{ "type": "bundle", "spec_version": "2.1", "id": "bundle--fb747822-c5fa-44a6-89bb-e4731a4598b3", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "objects": [ { "type": "malware", "spec_version": "2.1", "id": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Cheeky Chipmunk ", "description": "Cheeky Chipmunk is a malicious Microsoft Windows Remote Procedure Call (RPC) server, installed via a PowerShell loader. Command and control (C2) is performed using a separate standalone executable RPC client. The loader implements an Antimalware Scanning Interface (AMSI) avoidance technique and is protected using layered obfuscation, encryption and compression. Functionality includes execution of shell commands and upload/download of files. The RPC connection is set up using named pipes, for which numerous names have been observed across multiple versions of Cheeky Chipmunk. Cheeky Chipmunk is added as a Windows service to maintain persistence.", "malware_types": [ "trojan" ], "is_family": false, "capabilities": [ "accesses-remote-machines", "cleans-traces-of-infection", "hides-artifacts", "evades-av", "persists-after-system-reboot" ], "architecture_execution_envs": [ "x86-64", "x86" ], "implementation_languages": [ "powershell", ".net", "x86-32", "x86-64" ], "x_operating_systems": [ "windows" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--270195a4-4f55-4859-bcf3-f6dc2a013782", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Create or Modify System Process: Windows Service as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ], "description": "Cheeky Chipmunk maintains persistence by adding a new Windows service (pnrssp) for the RPC server component." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ac696d89-2052-48d3-9527-a94debe2ddaa", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--270195a4-4f55-4859-bcf3-f6dc2a013782", "target_ref": "attack-pattern--2959d63f-73fd-46a1-abd2-109d7dcede32" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4b781517-7593-4b18-a0c5-b7c302dbb5e9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--270195a4-4f55-4859-bcf3-f6dc2a013782" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d76aa900-81f0-4783-920a-68921d867f12", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Command and Scripting Interpreter: PowerShell as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "Open-source PowerShell runner code is embedded in the Cheeky Chipmunk RPC server and used to invoke commands stored in the registry." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--550531b8-2255-40c3-b84c-dc5254697b85", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--d76aa900-81f0-4783-920a-68921d867f12", "target_ref": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d4f3f59c-0b18-4698-970e-dea2bb4e7b2f", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--d76aa900-81f0-4783-920a-68921d867f12" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--022672ee-c1c2-49f3-be76-76ac7e2253ff", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Command and Scripting Interpreter: Windows Command Shell as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "The Cheeky Chipmunk RPC server can be sent Windows shell commands by the RPC client." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ba862479-c0c5-4286-95a1-88095bf3f518", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--022672ee-c1c2-49f3-be76-76ac7e2253ff", "target_ref": "attack-pattern--d1fcf083-a721-4223-aedf-bf8960798d62" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f9f137b6-79d0-473e-9227-0396c3eeeecd", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--022672ee-c1c2-49f3-be76-76ac7e2253ff" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bd25b4ec-23c0-4d22-905b-a637f5ad68bd", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Inter-Process Communication: Component Object Model as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "The Cheeky Chipmunk RPC server uses COM to call embedded PowerShell runner code." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2177007f-e033-40d6-8cc6-cfa9d927fcb1", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--bd25b4ec-23c0-4d22-905b-a637f5ad68bd", "target_ref": "attack-pattern--2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a06819a2-12ea-434e-9a17-1b917fa921ad", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--bd25b4ec-23c0-4d22-905b-a637f5ad68bd" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Windows Management Instrumentation as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "Cheeky Chipmunk implements an RPC server to receive tasking." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23cac1b2-7361-40ef-9abf-262dc6f2a368", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df", "target_ref": "attack-pattern--01a5a209-b94c-450b-b7f9-946497d91055" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d849a256-1f2c-4715-bca6-7570039073c0", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bb7b0a8a-f148-4744-a86b-9fb1ef2500a9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Deobfuscate/Decode Files or Information as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "The Cheeky Chipmunk loader uses built-in and open-source PowerShell libraries to Base64-decode, 3DES-decrypt, and GZIP-decompress the RPC server." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--12f56b5b-f2f6-44eb-8777-d621356e6cc9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--bb7b0a8a-f148-4744-a86b-9fb1ef2500a9", "target_ref": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cedfceb9-cc88-43c6-9ffa-65290bec2bab", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--bb7b0a8a-f148-4744-a86b-9fb1ef2500a9" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f0f0b205-ed24-4848-84c6-fae720ede8fe", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Indicator Removal on Host: File Deletion as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "The Cheeky Chipmunk loader is deleted from disk once the RPC server is running. " }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--80818e5e-1a09-4cb9-8815-da544b529b8d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--f0f0b205-ed24-4848-84c6-fae720ede8fe", "target_ref": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9b0de9ad-324a-44bd-89ee-b48e9c3a876a", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--f0f0b205-ed24-4848-84c6-fae720ede8fe" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--81726bec-559d-410c-bf9a-e709a951b553", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Indicator Removal on Host: File Deletion as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Cheeky Chipmunk deletes the log file containing details of its RPC server’s execution, following exfiltration." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ca1cb716-42c0-435d-8896-b9d51b50a455", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--81726bec-559d-410c-bf9a-e709a951b553", "target_ref": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--07970ba9-29ef-4699-a6f5-3091637d4773", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--81726bec-559d-410c-bf9a-e709a951b553" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--962931d6-3780-4297-bc30-a3e2966b8f3d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Masquerading: Match Legitimate Name or Location as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Cheeky Chipmunk masquerades as a legitimate Windows service path (netsvcs) to maintain persistence." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5d762a23-c348-44a9-b72a-d301e215d093", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--962931d6-3780-4297-bc30-a3e2966b8f3d", "target_ref": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--59a3fba6-1664-465c-978e-a23d7ea36908", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--962931d6-3780-4297-bc30-a3e2966b8f3d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3221ee44-0cfd-4331-9802-51248fa9b91f", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Masquerading: Match Legitimate Name or Location as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "The Cheeky Chipmunk log file (NTuser.log) is named similarly to a legitimate Windows log file (NTuser.dat.log)." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--62ba7cf8-5b61-4596-8020-8f0bfcbfa36d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--3221ee44-0cfd-4331-9802-51248fa9b91f", "target_ref": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6cd10818-bbc5-4a46-92f7-e34e92aaf00e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--3221ee44-0cfd-4331-9802-51248fa9b91f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f10d2ed9-e3bc-4b6f-ac00-8239b082d2e4", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Masquerading: Match Legitimate Name or Location as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "The Cheeky Chipmunk service (Peer Name Resolution Provider) is named similarly to a legitimate Windows service (Peer Name Resolution Protocol)." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1eeb6b94-fdf6-48d9-909d-72af559d2b3c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--f10d2ed9-e3bc-4b6f-ac00-8239b082d2e4", "target_ref": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f3d81f2a-00f2-4d9a-a69f-0ef40e7c3445", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--f10d2ed9-e3bc-4b6f-ac00-8239b082d2e4" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5257841a-1020-458d-9f90-017aed0d2455", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Obfuscated Files or Information as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Cheeky Chipmunk’s import names are obfuscated by XORing with 0x55." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--80d78343-e376-4ace-95d7-2587504af56a", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--5257841a-1020-458d-9f90-017aed0d2455", "target_ref": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d716c27c-1d36-4720-874c-e69377b0a84c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--5257841a-1020-458d-9f90-017aed0d2455" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8f06552d-61c0-4917-b0da-e9c43ab08d81", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Data from Local System as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "description": "Cheeky Chipmunk can be tasked to collect files." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--85798cf2-c7cc-4651-a641-62f009d78a69", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--8f06552d-61c0-4917-b0da-e9c43ab08d81", "target_ref": "attack-pattern--3c4a2599-71ee-4405-ba1e-0e28414b4bc5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e08ffb3-df22-4b3f-95d4-1df32d49acb1", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--8f06552d-61c0-4917-b0da-e9c43ab08d81" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6703e4e7-b2ab-42fc-96de-011fbf3bb981", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Impair Defenses: Disable or Modify Tools as used by Cheeky Chipmunk ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Cheeky Chipmunk implements an AMSI bypass technique." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--611ec852-ac86-4100-96cc-6c3fe7ee3d4d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--6703e4e7-b2ab-42fc-96de-011fbf3bb981", "target_ref": "attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3dfebc48-5c67-4ff6-a3a2-6d9e1765a0d9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "target_ref": "attack-pattern--6703e4e7-b2ab-42fc-96de-011fbf3bb981" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ccbf60e8-e36e-417e-8040-a39eb6a34b9a", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--353f45f6-3bb0-4598-9428-27193c596e84", "target_ref": "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--94359e87-92b4-40f4-836d-3b8b26a9aad2", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--353f45f6-3bb0-4598-9428-27193c596e84", "target_ref": "indicator--eff13b18-f049-473d-97ef-0c37a00e832c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8c9efafe-3c62-4531-8aa7-52b8ca15f1eb", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--353f45f6-3bb0-4598-9428-27193c596e84", "target_ref": "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f21c67b6-6409-4b4f-9768-ba640e69df1a", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a", "target_ref": "indicator--353f45f6-3bb0-4598-9428-27193c596e84" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c9b2d62f-c903-4888-9894-4662a701ce38", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a", "target_ref": "indicator--eff13b18-f049-473d-97ef-0c37a00e832c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1acc0c3b-ed1f-4967-b7bc-7eeefd0a30e1", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a", "target_ref": "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8f2e9b16-9832-4303-9dd9-8c99d48a91ee", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--eff13b18-f049-473d-97ef-0c37a00e832c", "target_ref": "indicator--353f45f6-3bb0-4598-9428-27193c596e84" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2120aa50-de6f-4098-970a-62c598772763", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--eff13b18-f049-473d-97ef-0c37a00e832c", "target_ref": "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e15652bc-ae6f-4846-a2b5-59c7f0adfd53", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--eff13b18-f049-473d-97ef-0c37a00e832c", "target_ref": "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--533681e4-1a4b-467a-b70e-93b08e373311", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9", "target_ref": "indicator--353f45f6-3bb0-4598-9428-27193c596e84" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5619110e-fca3-4cfb-8372-98ed74043298", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9", "target_ref": "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--548bd717-ae66-4512-9685-d63369dc0350", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9", "target_ref": "indicator--eff13b18-f049-473d-97ef-0c37a00e832c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--44f5dc29-9985-465b-9cbd-6d7d0e71f316", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1e2a0018-d0f6-494b-8d9c-6d7efb8a27e5", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9abebf0e-a597-4964-af60-cf6afcc87e2e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1e2a0018-d0f6-494b-8d9c-6d7efb8a27e5", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--02b230e8-795d-41c9-af4c-512aba4029b6", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1e2a0018-d0f6-494b-8d9c-6d7efb8a27e5", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b0f6283f-6cf3-47fd-8885-7dcef0bb0e64", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da", "target_ref": "indicator--1e2a0018-d0f6-494b-8d9c-6d7efb8a27e5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fad9c23e-8b92-4f5c-a2a9-8a25e5e90cea", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7b5d14d8-3080-4cd6-bde1-3a3a7358fb2e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--26e2be68-35c2-47c3-88f6-a7ab99271aba", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b", "target_ref": "indicator--1e2a0018-d0f6-494b-8d9c-6d7efb8a27e5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--617ce1fa-1e92-48f7-97dc-c0fe029e40fe", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--281fd16b-a65a-46c0-8909-40e2f84bdb63", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--de8ce500-66bb-4fec-a094-ef7d454d7f50", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90", "target_ref": "indicator--1e2a0018-d0f6-494b-8d9c-6d7efb8a27e5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ff412919-4283-41a1-b496-38c76f7979fd", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf87ff77-71a7-4c00-bf45-f44f08edc4b2", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ba3b6d4-18d5-4db9-aa11-06c4bebb858b", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--58a7a31f-c3da-4e01-9f37-0925895151da", "target_ref": "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fbdefd4c-23cd-4452-aece-1ed93efce9ab", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--58a7a31f-c3da-4e01-9f37-0925895151da", "target_ref": "indicator--0962291b-2d0e-4599-8971-53804221ce02" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--19a9ed59-2bfa-4464-b579-8168001399f4", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--58a7a31f-c3da-4e01-9f37-0925895151da", "target_ref": "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e27a5acb-d82c-4df2-8b3f-657387cd223e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b", "target_ref": "indicator--58a7a31f-c3da-4e01-9f37-0925895151da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6dc9c7b4-1e9a-4e03-99ff-1216325182a7", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b", "target_ref": "indicator--0962291b-2d0e-4599-8971-53804221ce02" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--72e003fe-004d-4bcc-8c22-540e739a8962", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b", "target_ref": "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8791b337-421b-4b61-a598-c9e24cf80da9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0962291b-2d0e-4599-8971-53804221ce02", "target_ref": "indicator--58a7a31f-c3da-4e01-9f37-0925895151da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ca863a81-9515-4c98-bd24-c20c95cb2140", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0962291b-2d0e-4599-8971-53804221ce02", "target_ref": "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5014ba9b-0c68-4e82-bba4-0def3d7a3ed5", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0962291b-2d0e-4599-8971-53804221ce02", "target_ref": "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--71ed7a57-eb25-41bc-9228-b6b1442974d8", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6", "target_ref": "indicator--58a7a31f-c3da-4e01-9f37-0925895151da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60e48d42-86f8-41dc-a3cc-6adae87dfd1f", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6", "target_ref": "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a13fbe52-13f9-4261-9009-91db9e2c93f9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6", "target_ref": "indicator--0962291b-2d0e-4599-8971-53804221ce02" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--851572ae-1f62-4d85-be5d-30d21eef2d69", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--bf1abd3e-cc10-4f30-a805-17645f3f2477", "target_ref": "indicator--1d648447-7249-4cc3-901b-dc6174ba7f6b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--48bd0742-a5a2-437d-b9dd-092cab8cb390", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--bf1abd3e-cc10-4f30-a805-17645f3f2477", "target_ref": "indicator--8317e94c-e26a-4a95-b5e4-5582adad12a7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7931d8c3-0125-43d6-8be8-5008ea52aea3", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1d648447-7249-4cc3-901b-dc6174ba7f6b", "target_ref": "indicator--bf1abd3e-cc10-4f30-a805-17645f3f2477" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--28201843-8a9c-4b0a-b032-07de405aeaaa", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1d648447-7249-4cc3-901b-dc6174ba7f6b", "target_ref": "indicator--8317e94c-e26a-4a95-b5e4-5582adad12a7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8b75698c-0b6a-4300-8fad-5a8ea410882e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8317e94c-e26a-4a95-b5e4-5582adad12a7", "target_ref": "indicator--bf1abd3e-cc10-4f30-a805-17645f3f2477" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8f2acc33-acfa-44a0-835b-d652a3ce71af", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8317e94c-e26a-4a95-b5e4-5582adad12a7", "target_ref": "indicator--1d648447-7249-4cc3-901b-dc6174ba7f6b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be5ab42a-6b08-456a-8efe-34f881ff11d2", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--06a9a6ed-3fec-4f9a-85c5-ec11230f8c4b", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--599e1f52-e8ab-4769-8f56-041173464cb0", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--06a9a6ed-3fec-4f9a-85c5-ec11230f8c4b", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5df7ad43-9020-4bbf-a284-d7c7dd0d1462", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--06a9a6ed-3fec-4f9a-85c5-ec11230f8c4b", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--98f978cb-5702-4045-9358-96e81aaaf031", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9", "target_ref": "indicator--06a9a6ed-3fec-4f9a-85c5-ec11230f8c4b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f4e1a9af-5386-4e88-b92d-373948590e7a", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a9a46bc5-cc78-48d0-9ef7-5285f94c236e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1f55d077-9c1c-45e2-ad92-a760bc74be9d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0", "target_ref": "indicator--06a9a6ed-3fec-4f9a-85c5-ec11230f8c4b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36146168-bace-4ea1-b839-ea6b0130d0b8", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8e8219d5-2c77-43d2-9302-8efdb364c322", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c9a33fd6-3992-4a5e-b9d4-7b3ef5870185", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d", "target_ref": "indicator--06a9a6ed-3fec-4f9a-85c5-ec11230f8c4b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8fc11632-36c8-42e8-98aa-44ee07cc2d7d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ba713145-afec-4294-a378-27a6dde17786", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--353f45f6-3bb0-4598-9428-27193c596e84", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'mstcf.ps1']", "description": "Cheeky Chipmunk service loader", "valid_from": "2022-01-24T10:15:20.370Z", "name": "Cheeky Chipmunk sample (Filename: mstcf.ps1)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--851c7ec8-f96c-470b-b9e7-8d473cc1a2e1", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--353f45f6-3bb0-4598-9428-27193c596e84", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '165be7620b78fe37cf25c797ee5b49e7']", "description": "Cheeky Chipmunk service loader", "valid_from": "2022-01-24T10:15:20.370Z", "name": "Cheeky Chipmunk sample (MD5: 165be7620b78fe37cf25c797ee5b49e7)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ad72428-a5be-4e9c-a6d7-b0e92a4fa266", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eff13b18-f049-473d-97ef-0c37a00e832c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '50c0bf9479efc93fa9cf1aa99bdca923273b71a1']", "description": "Cheeky Chipmunk service loader", "valid_from": "2022-01-24T10:15:20.370Z", "name": "Cheeky Chipmunk sample (SHA-1: 50c0bf9479efc93fa9cf1aa99bdca923273b71a1)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--289e2e12-7d30-41a6-8635-ef8c8cbc64b7", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--eff13b18-f049-473d-97ef-0c37a00e832c", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '22a8b4a7c7a467ea7fcf0a3930c99ecb482095093839683b400f58e2cdda176f']", "description": "Cheeky Chipmunk service loader", "valid_from": "2022-01-24T10:15:20.370Z", "name": "Cheeky Chipmunk sample (SHA-256: 22a8b4a7c7a467ea7fcf0a3930c99ecb482095093839683b400f58e2cdda176f)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50930fb4-904a-4263-b4a4-c0584db13845", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1e2a0018-d0f6-494b-8d9c-6d7efb8a27e5", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'securlsa.chk']", "description": "Cheeky Chipmunk RPC server", "valid_from": "2022-01-24T10:15:20.371Z", "name": "Cheeky Chipmunk sample (Filename: securlsa.chk)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c05d3311-7704-4f39-bf8a-a755c405d308", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--1e2a0018-d0f6-494b-8d9c-6d7efb8a27e5", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '38abeb8a68e9207da3e6ead88a9682ec']", "description": "Cheeky Chipmunk RPC server", "valid_from": "2022-01-24T10:15:20.371Z", "name": "Cheeky Chipmunk sample (MD5: 38abeb8a68e9207da3e6ead88a9682ec)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9753de0b-78db-4a10-abdc-d98c013f6b4d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '52c8cbd0545caab7596c1382c7fc5a479209851d']", "description": "Cheeky Chipmunk RPC server", "valid_from": "2022-01-24T10:15:20.371Z", "name": "Cheeky Chipmunk sample (SHA-1: 52c8cbd0545caab7596c1382c7fc5a479209851d)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a18ae448-6587-4d51-9aaa-271b5dfe0e9f", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '454e6c3d8c1c982cd301b4dd82ec3431935c28adea78ed8160d731ab0bed6cb7']", "description": "Cheeky Chipmunk RPC server", "valid_from": "2022-01-24T10:15:20.371Z", "name": "Cheeky Chipmunk sample (SHA-256: 454e6c3d8c1c982cd301b4dd82ec3431935c28adea78ed8160d731ab0bed6cb7)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--72653324-325d-4806-bbbe-ce05921e4003", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58a7a31f-c3da-4e01-9f37-0925895151da", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'mscsp.exe']", "description": "Cheeky Chipmunk RPC client", "valid_from": "2022-01-24T10:15:20.372Z", "name": "Cheeky Chipmunk sample (Filename: mscsp.exe)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ef17f0d5-ceb9-45e9-8647-ef45689b9403", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--58a7a31f-c3da-4e01-9f37-0925895151da", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'b03caf2f86a6b7adc06550bf666309a4']", "description": "Cheeky Chipmunk RPC client", "valid_from": "2022-01-24T10:15:20.372Z", "name": "Cheeky Chipmunk sample (MD5: b03caf2f86a6b7adc06550bf666309a4)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--01b2cd96-61fd-4825-9956-8cf8053e6c0c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0962291b-2d0e-4599-8971-53804221ce02", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '865f4c457bf86ff03456de828044f6ed6d6cf96a']", "description": "Cheeky Chipmunk RPC client", "valid_from": "2022-01-24T10:15:20.372Z", "name": "Cheeky Chipmunk sample (SHA-1: 865f4c457bf86ff03456de828044f6ed6d6cf96a)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad8bd2d8-e189-4884-b6de-c24efe795ee6", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0962291b-2d0e-4599-8971-53804221ce02", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'd86f7d63bf8faa7070ba096523cf114947b55570dc50b0583797c9897ba3559c']", "description": "Cheeky Chipmunk RPC client", "valid_from": "2022-01-24T10:15:20.372Z", "name": "Cheeky Chipmunk sample (SHA-256: d86f7d63bf8faa7070ba096523cf114947b55570dc50b0583797c9897ba3559c)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8ad3b262-34f4-4605-99de-582f07d7f060", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bf1abd3e-cc10-4f30-a805-17645f3f2477", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '50c98af90563bae4f89219d50feba38f']", "description": "Cheeky Chipmunk RPC client DLL", "valid_from": "2022-01-24T10:15:20.374Z", "name": "Cheeky Chipmunk sample (MD5: 50c98af90563bae4f89219d50feba38f)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8f2a639-d071-4598-b87a-c29d02aa7c2e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--bf1abd3e-cc10-4f30-a805-17645f3f2477", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1d648447-7249-4cc3-901b-dc6174ba7f6b", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '5d5825b14377c5e5fe96816dd72a90bd13dc9fc8']", "description": "Cheeky Chipmunk RPC client DLL", "valid_from": "2022-01-24T10:15:20.374Z", "name": "Cheeky Chipmunk sample (SHA-1: 5d5825b14377c5e5fe96816dd72a90bd13dc9fc8)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3b4b8fcd-20df-42b9-ac78-5a4672d6c5bc", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--1d648447-7249-4cc3-901b-dc6174ba7f6b", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8317e94c-e26a-4a95-b5e4-5582adad12a7", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '722fa0c893b39fef787b7bc277c979d29adc1525d77dd952f0cc61cd4d0597cc']", "description": "Cheeky Chipmunk RPC client DLL", "valid_from": "2022-01-24T10:15:20.374Z", "name": "Cheeky Chipmunk sample (SHA-256: 722fa0c893b39fef787b7bc277c979d29adc1525d77dd952f0cc61cd4d0597cc)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e67ed519-9b72-4350-bd67-dd5b0d88fa77", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--8317e94c-e26a-4a95-b5e4-5582adad12a7", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--06a9a6ed-3fec-4f9a-85c5-ec11230f8c4b", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'mscsp.exe']", "description": "Cheeky Chipmunk RPC client", "valid_from": "2022-01-24T10:15:20.375Z", "name": "Cheeky Chipmunk sample (Filename: mscsp.exe)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db85de68-e982-4c9b-a9ca-0f4aa7a00e69", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--06a9a6ed-3fec-4f9a-85c5-ec11230f8c4b", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '48afbdc27f3ff243ac2689e2ebd9f33c']", "description": "Cheeky Chipmunk RPC client", "valid_from": "2022-01-24T10:15:20.375Z", "name": "Cheeky Chipmunk sample (MD5: 48afbdc27f3ff243ac2689e2ebd9f33c)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1bcd9cc2-7f47-4141-abe2-c3616c7e05f8", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '7e4a6bac09ad214e98801bc199f96c265d7b6b48']", "description": "Cheeky Chipmunk RPC client", "valid_from": "2022-01-24T10:15:20.375Z", "name": "Cheeky Chipmunk sample (SHA-1: 7e4a6bac09ad214e98801bc199f96c265d7b6b48)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a973436-2189-449d-8721-e3d5f4180272", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '27e7d2054a68510c974add24f33c1c7ef06ef68028cca021cd6b5e67363e2bea']", "description": "Cheeky Chipmunk RPC client", "valid_from": "2022-01-24T10:15:20.375Z", "name": "Cheeky Chipmunk sample (SHA-256: 27e7d2054a68510c974add24f33c1c7ef06ef68028cca021cd6b5e67363e2bea)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ebb24a4-c1c3-4e57-aaa6-1983945d1566", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9b2a0634-7d76-459c-96da-f05ab8f27076", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CheekyChipmunk_command_argument_check \r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Cheeky Chipmunk argument checking code to determine command to process. \"\r\n date = \"2022-01-24\"\r\n hash1 = \"7e4a6bac09ad214e98801bc199f96c265d7b6b48\"\r\n\r\n strings:\r\n\t\t$1 = {66 83 F8 70 75 ?? C7 85 ?? FD FF FF 01 00 00 00 EB ??} \r\n\t\t\t//cmp ax, 70h ; 'p' \r\n\t\t\t//jnz short loc_401C39 \r\n\t\t\t//mov [ebp+Switch], 1 \r\n\t\t\t//jmp short loc_401C7F \r\n \r\n\t\t$2 = {66 83 F8 63 75 ?? C7 85 ?? FD FF FF 03 00 00 00 EB ??} \r\n\t\t\t//cmp ax, 63h ; 'c' \r\n\t\t\t//jnz short loc_401C4B \r\n\t\t\t//mov [ebp+Switch], 3 \r\n\t\t\t//jmp short loc_401C7F \r\n \r\n\t\t$3 = {66 83 F8 67 75 ?? C7 85 ?? FD FF FF 02 00 00 00 EB ??} \r\n\t\t\t//cmp ax, 67h ; 'g' \r\n\t\t\t//jnz short loc_401C5D \r\n\t\t\t//mov [ebp+Switch], 2 \r\n\t\t\t//jmp short loc_401C7F \r\n \r\n\t\t$4 = {66 83 F8 72 75 ?? C7 85 ?? FD FF FF 01 00 00 00 EB ??} \r\n\t\t\t//cmp ax, 72h ; 'r' \r\n\t\t\t//jnz short loc_401C6F \r\n\t\t\t//mov [ebp+var_300], 1 \r\n\t\t\t//jmp short loc_401C7F02} \r\n\r\n condition:\r\n\t\tuint16(0) == 0x5A4D and \r\n\t\tuint32(uint32(0x3c)) == 0x00004550 and \r\n\t\tall of them \r\n}\r\n", "description": "Detects Cheeky Chipmunk argument checking code to determine command to process. ", "valid_from": "2022-01-24T10:15:20.378Z", "name": "YARA: CheekyChipmunk_command_argument_check ", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f346c63b-47a0-40e9-998f-506516f81a2e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--9b2a0634-7d76-459c-96da-f05ab8f27076", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5d368dd6-3d09-4d7f-b3ac-c4d933fca791", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--9b2a0634-7d76-459c-96da-f05ab8f27076", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5a80b4c2-1080-474a-85c7-302478e4584d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--9b2a0634-7d76-459c-96da-f05ab8f27076", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad2758d7-9eb7-4ebf-a133-16d019d2f5f4", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--9b2a0634-7d76-459c-96da-f05ab8f27076", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CheekyChipmunk_GUID_bytes \r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the Cheeky Chipmunk RPC GUID\"\r\n date = \"2022-01-24\"\r\n hash1 = \"52c8cbd0545caab7596c1382c7fc5a479209851d\"\r\n hash2 = \"865f4c457bf86ff03456de828044f6ed6d6cf96a\"\r\n hash3 = \"5d5825b14377c5e5fe96816dd72a90bd13dc9fc8\"\r\n hash4 = \"7e4a6bac09ad214e98801bc199f96c265d7b6b48\"\r\n\r\n strings:\r\n $GUID = {64 25 F0 7D 1E C3 68 4A A6 88 72 D0 EC 84 07 46} \r\n\r\n condition:\r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n all of them \r\n} \r\n", "description": "Detects the Cheeky Chipmunk RPC GUID", "valid_from": "2022-01-24T10:15:20.378Z", "name": "YARA: CheekyChipmunk_GUID_bytes ", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d82df0ab-0f6f-4f89-9b24-cb12e55a3c84", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--288f1576-d384-4d06-8559-e6bca4240777", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c27337e5-cd94-4dd6-a289-af01f0121e15", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f3032c9-18e9-4398-afe2-c4ad71bb97b4", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee8f50e0-ba6a-4b41-a8fe-899b2981fb47", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d5b67af4-ca1a-48c6-a406-23647d658600", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dfa1089d-6b35-49bf-bdcc-0d43fead9d14", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--0962291b-2d0e-4599-8971-53804221ce02" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c9e7c303-5d04-4ca9-8378-ec3c5eef336f", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a21129da-5fe7-4a9e-ad9a-127bec5596bb", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--bf1abd3e-cc10-4f30-a805-17645f3f2477" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cbd1404b-2f13-47e3-9c73-b6a4e810b34b", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--1d648447-7249-4cc3-901b-dc6174ba7f6b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--731b06ce-73c8-43ee-9539-b1ad450b8b1c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--8317e94c-e26a-4a95-b5e4-5582adad12a7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--de86358a-2c4e-4959-bea9-b4bb8b5b3535", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ecc2041-77c1-4598-8412-d665e8790dfa", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8f67dc82-53d9-46ef-9cda-2364e2771cd3", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e4d9be86-bb5c-4b27-a08b-cd8ee3792905", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CheekyChipmunk_control_handler_code \r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the Cheeky Chipmunk RPC service control handler\"\r\n date = \"2022-01-24\"\r\n hash1 = \"52c8cbd0545caab7596c1382c7fc5a479209851d\"\r\n\r\n strings:\r\n $servicecode = {41 B8 01 00 00 00 33 D2 B9 03 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 33 C0 33 D2 B9 01 00 00 00 E8 ?? ?? ?? ?? EB ?? 41 B8 01 00 00 00 33 D2 B9 06 00 00 00 E8 ?? ?? ?? ?? 45 33 C0 33 D2 B9 07 00 00 00 E8 ?? ?? ?? ?? EB ?? 41 B8 01 00 00 00 33 D2 B9 05 00 00 00 E8 ?? ?? ?? ?? 45 33 C0 33 D2 B9 04 00 00 00 E8 ?? ?? ?? ??} \r\n\r\n condition:\r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n all of them \r\n} \r\n", "description": "Detects the Cheeky Chipmunk RPC service control handler", "valid_from": "2022-01-24T10:15:20.379Z", "name": "YARA: CheekyChipmunk_control_handler_code ", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--35a01d7e-3a63-4ebf-a083-879f5c4556a9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--e4d9be86-bb5c-4b27-a08b-cd8ee3792905", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0501ee6e-ccd0-46b3-b279-777be33a8c23", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--e4d9be86-bb5c-4b27-a08b-cd8ee3792905", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--348f9747-1acb-426c-b81c-909951e580bf", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--e4d9be86-bb5c-4b27-a08b-cd8ee3792905", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6f883c6f-987b-487f-98b0-5000cef29571", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--e4d9be86-bb5c-4b27-a08b-cd8ee3792905", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a6cd2d48-a476-4a22-bdcd-2a477b3e9065", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CheekyChipmunk_logfilename_stackstring \r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the stack string for the Cheeky Chipmunk log file name\"\r\n date = \"2022-01-24\"\r\n hash1 = \"52c8cbd0545caab7596c1382c7fc5a479209851d\"\r\n\r\n strings:\r\n $name = {B8 5C 00 00 00 66 89 84 24 ?? 00 00 00 B8 4E 00 00 00 66 89 84 24 ?? 00 00 00 B8 54 00 00 00 66 89 84 24 ?? 00 00 00 B8 55 00 00 00 66 89 84 24 ?? 00 00 00 B8 73 00 00 00 66 89 84 24 ?? 00 00 00 B8 65 00 00 00 66 89 84 24 ?? 00 00 00 B8 72 00 00 00 66 89 84 24 ?? 00 00 00 B8 2E 00 00 00 66 89 84 24 ?? 00 00 00 B8 6C 00 00 00 66 89 84 24 ?? 00 00 00 B8 6F 00 00 00 66 89 84 24 ?? 00 00 00 B8 67 00 00 00 66 89 84 24 ?? 00 00 00 33 C0 66 89 84 24 ?? 00 00 00} \r\n\r\n condition:\r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n all of them \r\n} \r\n", "description": "Detects the stack string for the Cheeky Chipmunk log file name", "valid_from": "2022-01-24T10:15:20.379Z", "name": "YARA: CheekyChipmunk_logfilename_stackstring ", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d07a9d8e-fb6f-4161-8f5f-81673d416abd", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a6cd2d48-a476-4a22-bdcd-2a477b3e9065", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8f94ef1-4488-4da8-97c7-a3e329b4f53f", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a6cd2d48-a476-4a22-bdcd-2a477b3e9065", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60c6ed5f-e751-4bd1-b478-bc36e2a63ee2", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a6cd2d48-a476-4a22-bdcd-2a477b3e9065", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3aedd33e-8384-4c6b-add3-4c37ddbc458f", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a6cd2d48-a476-4a22-bdcd-2a477b3e9065", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--39e24416-de65-4096-aa7b-13bd1643ab72", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CheekyChipmunk_amsi_avoidance_strings \r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Cheeky Chipmunk loader AMSI avoidance strings\"\r\n date = \"2022-01-24\"\r\n hash1 = \"50c0bf9479efc93fa9cf1aa99bdca923273b71a1\"\r\n\r\n strings:\r\n $functionname = \"FindAmsiFun\" \r\n $x86found = \"x32 protection detected\" \r\n $x64found = \"x64 protection detected\" \r\n\r\n condition:\r\n all of them \r\n} \r\n", "description": "Detects Cheeky Chipmunk loader AMSI avoidance strings", "valid_from": "2022-01-24T10:15:20.379Z", "name": "YARA: CheekyChipmunk_amsi_avoidance_strings", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4f559d9e-b45d-4e36-8b68-f5b09b15f8b3", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--39e24416-de65-4096-aa7b-13bd1643ab72", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--376da234-0c49-4d69-8ba9-1cb8706160db", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--39e24416-de65-4096-aa7b-13bd1643ab72", "target_ref": "attack-pattern--6703e4e7-b2ab-42fc-96de-011fbf3bb981" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--862f3453-a701-4800-9766-dbb74a7884de", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--39e24416-de65-4096-aa7b-13bd1643ab72", "target_ref": "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c4d08617-68bc-468e-a756-c15fef213cd4", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--39e24416-de65-4096-aa7b-13bd1643ab72", "target_ref": "indicator--eff13b18-f049-473d-97ef-0c37a00e832c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ddeae91b-15f2-4b13-86e5-c1d94bfef098", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--39e24416-de65-4096-aa7b-13bd1643ab72", "target_ref": "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b910710b-0bf4-4810-867a-3fa609e7e921", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CheekyChipmunk_namedpipe_stackstring \r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects stack string for Cheeky Chipmunk named pipe\"\r\n date = \"2022-01-24\"\r\n hash1 = \"52c8cbd0545caab7596c1382c7fc5a479209851d\"\r\n\r\n strings:\r\n $stackstring = {B8 5C 00 00 00 66 89 84 24 80 00 00 00 B8 70 00 00 00 66 89 84 24 82 00 00 00 B8 69 00 00 00 66 89 84 24 84 00 00 00 B8 70 00 00 00 66 89 84 24 86 00 00 00 B8 65 00 00 00 66 89 84 24 88 00 00 00 B8 5C 00 00 00 66 89 84 24 8A 00 00 00 B8 70 00 00 00 66 89 84 24 8C 00 00 00 B8 6E 00 00 00 66 89 84 24 8E 00 00 00 B8 72 00 00 00 66 89 84 24 90 00 00 00 B8 73 00 00 00 66 89 84 24 92 00 00 00 B8 76 00 00 00 66 89 84 24 94 00 00 00 B8 63 00 00 00 66 89 84 24 96 00 00 00 33 C0 66 89 84 24 98 00 00 00} \r\n\r\n condition:\r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n all of them \r\n} \r\n", "description": "Detects stack string for Cheeky Chipmunk named pipe", "valid_from": "2022-01-24T10:15:20.380Z", "name": "YARA: CheekyChipmunk_namedpipe_stackstring ", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9a6884cb-034c-4973-8665-008577fcecc9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--b910710b-0bf4-4810-867a-3fa609e7e921", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9e7cda5-dd0a-4c86-abd9-ef1d4d6ce886", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b910710b-0bf4-4810-867a-3fa609e7e921", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--93afa62e-c90f-40f1-9218-24ab98748ef0", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b910710b-0bf4-4810-867a-3fa609e7e921", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--81dca0af-f57c-4ac9-961a-aa4e5e6e267c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b910710b-0bf4-4810-867a-3fa609e7e921", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b66a2d78-d5c7-4f53-9ddf-cbf9fb15b988", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CheekyChipmunk_xor_function_code \r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Cheeky Chipmunk XOR function\"\r\n date = \"2022-01-24\"\r\n hash1 = \"52c8cbd0545caab7596c1382c7fc5a479209851d\"\r\n\r\n strings:\r\n $funccode = {8B 44 24 04 48 8B 4C 24 20 0F B6 04 01 8B 0C 24 03 C8 8B C1 89 04 24 8B 44 24 04 48 8B 4C 24 20 0F B6 04 01 83 F0 55 8B 4C 24 04 48 8B 54 24 20 88 04 0A B8 01 00 00 00 48 6B C0 00 48 8B 4C 24 20 0F B6 04 01 8B 0C 24 03 C8 8B C1 89 04 24} \r\n\r\n condition:\r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n all of them \r\n} \r\n", "description": "Detects Cheeky Chipmunk XOR function", "valid_from": "2022-01-24T10:15:20.380Z", "name": "YARA: CheekyChipmunk_xor_function_code", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ac74d0d9-ca12-4adc-a013-122deb962c69", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--b66a2d78-d5c7-4f53-9ddf-cbf9fb15b988", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f969bd25-7feb-4bd2-8254-3b985a7fd3b6", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--b66a2d78-d5c7-4f53-9ddf-cbf9fb15b988", "target_ref": "attack-pattern--5257841a-1020-458d-9f90-017aed0d2455" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60c7dfdb-12b9-40e8-ab60-23d8b498a3cd", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b66a2d78-d5c7-4f53-9ddf-cbf9fb15b988", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2ee3f99e-9f0e-492f-b609-86505c9cd5d0", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b66a2d78-d5c7-4f53-9ddf-cbf9fb15b988", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee255faf-c4be-4eae-b5ca-d567f4cb01ae", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--b66a2d78-d5c7-4f53-9ddf-cbf9fb15b988", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57626d3b-4776-437c-853f-cb453aa4b968", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CheekyChipmunk_PrintFormatStrings\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Cheeky Chipmunk client print format strings\"\r\n date = \"2022-01-24\"\r\n hash1 = \"5d5825b14377c5e5fe96816dd72a90bd13dc9fc8\"\r\n hash2 = \"7e4a6bac09ad214e98801bc199f96c265d7b6b48\"\r\n\r\n strings:\r\n $SN = \"0x%04d: SN %S: \"\r\n $RC = \"0x%04d: RC %S: \" \r\n $EX = \"0x%04d: EX %S: \"\r\n $SNSuccess = \"SN %S: success\"\r\n $RCSuccess = \"RC %S: success\"\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n uint32(uint32(0x3c)) == 0x00004550 and\r\n all of them\r\n}\r\n", "description": "Detects Cheeky Chipmunk client print format strings", "valid_from": "2022-01-24T10:15:20.380Z", "name": "YARA: CheekyChipmunk_print_format_strings", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70df9e60-8992-4263-ac81-d96cba1962c6", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--57626d3b-4776-437c-853f-cb453aa4b968", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a9f3830b-7649-43dc-af89-6d0178996429", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--57626d3b-4776-437c-853f-cb453aa4b968", "target_ref": "indicator--bf1abd3e-cc10-4f30-a805-17645f3f2477" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e2f042b2-cd1c-4ff9-9194-ed974892a756", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--57626d3b-4776-437c-853f-cb453aa4b968", "target_ref": "indicator--1d648447-7249-4cc3-901b-dc6174ba7f6b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1d8b0cb3-e273-43d0-976f-bf5b051d802f", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--57626d3b-4776-437c-853f-cb453aa4b968", "target_ref": "indicator--8317e94c-e26a-4a95-b5e4-5582adad12a7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8e433656-178c-48ba-85e9-7227d91e544e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--57626d3b-4776-437c-853f-cb453aa4b968", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b764a1a6-4547-4f30-9878-1cdac57edcf4", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--57626d3b-4776-437c-853f-cb453aa4b968", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf55bfea-8f77-43e4-a7dd-5264a8615094", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--57626d3b-4776-437c-853f-cb453aa4b968", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "alert tcp any any -> any 445 (msg:\"CheekyChipmunk_default_timeout_command\";\\\n\tcontent:\"|fe|SMB\"; offset:4; depth:4;\\\n\t# Command: IOCTL\n\tbyte_test:2,=,11,8,relative,little;\\\n\tcontent:\"|e0 2e 00 00|\"; fast_pattern; offset:148; depth:4;\\\n\tsid:1001410000; rev:1; classtype:malware-cnc;\\\n\tmetadata:date 2022-01-24;)", "description": "Detects RPC traffic containing Cheeky Chipmunk Default Command Timeout", "valid_from": "2022-01-24T10:15:20.381Z", "name": "Snort: CheekyChipmunk_default_timeout_command", "pattern_type": "snort" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2da0fa68-4111-4240-9cb1-957ec69f0043", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d8dfee65-9528-423d-b23f-038eea91f420", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "target_ref": "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c357fc26-c0b2-4792-8154-2ab6cfaa4d7b", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--09db25e3-dc3c-4325-ac36-1e24ec3274eb", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d1f601be-09df-4e89-9413-88db53d3f172", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f781494a-52ba-441d-9224-daccf1230ae5", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--42d92c8a-ef50-4464-b860-270706a73287", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--71f4dbf4-120b-4ede-867b-9dcac2f003ff", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "alert tcp any any -> any 445 (msg:\"Cheeky Chipmunk_RPC_GUID\";\\\n\tcontent:\"|fe|SMB\"; offset:4; depth:4;\\\n\t# Command: Write Request\n\tbyte_test:2,=,9,8,relative,little;\\\n\tcontent:\"d%|f0|}|1e c3|hJ|a6 88|r|d0 ec 84 07|F\"; offset:148; depth:16;\\\n\tsid:1001410001; rev:1; classtype:malware-cnc;\\\n\tmetadata:date 2022-01-24;)", "description": "Detects RPC traffic containing Cheeky Chipmunk RPC GUID", "valid_from": "2022-01-24T10:15:20.381Z", "name": "Snort: Cheeky Chipmunk_RPC_GUID", "pattern_type": "snort" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4086361f-71e0-4641-bf50-49c8bc4bcf3a", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2cc12a80-d4c5-4769-949a-14131105a375", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "target_ref": "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ff28db63-b224-4bb7-b740-0a4357274f31", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4defadf0-5b0f-48dd-91e6-14253a5915b3", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--16e358fe-cb1a-4c3c-b52f-41eb8a5698d6", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f84339ea-cb24-4685-a5b8-280b21b5ba9d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8ef72301-53d8-41fe-b622-f8348f91a4af", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--49463b8f-38c1-44a6-9414-6d93b235555d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "alert tcp any any -> any 445 (msg:\"CheekyChipmunk_namedpipe_pnrsvc\";\\\n\tcontent:\"|fe|SMB\"; offset:4; depth:4;\\\n\t# Command: Create Request\n\tbyte_test:2,=,5,8,relative,little;\\\n\tcontent:\"p|00|n|00|r|00|s|00|v|00|c|00|\"; offset:124; depth:12;\\\n\tsid:1001410002; rev:1; classtype:malware-cnc;\\\n\tmetadata:date 2022-01-24;)", "description": "Detects RPC traffic containing Cheeky Chipmunk named pipe", "valid_from": "2022-01-24T10:15:20.382Z", "name": "Snort: CheekyChipmunk_namedpipe_pnrsvc", "pattern_type": "snort" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--85a3dbf8-de9f-47f4-bc82-b2f1f4d88b52", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fd196971-18c0-4b9a-bc80-314e4c6c52cf", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "target_ref": "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--304fd0f8-8276-4eec-a040-8b77e4152c9a", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4cfd7ae0-544d-401d-bd17-328802bb40bd", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd39d19f-705f-4dd0-b9d0-0f43c9424615", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--66c2c432-b2fb-43cf-b595-9ec2dde653bc", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b142fe22-c76c-40a6-b1f0-56c4100c1dc3", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36cb7694-78e4-4915-b1c5-bd9338c5ad29", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "alert tcp any any -> any 445 (msg:\"CheekyChipmunk_namedpipe_atctl\";\\\n\tcontent:\"|fe|SMB\"; offset:4; depth:4;\\\n\t# Command: Create Request\n\tbyte_test:2,=,5,8,relative,little;\\\n\tcontent:\"a|00|t|00|c|00|t|00|l|00|\"; offset:124; depth:10;\\\n\tsid:1001410003; rev:1; classtype:malware-cnc;\\\n\tmetadata:date 2022-01-24;)", "description": "Detects RPC traffic containing Cheeky Chipmunk named pipe", "valid_from": "2022-01-24T10:15:20.382Z", "name": "Snort: CheekyChipmunk_namedpipe_atctl", "pattern_type": "snort" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--029ccc0f-1b05-4b2c-a192-2148756f13db", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9f1a1a2e-c32a-4aa1-9aad-500f02c8bf14", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "target_ref": "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--89b74f02-04da-496c-921d-5d5efe56f8c2", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fa935483-a05d-4ec2-bef4-c9ec3b0946d4", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--05484805-ce71-4773-be69-c9b65e03a164", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a5cd20ff-e56c-4b55-b20c-3ddf7ba92f58", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--586616ef-0b23-4ccb-ad73-237b5a745f37", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--476b2240-e381-4ef0-8dfa-df2ae972fe75", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "alert tcp any any -> any 445 (msg:\"CheekyChipmunk_namedpipe_pnrsvc\";\\\n\tcontent:\"|fe|SMB\"; offset:4; depth:4;\\\n\t# Command: Create Request\n\tbyte_test:2,=,5,8,relative,little;\\\n\tcontent:\"m|00|s|00|b|00|r|00|w|00|s|00|\"; offset:124; depth:12;\\\n\tsid:1001410004; rev:1; classtype:malware-cnc;\\\n\tmetadata:date 2022-01-24;)", "description": "Detects RPC traffic containing Cheeky Chipmunk named pipe", "valid_from": "2022-01-24T10:15:20.382Z", "name": "Snort: CheekyChipmunk_namedpipe_pnrsvc", "pattern_type": "snort" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fde9836e-97bd-47e9-9439-5dc17a4250c9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--910f332d-e817-4478-8c04-06eba323966d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "target_ref": "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b9cb715d-d5c1-4951-88e6-ce2f190d2336", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0a0af41a-2aa3-4ad7-9fd9-86262a5ba75c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1f26aaea-9e66-474a-a103-b9cb88a0ca9b", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7effaf86-3272-4102-91b8-31a2f3b72272", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "target_ref": "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7751873e-04fb-4c7c-a541-bbf96d273462", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "target_ref": "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--88984160-3882-474f-82b0-d855e6d2ff1b", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "target_ref": "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--44353f73-55f5-48ec-9d4e-f990213b3570", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = '%PUBLIC%\\\\NTUser.log']", "description": "Name of the Cheeky Chipmunk log file that will be present on a victim machine", "valid_from": "2022-01-24T10:15:20.383Z", "name": "Filename: %PUBLIC%\\NTUser.log", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9b8ab312-bded-4bd6-adfd-def786c89b4d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--44353f73-55f5-48ec-9d4e-f990213b3570", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--33a9e790-8cb9-4e52-a40d-b92d43869097", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44353f73-55f5-48ec-9d4e-f990213b3570", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bb7132ca-4bc6-4b18-bfdc-745ab83d5136", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44353f73-55f5-48ec-9d4e-f990213b3570", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e6a331fb-2686-45c4-a0a8-408a941163cf", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--44353f73-55f5-48ec-9d4e-f990213b3570", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--df428ccd-98c8-4e95-a27e-c09cabac5827", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = '%SYSTEMROOT%\\\\security\\\\database\\\\securlsa.chk']", "description": "Name of the RPC server that will be present on a victim machine", "valid_from": "2022-01-24T10:15:20.383Z", "name": "Filename: %SYSTEMROOT%\\security\\database\\securlsa.chk", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--773d59aa-67c2-4a93-892f-2c27a6d07a78", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--df428ccd-98c8-4e95-a27e-c09cabac5827", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8afe497e-e8b8-422c-9244-489bb654759e", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--df428ccd-98c8-4e95-a27e-c09cabac5827", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b494eeb-69c3-4dba-b45a-721790ddcb78", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--df428ccd-98c8-4e95-a27e-c09cabac5827", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--06b151a3-7c97-4e2d-a1c0-70f690fc2744", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--df428ccd-98c8-4e95-a27e-c09cabac5827", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--37cca899-e178-4b6c-932a-165676ffa563", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[windows-registry-key:values[*].name = '\\\\\\\\HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Svchost\\\\netsvcs\\\\Pnrssp']", "description": "Registry values required for the running of the service - this will be present on a victim machine", "valid_from": "2022-01-24T10:15:20.383Z", "name": "Registry value name: \\\\HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\\netsvcs\\Pnrssp", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ab34229-657a-4fca-b487-777ded1414e0", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--37cca899-e178-4b6c-932a-165676ffa563", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--337f3d1c-af8a-46db-b24f-02aa44b0f6f9", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--37cca899-e178-4b6c-932a-165676ffa563", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--927cd228-a0ec-4281-99d6-6751b3d8320f", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--37cca899-e178-4b6c-932a-165676ffa563", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--90229e99-3871-4e5f-8feb-b2490a6960c7", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--37cca899-e178-4b6c-932a-165676ffa563", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c287edef-21e7-416e-b770-ff65e1861bc6", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[windows-registry-key:values[*].name = '\\\\\\\\HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\services\\\\pnrssp\\\\ServiceMain\\\\ServiceMain']", "description": "Registry values required for the running of the service - this will be present on a victim machine", "valid_from": "2022-01-24T10:15:20.384Z", "name": "Registry value name: \\\\HKLM\\SYSTEM\\CurrentControlSet\\services\\pnrssp\\ServiceMain\\ServiceMain", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--44d0f13e-952c-4c4b-a093-90506c37f9b5", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--c287edef-21e7-416e-b770-ff65e1861bc6", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6f4a463a-6731-49cf-9812-32d501db4ada", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c287edef-21e7-416e-b770-ff65e1861bc6", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4a53dde5-7e26-4b88-9a2d-ce8f37571687", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c287edef-21e7-416e-b770-ff65e1861bc6", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b4fd3901-e2f4-40f6-90f2-e0307a130143", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c287edef-21e7-416e-b770-ff65e1861bc6", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ee1e5d10-d0ea-447e-b530-bad62218e83d", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[windows-registry-key:values[*].name = '\\\\\\\\HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\services\\\\pnrssp\\\\ServiceDll\\\\%SYSTEMROOT\\\\security\\\\database\\\\securlsa.chk']", "description": "Registry values required for the running of the service - this will be present on a victim machine", "valid_from": "2022-01-24T10:15:20.384Z", "name": "Registry value name: \\\\HKLM\\SYSTEM\\CurrentControlSet\\services\\pnrssp\\ServiceDll\\%SYSTEMROOT\\security\\database\\securlsa.chk", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--680bdaed-c1c9-4bfd-b499-046185bfa434", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--ee1e5d10-d0ea-447e-b530-bad62218e83d", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36ac8c12-e49a-480d-afbe-35edbe324edf", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ee1e5d10-d0ea-447e-b530-bad62218e83d", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--67c714fd-1350-4530-981f-e36a94efed64", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ee1e5d10-d0ea-447e-b530-bad62218e83d", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c1f4385-f87a-42dd-8345-ee6920def701", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ee1e5d10-d0ea-447e-b530-bad62218e83d", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--85d3c3dd-0e62-40cd-840d-bb41ebace3b6", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[windows-registry-key:values[*].name = '\\\\\\\\HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\services\\\\LanmanServer\\\\Parameters\\\\NullSessionPipes\\\\Pnrsvc']", "description": "NullSessionPipes registry value - this will be present on a victim machine", "valid_from": "2022-01-24T10:15:20.384Z", "name": "Registry value name: \\\\HKLM\\SYSTEM\\CurrentControlSet\\services\\LanmanServer\\Parameters\\NullSessionPipes\\Pnrsvc", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eed8e80a-d72c-4c88-b426-fb0be719e6c0", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--85d3c3dd-0e62-40cd-840d-bb41ebace3b6", "target_ref": "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03255105-9b27-452f-94e0-a24f75fa9504", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--85d3c3dd-0e62-40cd-840d-bb41ebace3b6", "target_ref": "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--02c7a513-eea6-4500-aa18-300cc1d72c6c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--85d3c3dd-0e62-40cd-840d-bb41ebace3b6", "target_ref": "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a415d4cd-5c19-4f93-8868-765ac085f9bc", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--85d3c3dd-0e62-40cd-840d-bb41ebace3b6", "target_ref": "indicator--f066c76f-c18a-4403-9a7f-746dba007c90" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", "created": "2022-10-01T00:00:00.000Z", "modified": "2022-10-01T00:00:00.000Z", "name": "TLP:CLEAR", "extensions": { "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": { "extension_type": "property-extension", "tlp_2_0" : "clear" } } }, { "type": "identity", "spec_version": "2.1", "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "created": "2021-05-20T12:00:00.000Z", "modified": "2021-05-20T12:00:00.000Z", "name": "NCSC", "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2959d63f-73fd-46a1-abd2-109d7dcede32", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" }, { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1543.003", "url": "https://attack.mitre.org/techniques/T1543/003" }, { "external_id": "CAPEC-478", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/478.html" }, { "external_id": "CAPEC-550", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/550.html" }, { "external_id": "CAPEC-551", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/551.html" }, { "url": "https://technet.microsoft.com/en-us/library/cc772408.aspx", "description": "Microsoft. (n.d.). Services. Retrieved June 7, 2016.", "source_name": "TechNet Services" }, { "url": "https://technet.microsoft.com/en-us/sysinternals/bb963902", "description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.", "source_name": "TechNet Autoruns" }, { "url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697", "description": "Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service was installed in the system. Retrieved August 7, 2018.", "source_name": "Microsoft 4697 APR 2017" }, { "url": "https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", "description": "Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding to help with intrusion detection. Retrieved August 7, 2018.", "source_name": "Microsoft Windows Event Forwarding FEB 2018" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Windows Service", "description": "Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075). \n\nAdversaries may install a new service or modify an existing service by using system utilities to interact with services, by directly modifying the Registry, or by using custom tools to interact with the Windows API. Adversaries may configure services to execute at startup in order to persist on a system.\n\nAn adversary may also incorporate [Masquerading](https://attack.mitre.org/techniques/T1036) by using a service name from a related operating system or benign software, or by modifying existing services to make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used. \n\nServices may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). ", "x_mitre_contributors": [ "Matthew Demaske, Adaptforward", "Travis Smith, Tripwire", "Pedro Harrison" ], "x_mitre_data_sources": [ "Service: Service Creation", "Service: Service Modification", "Process: Process Creation", "Process: OS API Execution", "Command: Command Execution", "Windows Registry: Windows Registry Key Creation", "Windows Registry: Windows Registry Key Modification" ], "x_mitre_effective_permissions": [ "Administrator", "SYSTEM" ], "x_mitre_detection": "Monitor processes and command-line arguments for actions that could create or modify services. Command-line invocation of tools capable of adding or modifying services may be unusual, depending on how systems are typically used in a particular environment. Services may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data. Remote access tools with built-in features may also interact directly with the Windows API to perform these functions outside of typical system utilities. Collect service utility execution and service binary path arguments used for analysis. Service binary paths may even be changed to execute commands or scripts. \n\nLook for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at HKLM\\SYSTEM\\CurrentControlSet\\Services. Changes to the binary path and the service startup type changed from manual or disabled to automatic, if it does not typically do so, may be suspicious. Tools such as Sysinternals Autoruns may also be used to detect system service changes that could be attempts at persistence.(Citation: TechNet Autoruns) \n\nCreation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017)(Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software.\n\nSuspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.", "x_mitre_version": "1.1", "x_mitre_is_subtechnique": true, "x_mitre_platforms": [ "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001" }, { "url": "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx", "description": "Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April 28, 2016.", "source_name": "TechNet PowerShell" }, { "url": "https://github.com/jaredhaight/PSAttack", "description": "Haight, J. (2016, April 21). PS>Attack. Retrieved June 1, 2016.", "source_name": "Github PSAttack" }, { "source_name": "Sixdub PowerPick Jan 2016", "url": "http://www.sixdub.net/?p=367", "description": "Warner, J.. (2015, January 6). Inexorable PowerShell – A Red Teamer’s Tale of Overcoming Simple AppLocker Policies. Retrieved December 8, 2018." }, { "source_name": "SilentBreak Offensive PS Dec 2015", "url": "https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/", "description": "Christensen, L.. (2015, December 28). The Evolution of Offensive PowerShell Invocation. Retrieved December 8, 2018." }, { "source_name": "Microsoft PSfromCsharp APR 2014", "url": "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/", "description": "Babinec, K. (2014, April 28). Executing PowerShell scripts from C#. Retrieved April 22, 2019." }, { "url": "http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf", "description": "Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.", "source_name": "Malware Archaeology PowerShell Cheat Sheet" }, { "url": "https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html", "description": "Dunwoody, M. (2016, February 11). GREATER VISIBILITY THROUGH POWERSHELL LOGGING. Retrieved February 16, 2016.", "source_name": "FireEye PowerShell Logging 2016" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "PowerShell", "description": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nA number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)\n\nPowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI). (Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_permissions_required": [ "User", "Administrator" ], "x_mitre_remote_support": true, "x_mitre_detection": "If proper execution policy is set, adversaries will likely be able to define their own execution policy if they obtain administrator or system access, either through the Registry or at the command line. This change in policy on a system may be a way to detect malicious use of PowerShell. If PowerShell is not used in an environment, then simply looking for PowerShell execution may detect malicious activity.\n\nMonitor for loading and/or execution of artifacts associated with PowerShell specific assemblies, such as System.Management.Automation.dll (especially to unusual process names/locations).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)\n\nIt is also beneficial to turn on PowerShell logging to gain increased fidelity in what occurs during execution (which is applied to .NET invocations). (Citation: Malware Archaeology PowerShell Cheat Sheet) PowerShell 5.0 introduced enhanced logging capabilities, and some of those features have since been added to PowerShell 4.0. Earlier versions of PowerShell do not have many logging features.(Citation: FireEye PowerShell Logging 2016) An organization can gather PowerShell execution details in a data analytic platform to supplement it with other data.", "x_mitre_data_sources": [ "Command: Command Execution", "Module: Module Load", "Process: Process Creation", "Script: Script Execution" ], "x_mitre_contributors": [ "Praetorian" ], "x_mitre_platforms": [ "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d1fcf083-a721-4223-aedf-bf8960798d62", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. \n\nBatch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel.", "name": "Windows Command Shell", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003" } ], "x_mitre_platforms": [ "Windows" ], "x_mitre_data_sources": [ "Command: Command Execution", "Process: Process Creation" ], "x_mitre_detection": "Usage of the Windows command shell may be common on administrator, developer, or power user systems depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.\n\nScripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.", "x_mitre_permissions_required": [ "User" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.1", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "description": "Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM)\n\nVarious COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)", "name": "Component Object Model", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1559.001", "url": "https://attack.mitre.org/techniques/T1559/001" }, { "source_name": "Fireeye Hunting COM June 2019", "url": "https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html", "description": "Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019." }, { "url": "https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx", "description": "Microsoft. (n.d.). Component Object Model (COM). Retrieved November 22, 2017.", "source_name": "Microsoft COM" }, { "url": "https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html", "description": "Forshaw, J. (2018, April 18). Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege. Retrieved May 3, 2018.", "source_name": "ProjectZero File Write EoP Apr 2018" }, { "url": "https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/", "description": "Nelson, M. (2017, November 16). Lateral Movement using Outlook's CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.", "source_name": "Enigma Outlook DCOM Lateral Movement Nov 2017" }, { "url": "https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/", "description": "Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017.", "source_name": "Enigma MMC20 COM Jan 2017" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "x_mitre_platforms": [ "Windows" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.0", "x_mitre_detection": "Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1059/001), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017)\n\nMonitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on. ", "x_mitre_data_sources": [ "Module: Module Load", "Process: Process Creation", "Script: Script Execution" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--01a5a209-b94c-450b-b7f9-946497d91055", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Windows Management Instrumentation", "description": "Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) (Citation: Wikipedia SMB) and Remote Procedure Call Service (RPCS) (Citation: TechNet RPC) for remote access. RPCS operates over port 135. (Citation: MSDN WMI)\n\nAn adversary can use WMI to interact with local and remote systems and use it as a means to perform many tactic functions, such as gathering information for Discovery and remote Execution of files as part of Lateral Movement. (Citation: FireEye WMI SANS 2015) (Citation: FireEye WMI 2015)", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1047", "url": "https://attack.mitre.org/techniques/T1047" }, { "url": "https://en.wikipedia.org/wiki/Server_Message_Block", "description": "Wikipedia. (2016, June 12). Server Message Block. Retrieved June 12, 2016.", "source_name": "Wikipedia SMB" }, { "url": "https://technet.microsoft.com/en-us/library/cc787851.aspx", "description": "Microsoft. (2003, March 28). What Is RPC?. Retrieved June 12, 2016.", "source_name": "TechNet RPC" }, { "url": "https://msdn.microsoft.com/en-us/library/aa394582.aspx", "description": "Microsoft. (n.d.). Windows Management Instrumentation. Retrieved April 27, 2016.", "source_name": "MSDN WMI" }, { "source_name": "FireEye WMI SANS 2015", "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf", "description": "Devon Kerr. (2015). There's Something About WMI. Retrieved May 4, 2020." }, { "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf", "description": "Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.", "source_name": "FireEye WMI 2015" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "x_mitre_system_requirements": [ "WMI service, winmgmt, running.\nHost/network firewalls allowing SMB and WMI ports from source to destination.\nSMB authentication." ], "x_mitre_platforms": [ "Windows" ], "x_mitre_remote_support": true, "x_mitre_permissions_required": [ "User", "Administrator" ], "x_mitre_detection": "Monitor network traffic for WMI connections; the use of WMI in environments that do not typically use WMI may be suspect. Perform process monitoring to capture command-line arguments of \"wmic\" and detect commands that are used to perform remote behavior. (Citation: FireEye WMI 2015)", "x_mitre_data_sources": [ "Command: Command Execution", "Process: Process Creation", "Network Traffic: Network Connection Creation" ], "x_mitre_version": "1.1", "x_mitre_is_subtechnique": false, "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1140", "url": "https://attack.mitre.org/techniques/T1140" }, { "url": "https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/", "description": "Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017.", "source_name": "Malwarebytes Targeted Attack against Saudi Arabia" }, { "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/", "description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.", "source_name": "Carbon Black Obfuscation Sept 2016" }, { "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/", "description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.", "source_name": "Volexity PowerDuke November 2016" } ], "description": "Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.\n\nOne such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)\n\nSometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)", "name": "Deobfuscate/Decode Files or Information", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_is_subtechnique": false, "x_mitre_version": "1.1", "x_mitre_contributors": [ "Matthew Demaske, Adaptforward", "Red Canary" ], "x_mitre_data_sources": [ "Process: Process Creation", "File: File Modification", "Script: Script Execution" ], "x_mitre_defense_bypassed": [ "Anti-virus", "Host intrusion prevention systems", "Signature-based detection", "Network intrusion detection system" ], "x_mitre_detection": "Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as [certutil](https://attack.mitre.org/software/S0160).\n\nMonitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.", "x_mitre_permissions_required": [ "User" ], "x_mitre_platforms": [ "Windows", "Linux", "macOS" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004" }, { "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/", "description": "Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.", "source_name": "Trend Micro APT Attack Tools" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "File Deletion", "description": "Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.\n\nThere are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_contributors": [ "Walker Johnson" ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_permissions_required": [ "User" ], "x_mitre_defense_bypassed": [ "Host forensic analysis" ], "x_mitre_detection": "It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.", "x_mitre_data_sources": [ "File: File Deletion", "Command: Command Execution" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "description": "Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.\n\nAdversaries may also use the same icon of the file they are trying to mimic.", "name": "Match Legitimate Name or Location", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.005", "url": "https://attack.mitre.org/techniques/T1036/005" }, { "external_id": "CAPEC-177", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/177.html" }, { "source_name": "Elastic Masquerade Ball", "description": "Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.", "url": "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf" }, { "source_name": "Twitter ItsReallyNick Masquerading Update", "url": "https://twitter.com/ItsReallyNick/status/1055321652777619457", "description": "Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019." }, { "source_name": "Docker Images", "url": "https://docs.docker.com/engine/reference/commandline/images/", "description": "Docker. (n.d.). Docker Images. Retrieved April 6, 2021." } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows", "Containers" ], "x_mitre_data_sources": [ "Image: Image Metadata", "File: File Metadata", "Process: Process Metadata" ], "x_mitre_detection": "Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.\n\nIf file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)\n\nIn containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.", "x_mitre_defense_bypassed": [ "Application control by file name or path" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.1", "x_mitre_contributors": [ "Yossi Weizman, Azure Defender Research Team", "Vishwas Manral, McAfee" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027", "url": "https://attack.mitre.org/techniques/T1027" }, { "external_id": "CAPEC-267", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/267.html" }, { "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/", "description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.", "source_name": "Volexity PowerDuke November 2016" }, { "url": "https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/", "description": "Pierre-Marc Bureau. (2013, April 26). Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole. Retrieved September 10, 2017.", "source_name": "Linux/Cdorked.A We Live Security Analysis" }, { "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/", "description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.", "source_name": "Carbon Black Obfuscation Sept 2016" }, { "url": "https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html", "description": "Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.", "source_name": "FireEye Obfuscation June 2017" }, { "url": "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/revoke-obfuscation-report.pdf", "description": "Bohannon, D. & Holmes, L. (2017, July 27). Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science. Retrieved February 12, 2018.", "source_name": "FireEye Revoke-Obfuscation July 2017" }, { "url": "https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/", "description": "White, J. (2017, March 10). Pulling Back the Curtains on EncodedCommand PowerShell Attacks. Retrieved February 12, 2018.", "source_name": "PaloAlto EncodedCommand March 2017" }, { "url": "https://github.com/danielbohannon/Revoke-Obfuscation", "description": "Bohannon, D. (2017, July 27). Revoke-Obfuscation. Retrieved February 12, 2018.", "source_name": "GitHub Revoke-Obfuscation" }, { "url": "https://github.com/itsreallynick/office-crackros", "description": "Carr, N. (2016, August 14). OfficeCrackros. Retrieved February 12, 2018.", "source_name": "GitHub Office-Crackros Aug 2016" } ], "description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. \n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as JavaScript. \n\nPortions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also obfuscate commands executed from payloads or directly via a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ", "name": "Obfuscated Files or Information", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_is_subtechnique": false, "x_mitre_version": "1.1", "x_mitre_contributors": [ "Red Canary", "Christiaan Beek, @ChristiaanBeek" ], "x_mitre_data_sources": [ "File: File Content", "File: File Metadata", "File: File Creation", "Process: Process Creation", "Command: Command Execution", "Command: Command Execution" ], "x_mitre_defense_bypassed": [ "Host forensic analysis", "Signature-based detection", "Host intrusion prevention systems", "Application control", "Log analysis", "Application control by file name or path" ], "x_mitre_detection": "Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature. If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system). \n\nFlag and analyze commands containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''\"'''. Windows' Sysmon and Event ID 4688 displays command-line arguments for processes. Deobfuscation tools can be used to detect these indicators in files/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016) \n\nObfuscation used in payloads for Initial Access can be detected at the network. Use network intrusion detection systems and email gateway filtering to identify compressed and encrypted attachments and scripts. Some email attachment detonation systems can open compressed and encrypted attachments. Payloads delivered over an encrypted connection from a website require encrypted network traffic inspection. \n\nThe first detection of a malicious tool may trigger an anti-virus or other security tool alert. Similar events may also occur at the boundary through network IDS, email scanning appliance, etc. The initial detection should be treated as an indication of a potentially more invasive intrusion. The alerting system should be thoroughly investigated beyond that initial alert for activity that was not detected. Adversaries may continue with an operation, assuming that individual events like an anti-virus detect will not be investigated or that an analyst will not be able to conclusively link that event to other activity occurring on the network. ", "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3c4a2599-71ee-4405-ba1e-0e28414b4bc5", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1005", "external_id": "T1005" } ], "description": "Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.\n\nAdversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106), which has functionality to interact with the file system to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.\n", "name": "Data from Local System", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_mitre_version": "1.2", "x_mitre_data_sources": [ "File: File Access", "Command: Command Execution" ], "x_mitre_detection": "Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).", "x_mitre_system_requirements": [ "Privileges to access certain files and directories" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": false, "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1562.001", "url": "https://attack.mitre.org/techniques/T1562/001" }, { "external_id": "CAPEC-578", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/578.html" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Disable or Modify Tools", "description": "Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_version": "1.1", "x_mitre_is_subtechnique": true, "x_mitre_permissions_required": [ "User", "Administrator" ], "x_mitre_defense_bypassed": [ "Anti-virus", "Log analysis", "Signature-based detection", "Host intrusion prevention systems", "File monitoring" ], "x_mitre_detection": "Monitor processes and command-line arguments to see if security tools are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools. Lack of log events may be suspicious.", "x_mitre_data_sources": [ "Process: Process Termination", "Windows Registry: Windows Registry Key Modification", "Windows Registry: Windows Registry Key Deletion", "Command: Command Execution", "Service: Service Metadata", "Sensor Health: Host Status" ], "x_mitre_platforms": [ "Windows", "macOS", "Linux", "Containers", "IaaS" ], "x_mitre_contributors": [ "Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security", "Nathaniel Quist, Palo Alto Networks", "Gal Singer, @galsinger29, Team Nautilus Aqua Security" ], "x_killchain": "mitre-attack" }, { "type": "report", "spec_version": "2.1", "id": "report--1f56b4db-fa46-4ea8-a1f4-bbc2515380d1", "created": "2022-01-24T00:00:00.000Z", "modified": "2022-01-24T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Malware Analysis Report: Cheeky Chipmunk", "description": "Windows malware implemented as an RPC server. Cheeky Chipmunk is a malicious Microsoft Windows Remote Procedure Call (RPC) server, installed via a PowerShell loader. Command and control (C2) is performed using a separate standalone executable RPC client. The loader implements an Antimalware Scanning Interface (AMSI) avoidance technique and is protected using layered obfuscation, encryption and compression. Functionality includes execution of shell commands and upload/download of files. The RPC connection is set up using named pipes, for which numerous names have been observed across multiple versions of Cheeky Chipmunk. Cheeky Chipmunk is added as a Windows service to maintain persistence.", "published": "2022-01-24T00:00:00Z", "external_references": [ { "source_name": "NCSC", "external_id": "NCSC/MAR/Cheeky-Chipmunk" } ], "report_types": [ "malware" ], "object_refs": [ "malware--d6a573d5-34ad-4f81-a469-35dfc55e7846", "attack-pattern--270195a4-4f55-4859-bcf3-f6dc2a013782", "relationship--ac696d89-2052-48d3-9527-a94debe2ddaa", "relationship--4b781517-7593-4b18-a0c5-b7c302dbb5e9", "attack-pattern--d76aa900-81f0-4783-920a-68921d867f12", "relationship--550531b8-2255-40c3-b84c-dc5254697b85", "relationship--d4f3f59c-0b18-4698-970e-dea2bb4e7b2f", "attack-pattern--022672ee-c1c2-49f3-be76-76ac7e2253ff", "relationship--ba862479-c0c5-4286-95a1-88095bf3f518", "relationship--f9f137b6-79d0-473e-9227-0396c3eeeecd", "attack-pattern--bd25b4ec-23c0-4d22-905b-a637f5ad68bd", "relationship--2177007f-e033-40d6-8cc6-cfa9d927fcb1", "relationship--a06819a2-12ea-434e-9a17-1b917fa921ad", "attack-pattern--992c04d5-6138-462a-98e8-46535d7515df", "relationship--23cac1b2-7361-40ef-9abf-262dc6f2a368", "relationship--d849a256-1f2c-4715-bca6-7570039073c0", "attack-pattern--bb7b0a8a-f148-4744-a86b-9fb1ef2500a9", "relationship--12f56b5b-f2f6-44eb-8777-d621356e6cc9", "relationship--cedfceb9-cc88-43c6-9ffa-65290bec2bab", "attack-pattern--f0f0b205-ed24-4848-84c6-fae720ede8fe", "relationship--80818e5e-1a09-4cb9-8815-da544b529b8d", "relationship--9b0de9ad-324a-44bd-89ee-b48e9c3a876a", "attack-pattern--81726bec-559d-410c-bf9a-e709a951b553", "relationship--ca1cb716-42c0-435d-8896-b9d51b50a455", "relationship--07970ba9-29ef-4699-a6f5-3091637d4773", "attack-pattern--962931d6-3780-4297-bc30-a3e2966b8f3d", "relationship--5d762a23-c348-44a9-b72a-d301e215d093", "relationship--59a3fba6-1664-465c-978e-a23d7ea36908", "attack-pattern--3221ee44-0cfd-4331-9802-51248fa9b91f", "relationship--62ba7cf8-5b61-4596-8020-8f0bfcbfa36d", "relationship--6cd10818-bbc5-4a46-92f7-e34e92aaf00e", "attack-pattern--f10d2ed9-e3bc-4b6f-ac00-8239b082d2e4", "relationship--1eeb6b94-fdf6-48d9-909d-72af559d2b3c", "relationship--f3d81f2a-00f2-4d9a-a69f-0ef40e7c3445", "attack-pattern--5257841a-1020-458d-9f90-017aed0d2455", "relationship--80d78343-e376-4ace-95d7-2587504af56a", "relationship--d716c27c-1d36-4720-874c-e69377b0a84c", "attack-pattern--8f06552d-61c0-4917-b0da-e9c43ab08d81", "relationship--85798cf2-c7cc-4651-a641-62f009d78a69", "relationship--9e08ffb3-df22-4b3f-95d4-1df32d49acb1", "attack-pattern--6703e4e7-b2ab-42fc-96de-011fbf3bb981", "relationship--611ec852-ac86-4100-96cc-6c3fe7ee3d4d", "relationship--3dfebc48-5c67-4ff6-a3a2-6d9e1765a0d9", "relationship--ccbf60e8-e36e-417e-8040-a39eb6a34b9a", "relationship--94359e87-92b4-40f4-836d-3b8b26a9aad2", "relationship--8c9efafe-3c62-4531-8aa7-52b8ca15f1eb", "relationship--f21c67b6-6409-4b4f-9768-ba640e69df1a", "relationship--c9b2d62f-c903-4888-9894-4662a701ce38", "relationship--1acc0c3b-ed1f-4967-b7bc-7eeefd0a30e1", "relationship--8f2e9b16-9832-4303-9dd9-8c99d48a91ee", "relationship--2120aa50-de6f-4098-970a-62c598772763", "relationship--e15652bc-ae6f-4846-a2b5-59c7f0adfd53", "relationship--533681e4-1a4b-467a-b70e-93b08e373311", "relationship--5619110e-fca3-4cfb-8372-98ed74043298", "relationship--548bd717-ae66-4512-9685-d63369dc0350", "relationship--44f5dc29-9985-465b-9cbd-6d7d0e71f316", "relationship--9abebf0e-a597-4964-af60-cf6afcc87e2e", "relationship--02b230e8-795d-41c9-af4c-512aba4029b6", "relationship--b0f6283f-6cf3-47fd-8885-7dcef0bb0e64", "relationship--fad9c23e-8b92-4f5c-a2a9-8a25e5e90cea", "relationship--7b5d14d8-3080-4cd6-bde1-3a3a7358fb2e", "relationship--26e2be68-35c2-47c3-88f6-a7ab99271aba", "relationship--617ce1fa-1e92-48f7-97dc-c0fe029e40fe", "relationship--281fd16b-a65a-46c0-8909-40e2f84bdb63", "relationship--de8ce500-66bb-4fec-a094-ef7d454d7f50", "relationship--ff412919-4283-41a1-b496-38c76f7979fd", "relationship--cf87ff77-71a7-4c00-bf45-f44f08edc4b2", "relationship--6ba3b6d4-18d5-4db9-aa11-06c4bebb858b", "relationship--fbdefd4c-23cd-4452-aece-1ed93efce9ab", "relationship--19a9ed59-2bfa-4464-b579-8168001399f4", "relationship--e27a5acb-d82c-4df2-8b3f-657387cd223e", "relationship--6dc9c7b4-1e9a-4e03-99ff-1216325182a7", "relationship--72e003fe-004d-4bcc-8c22-540e739a8962", "relationship--8791b337-421b-4b61-a598-c9e24cf80da9", "relationship--ca863a81-9515-4c98-bd24-c20c95cb2140", "relationship--5014ba9b-0c68-4e82-bba4-0def3d7a3ed5", "relationship--71ed7a57-eb25-41bc-9228-b6b1442974d8", "relationship--60e48d42-86f8-41dc-a3cc-6adae87dfd1f", "relationship--a13fbe52-13f9-4261-9009-91db9e2c93f9", "relationship--851572ae-1f62-4d85-be5d-30d21eef2d69", "relationship--48bd0742-a5a2-437d-b9dd-092cab8cb390", "relationship--7931d8c3-0125-43d6-8be8-5008ea52aea3", "relationship--28201843-8a9c-4b0a-b032-07de405aeaaa", "relationship--8b75698c-0b6a-4300-8fad-5a8ea410882e", "relationship--8f2acc33-acfa-44a0-835b-d652a3ce71af", "relationship--be5ab42a-6b08-456a-8efe-34f881ff11d2", "relationship--599e1f52-e8ab-4769-8f56-041173464cb0", "relationship--5df7ad43-9020-4bbf-a284-d7c7dd0d1462", "relationship--98f978cb-5702-4045-9358-96e81aaaf031", "relationship--f4e1a9af-5386-4e88-b92d-373948590e7a", "relationship--a9a46bc5-cc78-48d0-9ef7-5285f94c236e", "relationship--1f55d077-9c1c-45e2-ad92-a760bc74be9d", "relationship--36146168-bace-4ea1-b839-ea6b0130d0b8", "relationship--8e8219d5-2c77-43d2-9302-8efdb364c322", "relationship--c9a33fd6-3992-4a5e-b9d4-7b3ef5870185", "relationship--8fc11632-36c8-42e8-98aa-44ee07cc2d7d", "relationship--ba713145-afec-4294-a378-27a6dde17786", "indicator--353f45f6-3bb0-4598-9428-27193c596e84", "relationship--851c7ec8-f96c-470b-b9e7-8d473cc1a2e1", "indicator--a72c60d3-523f-4e53-9b8b-4f53cdb0519a", "relationship--0ad72428-a5be-4e9c-a6d7-b0e92a4fa266", "indicator--eff13b18-f049-473d-97ef-0c37a00e832c", "relationship--289e2e12-7d30-41a6-8635-ef8c8cbc64b7", "indicator--ed9e1569-1162-480e-bc05-623b4b0caaa9", "relationship--50930fb4-904a-4263-b4a4-c0584db13845", "indicator--1e2a0018-d0f6-494b-8d9c-6d7efb8a27e5", "relationship--c05d3311-7704-4f39-bf8a-a755c405d308", "indicator--d5d7f857-8d07-4c87-95f7-0bd8a846c8da", "relationship--9753de0b-78db-4a10-abdc-d98c013f6b4d", "indicator--a14e1650-a5fb-4ac8-9e5e-2168f834369b", "relationship--a18ae448-6587-4d51-9aaa-271b5dfe0e9f", "indicator--f066c76f-c18a-4403-9a7f-746dba007c90", "relationship--72653324-325d-4806-bbbe-ce05921e4003", "indicator--58a7a31f-c3da-4e01-9f37-0925895151da", "relationship--ef17f0d5-ceb9-45e9-8647-ef45689b9403", "indicator--fc368b72-3ac3-422b-a366-01f049ea7a4b", "relationship--01b2cd96-61fd-4825-9956-8cf8053e6c0c", "indicator--0962291b-2d0e-4599-8971-53804221ce02", "relationship--ad8bd2d8-e189-4884-b6de-c24efe795ee6", "indicator--7f2af1fa-afa2-4c77-87f9-e4ab896bb1d6", "relationship--8ad3b262-34f4-4605-99de-582f07d7f060", "indicator--bf1abd3e-cc10-4f30-a805-17645f3f2477", "relationship--f8f2a639-d071-4598-b87a-c29d02aa7c2e", "indicator--1d648447-7249-4cc3-901b-dc6174ba7f6b", "relationship--3b4b8fcd-20df-42b9-ac78-5a4672d6c5bc", "indicator--8317e94c-e26a-4a95-b5e4-5582adad12a7", "relationship--e67ed519-9b72-4350-bd67-dd5b0d88fa77", "indicator--06a9a6ed-3fec-4f9a-85c5-ec11230f8c4b", "relationship--db85de68-e982-4c9b-a9ca-0f4aa7a00e69", "indicator--632124b1-3db1-44d3-acbd-71bc0939ccf9", "relationship--1bcd9cc2-7f47-4141-abe2-c3616c7e05f8", "indicator--2f46e933-d049-4e97-aaf9-fc5ad427d6c0", "relationship--1a973436-2189-449d-8721-e3d5f4180272", "indicator--63d480d6-5b60-4978-ac08-3bf732d6132d", "relationship--0ebb24a4-c1c3-4e57-aaa6-1983945d1566", "indicator--9b2a0634-7d76-459c-96da-f05ab8f27076", "relationship--f346c63b-47a0-40e9-998f-506516f81a2e", "relationship--5d368dd6-3d09-4d7f-b3ac-c4d933fca791", "relationship--5a80b4c2-1080-474a-85c7-302478e4584d", "relationship--ad2758d7-9eb7-4ebf-a133-16d019d2f5f4", "indicator--26f4de71-b2f4-4fbf-a48e-238fe354d461", "relationship--d82df0ab-0f6f-4f89-9b24-cb12e55a3c84", "relationship--288f1576-d384-4d06-8559-e6bca4240777", "relationship--c27337e5-cd94-4dd6-a289-af01f0121e15", "relationship--3f3032c9-18e9-4398-afe2-c4ad71bb97b4", "relationship--ee8f50e0-ba6a-4b41-a8fe-899b2981fb47", "relationship--d5b67af4-ca1a-48c6-a406-23647d658600", "relationship--dfa1089d-6b35-49bf-bdcc-0d43fead9d14", "relationship--c9e7c303-5d04-4ca9-8378-ec3c5eef336f", "relationship--a21129da-5fe7-4a9e-ad9a-127bec5596bb", "relationship--cbd1404b-2f13-47e3-9c73-b6a4e810b34b", "relationship--731b06ce-73c8-43ee-9539-b1ad450b8b1c", "relationship--de86358a-2c4e-4959-bea9-b4bb8b5b3535", "relationship--6ecc2041-77c1-4598-8412-d665e8790dfa", "relationship--8f67dc82-53d9-46ef-9cda-2364e2771cd3", "indicator--e4d9be86-bb5c-4b27-a08b-cd8ee3792905", "relationship--35a01d7e-3a63-4ebf-a083-879f5c4556a9", "relationship--0501ee6e-ccd0-46b3-b279-777be33a8c23", "relationship--348f9747-1acb-426c-b81c-909951e580bf", "relationship--6f883c6f-987b-487f-98b0-5000cef29571", "indicator--a6cd2d48-a476-4a22-bdcd-2a477b3e9065", "relationship--d07a9d8e-fb6f-4161-8f5f-81673d416abd", "relationship--f8f94ef1-4488-4da8-97c7-a3e329b4f53f", "relationship--60c6ed5f-e751-4bd1-b478-bc36e2a63ee2", "relationship--3aedd33e-8384-4c6b-add3-4c37ddbc458f", "indicator--39e24416-de65-4096-aa7b-13bd1643ab72", "relationship--4f559d9e-b45d-4e36-8b68-f5b09b15f8b3", "relationship--376da234-0c49-4d69-8ba9-1cb8706160db", "relationship--862f3453-a701-4800-9766-dbb74a7884de", "relationship--c4d08617-68bc-468e-a756-c15fef213cd4", "relationship--ddeae91b-15f2-4b13-86e5-c1d94bfef098", "indicator--b910710b-0bf4-4810-867a-3fa609e7e921", "relationship--9a6884cb-034c-4973-8665-008577fcecc9", "relationship--e9e7cda5-dd0a-4c86-abd9-ef1d4d6ce886", "relationship--93afa62e-c90f-40f1-9218-24ab98748ef0", "relationship--81dca0af-f57c-4ac9-961a-aa4e5e6e267c", "indicator--b66a2d78-d5c7-4f53-9ddf-cbf9fb15b988", "relationship--ac74d0d9-ca12-4adc-a013-122deb962c69", "relationship--f969bd25-7feb-4bd2-8254-3b985a7fd3b6", "relationship--60c7dfdb-12b9-40e8-ab60-23d8b498a3cd", "relationship--2ee3f99e-9f0e-492f-b609-86505c9cd5d0", "relationship--ee255faf-c4be-4eae-b5ca-d567f4cb01ae", "indicator--57626d3b-4776-437c-853f-cb453aa4b968", "relationship--70df9e60-8992-4263-ac81-d96cba1962c6", "relationship--a9f3830b-7649-43dc-af89-6d0178996429", "relationship--e2f042b2-cd1c-4ff9-9194-ed974892a756", "relationship--1d8b0cb3-e273-43d0-976f-bf5b051d802f", "relationship--8e433656-178c-48ba-85e9-7227d91e544e", "relationship--b764a1a6-4547-4f30-9878-1cdac57edcf4", "relationship--cf55bfea-8f77-43e4-a7dd-5264a8615094", "indicator--0957d179-a899-4ed8-b1ee-de023290f294", "relationship--2da0fa68-4111-4240-9cb1-957ec69f0043", "relationship--d8dfee65-9528-423d-b23f-038eea91f420", "relationship--c357fc26-c0b2-4792-8154-2ab6cfaa4d7b", "relationship--09db25e3-dc3c-4325-ac36-1e24ec3274eb", "relationship--d1f601be-09df-4e89-9413-88db53d3f172", "relationship--f781494a-52ba-441d-9224-daccf1230ae5", "relationship--42d92c8a-ef50-4464-b860-270706a73287", "relationship--71f4dbf4-120b-4ede-867b-9dcac2f003ff", "indicator--08c21bf0-7e7d-4972-a30d-4e65e697a4a5", "relationship--4086361f-71e0-4641-bf50-49c8bc4bcf3a", "relationship--2cc12a80-d4c5-4769-949a-14131105a375", "relationship--ff28db63-b224-4bb7-b740-0a4357274f31", "relationship--4defadf0-5b0f-48dd-91e6-14253a5915b3", "relationship--16e358fe-cb1a-4c3c-b52f-41eb8a5698d6", "relationship--f84339ea-cb24-4685-a5b8-280b21b5ba9d", "relationship--8ef72301-53d8-41fe-b622-f8348f91a4af", "relationship--49463b8f-38c1-44a6-9414-6d93b235555d", "indicator--dedc76f1-19c0-469e-ae48-2437ec106525", "relationship--85a3dbf8-de9f-47f4-bc82-b2f1f4d88b52", "relationship--fd196971-18c0-4b9a-bc80-314e4c6c52cf", "relationship--304fd0f8-8276-4eec-a040-8b77e4152c9a", "relationship--4cfd7ae0-544d-401d-bd17-328802bb40bd", "relationship--cd39d19f-705f-4dd0-b9d0-0f43c9424615", "relationship--66c2c432-b2fb-43cf-b595-9ec2dde653bc", "relationship--b142fe22-c76c-40a6-b1f0-56c4100c1dc3", "relationship--36cb7694-78e4-4915-b1c5-bd9338c5ad29", "indicator--2d551c0f-f8f2-465d-aea4-b5f1c3ac8e19", "relationship--029ccc0f-1b05-4b2c-a192-2148756f13db", "relationship--9f1a1a2e-c32a-4aa1-9aad-500f02c8bf14", "relationship--89b74f02-04da-496c-921d-5d5efe56f8c2", "relationship--fa935483-a05d-4ec2-bef4-c9ec3b0946d4", "relationship--05484805-ce71-4773-be69-c9b65e03a164", "relationship--a5cd20ff-e56c-4b55-b20c-3ddf7ba92f58", "relationship--586616ef-0b23-4ccb-ad73-237b5a745f37", "relationship--476b2240-e381-4ef0-8dfa-df2ae972fe75", "indicator--67e8ba20-bb72-4df0-b078-e04eaa2de691", "relationship--fde9836e-97bd-47e9-9439-5dc17a4250c9", "relationship--910f332d-e817-4478-8c04-06eba323966d", "relationship--b9cb715d-d5c1-4951-88e6-ce2f190d2336", "relationship--0a0af41a-2aa3-4ad7-9fd9-86262a5ba75c", "relationship--1f26aaea-9e66-474a-a103-b9cb88a0ca9b", "relationship--7effaf86-3272-4102-91b8-31a2f3b72272", "relationship--7751873e-04fb-4c7c-a541-bbf96d273462", "relationship--88984160-3882-474f-82b0-d855e6d2ff1b", "indicator--44353f73-55f5-48ec-9d4e-f990213b3570", "relationship--9b8ab312-bded-4bd6-adfd-def786c89b4d", "relationship--33a9e790-8cb9-4e52-a40d-b92d43869097", "relationship--bb7132ca-4bc6-4b18-bfdc-745ab83d5136", "relationship--e6a331fb-2686-45c4-a0a8-408a941163cf", "indicator--df428ccd-98c8-4e95-a27e-c09cabac5827", "relationship--773d59aa-67c2-4a93-892f-2c27a6d07a78", "relationship--8afe497e-e8b8-422c-9244-489bb654759e", "relationship--2b494eeb-69c3-4dba-b45a-721790ddcb78", "relationship--06b151a3-7c97-4e2d-a1c0-70f690fc2744", "indicator--37cca899-e178-4b6c-932a-165676ffa563", "relationship--0ab34229-657a-4fca-b487-777ded1414e0", "relationship--337f3d1c-af8a-46db-b24f-02aa44b0f6f9", "relationship--927cd228-a0ec-4281-99d6-6751b3d8320f", "relationship--90229e99-3871-4e5f-8feb-b2490a6960c7", "indicator--c287edef-21e7-416e-b770-ff65e1861bc6", "relationship--44d0f13e-952c-4c4b-a093-90506c37f9b5", "relationship--6f4a463a-6731-49cf-9812-32d501db4ada", "relationship--4a53dde5-7e26-4b88-9a2d-ce8f37571687", "relationship--b4fd3901-e2f4-40f6-90f2-e0307a130143", "indicator--ee1e5d10-d0ea-447e-b530-bad62218e83d", "relationship--680bdaed-c1c9-4bfd-b499-046185bfa434", "relationship--36ac8c12-e49a-480d-afbe-35edbe324edf", "relationship--67c714fd-1350-4530-981f-e36a94efed64", "relationship--9c1f4385-f87a-42dd-8345-ee6920def701", "indicator--85d3c3dd-0e62-40cd-840d-bb41ebace3b6", "relationship--eed8e80a-d72c-4c88-b426-fb0be719e6c0", "relationship--03255105-9b27-452f-94e0-a24f75fa9504", "relationship--02c7a513-eea6-4500-aa18-300cc1d72c6c", "relationship--a415d4cd-5c19-4f93-8868-765ac085f9bc" ], "x_version": "1.0" } ] }