{
  "type": "bundle",
  "spec_version": "2.1",
  "id": "bundle--14b8aa0f-e3e9-43a1-b867-e5046ff3b694",
  "created": "2021-09-03T09:30:21.153Z",
  "modified": "2021-09-03T09:30:21.153Z",
  "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
  ],
  "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
  "objects": [
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5",
      "created": "2021-09-03T09:30:21.143Z",
      "modified": "2021-09-03T09:30:21.143Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Infinite Second",
      "description": "Infinite Second is a malicious PowerShell script that is used to drop the ComRAT malware. It uses the registry to store configuration and necessary data, including an obfuscated version of ComRAT. It bootstraps by modifying the scheduled task of the Microsoft Customer Experience Improvement Program known as the Microsoft Consolidator. Some functionality requires Administrator permissions and execution policies that allow any PowerShell script to be run (e.g. ‘Unrestricted’), and which depend on PowerShell version 2 being installed.",
      "malware_types": [
        "dropper"
      ],
      "is_family": false,
      "capabilities": [
        "installs-other-components",
        "persists-after-system-reboot"
      ],
      "implementation_languages": [
        "powershell"
      ],
      "x_operating_systems": [
        "windows"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d472402c-2d79-48e2-bc87-92b7d5ed5a1f",
      "created": "2021-09-03T09:30:21.143Z",
      "modified": "2021-09-03T09:30:21.143Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Command and Scripting Interpreter: PowerShell as used by Infinite Second",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ],
      "description": "Infinite Second is a PowerShell script that deploys and set ups up persistence for ComRAT."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d24c9603-11c3-4456-89eb-182d78a6c60f",
      "created": "2021-09-03T09:30:21.143Z",
      "modified": "2021-09-03T09:30:21.143Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--d472402c-2d79-48e2-bc87-92b7d5ed5a1f",
      "target_ref": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a13c533a-6da9-4d13-9421-ecd9abd118a4",
      "created": "2021-09-03T09:30:21.143Z",
      "modified": "2021-09-03T09:30:21.143Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5",
      "target_ref": "attack-pattern--d472402c-2d79-48e2-bc87-92b7d5ed5a1f"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--9ae339b8-80ec-46b4-bea1-bffc534879d1",
      "created": "2021-09-03T09:30:21.144Z",
      "modified": "2021-09-03T09:30:21.144Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Scheduled Task/Job: Scheduled Task as used by Infinite Second",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ],
      "description": "Infinite Second creates or modifies a scheduled task to run as SYSTEM to launch ComRAT."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6742fda-5c75-4ab1-94db-291b143e49fa",
      "created": "2021-09-03T09:30:21.144Z",
      "modified": "2021-09-03T09:30:21.144Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--9ae339b8-80ec-46b4-bea1-bffc534879d1",
      "target_ref": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--788a0402-251c-4350-820c-e9473edd26aa",
      "created": "2021-09-03T09:30:21.144Z",
      "modified": "2021-09-03T09:30:21.144Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5",
      "target_ref": "attack-pattern--9ae339b8-80ec-46b4-bea1-bffc534879d1"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc",
      "created": "2021-09-03T09:30:21.144Z",
      "modified": "2021-09-03T09:30:21.144Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Modify Registry as used by Infinite Second",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "Infinite Second stores cryptographic keys, additional scripts and obfuscated payloads in the registry."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76a69fd0-21e7-4e5d-ac75-479403219bb2",
      "created": "2021-09-03T09:30:21.144Z",
      "modified": "2021-09-03T09:30:21.144Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc",
      "target_ref": "attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bee5d3a8-590e-4ee0-a00e-132c103681cf",
      "created": "2021-09-03T09:30:21.145Z",
      "modified": "2021-09-03T09:30:21.145Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5",
      "target_ref": "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--1099d10b-c4dc-402d-88db-27dec5fa3d2f",
      "created": "2021-09-03T09:30:21.145Z",
      "modified": "2021-09-03T09:30:21.145Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Deobfuscate/Decode Files or Information as used by Infinite Second",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "Infinite Second deobfuscates information stored in the registry using 3DES, XOR, and Base64 encoding."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e21a5b7-a2e1-4a6b-a104-f87a7645c9ef",
      "created": "2021-09-03T09:30:21.145Z",
      "modified": "2021-09-03T09:30:21.145Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--1099d10b-c4dc-402d-88db-27dec5fa3d2f",
      "target_ref": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e4e5cd3-f6d2-41a2-8f05-7881a72a5bcc",
      "created": "2021-09-03T09:30:21.145Z",
      "modified": "2021-09-03T09:30:21.145Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5",
      "target_ref": "attack-pattern--1099d10b-c4dc-402d-88db-27dec5fa3d2f"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--19dc85dd-194f-4349-835b-7cf87ff41304",
      "created": "2021-09-03T09:30:21.145Z",
      "modified": "2021-09-03T09:30:21.145Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Masquerading: Match Legitimate Name or Location as used by Infinite Second",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "Infinite Second uses registry values that masquerade as legitimate software. "
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcd45c53-109e-43ad-97c5-dd887ddc7045",
      "created": "2021-09-03T09:30:21.145Z",
      "modified": "2021-09-03T09:30:21.145Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--19dc85dd-194f-4349-835b-7cf87ff41304",
      "target_ref": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ab5b090-5192-4226-9e90-56f4f13f2c0b",
      "created": "2021-09-03T09:30:21.145Z",
      "modified": "2021-09-03T09:30:21.145Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5",
      "target_ref": "attack-pattern--19dc85dd-194f-4349-835b-7cf87ff41304"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--4de6367e-2a30-4983-8202-32f021192241",
      "created": "2021-09-03T09:30:21.145Z",
      "modified": "2021-09-03T09:30:21.146Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Indicator Removal on Host: File Deletion as used by Infinite Second",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "Infinite Second deletes C:\\Windows\\Temp\\tmp4071.tmp\nand\nC:\\Users\\Public\\Documents\\thumbs.ini"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2106a461-50cc-421f-a566-fffa5a0ad981",
      "created": "2021-09-03T09:30:21.146Z",
      "modified": "2021-09-03T09:30:21.146Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--4de6367e-2a30-4983-8202-32f021192241",
      "target_ref": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af222bc2-5f65-447a-8174-54a2d259b61d",
      "created": "2021-09-03T09:30:21.146Z",
      "modified": "2021-09-03T09:30:21.146Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5",
      "target_ref": "attack-pattern--4de6367e-2a30-4983-8202-32f021192241"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b865bfe-a32f-4312-9e9d-9c83e469c066",
      "created": "2021-09-03T09:30:21.146Z",
      "modified": "2021-09-03T09:30:21.146Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule infinitesecond_custom_xor\r\n{\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"Identifies the XOR implementation\"\r\n\r\n    strings:\r\n      $a = \"KGJ5dGVbXSBpbmNvbWVfYnl0ZXMsIGJ5dGVbXSBnYW1tYSl7Ynl0ZVtdIG91dHB1dCA9IG5ldyBieXRlW2luY29tZV9ieXRlcy5MZW5ndGhdO2ZvciAoaW50IGkgPSAwOyBpIDwgaW5jb21lX2J5dGVzLkxlbmd0aDsgKytpKXtvdXRwdXRbaV0gPSAoYnl0ZSkoaW5jb21lX2J5dGVzW2ldIF4gZ2FtbWFbaSAlIGdhbW1hLkxlbmd0aF0pO31yZXR1cm4gb3V0cHV0O319\"\r\n\t$b = \"hieXRlW10gaW5jb21lX2J5dGVzLCBieXRlW10gZ2FtbWEpe2J5dGVbXSBvdXRwdXQgPSBuZXcgYnl0ZVtpbmNvbWVfYnl0ZXMuTGVuZ3RoXTtmb3IgKGludCBpID0gMDsgaSA8IGluY29tZV9ieXRlcy5MZW5ndGg7ICsraSl7b3V0cHV0W2ldID0gKGJ5dGUpKGluY29tZV9ieXRlc1tpXSBeIGdhbW1hW2kgJSBnYW1tYS5MZW5ndGhdKTt9cmV0dXJuIG91dHB1dDt9f\"\r\n\t$c = \"oYnl0ZVtdIGluY29tZV9ieXRlcywgYnl0ZVtdIGdhbW1hKXtieXRlW10gb3V0cHV0ID0gbmV3IGJ5dGVbaW5jb21lX2J5dGVzLkxlbmd0aF07Zm9yIChpbnQgaSA9IDA7IGkgPCBpbmNvbWVfYnl0ZXMuTGVuZ3RoOyArK2kpe291dHB1dFtpXSA9IChieXRlKShpbmNvbWVfYnl0ZXNbaV0gXiBnYW1tYVtpICUgZ2FtbWEuTGVuZ3RoXSk7fXJldHVybiBvdXRwdXQ7fX\"\r\n    condition:\r\n        any of them\r\n}\r\n",
      "description": "Identifies the XOR implementation",
      "valid_from": "2021-09-03T09:30:21.146Z",
      "name": "YARA: infinitesecond_custom_xor",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--134748e4-1a09-4fba-972b-28e7e76031f9",
      "created": "2021-09-03T09:30:21.146Z",
      "modified": "2021-09-03T09:30:21.146Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--6b865bfe-a32f-4312-9e9d-9c83e469c066",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96fb3eed-6bde-4ffc-9014-36b31e5cf99b",
      "created": "2021-09-03T09:30:21.146Z",
      "modified": "2021-09-03T09:30:21.146Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--6b865bfe-a32f-4312-9e9d-9c83e469c066",
      "target_ref": "attack-pattern--1099d10b-c4dc-402d-88db-27dec5fa3d2f"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e089951-ce57-48cc-9aaa-1fc71589dcb9",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule infinitesecond_random_name_function\r\n{\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"Identifies the random name generator\"\r\n\r\n    strings:\r\n        $ = \"function TVM730egf([string[]]$GP50afa) { $UC33gfa = ((1..(Get-Random -Min 2 -Max 4) | % {[Char](Get-Random -Min 0x41 -Max 0x5B)}) -join '');\"\r\n        $ = \"$EQ33abh = ((1..(Get-Random -Min 2 -Max 4) | % {[Char](Get-Random -Min 0x30 -Max 0x3A)}) -join '');\"\r\n        $ = \"$OFK689fa = ((1..(Get-Random -Min 2 -Max 4) | % {[Char](Get-Random -Min 0x61 -Max 0x6B)}) -join '');\"\r\n    condition: any of them\r\n}\r\n",
      "description": "Identifies the random name generator",
      "valid_from": "2021-09-03T09:30:21.147Z",
      "name": "YARA: infinitesecond_random_name_function",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ac805c2-1904-4470-baed-b4850e912009",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--2e089951-ce57-48cc-9aaa-1fc71589dcb9",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aafcc00d-5329-4279-b151-c9b7ed7196f4",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--2e089951-ce57-48cc-9aaa-1fc71589dcb9",
      "target_ref": "attack-pattern--1099d10b-c4dc-402d-88db-27dec5fa3d2f"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9e67f0b-c000-438a-8df5-802bdf790abe",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule infinitesecond_hardcoded_strings\r\n{\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"Identifies hardcoded strings throughout the script\"\r\n\r\n    strings:\r\n        $ = \"HKLM:\\\\SOFTWARE\\\\Microsoft\\\\SQMClient\\\\Windows\"\r\n        $ = \"\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\WINEVT\\\\Publishers\\\\{cabe18a5-69b9-4eec-bed0-fa080ed05a3b}\\\\ChannelReferences\\\\0\"\r\n        $ = \"C:\\\\Windows\\\\Temp\\\\tmp4071.tmp\"\r\n        $ = \"C:\\\\Windows\\\\System32\\\\Tasks\\\\Microsoft\\\\Windows\\\\Customer Experience Improvement Program\\\\Consolidator\"\r\n        $ = \"Microsoft\\\\Windows\\\\Customer Experience Improvement Program\"\r\n        $ = \"WSqmConHex\"\r\n        $ = \"WSqmConBin\"\r\n        $ = \"WSqmCons\"\r\n        $ = \"WSqmConBak\"\r\n\r\n        \r\n    condition: 4 of them\r\n}\r\n",
      "description": "Identifies hardcoded strings throughout the script",
      "valid_from": "2021-09-03T09:30:21.147Z",
      "name": "YARA: infinitesecond_hardcoded_strings",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91e16478-8880-4be1-add7-e05858c5bbd8",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e9e67f0b-c000-438a-8df5-802bdf790abe",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a85ea7e3-cbf8-402d-bf4e-9a5bcae9415b",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e9e67f0b-c000-438a-8df5-802bdf790abe",
      "target_ref": "attack-pattern--d472402c-2d79-48e2-bc87-92b7d5ed5a1f"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9663b13-4f09-4515-a3ca-ab31fa29b218",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule infinitesecond_3des_file\r\n{\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"3DES Initialisation Vector\"\r\n\r\n    strings:\r\n\t\t$IV = \"FVADRCORAOSKBHPX\"\r\n    condition:\r\n        all of them\r\n}\r\n",
      "description": "3DES Initialisation Vector",
      "valid_from": "2021-09-03T09:30:21.147Z",
      "name": "YARA: infinitesecond_3des_file",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50c863a4-af9c-44d4-9194-f968f72022a8",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e9663b13-4f09-4515-a3ca-ab31fa29b218",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34503406-beda-40a4-9fc5-1fcb7be768ef",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e9663b13-4f09-4515-a3ca-ab31fa29b218",
      "target_ref": "attack-pattern--1099d10b-c4dc-402d-88db-27dec5fa3d2f"
    },
{
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--950736f9-f344-4adc-b271-f4c0ff183547",
      "created": "2023-02-09T12:12:14.261Z",
      "modified": "2023-02-09T12:12:14.261Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule infinitesecond_psbreakpoint_luis_armstrong\n{\n    meta: \n        author = \"NCSC\"\n        description = \"Identification of unusual PowerShell break point\"\n\n\n    strings:\n        $  = \"Set-PSBreakpoint -Variable luis_armstrong -Mode Write;\" wide ascii\n    condition:\n        all of them\n}\n",
      "description": "Identification of unusual PowerShell break point",
      "valid_from": "2023-02-09T12:12:14.261Z",
      "name": "YARA: infinitesecond_psbreakpoint_luis_armstrong",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de3a861f-5bf7-4486-89ee-4bf52fdfb780",
      "created": "2023-02-09T12:12:14.261Z",
      "modified": "2023-02-09T12:12:14.261Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--950736f9-f344-4adc-b271-f4c0ff183547",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--165aac66-7d0d-4a48-8f1b-2d46819de3d8",
      "created": "2023-02-09T12:12:14.261Z",
      "modified": "2023-02-09T12:12:14.261Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule infinitesecond_powershell_reflective_injection\n{\n    meta: \n        author = \"NCSC\"\n        description = \"Identifies a modification made to reflective injection script\"\n\n\n    strings:\n\t\t$process_number = {7b 54 68 72 6f 77 20 22 43 61 6e 27 74 20 66 69 6e 64 20 70 72 6f 63 65 73 73 20 24 50 72 6f 63 4e 61 6d 65 22 7d 65 6c 73 65 7b 24 50 72 6f 63 49 64 20 3d 20 24 50 72 6f 63 65 73 73 65 73 5b 30 5d 2e 49 44 7d 7d} // {Throw \"Can't find process $ProcName\"}else{$ProcId = $Processes[0].ID}}\n\tcondition:\n\t\tall of them\n}\n",
      "description": "Identifies a modification made to reflective injection script",
      "valid_from": "2023-02-09T12:12:14.261Z",
      "name": "YARA: infinitesecond_powershell_reflective_injection",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d2817c9-6eec-484a-8a58-cd0f055ade1a",
      "created": "2023-02-09T12:12:14.261Z",
      "modified": "2023-02-09T12:12:14.261Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--165aac66-7d0d-4a48-8f1b-2d46819de3d8",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd86a150-f044-4ac4-b962-bc90574cd576",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45",
      "target_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26ae2da6-14d3-417a-95f1-e24511523692",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45",
      "target_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb1395d0-88c4-4d07-85af-a495ea3a2a96",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501",
      "target_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a78e786-8752-4eb1-b213-209222d0a95e",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501",
      "target_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b45174f-69f6-4e58-a800-91050aa8cbd3",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452",
      "target_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06e0b703-7ae7-4cad-bd22-154a8909cf15",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452",
      "target_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35e69fb7-55d4-4b10-93bd-67351ae81f11",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--a4df6020-d48b-4d6a-9838-03396d01676b",
      "target_ref": "indicator--9fe205d9-0078-4f60-8d41-487794824423"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84267d2b-827d-40f6-9745-8c1f3f75da54",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--a4df6020-d48b-4d6a-9838-03396d01676b",
      "target_ref": "indicator--887281ae-3572-4904-aa99-3c75ebc9b33e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4d41443-92af-411a-8ca4-88e696c6188e",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--9fe205d9-0078-4f60-8d41-487794824423",
      "target_ref": "indicator--a4df6020-d48b-4d6a-9838-03396d01676b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--814471c9-fb8c-4c7c-ae17-71a7a6233338",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--9fe205d9-0078-4f60-8d41-487794824423",
      "target_ref": "indicator--887281ae-3572-4904-aa99-3c75ebc9b33e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f5c7d1b-5430-45e2-8124-ebbd39a26583",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--887281ae-3572-4904-aa99-3c75ebc9b33e",
      "target_ref": "indicator--a4df6020-d48b-4d6a-9838-03396d01676b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83f7e2ad-55c7-4787-8c9d-a84ac6a22567",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--887281ae-3572-4904-aa99-3c75ebc9b33e",
      "target_ref": "indicator--9fe205d9-0078-4f60-8d41-487794824423"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9501aecd-70cb-49bd-a622-d2ab663e702b",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--e43a41e3-6223-4d07-9d82-0b64be745293",
      "target_ref": "indicator--6fdeec78-92c1-4138-96e7-d1b2e45f6705"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05bfcd1c-04a4-47d6-9826-04734390f024",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--e43a41e3-6223-4d07-9d82-0b64be745293",
      "target_ref": "indicator--05f51d61-7b2e-4d33-8736-51a78afd6cb3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1df6eb4-10f7-4850-8525-b4c7cca61557",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--6fdeec78-92c1-4138-96e7-d1b2e45f6705",
      "target_ref": "indicator--e43a41e3-6223-4d07-9d82-0b64be745293"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a6727be-0f46-4497-a8fa-46b8f9be5ca3",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--6fdeec78-92c1-4138-96e7-d1b2e45f6705",
      "target_ref": "indicator--05f51d61-7b2e-4d33-8736-51a78afd6cb3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a061af92-2408-4ee3-8824-98f4e96b01a8",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--05f51d61-7b2e-4d33-8736-51a78afd6cb3",
      "target_ref": "indicator--e43a41e3-6223-4d07-9d82-0b64be745293"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c14384f9-7afa-4d69-82a5-8de0d3509c1c",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--05f51d61-7b2e-4d33-8736-51a78afd6cb3",
      "target_ref": "indicator--6fdeec78-92c1-4138-96e7-d1b2e45f6705"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a73c524-4a56-49f7-9ae3-bb351bb2d8dd",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--d6e973f3-7543-4851-952f-2d40c9f80fcb",
      "target_ref": "indicator--371e2711-0722-45d2-8f5c-bd60e5627d66"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3d23637-aa62-43eb-ab37-2852934d8a6a",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--d6e973f3-7543-4851-952f-2d40c9f80fcb",
      "target_ref": "indicator--b01f4ac7-21bd-429b-8a2b-46e849362d2d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a5a10d3-c5cc-48a4-b3d3-f58cb7c7db67",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--371e2711-0722-45d2-8f5c-bd60e5627d66",
      "target_ref": "indicator--d6e973f3-7543-4851-952f-2d40c9f80fcb"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f491e3ce-ba36-4f51-a9f5-d50c1b2f5da6",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--371e2711-0722-45d2-8f5c-bd60e5627d66",
      "target_ref": "indicator--b01f4ac7-21bd-429b-8a2b-46e849362d2d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c53d62c7-77c5-4ce3-a8c7-0790cf4e72ba",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--b01f4ac7-21bd-429b-8a2b-46e849362d2d",
      "target_ref": "indicator--d6e973f3-7543-4851-952f-2d40c9f80fcb"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6dc890aa-92c9-45eb-babc-a092f384975e",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--b01f4ac7-21bd-429b-8a2b-46e849362d2d",
      "target_ref": "indicator--371e2711-0722-45d2-8f5c-bd60e5627d66"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f72f8fd9-8470-4c0c-95e7-73d03080a4be",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--9e9d2afb-d08c-4888-8127-9e36d328f171",
      "target_ref": "indicator--b790013c-f646-484c-931f-27fe5f09996b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d09f7a5-88e9-4f91-9272-6d5e055aac64",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--9e9d2afb-d08c-4888-8127-9e36d328f171",
      "target_ref": "indicator--877d5a66-6a78-4237-b914-29938da7d20d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ec2ae12-cbdd-40bf-a101-e675ddafecdd",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--b790013c-f646-484c-931f-27fe5f09996b",
      "target_ref": "indicator--9e9d2afb-d08c-4888-8127-9e36d328f171"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbd8877a-52a3-40b2-b457-9b7143123520",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--b790013c-f646-484c-931f-27fe5f09996b",
      "target_ref": "indicator--877d5a66-6a78-4237-b914-29938da7d20d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8381c17-ea68-42c6-bba2-c9f46e3cb349",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--877d5a66-6a78-4237-b914-29938da7d20d",
      "target_ref": "indicator--9e9d2afb-d08c-4888-8127-9e36d328f171"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1a7c0d6-e63b-46f7-a473-7478c44661ab",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--877d5a66-6a78-4237-b914-29938da7d20d",
      "target_ref": "indicator--b790013c-f646-484c-931f-27fe5f09996b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09204af1-ad88-4572-9af9-b5721ce17dbb",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--f90896ba-e181-4649-a99b-2b0286ec492d",
      "target_ref": "indicator--8a30f11f-0f14-411c-b4da-e8dd963c2d55"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd22bd03-f6db-458d-b159-be21ad6f81b4",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--f90896ba-e181-4649-a99b-2b0286ec492d",
      "target_ref": "indicator--a569c3f3-a0d3-45ac-a898-d48638bfca83"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9941a539-266b-4a60-88df-565e72c6cad4",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--8a30f11f-0f14-411c-b4da-e8dd963c2d55",
      "target_ref": "indicator--f90896ba-e181-4649-a99b-2b0286ec492d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3edc7e0-bc94-4b96-8372-1c68a870185b",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--8a30f11f-0f14-411c-b4da-e8dd963c2d55",
      "target_ref": "indicator--a569c3f3-a0d3-45ac-a898-d48638bfca83"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d1aee2b-fb71-4616-b809-af50118d3ac0",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--a569c3f3-a0d3-45ac-a898-d48638bfca83",
      "target_ref": "indicator--f90896ba-e181-4649-a99b-2b0286ec492d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61c44d09-dcfa-49ca-963e-c369620285ff",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--a569c3f3-a0d3-45ac-a898-d48638bfca83",
      "target_ref": "indicator--8a30f11f-0f14-411c-b4da-e8dd963c2d55"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43312909-8f56-409b-883f-073fcb384d45",
      "created": "2021-09-03T09:30:21.147Z",
      "modified": "2021-09-03T09:30:21.147Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'MD5' = 'aaedebe3574f07e81650437739ac9357']",
      "description": "Infinite Second PowerShell script",
      "valid_from": "2021-09-03T09:30:21.147Z",
      "name": "Infinite Second sample (MD5: aaedebe3574f07e81650437739ac9357)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e7c9a40-1543-463f-9d6e-a5d41bb756f0",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-1' = '2030075a29da9c6c1c44aeb4862588480a64509c']",
      "description": "Infinite Second PowerShell script",
      "valid_from": "2021-09-03T09:30:21.148Z",
      "name": "Infinite Second sample (SHA-1: 2030075a29da9c6c1c44aeb4862588480a64509c)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44cbedf4-fbce-4679-a8f7-c740a18a6697",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-256' = 'd532610528ad75d80c17f0372c5af8d2e417e0e2e08a055bf9923b71c149c51c']",
      "description": "Infinite Second PowerShell script",
      "valid_from": "2021-09-03T09:30:21.148Z",
      "name": "Infinite Second sample (SHA-256: d532610528ad75d80c17f0372c5af8d2e417e0e2e08a055bf9923b71c149c51c)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e312f8b1-92b9-4c44-81df-2021c4c45190",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4df6020-d48b-4d6a-9838-03396d01676b",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'MD5' = '187b78e6ac908b43556b3f97587a5071']",
      "description": "Script stored in registry (Base64 encoded)",
      "valid_from": "2021-09-03T09:30:21.148Z",
      "name": "Infinite Second sample (MD5: 187b78e6ac908b43556b3f97587a5071)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90645e89-6619-41ee-aea5-0adc6e2bd042",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--a4df6020-d48b-4d6a-9838-03396d01676b",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9fe205d9-0078-4f60-8d41-487794824423",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-1' = 'd67af71a2c5d717b5e299653a5c1b2d097919b43']",
      "description": "Script stored in registry (Base64 encoded)",
      "valid_from": "2021-09-03T09:30:21.148Z",
      "name": "Infinite Second sample (SHA-1: d67af71a2c5d717b5e299653a5c1b2d097919b43)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6928355-56a3-4b3f-a598-41bb2fe93ac1",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--9fe205d9-0078-4f60-8d41-487794824423",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--887281ae-3572-4904-aa99-3c75ebc9b33e",
      "created": "2021-09-03T09:30:21.148Z",
      "modified": "2021-09-03T09:30:21.148Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-256' = '9a3c57b080cb7b55d56b263a0bb2de592681e78716d025b3cdc895ee2dc144a1']",
      "description": "Script stored in registry (Base64 encoded)",
      "valid_from": "2021-09-03T09:30:21.148Z",
      "name": "Infinite Second sample (SHA-256: 9a3c57b080cb7b55d56b263a0bb2de592681e78716d025b3cdc895ee2dc144a1)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f799765b-10ca-4e49-81ee-1a76ab025b7c",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--887281ae-3572-4904-aa99-3c75ebc9b33e",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e43a41e3-6223-4d07-9d82-0b64be745293",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'MD5' = '486bd55b1e8b28d16367ce342bc6b733']",
      "description": "Script stored in registry (decoded)",
      "valid_from": "2021-09-03T09:30:21.149Z",
      "name": "Infinite Second sample (MD5: 486bd55b1e8b28d16367ce342bc6b733)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd6b40e5-8071-4f7d-9b9d-41a3591f43a1",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e43a41e3-6223-4d07-9d82-0b64be745293",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6fdeec78-92c1-4138-96e7-d1b2e45f6705",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-1' = 'f63ae2ca45badde26b8950628a0dd3f3a307bcf1']",
      "description": "Script stored in registry (decoded)",
      "valid_from": "2021-09-03T09:30:21.149Z",
      "name": "Infinite Second sample (SHA-1: f63ae2ca45badde26b8950628a0dd3f3a307bcf1)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb85bdf8-2b76-4d06-b368-6f1b955b580e",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--6fdeec78-92c1-4138-96e7-d1b2e45f6705",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--05f51d61-7b2e-4d33-8736-51a78afd6cb3",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-256' = '27fb6e28589ddff239d2616fde8169204da3f8365b9670e68f733424ecab93fe']",
      "description": "Script stored in registry (decoded)",
      "valid_from": "2021-09-03T09:30:21.149Z",
      "name": "Infinite Second sample (SHA-256: 27fb6e28589ddff239d2616fde8169204da3f8365b9670e68f733424ecab93fe)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23fa181d-18d5-4be2-bcea-7a8b4cc7bf84",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--05f51d61-7b2e-4d33-8736-51a78afd6cb3",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d6e973f3-7543-4851-952f-2d40c9f80fcb",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'MD5' = 'c310c43be2b837cd18d33356936254b0']",
      "description": "Modified version of the PowerSploit Invoke-ReflectivePEInjection PowerShell script",
      "valid_from": "2021-09-03T09:30:21.149Z",
      "name": "Infinite Second sample (MD5: c310c43be2b837cd18d33356936254b0)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b0755ea-5fae-4d10-a1f3-3e5059461fef",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--d6e973f3-7543-4851-952f-2d40c9f80fcb",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--371e2711-0722-45d2-8f5c-bd60e5627d66",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-1' = 'cf978c1dfe192485733223a6aa9b66797f7c1f08']",
      "description": "Modified version of the PowerSploit Invoke-ReflectivePEInjection PowerShell script",
      "valid_from": "2021-09-03T09:30:21.149Z",
      "name": "Infinite Second sample (SHA-1: cf978c1dfe192485733223a6aa9b66797f7c1f08)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aecb8daf-e614-4b0d-afaa-94acf1ec7e0d",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--371e2711-0722-45d2-8f5c-bd60e5627d66",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b01f4ac7-21bd-429b-8a2b-46e849362d2d",
      "created": "2021-09-03T09:30:21.149Z",
      "modified": "2021-09-03T09:30:21.149Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-256' = '84a8d297f2ca73164df69084a216f479fd2ce1052f465deb0300ba1f69614e8b']",
      "description": "Modified version of the PowerSploit Invoke-ReflectivePEInjection PowerShell script",
      "valid_from": "2021-09-03T09:30:21.149Z",
      "name": "Infinite Second sample (SHA-256: 84a8d297f2ca73164df69084a216f479fd2ce1052f465deb0300ba1f69614e8b)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--793b3304-6c74-4b3c-a7b6-1d43d9ba143b",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--b01f4ac7-21bd-429b-8a2b-46e849362d2d",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9e9d2afb-d08c-4888-8127-9e36d328f171",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'MD5' = '1d626b48ae7062bd319cb768a8ca979d']",
      "description": "ComRAT payload dropped by Infinite Second. Windows DLL (PE) x86",
      "valid_from": "2021-09-03T09:30:21.150Z",
      "name": "Infinite Second sample (MD5: 1d626b48ae7062bd319cb768a8ca979d)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--338d2a23-c320-496b-8c41-ba6e58c23ff7",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--9e9d2afb-d08c-4888-8127-9e36d328f171",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b790013c-f646-484c-931f-27fe5f09996b",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-1' = 'd117643019d665a29ce8a7b812268fb8d3e5aadb']",
      "description": "ComRAT payload dropped by Infinite Second. Windows DLL (PE) x86",
      "valid_from": "2021-09-03T09:30:21.150Z",
      "name": "Infinite Second sample (SHA-1: d117643019d665a29ce8a7b812268fb8d3e5aadb)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f82f88ad-1111-429b-9467-b1d98418bbec",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--b790013c-f646-484c-931f-27fe5f09996b",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--877d5a66-6a78-4237-b914-29938da7d20d",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-256' = 'b93484683014aca8e909c9b5648d8f0ac21a45d0c193f6ca40f0b01d2464c1c4']",
      "description": "ComRAT payload dropped by Infinite Second. Windows DLL (PE) x86",
      "valid_from": "2021-09-03T09:30:21.150Z",
      "name": "Infinite Second sample (SHA-256: b93484683014aca8e909c9b5648d8f0ac21a45d0c193f6ca40f0b01d2464c1c4)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63816532-4339-401f-a7b1-e060bfbdcaac",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--877d5a66-6a78-4237-b914-29938da7d20d",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f90896ba-e181-4649-a99b-2b0286ec492d",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'MD5' = '82fc41b3e9ce722d4e6b21580e873d52']",
      "description": "ComRAT payload dropped by Infinite Second. Windows DLL (PE) x64",
      "valid_from": "2021-09-03T09:30:21.150Z",
      "name": "Infinite Second sample (MD5: 82fc41b3e9ce722d4e6b21580e873d52)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--593096b1-7fea-4f4e-887d-1167ee502bdf",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--f90896ba-e181-4649-a99b-2b0286ec492d",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a30f11f-0f14-411c-b4da-e8dd963c2d55",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-1' = '8a93f216607f43bd39164096728ae2bbcdbc2de8']",
      "description": "ComRAT payload dropped by Infinite Second. Windows DLL (PE) x64",
      "valid_from": "2021-09-03T09:30:21.150Z",
      "name": "Infinite Second sample (SHA-1: 8a93f216607f43bd39164096728ae2bbcdbc2de8)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47bf0204-0ee0-42ad-a76e-d9990ce42cf8",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--8a30f11f-0f14-411c-b4da-e8dd963c2d55",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a569c3f3-a0d3-45ac-a898-d48638bfca83",
      "created": "2021-09-03T09:30:21.150Z",
      "modified": "2021-09-03T09:30:21.150Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-256' = 'e209d07f8992892bf4776c897a8f054849b12464d9f58bcb78602217b3fd98bc']",
      "description": "ComRAT payload dropped by Infinite Second. Windows DLL (PE) x64",
      "valid_from": "2021-09-03T09:30:21.150Z",
      "name": "Infinite Second sample (SHA-256: e209d07f8992892bf4776c897a8f054849b12464d9f58bcb78602217b3fd98bc)",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b84cf0a5-8e88-4654-a761-19db13ed4627",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--a569c3f3-a0d3-45ac-a898-d48638bfca83",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2562a69-66f8-4dd7-9cd9-41f2777c0ed7",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[windows-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\SQMClient\\\\Windows\\\\WSqmCons']",
      "description": "Used to store the obfuscated PowerShell script",
      "valid_from": "2021-09-03T09:30:21.151Z",
      "name": "Registry value name: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\WSqmCons",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de6894e2-c4aa-4a45-9f93-6d530f066a5f",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--c2562a69-66f8-4dd7-9cd9-41f2777c0ed7",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d16645e5-7862-46a0-aa74-b0d2fecdfc87",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--c2562a69-66f8-4dd7-9cd9-41f2777c0ed7",
      "target_ref": "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9366cef1-9db1-4702-bd71-76ede927d01d",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c2562a69-66f8-4dd7-9cd9-41f2777c0ed7",
      "target_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b95f9d4c-3894-422b-8d83-03c853a1c17a",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c2562a69-66f8-4dd7-9cd9-41f2777c0ed7",
      "target_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1c00bb9-7b4f-4990-9fe6-d29054946230",
      "created": "2021-09-03T09:30:21.151Z",
      "modified": "2021-09-03T09:30:21.151Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c2562a69-66f8-4dd7-9cd9-41f2777c0ed7",
      "target_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--92a54e46-e09c-464f-aa6a-9d3bfe58bf02",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[windows-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\WINEVT\\\\Publishers\\\\{cabe18a5-69b9-4eec-bed0-fa080ed05a3b}\\\\ChannelReferences\\\\0\\\\N ']",
      "description": "Used to store hardcoded 3DES password for ComRAT payload",
      "valid_from": "2021-09-03T09:30:21.152Z",
      "name": "Registry value name: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers\\{cabe18a5-69b9-4eec-bed0-fa080ed05a3b}\\ChannelReferences\\0\\N ",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3029ee1d-ee6e-46f3-8f0b-12b0619427f2",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--92a54e46-e09c-464f-aa6a-9d3bfe58bf02",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b41edf53-a9b0-4706-9657-78923ec23ca1",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--92a54e46-e09c-464f-aa6a-9d3bfe58bf02",
      "target_ref": "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--670a22fa-5e9f-4299-adf0-54a52eda194c",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--92a54e46-e09c-464f-aa6a-9d3bfe58bf02",
      "target_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0ef6f31-6880-4f31-a54c-8e16ebe4411d",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--92a54e46-e09c-464f-aa6a-9d3bfe58bf02",
      "target_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c12ca2c1-b143-448c-88af-559561b4ce74",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--92a54e46-e09c-464f-aa6a-9d3bfe58bf02",
      "target_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b41b3019-a6b4-4e33-9421-e42980880a2c",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[windows-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\WINEVT\\\\Publishers\\\\{cabe18a5-69b9-4eec-bed0-fa080ed05a3b}\\\\ChannelReferences\\\\0\\\\S']",
      "description": "Used to store hardcoded 3DES salt for ComRAT payload",
      "valid_from": "2021-09-03T09:30:21.152Z",
      "name": "Registry value name: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers\\{cabe18a5-69b9-4eec-bed0-fa080ed05a3b}\\ChannelReferences\\0\\S",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--828af84c-4a34-439f-b210-924f35d70f92",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--b41b3019-a6b4-4e33-9421-e42980880a2c",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b52ca88-19f1-4b5d-be5f-3a6143dcefc5",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--b41b3019-a6b4-4e33-9421-e42980880a2c",
      "target_ref": "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fab9377e-6460-4ce5-b619-3160700d77eb",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--b41b3019-a6b4-4e33-9421-e42980880a2c",
      "target_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07729e71-eb36-4dc0-a9f2-d02e05e73580",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--b41b3019-a6b4-4e33-9421-e42980880a2c",
      "target_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--098afa09-c3ea-4554-8b36-bedc27fa8324",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--b41b3019-a6b4-4e33-9421-e42980880a2c",
      "target_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--92b8597c-7fbd-490b-8168-4a2e2f58d10f",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[windows-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\SQMClient\\\\Windows\\\\WSqmConBin']",
      "description": "Backup of the previous Consolidator executable e.g %SystemRoot%\\System32\\wsqmcons.exe",
      "valid_from": "2021-09-03T09:30:21.152Z",
      "name": "Registry value name: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\WSqmConBin",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13b2564a-7cfc-4f93-997a-d9b25ff252b9",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--92b8597c-7fbd-490b-8168-4a2e2f58d10f",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4245bd48-726b-4500-82ed-52d7e08a46b6",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--92b8597c-7fbd-490b-8168-4a2e2f58d10f",
      "target_ref": "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87b50111-5157-4fb5-85df-8daf9d1761d0",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--92b8597c-7fbd-490b-8168-4a2e2f58d10f",
      "target_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b60da1f5-b84e-4e48-8226-a0d5729c9785",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--92b8597c-7fbd-490b-8168-4a2e2f58d10f",
      "target_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98ec9008-6e57-4e91-88ea-6d37234be548",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--92b8597c-7fbd-490b-8168-4a2e2f58d10f",
      "target_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8280a1c-ea9c-4864-8ad2-bf407c9ef4fd",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[windows-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\SQMClient\\\\Windows\\\\WSqmConHex']",
      "description": "Backup of Consolidator arguments",
      "valid_from": "2021-09-03T09:30:21.152Z",
      "name": "Registry value name: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\WSqmConHex",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0eafd8f0-73f8-4970-815f-55f38d0032cf",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e8280a1c-ea9c-4864-8ad2-bf407c9ef4fd",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bf5c92e-690e-4bef-98c8-afee6c87046e",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e8280a1c-ea9c-4864-8ad2-bf407c9ef4fd",
      "target_ref": "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b82dfcb1-00b9-4dbd-bade-2a631378f88d",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e8280a1c-ea9c-4864-8ad2-bf407c9ef4fd",
      "target_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--457bb99b-7f42-47aa-b890-f7f0c31668f1",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e8280a1c-ea9c-4864-8ad2-bf407c9ef4fd",
      "target_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e93212e-d65c-4ef9-8706-c9d37d87c81e",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e8280a1c-ea9c-4864-8ad2-bf407c9ef4fd",
      "target_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea31a56a-1dd5-4454-89d5-90f49186745e",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[windows-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\SQMClient\\\\Windows\\\\WSqmConBak']",
      "description": "Backup of Consolidator scheduled task configuration",
      "valid_from": "2021-09-03T09:30:21.152Z",
      "name": "Registry value name: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\WSqmConBak",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fee1313f-408b-4907-b7c8-78adbec14601",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--ea31a56a-1dd5-4454-89d5-90f49186745e",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36e4f325-a06f-40f7-a82e-610dc65e98f0",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--ea31a56a-1dd5-4454-89d5-90f49186745e",
      "target_ref": "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6eabb771-216a-46a7-904b-fd5476c81e9c",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--ea31a56a-1dd5-4454-89d5-90f49186745e",
      "target_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--244fcaca-e932-4df1-9fe6-b5537b70202b",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--ea31a56a-1dd5-4454-89d5-90f49186745e",
      "target_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20fd89a4-bafa-4ed7-a3ca-30e8d940b9ea",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--ea31a56a-1dd5-4454-89d5-90f49186745e",
      "target_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa5bb99b-7bf8-450a-9e32-b64ec118997f",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[directory:path LIKE 'C:\\\\Windows\\\\Temp\\\\tmp4071.tmp']",
      "description": "This file is deleted by Infinite Second",
      "valid_from": "2021-09-03T09:30:21.152Z",
      "name": "Path: C:\\Windows\\Temp\\tmp4071.tmp",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--148d4b23-c1a1-438f-b35d-74c3079286ac",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--fa5bb99b-7bf8-450a-9e32-b64ec118997f",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--838fbc5d-09ca-4a47-9c24-601d73ab4af1",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--fa5bb99b-7bf8-450a-9e32-b64ec118997f",
      "target_ref": "attack-pattern--4de6367e-2a30-4983-8202-32f021192241"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ca4d469-d53e-468b-b5cf-eccec960ca75",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--fa5bb99b-7bf8-450a-9e32-b64ec118997f",
      "target_ref": "indicator--43312909-8f56-409b-883f-073fcb384d45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db5192ba-b7c7-4507-8f53-e92a5c9f0b7c",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--fa5bb99b-7bf8-450a-9e32-b64ec118997f",
      "target_ref": "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b57bfba8-ddc6-4e9f-a427-a6410231b178",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--fa5bb99b-7bf8-450a-9e32-b64ec118997f",
      "target_ref": "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d608c635-bf67-45c8-8c61-2cc8edd849f3",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[directory:path LIKE 'C:\\\\Users\\\\Public\\\\Documents\\\\thumbs.ini']",
      "description": "This file is executed and then deleted by Infinite Second",
      "valid_from": "2021-09-03T09:30:21.152Z",
      "name": "Path: C:\\Users\\Public\\Documents\\thumbs.ini",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b57d2b34-76be-46ce-9145-558cd7b4dd7b",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--d608c635-bf67-45c8-8c61-2cc8edd849f3",
      "target_ref": "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6c785c5-352c-4b67-aa78-9b4e37a7741a",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--d608c635-bf67-45c8-8c61-2cc8edd849f3",
      "target_ref": "attack-pattern--4de6367e-2a30-4983-8202-32f021192241"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c193c0a9-3d73-4977-98bb-5da54c877cf0",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--d608c635-bf67-45c8-8c61-2cc8edd849f3",
      "target_ref": "indicator--d6e973f3-7543-4851-952f-2d40c9f80fcb"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6321a588-4e18-4b7f-8a4a-87499aeac0b7",
      "created": "2021-09-03T09:30:21.152Z",
      "modified": "2021-09-03T09:30:21.152Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--d608c635-bf67-45c8-8c61-2cc8edd849f3",
      "target_ref": "indicator--371e2711-0722-45d2-8f5c-bd60e5627d66"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87d9e072-7d58-4d65-b871-32a7e4f16f0f",
      "created": "2021-09-03T09:30:21.153Z",
      "modified": "2021-09-03T09:30:21.153Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--d608c635-bf67-45c8-8c61-2cc8edd849f3",
      "target_ref": "indicator--b01f4ac7-21bd-429b-8a2b-46e849362d2d"
    },
    {
      "type": "marking-definition", 
      "spec_version": "2.1", 
      "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", 
      "created": "2022-10-01T00:00:00.000Z",
      "modified": "2022-10-01T00:00:00.000Z", 
      "name": "TLP:CLEAR",
      "extensions": {
      "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": {
         "extension_type": "property-extension",
         "tlp_2_0" : "clear"
         }
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "created": "2021-05-20T12:00:00.000Z",
      "modified": "2021-05-20T12:00:00.000Z",
      "name": "NCSC",
      "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
      "created": "2020-03-09T13:48:55.078Z",
      "modified": "2020-06-24T13:51:22.360Z",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.001",
          "url": "https://attack.mitre.org/techniques/T1059/001"
        },
        {
          "url": "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx",
          "description": "Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April 28, 2016.",
          "source_name": "TechNet PowerShell"
        },
        {
          "url": "https://github.com/jaredhaight/PSAttack",
          "description": "Haight, J. (2016, April 21). PS>Attack. Retrieved June 1, 2016.",
          "source_name": "Github PSAttack"
        },
        {
          "source_name": "Sixdub PowerPick Jan 2016",
          "url": "http://www.sixdub.net/?p=367",
          "description": "Warner, J.. (2015, January 6). Inexorable PowerShell – A Red Teamer’s Tale of Overcoming Simple AppLocker Policies. Retrieved December 8, 2018."
        },
        {
          "source_name": "SilentBreak Offensive PS Dec 2015",
          "url": "https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/",
          "description": "Christensen, L.. (2015, December 28). The Evolution of Offensive PowerShell Invocation. Retrieved December 8, 2018."
        },
        {
          "source_name": "Microsoft PSfromCsharp APR 2014",
          "url": "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/",
          "description": "Babinec, K. (2014, April 28). Executing PowerShell scripts from C#. Retrieved April 22, 2019."
        },
        {
          "url": "http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf",
          "description": "Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.",
          "source_name": "Malware Archaeology PowerShell Cheat Sheet"
        },
        {
          "url": "https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html",
          "description": "Dunwoody, M. (2016, February 11). GREATER VISIBILITY THROUGH POWERSHELL LOGGING. Retrieved February 16, 2016.",
          "source_name": "FireEye PowerShell Logging 2016"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "PowerShell",
      "description": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nA number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363),  [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)\n\nPowerShell commands/scripts can also be executed without directly invoking the <code>powershell.exe</code> binary through interfaces to PowerShell's underlying <code>System.Management.Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI). (Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ],
      "x_mitre_version": "1.0",
      "x_mitre_is_subtechnique": true,
      "x_mitre_permissions_required": [
        "User",
        "Administrator"
      ],
      "x_mitre_remote_support": true,
      "x_mitre_detection": "If proper execution policy is set, adversaries will likely be able to define their own execution policy if they obtain administrator or system access, either through the Registry or at the command line. This change in policy on a system may be a way to detect malicious use of PowerShell. If PowerShell is not used in an environment, then simply looking for PowerShell execution may detect malicious activity.\n\nMonitor for loading and/or execution of artifacts associated with PowerShell specific assemblies, such as System.Management.Automation.dll (especially to unusual process names/locations).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)\n\nIt is also beneficial to turn on PowerShell logging to gain increased fidelity in what occurs during execution (which is applied to .NET invocations). (Citation: Malware Archaeology PowerShell Cheat Sheet) PowerShell 5.0 introduced enhanced logging capabilities, and some of those features have since been added to PowerShell 4.0. Earlier versions of PowerShell do not have many logging features.(Citation: FireEye PowerShell Logging 2016) An organization can gather PowerShell execution details in a data analytic platform to supplement it with other data.",
      "x_mitre_data_sources": [
        "Command: Command Execution",
        "Module: Module Load",
        "Process: Process Creation",
        "Script: Script Execution"
      ],
      "x_mitre_contributors": [
        "Praetorian"
      ],
      "x_mitre_platforms": [
        "Windows"
      ],
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
      "created": "2019-11-27T14:58:00.429Z",
      "modified": "2020-12-30T14:26:44.730Z",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        },
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        },
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "privilege-escalation"
        }
      ],
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1053.005",
          "url": "https://attack.mitre.org/techniques/T1053/005"
        },
        {
          "url": "https://twitter.com/leoloobeek/status/939248813465853953",
          "description": "Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017.",
          "source_name": "Twitter Leoloobeek Scheduled Task"
        },
        {
          "url": "https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen",
          "description": "Satyajit321. (2015, November 3). Scheduled Tasks History Retention settings. Retrieved December 12, 2017.",
          "source_name": "TechNet Forum Scheduled Task Operational Setting"
        },
        {
          "url": "https://technet.microsoft.com/library/dd315590.aspx",
          "description": "Microsoft. (n.d.). General Task Registration. Retrieved December 12, 2017.",
          "source_name": "TechNet Scheduled Task Events"
        },
        {
          "source_name": "Microsoft Scheduled Task Events Win10",
          "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events",
          "description": "Microsoft. (2017, May 28). Audit Other Object Access Events. Retrieved June 27, 2019."
        },
        {
          "url": "https://technet.microsoft.com/en-us/sysinternals/bb963902",
          "description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.",
          "source_name": "TechNet Autoruns"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "Scheduled Task",
      "description": "Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The <code>schtasks</code> can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.\n\nThe deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At (Windows)](https://attack.mitre.org/techniques/T1053/002)), though <code>at.exe</code> can not access tasks created with <code>schtasks</code> or the Control Panel.\n\nAn adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account (such as SYSTEM).",
      "x_mitre_version": "1.0",
      "x_mitre_is_subtechnique": true,
      "x_mitre_remote_support": true,
      "x_mitre_permissions_required": [
        "Administrator"
      ],
      "x_mitre_detection": "Monitor process execution from the <code>svchost.exe</code> in Windows 10 and the Windows Task Scheduler <code>taskeng.exe</code> for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\\System32\\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.\n\nConfigure event logging for scheduled task creation and changes by enabling the \"Microsoft-Windows-TaskScheduler/Operational\" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)\n\n* Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered\n* Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated\n* Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted\n* Event ID 4698 on Windows 10, Server 2016 - Scheduled task created\n* Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled\n* Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled\n\nTools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.",
      "x_mitre_data_sources": [
        "Scheduled Job: Scheduled Job Creation",
        "Command: Command Execution",
        "File: File Modification",
        "Process: Process Creation"
      ],
      "x_mitre_platforms": [
        "Windows"
      ],
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4",
      "created": "2017-05-31T21:31:23.587Z",
      "modified": "2020-08-13T20:02:49.641Z",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "Modify Registry",
      "description": "Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.\n\nAccess to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API.\n\nRegistry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017)\n\nThe Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1112",
          "url": "https://attack.mitre.org/techniques/T1112"
        },
        {
          "external_id": "CAPEC-203",
          "source_name": "capec",
          "url": "https://capec.mitre.org/data/definitions/203.html"
        },
        {
          "url": "https://technet.microsoft.com/en-us/library/cc732643.aspx",
          "description": "Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.",
          "source_name": "Microsoft Reg"
        },
        {
          "url": "https://docs.microsoft.com/sysinternals/downloads/reghide",
          "description": "Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved August 9, 2018.",
          "source_name": "Microsoft Reghide NOV 2006"
        },
        {
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/",
          "description": "Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows Registry. Retrieved August 9, 2018.",
          "source_name": "TrendMicro POWELIKS AUG 2014"
        },
        {
          "url": "https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353",
          "description": "Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. Retrieved August 9, 2018.",
          "source_name": "SpectorOps Hiding Reg Jul 2017"
        },
        {
          "url": "https://technet.microsoft.com/en-us/library/cc754820.aspx",
          "description": "Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved May 1, 2015.",
          "source_name": "Microsoft Remote"
        },
        {
          "url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4657",
          "description": "Miroshnikov, A. & Hall, J. (2017, April 18). 4657(S): A registry value was modified. Retrieved August 9, 2018.",
          "source_name": "Microsoft 4657 APR 2017"
        },
        {
          "url": "https://docs.microsoft.com/en-us/sysinternals/downloads/regdelnull",
          "description": "Russinovich, M. & Sharkey, K. (2016, July 4). RegDelNull v1.11. Retrieved August 10, 2018.",
          "source_name": "Microsoft RegDelNull July 2016"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_is_subtechnique": false,
      "x_mitre_platforms": [
        "Windows"
      ],
      "x_mitre_permissions_required": [
        "User",
        "Administrator",
        "SYSTEM"
      ],
      "x_mitre_detection": "Modifications to the Registry are normal and occur throughout typical use of the Windows operating system. Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods). (Citation: Microsoft 4657 APR 2017) Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, etc., are suspicious, as are additions or changes to files within the startup folder. Changes could also include new services and modification of existing binary paths to point to malicious files. If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file.\n\nMonitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. The Registry may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), which may require additional logging features to be configured in the operating system to collect necessary information for analysis.\n\nMonitor for processes, command-line arguments, and API calls associated with concealing Registry keys, such as Reghide. (Citation: Microsoft Reghide NOV 2006) Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns (Citation: SpectorOps Hiding Reg Jul 2017) and RegDelNull (Citation: Microsoft RegDelNull July 2016).",
      "x_mitre_defense_bypassed": [
        "Host forensic analysis"
      ],
      "x_mitre_data_sources": [
        "Process: Process Creation",
        "Process: OS API Execution",
        "Command: Command Execution",
        "Windows Registry: Windows Registry Key Creation",
        "Windows Registry: Windows Registry Key Modification",
        "Windows Registry: Windows Registry Key Deletion"
      ],
      "x_mitre_contributors": [
        "Bartosz Jerzman",
        "Travis Smith, Tripwire",
        "David Lu, Tripwire"
      ],
      "x_mitre_version": "1.2",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c",
      "created": "2017-12-14T16:46:06.044Z",
      "modified": "2020-07-09T14:42:23.122Z",
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1140",
          "url": "https://attack.mitre.org/techniques/T1140"
        },
        {
          "url": "https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/",
          "description": "Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017.",
          "source_name": "Malwarebytes Targeted Attack against Saudi Arabia"
        },
        {
          "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/",
          "description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.",
          "source_name": "Carbon Black Obfuscation Sept 2016"
        },
        {
          "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/",
          "description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.",
          "source_name": "Volexity PowerDuke November 2016"
        }
      ],
      "description": "Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.\n\nOne such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows <code>copy /b</code> command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)\n\nSometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)",
      "name": "Deobfuscate/Decode Files or Information",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_is_subtechnique": false,
      "x_mitre_version": "1.1",
      "x_mitre_contributors": [
        "Matthew Demaske, Adaptforward",
        "Red Canary"
      ],
      "x_mitre_data_sources": [
        "Process: Process Creation",
        "File: File Modification",
        "Script: Script Execution"
      ],
      "x_mitre_defense_bypassed": [
        "Anti-virus",
        "Host intrusion prevention systems",
        "Signature-based detection",
        "Network intrusion detection system"
      ],
      "x_mitre_detection": "Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as [certutil](https://attack.mitre.org/software/S0160).\n\nMonitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.",
      "x_mitre_permissions_required": [
        "User"
      ],
      "x_mitre_platforms": [
        "Windows",
        "Linux",
        "macOS"
      ],
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
      "created": "2020-02-10T20:43:10.239Z",
      "modified": "2021-04-20T19:23:37.762Z",
      "description": "Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.\n\nAdversaries may also use the same icon of the file they are trying to mimic.",
      "name": "Match Legitimate Name or Location",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.005",
          "url": "https://attack.mitre.org/techniques/T1036/005"
        },
        {
          "external_id": "CAPEC-177",
          "source_name": "capec",
          "url": "https://capec.mitre.org/data/definitions/177.html"
        },
        {
          "source_name": "Elastic Masquerade Ball",
          "description": "Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.",
          "url": "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf"
        },
        {
          "source_name": "Twitter ItsReallyNick Masquerading Update",
          "url": "https://twitter.com/ItsReallyNick/status/1055321652777619457",
          "description": "Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019."
        },
        {
          "source_name": "Docker Images",
          "url": "https://docs.docker.com/engine/reference/commandline/images/",
          "description": "Docker. (n.d.). Docker Images. Retrieved April 6, 2021."
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows",
        "Containers"
      ],
      "x_mitre_data_sources": [
        "Image: Image Metadata",
        "File: File Metadata",
        "Process: Process Metadata"
      ],
      "x_mitre_detection": "Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.\n\nIf file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)\n\nIn containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.",
      "x_mitre_defense_bypassed": [
        "Application control by file name or path"
      ],
      "x_mitre_is_subtechnique": true,
      "x_mitre_version": "1.1",
      "x_mitre_contributors": [
        "Yossi Weizman, Azure Defender Research Team",
        "Vishwas Manral, McAfee"
      ],
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c",
      "created": "2020-01-31T12:35:36.479Z",
      "modified": "2020-03-29T21:34:16.209Z",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1070.004",
          "url": "https://attack.mitre.org/techniques/T1070/004"
        },
        {
          "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/",
          "description": "Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.",
          "source_name": "Trend Micro APT Attack Tools"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "File Deletion",
      "description": "Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.\n\nThere are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_contributors": [
        "Walker Johnson"
      ],
      "x_mitre_version": "1.0",
      "x_mitre_is_subtechnique": true,
      "x_mitre_permissions_required": [
        "User"
      ],
      "x_mitre_defense_bypassed": [
        "Host forensic analysis"
      ],
      "x_mitre_detection": "It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.",
      "x_mitre_data_sources": [
        "File: File Deletion",
        "Command: Command Execution"
      ],
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows"
      ],
      "x_killchain": "mitre-attack"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--a8292a55-fd56-4d12-8e86-733332985ff9",
      "created": "2021-09-03T09:30:21.153Z",
      "modified": "2021-09-03T09:30:21.153Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Malware Analysis Report: Infinite Second",
      "description": "Infinite Second is a malicious PowerShell script that is used to drop the ComRAT malware. It uses the registry to store configuration and necessary data, including an obfuscated version of ComRAT. It bootstraps by modifying the scheduled task of the Microsoft Customer Experience Improvement Program known as the Microsoft Consolidator. Some functionality requires Administrator permissions and execution policies that allow any PowerShell script to be run (e.g. ‘Unrestricted’), and which depend on PowerShell version 2 being installed.",
      "published": "2021-09-03T09:30:21.153Z",
      "external_references": [
        {
          "source_name": "NCSC",
          "external_id": "NCSC/MAR/Infinite-Second"
        }
      ],
      "report_types": [
        "malware"
      ],
      "object_refs": [
        "malware--dd9c1cf5-1a0e-43fb-be58-9f28c6ce0da5",
        "attack-pattern--d472402c-2d79-48e2-bc87-92b7d5ed5a1f",
        "relationship--d24c9603-11c3-4456-89eb-182d78a6c60f",
        "relationship--a13c533a-6da9-4d13-9421-ecd9abd118a4",
        "attack-pattern--9ae339b8-80ec-46b4-bea1-bffc534879d1",
        "relationship--c6742fda-5c75-4ab1-94db-291b143e49fa",
        "relationship--788a0402-251c-4350-820c-e9473edd26aa",
        "attack-pattern--a8c00a3c-35a2-4c3d-8f7c-220fc3a290dc",
        "relationship--76a69fd0-21e7-4e5d-ac75-479403219bb2",
        "relationship--bee5d3a8-590e-4ee0-a00e-132c103681cf",
        "attack-pattern--1099d10b-c4dc-402d-88db-27dec5fa3d2f",
        "relationship--8e21a5b7-a2e1-4a6b-a104-f87a7645c9ef",
        "relationship--5e4e5cd3-f6d2-41a2-8f05-7881a72a5bcc",
        "attack-pattern--19dc85dd-194f-4349-835b-7cf87ff41304",
        "relationship--dcd45c53-109e-43ad-97c5-dd887ddc7045",
        "relationship--0ab5b090-5192-4226-9e90-56f4f13f2c0b",
        "attack-pattern--4de6367e-2a30-4983-8202-32f021192241",
        "relationship--2106a461-50cc-421f-a566-fffa5a0ad981",
        "relationship--af222bc2-5f65-447a-8174-54a2d259b61d",
        "indicator--6b865bfe-a32f-4312-9e9d-9c83e469c066",
        "relationship--134748e4-1a09-4fba-972b-28e7e76031f9",
        "relationship--96fb3eed-6bde-4ffc-9014-36b31e5cf99b",
        "indicator--2e089951-ce57-48cc-9aaa-1fc71589dcb9",
        "relationship--7ac805c2-1904-4470-baed-b4850e912009",
        "relationship--aafcc00d-5329-4279-b151-c9b7ed7196f4",
        "indicator--e9e67f0b-c000-438a-8df5-802bdf790abe",
        "relationship--91e16478-8880-4be1-add7-e05858c5bbd8",
        "relationship--a85ea7e3-cbf8-402d-bf4e-9a5bcae9415b",
        "indicator--e9663b13-4f09-4515-a3ca-ab31fa29b218",
        "relationship--50c863a4-af9c-44d4-9194-f968f72022a8",
        "relationship--34503406-beda-40a4-9fc5-1fcb7be768ef",
        "relationship--cd86a150-f044-4ac4-b962-bc90574cd576",
        "relationship--26ae2da6-14d3-417a-95f1-e24511523692",
        "relationship--bb1395d0-88c4-4d07-85af-a495ea3a2a96",
        "relationship--6a78e786-8752-4eb1-b213-209222d0a95e",
        "relationship--0b45174f-69f6-4e58-a800-91050aa8cbd3",
        "relationship--06e0b703-7ae7-4cad-bd22-154a8909cf15",
        "relationship--35e69fb7-55d4-4b10-93bd-67351ae81f11",
        "relationship--84267d2b-827d-40f6-9745-8c1f3f75da54",
        "relationship--d4d41443-92af-411a-8ca4-88e696c6188e",
        "relationship--814471c9-fb8c-4c7c-ae17-71a7a6233338",
        "relationship--5f5c7d1b-5430-45e2-8124-ebbd39a26583",
        "relationship--83f7e2ad-55c7-4787-8c9d-a84ac6a22567",
        "relationship--9501aecd-70cb-49bd-a622-d2ab663e702b",
        "relationship--05bfcd1c-04a4-47d6-9826-04734390f024",
        "relationship--b1df6eb4-10f7-4850-8525-b4c7cca61557",
        "relationship--3a6727be-0f46-4497-a8fa-46b8f9be5ca3",
        "relationship--a061af92-2408-4ee3-8824-98f4e96b01a8",
        "relationship--c14384f9-7afa-4d69-82a5-8de0d3509c1c",
        "relationship--3a73c524-4a56-49f7-9ae3-bb351bb2d8dd",
        "relationship--e3d23637-aa62-43eb-ab37-2852934d8a6a",
        "relationship--7a5a10d3-c5cc-48a4-b3d3-f58cb7c7db67",
        "relationship--f491e3ce-ba36-4f51-a9f5-d50c1b2f5da6",
        "relationship--c53d62c7-77c5-4ce3-a8c7-0790cf4e72ba",
        "relationship--6dc890aa-92c9-45eb-babc-a092f384975e",
        "relationship--f72f8fd9-8470-4c0c-95e7-73d03080a4be",
        "relationship--6d09f7a5-88e9-4f91-9272-6d5e055aac64",
        "relationship--8ec2ae12-cbdd-40bf-a101-e675ddafecdd",
        "relationship--bbd8877a-52a3-40b2-b457-9b7143123520",
        "relationship--a8381c17-ea68-42c6-bba2-c9f46e3cb349",
        "relationship--f1a7c0d6-e63b-46f7-a473-7478c44661ab",
        "relationship--09204af1-ad88-4572-9af9-b5721ce17dbb",
        "relationship--dd22bd03-f6db-458d-b159-be21ad6f81b4",
        "relationship--9941a539-266b-4a60-88df-565e72c6cad4",
        "relationship--a3edc7e0-bc94-4b96-8372-1c68a870185b",
        "relationship--3d1aee2b-fb71-4616-b809-af50118d3ac0",
        "relationship--61c44d09-dcfa-49ca-963e-c369620285ff",
        "indicator--43312909-8f56-409b-883f-073fcb384d45",
        "relationship--5e7c9a40-1543-463f-9d6e-a5d41bb756f0",
        "indicator--712c12d3-5d7e-4c8e-8813-9321a5ad2501",
        "relationship--44cbedf4-fbce-4679-a8f7-c740a18a6697",
        "indicator--dca8fefc-fbb9-441f-a447-d09e0505f452",
        "relationship--e312f8b1-92b9-4c44-81df-2021c4c45190",
        "indicator--a4df6020-d48b-4d6a-9838-03396d01676b",
        "relationship--90645e89-6619-41ee-aea5-0adc6e2bd042",
        "indicator--9fe205d9-0078-4f60-8d41-487794824423",
        "relationship--e6928355-56a3-4b3f-a598-41bb2fe93ac1",
        "indicator--887281ae-3572-4904-aa99-3c75ebc9b33e",
        "relationship--f799765b-10ca-4e49-81ee-1a76ab025b7c",
        "indicator--e43a41e3-6223-4d07-9d82-0b64be745293",
        "relationship--bd6b40e5-8071-4f7d-9b9d-41a3591f43a1",
        "indicator--6fdeec78-92c1-4138-96e7-d1b2e45f6705",
        "relationship--cb85bdf8-2b76-4d06-b368-6f1b955b580e",
        "indicator--05f51d61-7b2e-4d33-8736-51a78afd6cb3",
        "relationship--23fa181d-18d5-4be2-bcea-7a8b4cc7bf84",
        "indicator--d6e973f3-7543-4851-952f-2d40c9f80fcb",
        "relationship--9b0755ea-5fae-4d10-a1f3-3e5059461fef",
        "indicator--371e2711-0722-45d2-8f5c-bd60e5627d66",
        "relationship--aecb8daf-e614-4b0d-afaa-94acf1ec7e0d",
        "indicator--b01f4ac7-21bd-429b-8a2b-46e849362d2d",
        "relationship--793b3304-6c74-4b3c-a7b6-1d43d9ba143b",
        "indicator--9e9d2afb-d08c-4888-8127-9e36d328f171",
        "relationship--338d2a23-c320-496b-8c41-ba6e58c23ff7",
        "indicator--b790013c-f646-484c-931f-27fe5f09996b",
        "relationship--f82f88ad-1111-429b-9467-b1d98418bbec",
        "indicator--877d5a66-6a78-4237-b914-29938da7d20d",
        "relationship--63816532-4339-401f-a7b1-e060bfbdcaac",
        "indicator--f90896ba-e181-4649-a99b-2b0286ec492d",
        "relationship--593096b1-7fea-4f4e-887d-1167ee502bdf",
        "indicator--8a30f11f-0f14-411c-b4da-e8dd963c2d55",
        "relationship--47bf0204-0ee0-42ad-a76e-d9990ce42cf8",
        "indicator--a569c3f3-a0d3-45ac-a898-d48638bfca83",
        "relationship--b84cf0a5-8e88-4654-a761-19db13ed4627",
        "indicator--c2562a69-66f8-4dd7-9cd9-41f2777c0ed7",
        "relationship--de6894e2-c4aa-4a45-9f93-6d530f066a5f",
        "relationship--d16645e5-7862-46a0-aa74-b0d2fecdfc87",
        "relationship--9366cef1-9db1-4702-bd71-76ede927d01d",
        "relationship--b95f9d4c-3894-422b-8d83-03c853a1c17a",
        "relationship--e1c00bb9-7b4f-4990-9fe6-d29054946230",
        "indicator--92a54e46-e09c-464f-aa6a-9d3bfe58bf02",
        "relationship--3029ee1d-ee6e-46f3-8f0b-12b0619427f2",
        "relationship--b41edf53-a9b0-4706-9657-78923ec23ca1",
        "relationship--670a22fa-5e9f-4299-adf0-54a52eda194c",
        "relationship--a0ef6f31-6880-4f31-a54c-8e16ebe4411d",
        "relationship--c12ca2c1-b143-448c-88af-559561b4ce74",
        "indicator--b41b3019-a6b4-4e33-9421-e42980880a2c",
        "relationship--828af84c-4a34-439f-b210-924f35d70f92",
        "relationship--0b52ca88-19f1-4b5d-be5f-3a6143dcefc5",
        "relationship--fab9377e-6460-4ce5-b619-3160700d77eb",
        "relationship--07729e71-eb36-4dc0-a9f2-d02e05e73580",
        "relationship--098afa09-c3ea-4554-8b36-bedc27fa8324",
        "indicator--92b8597c-7fbd-490b-8168-4a2e2f58d10f",
        "relationship--13b2564a-7cfc-4f93-997a-d9b25ff252b9",
        "relationship--4245bd48-726b-4500-82ed-52d7e08a46b6",
        "relationship--87b50111-5157-4fb5-85df-8daf9d1761d0",
        "relationship--b60da1f5-b84e-4e48-8226-a0d5729c9785",
        "relationship--98ec9008-6e57-4e91-88ea-6d37234be548",
        "indicator--e8280a1c-ea9c-4864-8ad2-bf407c9ef4fd",
        "relationship--0eafd8f0-73f8-4970-815f-55f38d0032cf",
        "relationship--6bf5c92e-690e-4bef-98c8-afee6c87046e",
        "relationship--b82dfcb1-00b9-4dbd-bade-2a631378f88d",
        "relationship--457bb99b-7f42-47aa-b890-f7f0c31668f1",
        "relationship--7e93212e-d65c-4ef9-8706-c9d37d87c81e",
        "indicator--ea31a56a-1dd5-4454-89d5-90f49186745e",
        "relationship--fee1313f-408b-4907-b7c8-78adbec14601",
        "relationship--36e4f325-a06f-40f7-a82e-610dc65e98f0",
        "relationship--6eabb771-216a-46a7-904b-fd5476c81e9c",
        "relationship--244fcaca-e932-4df1-9fe6-b5537b70202b",
        "relationship--20fd89a4-bafa-4ed7-a3ca-30e8d940b9ea",
        "indicator--fa5bb99b-7bf8-450a-9e32-b64ec118997f",
        "relationship--148d4b23-c1a1-438f-b35d-74c3079286ac",
        "relationship--838fbc5d-09ca-4a47-9c24-601d73ab4af1",
        "relationship--8ca4d469-d53e-468b-b5cf-eccec960ca75",
        "relationship--db5192ba-b7c7-4507-8f53-e92a5c9f0b7c",
        "relationship--b57bfba8-ddc6-4e9f-a427-a6410231b178",
        "indicator--d608c635-bf67-45c8-8c61-2cc8edd849f3",
        "relationship--b57d2b34-76be-46ce-9145-558cd7b4dd7b",
        "relationship--f6c785c5-352c-4b67-aa78-9b4e37a7741a",
        "relationship--c193c0a9-3d73-4977-98bb-5da54c877cf0",
        "relationship--6321a588-4e18-4b7f-8a4a-87499aeac0b7",
        "relationship--87d9e072-7d58-4d65-b871-32a7e4f16f0f"
      ]
    }
  ]
}