Script: Script Execution", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "1.3", "x_mitre_permissions_required": [ "User" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": false, "description": "Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).\n\nAdversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next. ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1016", "external_id": "T1016", "source_name": "mitre-attack" }, { "url": "https://capec.mitre.org/data/definitions/309.html", "external_id": "CAPEC-309", "source_name": "capec" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f3c544dc-673c-4ef3-accb-53229f1ae077", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "System Time Discovery", "description": "An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. (Citation: MSDN System Time) (Citation: Technet Windows Time Service)\n\nSystem time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. (Citation: Technet Windows Time Service)\n\nThis information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) (Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. [System Location Discovery](https://attack.mitre.org/techniques/T1614)). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1124", "url": "https://attack.mitre.org/techniques/T1124" }, { "external_id": "CAPEC-295", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/295.html" }, { "url": "https://msdn.microsoft.com/ms724961.aspx", "description": "Microsoft. (n.d.). System Time. Retrieved November 25, 2016.", "source_name": "MSDN System Time" }, { "url": "https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-time-service-tools-and-settings", "description": "Mathers, B. (2016, September 30). Windows Time Service Tools and Settings. Retrieved November 25, 2016.", "source_name": "Technet Windows Time Service" }, { "url": "https://www.rsaconference.com/writable/presentations/file_upload/ht-209_rivner_schwartz.pdf", "description": "Rivner, U., Schwartz, E. (2012). They’re Inside… Now What?. Retrieved November 25, 2016.", "source_name": "RSA EU12 They're Inside" }, { "source_name": "AnyRun TimeBomb", "url": "https://any.run/cybersecurity-blog/time-bombs-malware-with-delayed-execution/", "description": "Malicious History. (2020, September 17). Time Bombs: Malware With Delayed Execution. Retrieved April 22, 2021." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_contributors": [ "FIRST.ORG's Cyber Threat Intelligence SIG" ], "x_mitre_is_subtechnique": false, "x_mitre_platforms": [ "Windows" ], "x_mitre_permissions_required": [ "User" ], "x_mitre_detection": "Command-line interface monitoring may be useful to detect instances of net.exe or other command-line utilities being used to gather system time or time zone. Methods of detecting API use for gathering this information are likely less useful due to how often they may be used by legitimate software.", "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "1.2", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Web Protocols", "description": "Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as HTTP and HTTPS that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)\n\nMonitor for web traffic to/from known-bad or suspicious domains. ", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Traffic Content" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1095", "url": "https://attack.mitre.org/techniques/T1095" }, { "url": "http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29", "description": "Wikipedia. (n.d.). List of network protocols (OSI model). Retrieved December 4, 2014.", "source_name": "Wikipedia OSI" }, { "source_name": "Cisco Synful Knock Evolution", "url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices", "description": "Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020." }, { "url": "http://support.microsoft.com/KB/170292", "description": "Microsoft. (n.d.). Internet Control Message Protocol (ICMP) Basics. Retrieved December 1, 2014.", "source_name": "Microsoft ICMP" }, { "source_name": "Cisco Blog Legacy Device Attacks", "url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954", "description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020." }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "description": "Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).\n\nICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution)\n Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.", "name": "Non-Application Layer Protocol", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_mitre_version": "2.1", "x_mitre_contributors": [ "Ryan Becwar" ], "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Traffic Content" ], "x_mitre_detection": "Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network.(Citation: Cisco Blog Legacy Device Attacks)\n\nAnalyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2) \n\nMonitor and investigate API calls to functions associated with enabling and/or utilizing alternative communication channels.", "x_mitre_network_requirements": true, "x_mitre_platforms": [ "Windows", "Linux", "macOS", "Network" ], "x_mitre_is_subtechnique": false, "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b8902400-e6c5-4ba2-95aa-2d35b442b118", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1573", "url": "https://attack.mitre.org/techniques/T1573" }, { "url": "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840", "description": "Butler, M. (2013, November). Finding Hidden Threats by Decrypting SSL. Retrieved April 5, 2016.", "source_name": "SANS Decrypting SSL" }, { "url": "https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html", "description": "Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved April 5, 2016.", "source_name": "SEI SSL Inspection Risks" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Encrypted Channel", "description": "Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": false, "x_mitre_detection": "SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.(Citation: SANS Decrypting SSL) SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation.(Citation: SEI SSL Inspection Risks)\n\nIn general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Content" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "report", "spec_version": "2.1", "id": "report--d1403123-7477-4657-9ee5-77fa36f4d370", "created": "2022-03-25T00:00:00.000Z", "modified": "2022-03-25T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Malware Analysis Report: Busy Buzzard", "description": "A plugin-based Windows remote access tool. Busy Buzzard is deployed as an RC4-encrypted Windows DLL, with a shellcode stub to decrypt and load it into memory. Command and control (C2) communication is either sent over HTTPS with RC4 encryption and Base64 encoding of tasking or sent directly over raw TCP with RC4 encryption of tasking. The malware provides the capability to load and execute shellcode or Windows DLL plugins.", "published": "2022-03-25T00:00:00Z", "external_references": [ { "source_name": "NCSC", "external_id": "NCSC/MAR/Busy-Buzzard" } ], "report_types": [ "malware" ], "object_refs": [ "malware--219357af-b2d8-4d88-8141-840bf4c7ed91", "attack-pattern--074a2ea5-a746-4bc2-9fd7-dd8853066817", "relationship--b5f40fa4-6755-4632-9882-d3e8008f82b7", "relationship--01733bcc-8fce-4188-ba75-70a34cbfe22d", "attack-pattern--8a15e062-877a-41a2-acc0-15e23f725e3e", "relationship--b5008e49-7e1d-44bc-bc2f-643bbf7fbade", "relationship--e986d895-3902-48f7-a405-b21ee9c9a669", "attack-pattern--edcfcf53-1cfa-44ca-90eb-c67656bf31c2", "relationship--df79ba47-df51-4818-b46d-cdbbda6eec99", "relationship--c82ffaf6-de81-4426-86ce-09ea55f6e141", "attack-pattern--1e3118fe-f00c-4351-849f-81f6f92e1007", "relationship--c8920dbf-17ec-443e-9fbe-477b91a5c640", "relationship--b8aaefb2-4cc8-472d-8b05-a9e43f48e74d", "attack-pattern--a34df58c-a83a-482b-adc0-5b1cb3f6824a", "relationship--363f72cf-ae77-4ec1-b9f4-49c46d1b653c", "relationship--c28d4592-8c8a-47b9-8ba4-ce504189f395", "attack-pattern--a4ad54dd-c927-42ef-848f-2f6c1031bac4", "relationship--bf517389-18df-4903-a276-df3721968cc1", "relationship--2a46a38c-c227-4ba5-9713-6aa2a0c17300", "attack-pattern--fe929bf5-13a4-4f7c-b576-5404147ffc70", "relationship--d6c2e66a-2e93-4594-b550-785fbee79b10", "relationship--81a15411-6571-45b8-875b-84ab82c1b0da", "attack-pattern--88a6761e-32d4-45d4-97da-0a6853af25c5", "relationship--f5591375-c0e2-4b88-bd89-18d5e8ecab0b", "relationship--02d137d9-81eb-4975-867a-01a27b25ee95", "attack-pattern--d0b11c53-1969-44a2-81bd-292d8fb17bb7", "relationship--b4ff5032-f787-459a-a38d-958faa0cebb6", "relationship--5d77aeee-bcf4-433e-a080-fd9d202012f2", "attack-pattern--5ddc3e85-6f73-4c49-b6d9-a2dd42c4405e", "relationship--95135466-276d-4729-b4c6-7d7dbb8ccc47", "relationship--d9a38b4f-63a9-4e38-9d5c-fa3314ae4a2f", "attack-pattern--d6c465d2-153d-40b8-8c58-4f9e6782eb1c", "relationship--be5851df-532f-4d12-a01f-34c55559d9fe", "relationship--2e770af9-b11c-4da6-ab1e-e6e02d71a644", "relationship--89bb26f4-a359-4b00-9a44-2a865a08ecf7", "relationship--edc526c7-c7c0-4dcc-bb6e-436e105ca59c", "relationship--805e45bb-5c23-46d4-82e3-d17b79d699d2", "relationship--294f4c68-a281-468a-b254-0c3f9fa05cd4", "relationship--b81753e7-d8fc-46b8-a3be-5444cc55095d", "relationship--3ac8d626-78b2-4128-886e-56af9c479b55", "relationship--35e0357c-a1e6-4b8b-bc65-59809ed3cd33", "relationship--f6dd5e2d-b739-41d0-aba8-a9fbd668666f", "relationship--108c50cb-10ef-4a4f-8bfa-b55947d60db5", "relationship--f12b58b7-4b0b-4bf8-8f6e-7015e8b80fd1", "relationship--9fdcec7d-2a13-4958-ade5-f84876be8024", "relationship--83ff43a8-bfbc-445f-bcd1-a3dc63c74d35", "relationship--d2c112f1-9f70-4e51-b500-78750b58398f", "relationship--529deb5a-aa6f-4280-a9d6-c075ebf515fa", "relationship--31f6c434-8870-4d95-8dfa-c1f9f1284312", "relationship--e94a94dd-4203-43e8-a20c-de223a443cb9", "relationship--14b8c02d-056e-440e-b7a8-6ce12b2985a3", "relationship--202447a1-f24b-4d56-b9b0-b359468eb78b", "relationship--7ccedce4-6f73-40cf-873b-df9d8f555b5b", "relationship--b5616b3e-685c-4550-8f62-947e3c945d23", "relationship--2f456858-6170-453b-bbc0-bbb09b4540b5", "relationship--93ad5bce-8254-4239-a7d8-93eed047b7c3", "relationship--bfa68883-ec3b-4aca-ac84-c51589d41906", "relationship--5f92ef79-93ae-45db-978e-570379d698d8", "relationship--fb13f970-1428-441f-8390-74905580c4e9", "relationship--0877651b-b8a5-414a-891c-bc9e41c0eed8", "relationship--aafc0e99-5973-4739-b124-e0ff6f5ade34", "relationship--acc5beb9-4786-4a61-945e-484ae9333819", "relationship--a1e17fb4-698f-402b-9c1c-c9f34d7af7ab", "relationship--9bd4451b-58ae-4bea-8b81-d550b34e6341", "relationship--d2ff7650-b0ae-4ce2-9374-0f6325f22470", "relationship--44a4ef45-b9dd-4177-9abc-b86f72626865", "relationship--099271d0-97cf-4f1d-82da-58269a7ef6ce", "relationship--ba696afb-7796-48fd-9f4a-a8f7e7dcee23", "relationship--53df7c38-c002-4430-bb42-afb17911f4ba", "relationship--6aef9595-48b0-49fa-8bbf-108ffbe3cfee", "relationship--7ed294b0-9544-4461-b253-7512304db37b", "relationship--4069a0a1-4370-4b58-8f56-568ead7a3d49", "relationship--5132dd39-00fb-451a-b7d6-a317b36b448c", "relationship--6e85b14b-d8af-497c-9e42-4260437931f3", "relationship--0d553233-7334-4366-922a-b8a5ffdaf69a", "relationship--69dc0b76-2b02-4039-b75e-00c3b295a5f5", "relationship--3bb2a1e7-6d25-4f78-b737-4f68ee54d0a4", "relationship--b9df7b80-1086-424c-95b3-a81f11d7ebea", "relationship--be34a197-0861-45f1-be90-4e1a9fe13691", "relationship--a3124d52-2cc2-44db-ade0-bad3c7167fd8", "relationship--5b920ec2-14f8-497f-8dbb-c43c1c751b1e", "relationship--10d082f7-98cb-4b7b-a0dd-cddcf6ab5a3c", "indicator--7fc265d4-95b8-4a11-9ba5-d7ba4d95c286", "relationship--4d754b27-3c85-43c6-96a8-ff540ace7aa6", "indicator--a2684e41-587e-4e8b-a1e0-576a6f249823", "relationship--cf8c1de3-ed96-4ca6-8487-c90ecebe1886", "indicator--efd5cbe8-2a40-4d4a-a0da-1097e0a71705", "relationship--454c1a9d-5116-4506-8819-6d5f58fd69f9", "indicator--6a2cb23f-9ad2-4838-b3c3-4a64385a59de", "relationship--5ba8d6f0-a2ed-4cd4-a9fe-3071db768405", "indicator--9da79ab3-fb8e-4acc-bd28-7cc80307eb1f", "relationship--0fbfa17f-73bf-4f24-abd1-a3ae4e3c0664", "indicator--62b54e67-569f-4c72-9fd5-7f1145bb7be5", "relationship--291a899a-dd78-4885-b25f-f6adb50ce890", "indicator--463bb2dd-3242-430e-85f0-b193f3b0e9db", "relationship--32151297-d414-4b4e-a6d8-d8ff66e8c40d", "indicator--5892e326-e8b6-4e50-b8c8-b0f330d03573", "relationship--eaac3146-7daf-4d3a-a136-03ec182db915", "indicator--7c3af8ad-d7d2-46de-9f35-c03aec52734b", "relationship--1852e01e-d464-459e-94e9-0863cf908348", "indicator--d2e9a9c6-1eab-49c7-aeb4-4c59a2f3d5c4", "relationship--4890911f-77e3-43fb-bf81-b5e1fd301ccc", "indicator--72eee5d1-ad56-4ca4-8903-b4f3d1b5526b", "relationship--6b73170e-4f17-4e88-a0c8-284a7d775de9", "indicator--7c066000-76e8-44ef-8fce-80c93e276d8e", "relationship--0f855800-7b4e-412d-b477-e31ca421dc74", "indicator--9de06d15-878c-4865-8b5a-f3a1ca095be4", "relationship--24d8deed-5f52-47e5-a3f8-199159f5862e", "indicator--13142f32-8876-4585-bd63-456ee83d6382", "relationship--5454f21c-5ba0-41e4-b344-9884f7610773", "indicator--a9cd3315-9a6c-48aa-9578-8f436f2d2cc3", "relationship--b9521258-29eb-4e69-934f-12549222991e", "indicator--39f0766c-5cfc-426f-8407-f9371b81856f", "relationship--d0f71fcb-93aa-4369-a980-bfbc4409a82c", "indicator--de02fbcd-f866-4f13-8aef-fb627e0280bd", "relationship--57b03155-b34b-4131-892e-51e66f162110", "indicator--48ef2e01-da5f-44d8-868b-df6be4c88fe5", "relationship--f6c0bf0b-2e73-4ae2-9a9c-4db58552cb40", "indicator--42b99eb3-89f3-477a-b6df-3b3b01de53b7", "relationship--c4029cb6-01a2-42db-97ba-c4d10e99cfdb", "indicator--addadd5e-bf78-4843-a8f4-133896c43666", "relationship--bb613cdf-20a7-4411-a1e1-92d58de10e6d", "indicator--3aaa763b-352c-4e70-ba58-5da031b49ac2", "relationship--c17be231-7ee4-48f4-a443-27271c493da5", "indicator--f07a863c-c053-4b8f-93a9-596b62078f05", "relationship--9ef06e3b-5cec-4852-8994-fcc6296f10db", "indicator--8899a809-e680-4b49-a434-b5fd68d044b1", "relationship--9cf1fab9-bfbb-43a3-afd1-d4615888e163", "indicator--1e4f95eb-f588-407e-acc8-3a777801feba", "relationship--91b321a8-a0a2-4f33-a9cc-e7e8f4dcf4f4", "indicator--fe4f939f-355f-4503-95b4-e8f08ec5d9c3", "relationship--6a8c6e96-eadc-4a95-8318-28b1a75fcb54", "relationship--9c731664-2d6f-4671-bbf5-f6b968bbc065", "relationship--5b426302-1b82-46cd-8738-fad759c9c820", "relationship--a0cafd7f-b827-444a-8f89-4435f8fd3f5e", "relationship--163d4df8-cb14-4d40-b2d5-ea17db9558bd", "relationship--d54355f1-f976-4df6-8bb1-fe424ff145ed", "relationship--ee4884ed-03f7-49a9-8a4a-ea379888e0e4", "relationship--1eba4394-13cf-4f78-b2e2-ec20040fb326", "relationship--e7807bf3-f106-4a70-9739-853c3de013b5", "relationship--7a3fe3f4-f8dd-4be9-a7b5-478cec906348", "relationship--8e7f7131-79b1-408a-b14e-595f11b14efe", "relationship--00d1343d-31fa-4a50-9059-096b10f8a674", "relationship--4f91d2d2-0b48-44fb-ae1f-c4b530091dcf", "relationship--62d3c4a6-70f5-4d44-9138-d0027ce853d9", "relationship--6e111459-1d0a-4943-8fb2-2e84daecdb88", "relationship--26b3aeba-75c2-4845-9af0-f096e5dc3aff", "relationship--061b513d-d666-4572-a914-aaf94820b354", "relationship--34409221-c08d-4677-94c3-0ca4b69c8801", "relationship--71109a28-0c9b-4d41-84f5-5085603f6ca4", "indicator--1f184d6b-b859-4e56-aaa6-f5965c28aa69", "relationship--df318e7d-adfd-4941-a86b-557963b25a2a", "relationship--5ebe906f-4f02-4abd-8fc4-96b48014d1cf", "relationship--db80f563-e17e-45d5-a1a9-2ee259b0e1a5", "relationship--69c34b56-0585-45a1-b9b6-0f072d1a205d", "relationship--9dcd8155-398d-4058-8762-411507af9296", "relationship--eb9804fc-0073-4be2-b86a-35ed70402493", "relationship--aeb59e97-91b4-478c-97d0-14b5d3413284", "relationship--e8985e16-1ab0-4ef7-b8d1-e3758b65d7a9", "relationship--21b4c75e-6a08-4a0b-a3df-28d7b368c108", "relationship--44334344-7a58-48ec-a8cb-5963ad8f8b5b", "indicator--bedf6fc9-a6cc-4622-9774-f6ea548bc4a5", "relationship--1bdf2d8e-eed8-4b33-84ca-d7fadf3ed454", "relationship--18e70cb1-29d0-4fc9-bb12-6ea5c078250f", "relationship--5256f33f-4a8b-4fad-86d5-4fba81166748", "relationship--6b95853d-3396-48de-8d3d-6cc4af6b95df", "relationship--f9a49907-d6db-4f8b-b78a-dbf03ba6e767", "relationship--47183a09-3775-44d4-a51d-7f370ce6f458", "relationship--9bbf57e2-9a5d-4af4-9eef-c5be0fea3369", "relationship--bc54b0a3-38e2-4f6c-994f-ba2985e1c1de", "relationship--41ad3357-308d-414c-b4be-551ba81f70cf", "relationship--29058fe2-80eb-46cc-8fb5-19bb88535e58", "relationship--a23ae13f-0459-4c8c-aa84-eab92f7aa4ab", "relationship--8dfe68c5-f3d8-413a-9dfd-65c4c8df06a4", "relationship--d6083247-404b-422b-bcf2-310f3bb0b757", "relationship--7eb3bfb1-a231-4f2a-b706-d7974112bc37", "relationship--779b0d65-a0cd-452f-9722-57eea899dde1", "relationship--c7ccf755-056e-430f-bb04-8d2c94f4e50e", "indicator--44532b5c-5905-458b-9d07-e37204ba1f4a", "relationship--2c87a8b9-1922-4403-86cf-203cefe71cd8", "relationship--9cd0bf12-156c-469a-8300-c3cd36db5ebb", "relationship--6afe4f8b-8a3f-4169-a0e2-4474a175c5de", "relationship--e0b43089-e6ea-48d9-a77c-ec45d460adf4", "relationship--6db867d4-bddb-44a8-90ac-5e134bc55788", "relationship--58e03659-c606-4f2c-9a6c-69568381166e", "relationship--4bebc3ff-af47-42ea-89a9-e69334b06999", "relationship--ee2d7e43-256a-4b2e-a8ea-6b72979eed5e", "relationship--70a51dc3-45e4-4bf9-9468-1e9a6c5abe66", "relationship--b28ccae6-4937-4411-b877-be780ea33700", "relationship--929e4e64-269d-4502-9bdb-41a225f2269c", "relationship--0eb3ff90-70e9-441d-8b8a-50edb09302fe", "relationship--a93b3f3b-9845-4414-a52c-b0f16dcebe71", "relationship--629c92f7-5edd-4592-aac2-b73191733918", "relationship--a572f2c8-3f7d-4798-a2b5-5a0be8017885", "relationship--ed73e469-94e3-401b-bc3f-eaad1aa1410c", "relationship--42ad486e-348f-4bce-bdcc-a09dabf2eb75", "relationship--30d0f1f4-9985-453b-a334-8e1d9d915833", "relationship--5e1db025-7652-45e4-b30c-b824af756bf2", "indicator--43a16033-2665-4d5a-8728-827609e0827d", "relationship--744a25f2-00cb-4d4f-acb0-e1d50ed08343", "relationship--0c5f884a-926e-4c1f-9179-8e9184882c8e", "relationship--2950c448-433c-4748-80eb-723acd0b4c40", "relationship--1ef688b1-e444-4d1c-a575-c8c1329aa1b2", "relationship--588b82a7-a460-4ec0-9062-eb90fa5fdab7", "relationship--64d3680d-d69f-4e0f-a2ec-4c37e8f4c7ac", "relationship--a316a36e-5b14-464b-a7e7-ba4b3d8bf1ac", "relationship--e54d4b4c-89af-4edb-9198-5af74a1ef2fc", "relationship--be627f36-257e-40b8-a9ea-dec78b86363f", "relationship--0f7246fd-bd12-4a92-b9da-ed26fc2daaa7", "indicator--bca2f1a7-10ef-490e-ae7c-6712e0c6747a", "relationship--0023e79c-cf61-4846-bf52-9af1909020b9", "relationship--e6717c89-aae6-4d91-a109-c05b8ed06757", "relationship--5c68ae0f-8141-4745-8bdf-50eaeabe8295", "relationship--edc0377b-4806-40a9-80c3-02c0acdd412f", "relationship--65aaeba0-3f3d-411e-899d-63eac1efe112", "relationship--89abe5a3-b34e-4625-b0e4-ad4229c78115", "relationship--bb962bc6-0f98-4896-9e38-bc22c4e1be87", "indicator--d1cdcf17-5d5c-433e-94b6-0132cd306c2f", "relationship--5b34cedf-1f69-464d-9036-0d8009bd8425", "relationship--41e79adc-5cd9-4a46-95d7-5592d7eea2ee", "relationship--295131e7-09ec-4b4d-b62d-9058f1d015ca", "relationship--0f2343d9-0d5e-453e-8167-f2b2f75e31de", "relationship--c8085b13-0608-48cf-90be-19290ae7e539", "relationship--d3e0cfa8-bf59-41a8-aec6-d5fbb01b366f", "relationship--19633280-92a9-4619-844c-a0d15422df03", "indicator--89e83091-efd6-4478-ad19-d364dd3cd5b6", "relationship--178a3734-89da-4c45-9239-3b5b2f073e03", "relationship--eea589d6-5220-4930-b4c1-d4d3cb948ed4", "relationship--795a5783-0baf-4ceb-b27f-9d375c8c779e", "relationship--24314b97-5ade-45ec-a554-3f8c4aab60c1", "relationship--8f49362d-bcc5-4a60-947c-4c4a6e2882c3", "relationship--9d5f5df9-46a7-4df3-8769-021acd0873b7", "relationship--b2950129-beb3-4aa3-86d6-4b96e6d2a171", "relationship--2af77212-9ca2-45e5-b4bf-e44969b86aac", "relationship--382b81c1-c970-4622-81fd-9e8e9a42cb46", "relationship--1b505a87-5a99-42d6-9da6-9ee8bd71ba49", "relationship--0f89fcef-556c-4570-a168-e434e8c277bf", "relationship--e84c75f0-86d1-492f-bc89-ae46e70696bc", "relationship--764cd961-404c-4df7-b0b9-391eeddb8d47", "relationship--d19d3b68-8fdd-4250-ba0d-d21de8db21c1", "relationship--3f36ba82-301b-47d4-884a-e88e975ba9f0", "relationship--d192c3e2-6713-4b78-a268-fd9cc3d21f53", "relationship--9849491e-928b-4257-901e-dd996ee81caa", "relationship--d12f6e6f-eacd-40d0-9bfb-4498b596c779", "relationship--81058a78-a919-454a-b6c7-8238ee8b83d6", "indicator--3c7d7557-92c0-46a5-aab5-c88b4dd88ca7", "relationship--89303a39-43c2-4504-b30f-fc6189bd4a07", "relationship--795653e8-860e-4ed5-ba19-5276eb5b7607", "relationship--6ba7f57a-bf0d-4118-ae58-7ee63a485a41", "relationship--e366d769-1412-4898-a4ef-f0838e334047", "relationship--283029d5-b905-4d73-8561-5ec8e874e801", "relationship--39e216ab-a381-40a0-bfb8-2ef6b508fa2f", "relationship--b72d9704-0714-4710-a056-1dfc54a4d031", "relationship--b7a58c72-0076-4163-93c9-7ee381faefba", "relationship--9e40a0a2-7491-48bb-8fbc-e7662cfae6ce", "relationship--d0947563-0e1d-4197-b0b9-2ef496c0f85d", "indicator--4405f2db-95b4-4093-af37-615e29fefbdd", "relationship--bf2d6e70-0d09-4a0e-87e7-53322d15e435", "relationship--e63bd7dc-7593-4b00-bccd-11a76af00f2e", "relationship--86a85eb7-60e7-417d-a4bc-86dd5a5fa276", "relationship--71776180-7619-46dd-9dee-c06048c259f0", "relationship--d1732061-c8f9-4f66-966d-323894e71836", "relationship--0413f629-0efd-4306-942f-75d7ce00f6d8", "relationship--dc16ef8a-b05b-4218-b5de-24d35bc29501", "relationship--37a59a9c-db7d-4bba-bf2c-b55426790e4e", "relationship--ebe91ad1-f268-480d-a4f9-e85b53c8c2e3", "relationship--ee2217f7-1c12-44ee-b8d8-12ab12ebaaa7", "relationship--84e1c819-8db3-43c3-8cfd-9b6ea814540d", "indicator--794f69b0-c2f1-4679-9bc0-abe135af41c7", "relationship--a6ebab7e-f9d7-4a46-a010-d33ca9d3de79", "relationship--eef4fc5c-6078-411c-81db-d77513e47f5b", "relationship--0c89309d-98b4-49e4-8cf6-56c6423c7677", "relationship--4d665fe7-52c1-4e51-9675-770edbe406b9", "relationship--d7d1777f-e288-4b1a-86af-900329b30dd8", "relationship--aad34fd8-5908-4244-b703-901175f0f4bb", "relationship--1f6c4388-2e23-4309-ab12-000ab5ac60d0", "relationship--577a712d-62aa-4c73-9dc2-c3865d0f67aa", "indicator--74fdd642-1f6e-435d-98c7-9fde0f52c27e", "relationship--9a240bee-9d49-4b73-81df-98a59378db09", "relationship--e4a9b138-3b54-4521-8587-04a89f2a5a80", "relationship--ffea1c37-8f52-493a-925d-920f2c0bbe8f", "relationship--7273221d-67bc-4eeb-8ae1-dcc4a6d37999", "relationship--4e7cfee0-8cb2-4bd9-b77d-e328f9f0d046", "indicator--f4af436e-4020-42eb-98f9-b2b3ce26eff6", "relationship--b332d0a6-3e17-4a04-b947-197411c65593", "relationship--ad487278-8168-4e21-b5e5-cf476c1e8955", "relationship--79a00ea8-587c-4a59-9ff4-720dcbbdf85d", "relationship--7d53366a-9287-40ee-b97d-53eeed16bfd2", "relationship--b21f36b2-526c-4868-9b3b-9dc0c94f0120", "relationship--8a323342-067d-49a3-853a-fcd3c12b364f", "relationship--07123dcd-1713-4341-b4f7-b7dee1eedf48", "relationship--88c34d27-4a07-406c-bc96-88c3c6840fd1", "relationship--5817bd6c-1473-4caf-be32-f9f8f65139c9", "relationship--6deb48ff-4f60-41bf-a80b-d73269a5c182", "relationship--548169cb-c32d-43db-8731-ac030294876c", "indicator--44f7cf4c-8c41-489a-ad6f-d49d0a273e0d", "relationship--8d51e683-3bf3-4419-9268-f8e1af1a4a38", "relationship--67a57f9b-76ab-4c07-92b0-3dedafaf94b8", "relationship--94482097-b05c-462e-98b9-c58c2364f4b5", "relationship--e06f1c77-9ab7-4090-b0c9-6d37a6335475", "relationship--b75f0548-78bc-4ad6-a111-e983189446d5", "relationship--3462eaa6-7bc2-4b4e-aa3a-0fe7820dd31a", "relationship--45d4e479-ec8e-47d2-a772-b16100cca193", "relationship--3e540978-631d-45de-ad24-da18d629687b", "indicator--238d090f-db94-4b98-bc81-20815930663d", "relationship--34912968-ccf1-407a-a9fd-bae79dc60b95", "relationship--f32f27cd-6533-4c02-94f2-a2bc45f422b1", "relationship--6d7e073a-ad05-4ff8-8c93-74bb3d8e6dce", "relationship--0fc10381-68ad-46ad-a817-0b0ee5c3a254", "relationship--72fe8881-0d1f-4c76-89ea-1e44d2d0291d", "relationship--6084125c-9e21-44f8-8181-8bf60db61fbd", "relationship--9bb286f8-567d-4b40-9123-7ab6ea5bc549", "indicator--78adcb14-b181-4a17-aa87-b95586175a22", "relationship--cb04bce6-e0d7-4b73-838f-be6bafa48668", "relationship--c707765c-7b07-4a93-95cc-350692bfb691", "relationship--89f685d6-98a7-4de3-a1d4-a7662e956492", "relationship--ee7e7b1e-1870-4058-9930-ec50432bef7c" ], "x_version": "1.0" } ] }