{ "type": "bundle", "spec_version": "2.1", "id": "bundle--30acc1a6-6157-4c54-95e0-b86238ab00c1", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "objects": [ { "type": "malware", "spec_version": "2.1", "id": "malware--ec285724-d62c-4f3c-a3d2-881b23375192", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Jolly Jellyfish", "description": "Jolly Jellyfish downloads and executes shellcode, which is hidden in legitimate bitmap image (BMP) files. HTTP is used to download image files. Debug information left in the samples suggest the author refers to this malware as fishmaster.\n", "malware_types": [ "downloader" ], "is_family": false, "capabilities": [ "anti-debugging", "installs-other-components", "communicates-with-c2", "hides-artifacts" ], "architecture_execution_envs": [ "x86-64" ], "implementation_languages": [ "c" ], "x_operating_systems": [ "windows" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--308d237e-81bf-463d-85de-91efd1fd7f2f", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Virtualization/Sandbox Evasion: System Checks as used by Jolly Jellyfish", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Jolly Jellyfish checks the available memory is greater than 1GB, the size of the disk is greater than 1GB, and the number of logical processors is greater than 0. These checks are designed to avoid running on a machine with low resources, as virtual machines and sandboxes are more likely to have low resources. If these checks fail the process will exit before any malicious behaviour occurs, avoiding detection." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--09e31205-8cd9-4a0e-b07c-c834762bffa8", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--308d237e-81bf-463d-85de-91efd1fd7f2f", "target_ref": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5978ed28-e596-431b-8cce-96c08d69b4aa", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192", "target_ref": "attack-pattern--308d237e-81bf-463d-85de-91efd1fd7f2f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1912f183-c032-427c-b4f6-1e705accd501", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Virtualization/Sandbox Evasion: Time Based Evasion as used by Jolly Jellyfish", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Jolly Jellyfish adds short sleep commands throughout execution, which could be an attempt to slow down execution enough to evade detection by automated analysis platforms." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f80907d-9f11-4957-ab7e-455f7c55e8df", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--1912f183-c032-427c-b4f6-1e705accd501", "target_ref": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0e22ab8a-ff37-46ea-bcb3-2d670ebc82e3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192", "target_ref": "attack-pattern--1912f183-c032-427c-b4f6-1e705accd501" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--261a1ac6-3700-495b-bf14-0bbb192625e1", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Application Layer Protocol: Web Protocols as used by Jolly Jellyfish", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Jolly Jellyfish downloads shellcode over HTTP." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb4a3fd3-d76c-4679-a812-22a59740105c", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--261a1ac6-3700-495b-bf14-0bbb192625e1", "target_ref": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--41ff2124-e638-4f1c-af0f-bf4d281a1bc0", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192", "target_ref": "attack-pattern--261a1ac6-3700-495b-bf14-0bbb192625e1" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--26cb9974-4b3a-4740-849b-ee80ee9e6831", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Data Obfuscation as used by Jolly Jellyfish", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Some variants of Jolly Jellyfish download XOR-encoded shellcode." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--55c68746-3488-444e-9db2-2464754c6feb", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--26cb9974-4b3a-4740-849b-ee80ee9e6831", "target_ref": "attack-pattern--ad255bfe-a9e6-4b52-a258-8d3462abe842" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--572e07ab-abcd-48c9-908e-70f2cbda8e98", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192", "target_ref": "attack-pattern--26cb9974-4b3a-4740-849b-ee80ee9e6831" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--893755ce-0e3a-43c3-9559-dc416091f295", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Data Obfuscation: Steganography as used by Jolly Jellyfish", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Jolly Jellyfish downloads shellcode contained within bitmap image (BMP) files." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8d96ca35-c834-447f-8e2f-0535504ad7bb", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--893755ce-0e3a-43c3-9559-dc416091f295", "target_ref": "attack-pattern--eec23884-3fa1-4d8a-ac50-6f104d51e235" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--94ebeb1c-5f14-41b7-b7e4-ffc4212a435f", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192", "target_ref": "attack-pattern--893755ce-0e3a-43c3-9559-dc416091f295" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--82ed60dc-bd37-475b-abda-c4c1f51f1262", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--b17581d8-7c6e-46ff-9cc9-b99ffc8961e6", "target_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f96ef26f-3d16-4037-bfe4-e68cf2d4a5ff", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--b17581d8-7c6e-46ff-9cc9-b99ffc8961e6", "target_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a1c8fb11-8743-4332-af5c-c311802ca30b", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--b17581d8-7c6e-46ff-9cc9-b99ffc8961e6", "target_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e62aa145-9b5c-428f-8d12-111231f11aab", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f", "target_ref": "indicator--b17581d8-7c6e-46ff-9cc9-b99ffc8961e6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--512fd9b1-2a0a-45e9-ad59-e4d150d84613", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f", "target_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1748e319-1cbd-4dd2-abde-81af89d8f4f8", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f", "target_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--035fa351-f234-4c92-8429-3f414fd9801f", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884", "target_ref": "indicator--b17581d8-7c6e-46ff-9cc9-b99ffc8961e6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e88d08f2-8b5f-4093-b88b-21f4c6db801a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884", "target_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1244b1e6-3bf5-496c-b5e8-3f4c776332e1", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884", "target_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6f513cb5-d376-4a45-8fb9-f02551a83512", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b", "target_ref": "indicator--b17581d8-7c6e-46ff-9cc9-b99ffc8961e6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4657c2eb-7071-4023-98e6-a5321391e315", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b", "target_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3655ceb6-cd52-4d92-a941-d52001f06439", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b", "target_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--88a74dbf-1200-46b9-854f-7831c2558886", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--3d620320-640b-48b5-bb3f-34cbc197afce", "target_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0d3bd05e-5fe5-432d-8e94-af545d765dae", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--3d620320-640b-48b5-bb3f-34cbc197afce", "target_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87b32d8c-3839-4b86-b92f-cb058bd2ccce", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--3d620320-640b-48b5-bb3f-34cbc197afce", "target_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77878a09-9029-4fa9-9b54-ba16c851f1ea", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063", "target_ref": "indicator--3d620320-640b-48b5-bb3f-34cbc197afce" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0dd808be-5c06-4c19-96f7-e921cc3432db", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063", "target_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--007da45b-a33b-47b8-b386-93b6a5907041", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063", "target_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--45a19579-35fb-49d2-bf5f-938b4d30c26a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3", "target_ref": "indicator--3d620320-640b-48b5-bb3f-34cbc197afce" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2d1098fe-c134-4acd-bea4-5d5e9ed7f7e4", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3", "target_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2614d8a5-3ec9-4864-b224-193f229b2720", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3", "target_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fad5d30c-ece4-4fa3-9c38-f2e1264394b2", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363", "target_ref": "indicator--3d620320-640b-48b5-bb3f-34cbc197afce" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--739f8582-e613-4e80-8c47-30fe0bc88af7", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363", "target_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03e1055f-98b1-4763-8ce6-399c79fff209", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363", "target_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8cab5e68-6589-44b0-a4de-4c79bddf1d21", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--ca876d33-e78f-4f8b-8b9a-41c5ef18b10c", "target_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ecc1a753-d95d-441b-9ea7-842b54611e7a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--ca876d33-e78f-4f8b-8b9a-41c5ef18b10c", "target_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fa4c32ca-232b-4529-a34c-5164dff1c7c9", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--ca876d33-e78f-4f8b-8b9a-41c5ef18b10c", "target_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c40a70c-b5be-48a6-8ee0-8f496272d50a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad", "target_ref": "indicator--ca876d33-e78f-4f8b-8b9a-41c5ef18b10c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ce7ed92-7a45-48e7-8f93-34f0e1084703", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad", "target_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--76de5b85-7c7f-4029-97c1-f9aff6294b36", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad", "target_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0d3c12d2-3a06-4db9-8a06-48cf19b40484", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f", "target_ref": "indicator--ca876d33-e78f-4f8b-8b9a-41c5ef18b10c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8b2a36e-27ca-42a3-8204-c634bf6415c6", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f", "target_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--79a1a07b-f670-4478-9c66-7e8aedb3061d", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f", "target_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c1fea651-fd36-44b5-aa3f-a8f30ed3ade7", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3", "target_ref": "indicator--ca876d33-e78f-4f8b-8b9a-41c5ef18b10c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c7e3ae6c-7159-4e5f-9060-9be4452ed75d", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3", "target_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c13ab2ed-21f2-49e7-9a34-eb4491dbe97a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3", "target_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--110bfb7a-fe6d-4868-a56b-9f6f37ba4467", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4d1c6279-9b5d-4cbd-a927-1b3ca6ca5b8d", "target_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2952e1b1-b96f-44ea-b139-bd84e5ec5743", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4d1c6279-9b5d-4cbd-a927-1b3ca6ca5b8d", "target_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f3bfb887-6d44-4296-8dd4-b3afea779fa1", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4d1c6279-9b5d-4cbd-a927-1b3ca6ca5b8d", "target_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f5dd0e27-87f4-4fff-baa9-4b6990b4e457", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5", "target_ref": "indicator--4d1c6279-9b5d-4cbd-a927-1b3ca6ca5b8d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b86e8410-b79b-450f-9320-7d412cdef6b3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5", "target_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--96442b54-02fe-43ba-94c3-3967f326cc6d", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5", "target_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a6a6cfa9-0325-41bb-b2cc-fe21e31e4d73", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a", "target_ref": "indicator--4d1c6279-9b5d-4cbd-a927-1b3ca6ca5b8d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ff4e409e-5906-402a-8c5a-1deb830e9d83", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a", "target_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d03418a4-73aa-4c68-967c-7bfa3459a4f6", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a", "target_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--27794bda-a032-4a86-bb79-5394d3d98657", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1", "target_ref": "indicator--4d1c6279-9b5d-4cbd-a927-1b3ca6ca5b8d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--21d94e57-8b6f-4ef2-ad93-1cf29175834b", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1", "target_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--13971af1-6647-46bb-ac28-2d8b0b0facba", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1", "target_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3fd9ef73-b941-4993-b90b-40a3cf0ff580", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--460c1485-822f-4d70-855c-7a3ef8f2fd87", "target_ref": "indicator--4a2ea99b-c3ef-49a4-b633-64c1f0ca865b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--35f34d0c-0ea7-4265-8bce-a5fa2dcecd56", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--460c1485-822f-4d70-855c-7a3ef8f2fd87", "target_ref": "indicator--372d1639-09b0-403a-b56f-5e45dde0ad88" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--51d9659a-d904-4d8a-ae7d-d94cee1b1158", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--460c1485-822f-4d70-855c-7a3ef8f2fd87", "target_ref": "indicator--0b849ed2-c49a-4a51-9095-92fc0578140b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9459abb1-a2c3-4f34-a80b-060c2925ea02", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4a2ea99b-c3ef-49a4-b633-64c1f0ca865b", "target_ref": "indicator--460c1485-822f-4d70-855c-7a3ef8f2fd87" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--99701140-47d1-426d-8780-8af2029dd39a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4a2ea99b-c3ef-49a4-b633-64c1f0ca865b", "target_ref": "indicator--372d1639-09b0-403a-b56f-5e45dde0ad88" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5d650054-494a-476f-a6ae-9a5fc85d3df3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4a2ea99b-c3ef-49a4-b633-64c1f0ca865b", "target_ref": "indicator--0b849ed2-c49a-4a51-9095-92fc0578140b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dd39cbb1-56c6-4746-b425-ae3a61509d2e", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--372d1639-09b0-403a-b56f-5e45dde0ad88", "target_ref": "indicator--460c1485-822f-4d70-855c-7a3ef8f2fd87" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd3f0c72-2185-41a2-bf7c-1b68d664f2f3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--372d1639-09b0-403a-b56f-5e45dde0ad88", "target_ref": "indicator--4a2ea99b-c3ef-49a4-b633-64c1f0ca865b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23625697-941a-46b6-8781-29ddbb9e27aa", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--372d1639-09b0-403a-b56f-5e45dde0ad88", "target_ref": "indicator--0b849ed2-c49a-4a51-9095-92fc0578140b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a9d3ffab-cd14-4abd-956f-37cace43e2d3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0b849ed2-c49a-4a51-9095-92fc0578140b", "target_ref": "indicator--460c1485-822f-4d70-855c-7a3ef8f2fd87" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b0d90af-9302-42fa-8c33-5d878face380", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0b849ed2-c49a-4a51-9095-92fc0578140b", "target_ref": "indicator--4a2ea99b-c3ef-49a4-b633-64c1f0ca865b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2e487172-3078-4e22-9a9d-c2ee888b3c69", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0b849ed2-c49a-4a51-9095-92fc0578140b", "target_ref": "indicator--372d1639-09b0-403a-b56f-5e45dde0ad88" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b17581d8-7c6e-46ff-9cc9-b99ffc8961e6", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'abcd461bdb6a6537b7a36848a87b5ea6.virus']", "description": "Jolly Jellyfish shellcode downloader which also downloads and executes a legitimate file", "valid_from": "2021-12-15T10:02:42.051Z", "name": "Jolly Jellyfish sample (Filename: abcd461bdb6a6537b7a36848a87b5ea6.virus)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d0396a74-1268-40b8-abf3-cdbc915ab512", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--b17581d8-7c6e-46ff-9cc9-b99ffc8961e6", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'abcd461bdb6a6537b7a36848a87b5ea6']", "description": "Jolly Jellyfish shellcode downloader which also downloads and executes a legitimate file", "valid_from": "2021-12-15T10:02:42.051Z", "name": "Jolly Jellyfish sample (MD5: abcd461bdb6a6537b7a36848a87b5ea6)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--78296626-b14f-4b52-bbda-46f337668f22", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'e99d5a620a488133f4da24e1f8d2d5e68542b6f3']", "description": "Jolly Jellyfish shellcode downloader which also downloads and executes a legitimate file", "valid_from": "2021-12-15T10:02:42.051Z", "name": "Jolly Jellyfish sample (SHA-1: e99d5a620a488133f4da24e1f8d2d5e68542b6f3)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--177b091f-3cd7-45d5-b2bc-0e0bd8c5d1b5", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'f21a9c69bfca6f0633ba1e669e5cf86bd8fc55b2529cd9b064ff9e2e129525e8']", "description": "Jolly Jellyfish shellcode downloader which also downloads and executes a legitimate file", "valid_from": "2021-12-15T10:02:42.051Z", "name": "Jolly Jellyfish sample (SHA-256: f21a9c69bfca6f0633ba1e669e5cf86bd8fc55b2529cd9b064ff9e2e129525e8)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--25a58023-9cda-4c10-8bfc-32c1e783f295", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3d620320-640b-48b5-bb3f-34cbc197afce", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'Browser_plugin (8).exe']", "description": "Jolly Jellyfish shellcode downloader, of XOR-obfuscated shellcode, additionally displays a message box on execution", "valid_from": "2021-12-15T10:02:42.052Z", "name": "Jolly Jellyfish sample (Filename: Browser_plugin (8).exe)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7689664a-9903-49a5-afbe-824e12fb2c9a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--3d620320-640b-48b5-bb3f-34cbc197afce", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--26677f80-9ce8-4e36-85f3-63d527445063", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'a241ff3d86925a4a12916b401536b019']", "description": "Jolly Jellyfish shellcode downloader, of XOR-obfuscated shellcode, additionally displays a message box on execution", "valid_from": "2021-12-15T10:02:42.052Z", "name": "Jolly Jellyfish sample (MD5: a241ff3d86925a4a12916b401536b019)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60410e10-a227-48cc-973c-c5b13f9e4319", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'd28eacb1b4d2e9ef54f7dff09ca03a6866fc9184']", "description": "Jolly Jellyfish shellcode downloader, of XOR-obfuscated shellcode, additionally displays a message box on execution", "valid_from": "2021-12-15T10:02:42.052Z", "name": "Jolly Jellyfish sample (SHA-1: d28eacb1b4d2e9ef54f7dff09ca03a6866fc9184)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e913866d-3bd2-468d-a133-288900b5cb27", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c7551012-c027-48d4-ac33-a57c7caea363", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'a7e9e2bec3ad283a9a0b130034e822c8b6dfd26dda855f883a3a4ff785514f97']", "description": "Jolly Jellyfish shellcode downloader, of XOR-obfuscated shellcode, additionally displays a message box on execution", "valid_from": "2021-12-15T10:02:42.052Z", "name": "Jolly Jellyfish sample (SHA-256: a7e9e2bec3ad283a9a0b130034e822c8b6dfd26dda855f883a3a4ff785514f97)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc3e5bcc-9e9e-4b19-9e05-1ea93656e7f3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ca876d33-e78f-4f8b-8b9a-41c5ef18b10c", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'Browser_Plugin.exe']", "description": "Jolly Jellyfish shellcode downloader of XOR-obfuscated shellcode, additionally downloads a legitimate file and displays a message box on execution", "valid_from": "2021-12-15T10:02:42.052Z", "name": "Jolly Jellyfish sample (Filename: Browser_Plugin.exe)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--79164a2b-84c4-4748-ab60-d647153121bc", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--ca876d33-e78f-4f8b-8b9a-41c5ef18b10c", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '738f46546f6d4a79e2d917b26bf8a93a']", "description": "Jolly Jellyfish shellcode downloader of XOR-obfuscated shellcode, additionally downloads a legitimate file and displays a message box on execution", "valid_from": "2021-12-15T10:02:42.052Z", "name": "Jolly Jellyfish sample (MD5: 738f46546f6d4a79e2d917b26bf8a93a)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a7c6b43e-c343-4d43-83fa-0ea67430ade8", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '834e80f6fa9935fd3184c25e4e37b0a068a773ee']", "description": "Jolly Jellyfish shellcode downloader of XOR-obfuscated shellcode, additionally downloads a legitimate file and displays a message box on execution", "valid_from": "2021-12-15T10:02:42.053Z", "name": "Jolly Jellyfish sample (SHA-1: 834e80f6fa9935fd3184c25e4e37b0a068a773ee)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--04ff0567-59e5-4f61-ab9e-1408ca1d487e", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '4a43fa8a3305c2a17f6a383fb68f02515f589ba112c6e95f570ce421cc690910']", "description": "Jolly Jellyfish shellcode downloader of XOR-obfuscated shellcode, additionally downloads a legitimate file and displays a message box on execution", "valid_from": "2021-12-15T10:02:42.053Z", "name": "Jolly Jellyfish sample (SHA-256: 4a43fa8a3305c2a17f6a383fb68f02515f589ba112c6e95f570ce421cc690910)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e7fbdc4d-3dc2-4195-a132-d64feab81e70", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4d1c6279-9b5d-4cbd-a927-1b3ca6ca5b8d", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'bk.exe']", "description": "Jolly Jellyfish shellcode downloader", "valid_from": "2021-12-15T10:02:42.053Z", "name": "Jolly Jellyfish sample (Filename: bk.exe)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--43699999-ec05-4e34-9d41-325b6d1e46a5", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4d1c6279-9b5d-4cbd-a927-1b3ca6ca5b8d", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '014dac67e8c32a25ccb024d1d1017b58']", "description": "Jolly Jellyfish shellcode downloader", "valid_from": "2021-12-15T10:02:42.053Z", "name": "Jolly Jellyfish sample (MD5: 014dac67e8c32a25ccb024d1d1017b58)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--68e794df-b0f3-4ed1-b0e2-832e9c464701", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'ba5558d79dadc12bbbe07e3444441d51d5e5931e']", "description": "Jolly Jellyfish shellcode downloader", "valid_from": "2021-12-15T10:02:42.053Z", "name": "Jolly Jellyfish sample (SHA-1: ba5558d79dadc12bbbe07e3444441d51d5e5931e)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b36bc2a6-9872-478c-867e-a77630f0718b", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '0df3b6e2535f8bb564183ab4e5e47d9b30ffc0204cc5bda1bae8984cdc418410']", "description": "Jolly Jellyfish shellcode downloader", "valid_from": "2021-12-15T10:02:42.053Z", "name": "Jolly Jellyfish sample (SHA-256: 0df3b6e2535f8bb564183ab4e5e47d9b30ffc0204cc5bda1bae8984cdc418410)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4698b1a5-7d26-44e7-9cce-5b8086a2954c", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--460c1485-822f-4d70-855c-7a3ef8f2fd87", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'x37.bmp']", "description": "Jolly Jellyfish payload", "valid_from": "2021-12-15T10:02:42.054Z", "name": "Jolly Jellyfish sample (Filename: x37.bmp)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--98e1846b-6682-4bf1-ba9b-662110b27634", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--460c1485-822f-4d70-855c-7a3ef8f2fd87", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4a2ea99b-c3ef-49a4-b633-64c1f0ca865b", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'a8c4ac44a5aa9d22319fe4b20cc5e790']", "description": "Jolly Jellyfish payload", "valid_from": "2021-12-15T10:02:42.054Z", "name": "Jolly Jellyfish sample (MD5: a8c4ac44a5aa9d22319fe4b20cc5e790)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4cc4f373-1b84-49be-abba-2dd7c02395f0", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4a2ea99b-c3ef-49a4-b633-64c1f0ca865b", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--372d1639-09b0-403a-b56f-5e45dde0ad88", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '7c348809e99c0be3ba5c122009a2cd15ad50b7bf']", "description": "Jolly Jellyfish payload", "valid_from": "2021-12-15T10:02:42.054Z", "name": "Jolly Jellyfish sample (SHA-1: 7c348809e99c0be3ba5c122009a2cd15ad50b7bf)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad968725-73f4-491a-8ee5-86ba3b0a67e8", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--372d1639-09b0-403a-b56f-5e45dde0ad88", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0b849ed2-c49a-4a51-9095-92fc0578140b", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'f0449c41bc3eebb8ea025fafc5b0cd1fcbe9a2d80c447ecc00cf3cab43e1c311']", "description": "Jolly Jellyfish payload", "valid_from": "2021-12-15T10:02:42.054Z", "name": "Jolly Jellyfish sample (SHA-256: f0449c41bc3eebb8ea025fafc5b0cd1fcbe9a2d80c447ecc00cf3cab43e1c311)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--61708026-4c7e-4aca-a04f-4f9c8958a159", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0b849ed2-c49a-4a51-9095-92fc0578140b", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule JollyJellyfish_unique_string_Bidenhappyhappyhappy \r\n{ \r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the “Bidenhappyhappyhappy” string used by the Jolly Jellyfish malware\"\r\n date = \"2021-12-15\"\r\n hash1 = \"e99d5a620a488133f4da24e1f8d2d5e68542b6f3\"\r\n hash2 = \"834e80f6fa9935fd3184c25e4e37b0a068a773ee\"\r\n hash3 = \"d28eacb1b4d2e9ef54f7dff09ca03a6866fc9184\"\r\n hash4 = \"ba5558d79dadc12bbbe07e3444441d51d5e5931e\"\r\n \r\n strings: \r\n $1 = \"Bidenhappyhappyhappy\" \r\n\t\t \r\n condition: \r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n all of them \r\n} \r\n", "description": "Detects the “Bidenhappyhappyhappy” string used by the Jolly Jellyfish malware", "valid_from": "2021-12-15T10:02:42.055Z", "name": "YARA: JollyJellyfish_unique_string_Bidenhappyhappyhappy", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--260f731c-a2d7-49fb-8c4a-e940ed98ade6", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--44999cc6-f7ac-45e7-aab7-9fc81c25b0a7", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--98970331-eb85-4a58-a41a-4488d2ab5809", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--43a164d6-736f-4ff4-b44b-0bf6a26b6e9a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--934e1691-3536-406c-840a-52df9ccad8ab", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e5ce70e7-a1a7-4784-9efd-8458f86ebf91", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3aeef239-f959-4d0e-a673-58983c6ce93f", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3e8aa733-1d1e-4445-8250-fe5117d7a7ec", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c25cd459-fae9-41da-9292-05aa99786de5", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c55c6b7-8bab-4784-bda0-d91f6c4c3785", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dc65a72b-ecce-4abe-abfe-d998ee5fbe1e", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c639856-e58b-4f62-ae3c-4a85d92bfbff", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--152668c9-d126-4b9c-bcb9-64cc2e6c4c4c", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "target_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a79639eb-8e04-4a66-8e7c-0d4015f1e2db", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule JollyJellyfish_unique_messagebox_display_string \r\n{ \r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the string displayed by the message box in some variants of Jolly Jellyfish\"\r\n date = \"2021-12-15\"\r\n hash1 = \"d28eacb1b4d2e9ef54f7dff09ca03a6866fc9184\"\r\n hash2 = \"834e80f6fa9935fd3184c25e4e37b0a068a773ee\"\r\n \r\n strings: \r\n $popuptext = {E4 AF C0 C0 C6 F7 B2 E5 BC FE D2 D1 BE AD B3 C9 B9 A6 B8 FC D0 C2 A3 AC C7 EB D6 D8 C6 F4 E4 AF C0 C0 C6 F7 A3 A1} \r\n\t\t \r\n condition: \r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n all of them \r\n} \r\n", "description": "Detects the string displayed by the message box in some variants of Jolly Jellyfish", "valid_from": "2021-12-15T10:02:42.056Z", "name": "YARA: JollyJellyfish_unique_messagebox_display_string ", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd2bd345-2bfa-4782-9832-e07d4d67dbc0", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a79639eb-8e04-4a66-8e7c-0d4015f1e2db", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5994cb35-7d0e-4373-99b8-cb54d1005cd3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a79639eb-8e04-4a66-8e7c-0d4015f1e2db", "target_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f7633f1-6fca-417e-8d86-8e99a447b662", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a79639eb-8e04-4a66-8e7c-0d4015f1e2db", "target_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a1b1e19a-f012-45c5-b293-9f7a12393799", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a79639eb-8e04-4a66-8e7c-0d4015f1e2db", "target_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e5e6c980-ea71-49db-bb27-71313eeb3de9", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a79639eb-8e04-4a66-8e7c-0d4015f1e2db", "target_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4a53078f-7030-48fe-9d17-d027057eb203", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a79639eb-8e04-4a66-8e7c-0d4015f1e2db", "target_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d4949b8-2a6e-48a5-b345-0a9ca3369666", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a79639eb-8e04-4a66-8e7c-0d4015f1e2db", "target_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule JollyJellyfish_check_memory_greater_1gb \r\n{ \r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Jolly Jellyfish check for memory being greater than 1GB\"\r\n date = \"2021-12-15\"\r\n hash1 = \"e99d5a620a488133f4da24e1f8d2d5e68542b6f3\"\r\n hash2 = \"d28eacb1b4d2e9ef54f7dff09ca03a6866fc9184\"\r\n hash3 = \"834e80f6fa9935fd3184c25e4e37b0a068a773ee\"\r\n hash4 = \"ba5558d79dadc12bbbe07e3444441d51d5e5931e\"\r\n strings: \r\n $1 = {33 D2 48 8B 44 ?? 38 B9 00 04 00 00 48 F7 F1 33 D2 B9 00 04 00 00 48 F7 F1 89 44 ?? ?? 81 7C ?? ?? 00 04 00 00} \r\n $2 = {48 8B 44 ?? 38 48 C1 E8 14 ?? 00 04 00 00} \r\n condition: \r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n any of them \r\n} \r\n", "description": "Detects Jolly Jellyfish check for memory being greater than 1GB", "valid_from": "2021-12-15T10:02:42.056Z", "name": "YARA: JollyJellyfish_check_memory_greater_1gb ", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aee0ee18-f382-4675-8ac4-74c4ecd0ab07", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03a51106-99e3-41b2-95f6-0c19f9ccad25", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "attack-pattern--308d237e-81bf-463d-85de-91efd1fd7f2f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e78c1ed-d8db-45c7-bf0b-63dbdc0d115a", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0d094b29-d2d3-4397-8d5a-457e6781a793", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--75d6cf05-0d5d-477a-9491-5f1f6d277616", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb3a058a-960a-475f-a962-ede41347d532", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7a4b8e90-483d-413c-a110-96b40e005420", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8461bea-4e7f-4b57-8e50-d3878ddc8bc4", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b6fc5f9-9cbf-4a0d-9892-58ab78dcd3ed", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--872b4b11-ebc2-41c8-8917-408f1f40ab67", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--40e943e4-abe5-404e-b34f-41dede6da877", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--301145e1-c164-4cad-87a4-5cf895d51baf", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50d48a5b-d4d5-47f9-84b4-940f1cb8293e", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--66ed2098-a3dd-4418-903c-15b78deea441", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "target_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule JollyJellyfish_pdb_string \r\n{ \r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the Jolly Jellyfish PDB string\"\r\n date = \"2021-12-15\"\r\n hash1 = \"e99d5a620a488133f4da24e1f8d2d5e68542b6f3\"\r\n hash2 = \"834e80f6fa9935fd3184c25e4e37b0a068a773ee\"\r\n hash3 = \"d28eacb1b4d2e9ef54f7dff09ca03a6866fc9184\"\r\n hash4 = \"ba5558d79dadc12bbbe07e3444441d51d5e5931e\"\r\n \r\n strings: \r\n $pdb = \"fishmaster.pdb\" \r\n \r\n condition: \r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n any of them \r\n} \r\n", "description": "Detects the Jolly Jellyfish PDB string", "valid_from": "2021-12-15T10:02:42.057Z", "name": "YARA: JollyJellyfish_pdb_string", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a064c6a7-8051-44a4-b5c4-9cfd0a0dcbf4", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d373f958-de45-414f-8826-e5f457c60822", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9325abad-8c41-4165-9c81-cdc1992b3149", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bab8c055-2192-47f6-9744-84228510ee58", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4f9c777e-776b-4d2d-9f1c-95a05e30be22", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6735ca91-07d9-4f0d-8c0a-3d25d3518568", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--94491e57-6063-4af8-a832-658dcadabd23", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3c658198-fcb8-44c9-b91a-350f4c3101ba", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2bdadf8e-b167-4525-b54b-f28ec4190dd3", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--79c4e899-7e45-410c-b8e2-5656fa6afbac", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d9a116d3-8f55-470d-89ef-1b3ee0339cc8", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c4f40a1-9b98-427a-975d-ba00fe6e0e2d", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7fa4995a-6c25-4fed-aa63-d369ba2e1ab5", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "target_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule JollyJellyfish_identify_shellcode_start_addr \r\n{ \r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects Jolly Jellyfish finding the start address of the shellcode in the downloaded data\"\r\n date = \"2021-12-15\"\r\n hash1 = \"e99d5a620a488133f4da24e1f8d2d5e68542b6f3\"\r\n hash2 = \"d28eacb1b4d2e9ef54f7dff09ca03a6866fc9184\"\r\n hash3 = \"834e80f6fa9935fd3184c25e4e37b0a068a773ee\"\r\n hash4 = \"ba5558d79dadc12bbbe07e3444441d51d5e5931e\"\r\n \r\n strings: \r\n $1 = {48 89 84 24 ?? 00 00 00 48 8B 84 24 ?? 00 00 00 8B 40 0A 48 8B 4C 24 ?? 48 8D 44 01 03} \r\n $2 = {8B 43 0A 48 83 C0 03 48 03 D8} \r\n condition: \r\n uint16(0) == 0x5A4D and \r\n uint32(uint32(0x3c)) == 0x00004550 and \r\n any of them \r\n} \r\n", "description": "Detects Jolly Jellyfish finding the start address of the shellcode in the downloaded data", "valid_from": "2021-12-15T10:02:42.058Z", "name": "YARA: JollyJellyfish_identify_shellcode_start_addr ", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f90dc58-060f-4a3b-a60a-04e7b88da381", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9578338-e448-4a24-94c9-aa490324156d", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--19827534-3887-48c1-8766-ce7e08ea4287", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60e71c25-dc79-4f7c-bb84-0a879cb8bf47", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ae569f0-b235-4d70-8fa8-576a5e4f9526", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a08cdd16-3091-43c0-a884-ad2553228539", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--47d1363c-9455-4bff-a500-5f7a3629c613", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2ee9b334-9b33-449f-84ed-3cd15f9f2815", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--713ee099-40ff-4e94-80c7-4a45cbb9fbad", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9af85dec-bb5b-4cc3-95b7-896f52ec7da5", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--97caec76-c551-4828-809d-a1e80f353cae", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c8b55c03-0739-4649-99e1-4f99920d6d50", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5728c37-7cfa-450d-8190-9d4c98914314", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "target_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e229dba4-1747-4812-8e15-61de6932defa", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[url:value = 'http://download.google-images[.]ml:8880/downloa/37.bmp ']", "description": "URL for downloading shellcode", "valid_from": "2021-12-15T10:02:42.059Z", "name": "URL: http://download.google-images[.]ml:8880/downloa/37.bmp ", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8faf4e91-200b-4b67-a6cb-07cbf64a0a2d", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--e229dba4-1747-4812-8e15-61de6932defa", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6110de97-d3f7-4b7c-9f29-998fe751d5be", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--e229dba4-1747-4812-8e15-61de6932defa", "target_ref": "attack-pattern--261a1ac6-3700-495b-bf14-0bbb192625e1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ea790b5a-aa51-467e-b502-882a47c08b77", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--e229dba4-1747-4812-8e15-61de6932defa", "target_ref": "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3e3c401c-aaa4-4199-b658-03dbcf77db3b", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--e229dba4-1747-4812-8e15-61de6932defa", "target_ref": "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f58a3109-7e08-4060-bd8e-0122eb4efed7", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--e229dba4-1747-4812-8e15-61de6932defa", "target_ref": "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--998e4a70-2ae9-4ada-b8c8-2f3822243fb1", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[url:value = 'http://download.google-images[.]ml:8880/download/x37.bmp ']", "description": "URL for downloading shellcode", "valid_from": "2021-12-15T10:02:42.059Z", "name": "URL: http://download.google-images[.]ml:8880/download/x37.bmp ", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8e8e7bcd-22c6-4c4a-b459-151ecdc9d029", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--998e4a70-2ae9-4ada-b8c8-2f3822243fb1", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f1c3137e-33ad-43ef-8572-dd9899b1e4fe", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--998e4a70-2ae9-4ada-b8c8-2f3822243fb1", "target_ref": "attack-pattern--261a1ac6-3700-495b-bf14-0bbb192625e1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a55f7edc-5d31-46bf-972e-d2fa2eae618c", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--998e4a70-2ae9-4ada-b8c8-2f3822243fb1", "target_ref": "indicator--26677f80-9ce8-4e36-85f3-63d527445063" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ab37bbe0-5b9d-4803-9cdb-5ac24ad81991", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--998e4a70-2ae9-4ada-b8c8-2f3822243fb1", "target_ref": "indicator--5639173b-bec6-4492-9c74-abec2ae930f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--846b87e1-7e9e-4448-8e1c-82a079ebdfbe", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--998e4a70-2ae9-4ada-b8c8-2f3822243fb1", "target_ref": "indicator--c7551012-c027-48d4-ac33-a57c7caea363" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9567bd0f-8071-45e7-b667-25bcf4a4539e", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[url:value = 'http://micsoftin[.]us:2086/dow/83.bmp']", "description": "URL for downloading shellcode", "valid_from": "2021-12-15T10:02:42.059Z", "name": "URL: http://micsoftin[.]us:2086/dow/83.bmp", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e0a31412-b9cd-4b3c-af14-57b102a29826", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--9567bd0f-8071-45e7-b667-25bcf4a4539e", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--33e0a97b-37be-418a-9dd4-b1670ae7f84c", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--9567bd0f-8071-45e7-b667-25bcf4a4539e", "target_ref": "attack-pattern--261a1ac6-3700-495b-bf14-0bbb192625e1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70bb828c-9e9b-4098-96ba-82110b09c13e", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--9567bd0f-8071-45e7-b667-25bcf4a4539e", "target_ref": "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--89bf371f-6e4e-4e2f-bda0-9e4d6a9b3e3d", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--9567bd0f-8071-45e7-b667-25bcf4a4539e", "target_ref": "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--31f1ed89-9464-4364-b587-1107cf83a443", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--9567bd0f-8071-45e7-b667-25bcf4a4539e", "target_ref": "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--49c97f8c-514a-460d-9c70-6b0081509da9", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[url:value = 'http://172.20.10[.]6/save.bmp ']", "description": "URL for downloading shellcode", "valid_from": "2021-12-15T10:02:42.060Z", "name": "URL: http://172.20.10[.]6/save.bmp ", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7a1855c8-0b71-4790-bc8e-4d0573f2c269", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--49c97f8c-514a-460d-9c70-6b0081509da9", "target_ref": "malware--ec285724-d62c-4f3c-a3d2-881b23375192" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c4a85af-76e4-4bb9-8292-b4482e6f4910", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--49c97f8c-514a-460d-9c70-6b0081509da9", "target_ref": "attack-pattern--261a1ac6-3700-495b-bf14-0bbb192625e1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb514bb8-9036-4fcf-b0d3-63bf0f7d42f7", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--49c97f8c-514a-460d-9c70-6b0081509da9", "target_ref": "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--af981356-009c-40bc-a691-b0a815b0369d", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--49c97f8c-514a-460d-9c70-6b0081509da9", "target_ref": "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b3daf0e-351a-44e4-873c-fbc115a7d495", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--49c97f8c-514a-460d-9c70-6b0081509da9", "target_ref": "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", "created": "2022-10-01T00:00:00.000Z", "modified": "2022-10-01T00:00:00.000Z", "name": "TLP:CLEAR", "extensions": { "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": { "extension_type": "property-extension", "tlp_2_0" : "clear" } } }, { "type": "identity", "spec_version": "2.1", "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "name": "NCSC", "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "description": "Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors. \n\nSpecific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. \n\nChecks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. \n\nOther common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. \n \nHardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)", "name": "System Checks", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1497.001", "url": "https://attack.mitre.org/techniques/T1497/001" }, { "source_name": "McAfee Virtual Jan 2017", "url": "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/", "description": "Roccia, T. (2017, January 19). Stopping Malware With a Fake Virtual Machine. Retrieved April 17, 2019." }, { "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/", "description": "Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.", "source_name": "Unit 42 OilRig Sept 2018" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" }, { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_contributors": [ "Deloitte Threat Library Team" ], "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_detection": "Virtualization/sandbox related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.", "x_mitre_is_subtechnique": true, "x_mitre_version": "2.0", "x_mitre_defense_bypassed": [ "Static File Analysis", "Signature-based detection", "Host forensic analysis", "Anti-virus" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "description": "Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.\n\nAdversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.\n\nAdversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)", "name": "Time Based Evasion", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1497.003", "url": "https://attack.mitre.org/techniques/T1497/003" }, { "source_name": "ISACA Malware Tricks", "url": "https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/evasive-malware-tricks-how-malware-evades-detection-by-sandboxes", "description": "Kolbitsch, C. (2017, November 1). Evasive Malware Tricks: How Malware Evades Detection by Sandboxes. Retrieved March 30, 2021." } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" }, { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_contributors": [ "Deloitte Threat Library Team" ], "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_detection": "Time-based evasion will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection. ", "x_mitre_is_subtechnique": true, "x_mitre_version": "1.1", "x_mitre_defense_bypassed": [ "Host forensic analysis", "Signature-based detection", "Static File Analysis", "Anti-virus" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Web Protocols", "description": "Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as HTTP and HTTPS that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)\n\nMonitor for web traffic to/from known-bad or suspicious domains. ", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Traffic Content" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ad255bfe-a9e6-4b52-a258-8d3462abe842", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Data Obfuscation", "description": "Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols. ", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1001", "url": "https://attack.mitre.org/techniques/T1001" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "x_mitre_is_subtechnique": false, "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_network_requirements": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Content" ], "x_mitre_version": "1.1", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--eec23884-3fa1-4d8a-ac50-6f104d51e235", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1001.002", "url": "https://attack.mitre.org/techniques/T1001/002" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Steganography", "description": "Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control. ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Content" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "report", "spec_version": "2.1", "id": "report--39f59e12-9a02-4edd-9673-ce0a7e733e24", "created": "2021-12-15T00:00:00.000Z", "modified": "2021-12-15T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Malware Analysis Report: Jolly Jellyfish", "description": "Non-persistent downloader for shellcode embedded in image files. Jolly Jellyfish downloads and executes shellcode, which is hidden in legitimate bitmap image (BMP) files. HTTP is used to download image files. Debug information left in the samples suggest the author refers to this malware as fishmaster.", "published": "2021-12-15T00:00:00.000Z", "external_references": [ { "source_name": "NCSC", "external_id": "NCSC/MAR/Jolly-Jellyfish" } ], "report_types": [ "malware" ], "object_refs": [ "malware--ec285724-d62c-4f3c-a3d2-881b23375192", "attack-pattern--308d237e-81bf-463d-85de-91efd1fd7f2f", "relationship--09e31205-8cd9-4a0e-b07c-c834762bffa8", "relationship--5978ed28-e596-431b-8cce-96c08d69b4aa", "attack-pattern--1912f183-c032-427c-b4f6-1e705accd501", "relationship--0f80907d-9f11-4957-ab7e-455f7c55e8df", "relationship--0e22ab8a-ff37-46ea-bcb3-2d670ebc82e3", "attack-pattern--261a1ac6-3700-495b-bf14-0bbb192625e1", "relationship--fb4a3fd3-d76c-4679-a812-22a59740105c", "relationship--41ff2124-e638-4f1c-af0f-bf4d281a1bc0", "attack-pattern--26cb9974-4b3a-4740-849b-ee80ee9e6831", "relationship--55c68746-3488-444e-9db2-2464754c6feb", "relationship--572e07ab-abcd-48c9-908e-70f2cbda8e98", "attack-pattern--893755ce-0e3a-43c3-9559-dc416091f295", "relationship--8d96ca35-c834-447f-8e2f-0535504ad7bb", "relationship--94ebeb1c-5f14-41b7-b7e4-ffc4212a435f", "relationship--82ed60dc-bd37-475b-abda-c4c1f51f1262", "relationship--f96ef26f-3d16-4037-bfe4-e68cf2d4a5ff", "relationship--a1c8fb11-8743-4332-af5c-c311802ca30b", "relationship--e62aa145-9b5c-428f-8d12-111231f11aab", "relationship--512fd9b1-2a0a-45e9-ad59-e4d150d84613", "relationship--1748e319-1cbd-4dd2-abde-81af89d8f4f8", "relationship--035fa351-f234-4c92-8429-3f414fd9801f", "relationship--e88d08f2-8b5f-4093-b88b-21f4c6db801a", "relationship--1244b1e6-3bf5-496c-b5e8-3f4c776332e1", "relationship--6f513cb5-d376-4a45-8fb9-f02551a83512", "relationship--4657c2eb-7071-4023-98e6-a5321391e315", "relationship--3655ceb6-cd52-4d92-a941-d52001f06439", "relationship--88a74dbf-1200-46b9-854f-7831c2558886", "relationship--0d3bd05e-5fe5-432d-8e94-af545d765dae", "relationship--87b32d8c-3839-4b86-b92f-cb058bd2ccce", "relationship--77878a09-9029-4fa9-9b54-ba16c851f1ea", "relationship--0dd808be-5c06-4c19-96f7-e921cc3432db", "relationship--007da45b-a33b-47b8-b386-93b6a5907041", "relationship--45a19579-35fb-49d2-bf5f-938b4d30c26a", "relationship--2d1098fe-c134-4acd-bea4-5d5e9ed7f7e4", "relationship--2614d8a5-3ec9-4864-b224-193f229b2720", "relationship--fad5d30c-ece4-4fa3-9c38-f2e1264394b2", "relationship--739f8582-e613-4e80-8c47-30fe0bc88af7", "relationship--03e1055f-98b1-4763-8ce6-399c79fff209", "relationship--8cab5e68-6589-44b0-a4de-4c79bddf1d21", "relationship--ecc1a753-d95d-441b-9ea7-842b54611e7a", "relationship--fa4c32ca-232b-4529-a34c-5164dff1c7c9", "relationship--9c40a70c-b5be-48a6-8ee0-8f496272d50a", "relationship--0ce7ed92-7a45-48e7-8f93-34f0e1084703", "relationship--76de5b85-7c7f-4029-97c1-f9aff6294b36", "relationship--0d3c12d2-3a06-4db9-8a06-48cf19b40484", "relationship--f8b2a36e-27ca-42a3-8204-c634bf6415c6", "relationship--79a1a07b-f670-4478-9c66-7e8aedb3061d", "relationship--c1fea651-fd36-44b5-aa3f-a8f30ed3ade7", "relationship--c7e3ae6c-7159-4e5f-9060-9be4452ed75d", "relationship--c13ab2ed-21f2-49e7-9a34-eb4491dbe97a", "relationship--110bfb7a-fe6d-4868-a56b-9f6f37ba4467", "relationship--2952e1b1-b96f-44ea-b139-bd84e5ec5743", "relationship--f3bfb887-6d44-4296-8dd4-b3afea779fa1", "relationship--f5dd0e27-87f4-4fff-baa9-4b6990b4e457", "relationship--b86e8410-b79b-450f-9320-7d412cdef6b3", "relationship--96442b54-02fe-43ba-94c3-3967f326cc6d", "relationship--a6a6cfa9-0325-41bb-b2cc-fe21e31e4d73", "relationship--ff4e409e-5906-402a-8c5a-1deb830e9d83", "relationship--d03418a4-73aa-4c68-967c-7bfa3459a4f6", "relationship--27794bda-a032-4a86-bb79-5394d3d98657", "relationship--21d94e57-8b6f-4ef2-ad93-1cf29175834b", "relationship--13971af1-6647-46bb-ac28-2d8b0b0facba", "relationship--3fd9ef73-b941-4993-b90b-40a3cf0ff580", "relationship--35f34d0c-0ea7-4265-8bce-a5fa2dcecd56", "relationship--51d9659a-d904-4d8a-ae7d-d94cee1b1158", "relationship--9459abb1-a2c3-4f34-a80b-060c2925ea02", "relationship--99701140-47d1-426d-8780-8af2029dd39a", "relationship--5d650054-494a-476f-a6ae-9a5fc85d3df3", "relationship--dd39cbb1-56c6-4746-b425-ae3a61509d2e", "relationship--bd3f0c72-2185-41a2-bf7c-1b68d664f2f3", "relationship--23625697-941a-46b6-8781-29ddbb9e27aa", "relationship--a9d3ffab-cd14-4abd-956f-37cace43e2d3", "relationship--5b0d90af-9302-42fa-8c33-5d878face380", "relationship--2e487172-3078-4e22-9a9d-c2ee888b3c69", "indicator--b17581d8-7c6e-46ff-9cc9-b99ffc8961e6", "relationship--d0396a74-1268-40b8-abf3-cdbc915ab512", "indicator--df98c98c-1fa9-4080-8a7d-ece07227db9f", "relationship--78296626-b14f-4b52-bbda-46f337668f22", "indicator--cd676fab-2e40-48bd-8dd3-8370b9d6f884", "relationship--177b091f-3cd7-45d5-b2bc-0e0bd8c5d1b5", "indicator--5198b0f0-3ac8-412e-93ab-d5e7dedc592b", "relationship--25a58023-9cda-4c10-8bfc-32c1e783f295", "indicator--3d620320-640b-48b5-bb3f-34cbc197afce", "relationship--7689664a-9903-49a5-afbe-824e12fb2c9a", "indicator--26677f80-9ce8-4e36-85f3-63d527445063", "relationship--60410e10-a227-48cc-973c-c5b13f9e4319", "indicator--5639173b-bec6-4492-9c74-abec2ae930f3", "relationship--e913866d-3bd2-468d-a133-288900b5cb27", "indicator--c7551012-c027-48d4-ac33-a57c7caea363", "relationship--fc3e5bcc-9e9e-4b19-9e05-1ea93656e7f3", "indicator--ca876d33-e78f-4f8b-8b9a-41c5ef18b10c", "relationship--79164a2b-84c4-4748-ab60-d647153121bc", "indicator--0ea8eec0-33bd-4598-8faa-760520f6c1ad", "relationship--a7c6b43e-c343-4d43-83fa-0ea67430ade8", "indicator--46a415e7-058c-4655-b3ff-3e84cb8f771f", "relationship--04ff0567-59e5-4f61-ab9e-1408ca1d487e", "indicator--fa5af815-ad71-4aab-963e-7b5e5c9338e3", "relationship--e7fbdc4d-3dc2-4195-a132-d64feab81e70", "indicator--4d1c6279-9b5d-4cbd-a927-1b3ca6ca5b8d", "relationship--43699999-ec05-4e34-9d41-325b6d1e46a5", "indicator--2e8d0285-63aa-439f-9282-7735bb9973c5", "relationship--68e794df-b0f3-4ed1-b0e2-832e9c464701", "indicator--011fdae9-4d9d-41c0-a292-6ca092640a4a", "relationship--b36bc2a6-9872-478c-867e-a77630f0718b", "indicator--e66786e4-7990-4dd7-97d2-c5d35fefbaa1", "relationship--4698b1a5-7d26-44e7-9cce-5b8086a2954c", "indicator--460c1485-822f-4d70-855c-7a3ef8f2fd87", "relationship--98e1846b-6682-4bf1-ba9b-662110b27634", "indicator--4a2ea99b-c3ef-49a4-b633-64c1f0ca865b", "relationship--4cc4f373-1b84-49be-abba-2dd7c02395f0", "indicator--372d1639-09b0-403a-b56f-5e45dde0ad88", "relationship--ad968725-73f4-491a-8ee5-86ba3b0a67e8", "indicator--0b849ed2-c49a-4a51-9095-92fc0578140b", "relationship--61708026-4c7e-4aca-a04f-4f9c8958a159", "indicator--cba2de1c-24b3-4741-ae89-286884da3f9f", "relationship--260f731c-a2d7-49fb-8c4a-e940ed98ade6", "relationship--44999cc6-f7ac-45e7-aab7-9fc81c25b0a7", "relationship--98970331-eb85-4a58-a41a-4488d2ab5809", "relationship--43a164d6-736f-4ff4-b44b-0bf6a26b6e9a", "relationship--934e1691-3536-406c-840a-52df9ccad8ab", "relationship--e5ce70e7-a1a7-4784-9efd-8458f86ebf91", "relationship--3aeef239-f959-4d0e-a673-58983c6ce93f", "relationship--3e8aa733-1d1e-4445-8250-fe5117d7a7ec", "relationship--c25cd459-fae9-41da-9292-05aa99786de5", "relationship--9c55c6b7-8bab-4784-bda0-d91f6c4c3785", "relationship--dc65a72b-ecce-4abe-abfe-d998ee5fbe1e", "relationship--2c639856-e58b-4f62-ae3c-4a85d92bfbff", "relationship--152668c9-d126-4b9c-bcb9-64cc2e6c4c4c", "indicator--a79639eb-8e04-4a66-8e7c-0d4015f1e2db", "relationship--cd2bd345-2bfa-4782-9832-e07d4d67dbc0", "relationship--5994cb35-7d0e-4373-99b8-cb54d1005cd3", "relationship--0f7633f1-6fca-417e-8d86-8e99a447b662", "relationship--a1b1e19a-f012-45c5-b293-9f7a12393799", "relationship--e5e6c980-ea71-49db-bb27-71313eeb3de9", "relationship--4a53078f-7030-48fe-9d17-d027057eb203", "relationship--4d4949b8-2a6e-48a5-b345-0a9ca3369666", "indicator--acc3ddeb-985e-4b88-9de1-4bff08833908", "relationship--aee0ee18-f382-4675-8ac4-74c4ecd0ab07", "relationship--03a51106-99e3-41b2-95f6-0c19f9ccad25", "relationship--6e78c1ed-d8db-45c7-bf0b-63dbdc0d115a", "relationship--0d094b29-d2d3-4397-8d5a-457e6781a793", "relationship--75d6cf05-0d5d-477a-9491-5f1f6d277616", "relationship--eb3a058a-960a-475f-a962-ede41347d532", "relationship--7a4b8e90-483d-413c-a110-96b40e005420", "relationship--f8461bea-4e7f-4b57-8e50-d3878ddc8bc4", "relationship--2b6fc5f9-9cbf-4a0d-9892-58ab78dcd3ed", "relationship--872b4b11-ebc2-41c8-8917-408f1f40ab67", "relationship--40e943e4-abe5-404e-b34f-41dede6da877", "relationship--301145e1-c164-4cad-87a4-5cf895d51baf", "relationship--50d48a5b-d4d5-47f9-84b4-940f1cb8293e", "relationship--66ed2098-a3dd-4418-903c-15b78deea441", "indicator--7f016c8e-eed8-406e-8ccd-35ab700169da", "relationship--a064c6a7-8051-44a4-b5c4-9cfd0a0dcbf4", "relationship--d373f958-de45-414f-8826-e5f457c60822", "relationship--9325abad-8c41-4165-9c81-cdc1992b3149", "relationship--bab8c055-2192-47f6-9744-84228510ee58", "relationship--4f9c777e-776b-4d2d-9f1c-95a05e30be22", "relationship--6735ca91-07d9-4f0d-8c0a-3d25d3518568", "relationship--94491e57-6063-4af8-a832-658dcadabd23", "relationship--3c658198-fcb8-44c9-b91a-350f4c3101ba", "relationship--2bdadf8e-b167-4525-b54b-f28ec4190dd3", "relationship--79c4e899-7e45-410c-b8e2-5656fa6afbac", "relationship--d9a116d3-8f55-470d-89ef-1b3ee0339cc8", "relationship--9c4f40a1-9b98-427a-975d-ba00fe6e0e2d", "relationship--7fa4995a-6c25-4fed-aa63-d369ba2e1ab5", "indicator--1c0ca900-e870-47ad-addc-509b99f12cff", "relationship--0f90dc58-060f-4a3b-a60a-04e7b88da381", "relationship--e9578338-e448-4a24-94c9-aa490324156d", "relationship--19827534-3887-48c1-8766-ce7e08ea4287", "relationship--60e71c25-dc79-4f7c-bb84-0a879cb8bf47", "relationship--6ae569f0-b235-4d70-8fa8-576a5e4f9526", "relationship--a08cdd16-3091-43c0-a884-ad2553228539", "relationship--47d1363c-9455-4bff-a500-5f7a3629c613", "relationship--2ee9b334-9b33-449f-84ed-3cd15f9f2815", "relationship--713ee099-40ff-4e94-80c7-4a45cbb9fbad", "relationship--9af85dec-bb5b-4cc3-95b7-896f52ec7da5", "relationship--97caec76-c551-4828-809d-a1e80f353cae", "relationship--c8b55c03-0739-4649-99e1-4f99920d6d50", "relationship--b5728c37-7cfa-450d-8190-9d4c98914314", "indicator--e229dba4-1747-4812-8e15-61de6932defa", "relationship--8faf4e91-200b-4b67-a6cb-07cbf64a0a2d", "relationship--6110de97-d3f7-4b7c-9f29-998fe751d5be", "relationship--ea790b5a-aa51-467e-b502-882a47c08b77", "relationship--3e3c401c-aaa4-4199-b658-03dbcf77db3b", "relationship--f58a3109-7e08-4060-bd8e-0122eb4efed7", "indicator--998e4a70-2ae9-4ada-b8c8-2f3822243fb1", "relationship--8e8e7bcd-22c6-4c4a-b459-151ecdc9d029", "relationship--f1c3137e-33ad-43ef-8572-dd9899b1e4fe", "relationship--a55f7edc-5d31-46bf-972e-d2fa2eae618c", "relationship--ab37bbe0-5b9d-4803-9cdb-5ac24ad81991", "relationship--846b87e1-7e9e-4448-8e1c-82a079ebdfbe", "indicator--9567bd0f-8071-45e7-b667-25bcf4a4539e", "relationship--e0a31412-b9cd-4b3c-af14-57b102a29826", "relationship--33e0a97b-37be-418a-9dd4-b1670ae7f84c", "relationship--70bb828c-9e9b-4098-96ba-82110b09c13e", "relationship--89bf371f-6e4e-4e2f-bda0-9e4d6a9b3e3d", "relationship--31f1ed89-9464-4364-b587-1107cf83a443", "indicator--49c97f8c-514a-460d-9c70-6b0081509da9", "relationship--7a1855c8-0b71-4790-bc8e-4d0573f2c269", "relationship--7c4a85af-76e4-4bb9-8292-b4482e6f4910", "relationship--eb514bb8-9036-4fcf-b0d3-63bf0f7d42f7", "relationship--af981356-009c-40bc-a691-b0a815b0369d", "relationship--2b3daf0e-351a-44e4-873c-fbc115a7d495" ], "x_version": "1.0" } ] }