{
{
"type": "malware",
"id": "malware--1f2b5b88-8ff7-4a4d-aa9d-feb398cd01dc",
"created": "2016-05-12T08:17:27.000000Z",
"modified": "2016-05-12T08:17:27.000000Z",
"version": "1",
"name": "Sample Malware",
"description": "...",
"labels": ["rat"]
},
{
"type": "attack-pattern",
"id": "attack-pattern--12edad81-8ff7-4a4d-aa9d-feb398cd8421",
"created": "2016-05-12T08:17:27.000000Z",
"modified": "2016-05-12T08:17:27.000000Z",
"version": 1,
"name": "Spear Phishing",
"kill_chain_phases": [
{
"kill_chain_name": "lockheed-martin-cyber-kill-chain",
"phase_name": "delivery"
}
]
},
{
"type": "attack-pattern",
"id": "attack-pattern--d8112eda-8ff7-4a4d-aa9d-8cd2184feb39",
"created": "2016-05-12T08:17:27.000000Z",
"modified": "2016-05-12T08:17:27.000000Z",
"version": 1,
"name": "Spear Phishing",
"kill_chain_phases": [
{
"kill_chain_name": "lockheed-martin-cyber-kill-chain",
"phase_name": "command and control"
}
]
},
{
"type": "observed-data",
"labels":["dynamic-analysis", "windows-10", "word-2016"]
"id": "observed-data--5211d302-02ac-498a-92f9-518492f123c44",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created": "2016-04-06T19:58:16Z",
"modified": "2016-04-06T19:58:16Z",
"version": 1,
"first_observed": "2015-12-21T19:00:00Z",
"last_observed": "2015-12-21T19:00:00Z",
"number_observed": 1,
"cybox": {
"spec_version": "3.0",
"objects": {
"0": {
"type": "file-object",
"hashes": {
"SHA-256": "ceafbfd424be2ca4a5f0402cae090dda2fb0526cf521b60b60077c0f622b285a"
}
},
"1": {
"type": "process",
"binary_ref": "0",
"opened_connection_refs": ["2"]
},
"2": {
"type": "network-traffic",
"dst_ref": "3",
"protocols":["tcp"],
"extensions": {
"http-request-ext": {
"request_method": "post",
"request_value": "/command",
"request_version": "http/1.1",
"request_header": {
"Accept-Encoding": "gzip,deflate",
"User-Agent": "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113"
}
}
}
}
"3": {
"type": "ipv4-addr",
"value": "1.2.3.4"
}
}
}
},
{
"type": "observed-data",
"labels":["static-analysis"]
"id": "observed-data--1d2530aa-02ac-498a-92f9-32f845f4412e9",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created": "2016-04-06T19:58:16Z",
"modified": "2016-04-06T19:58:16Z",
"version": 1,
"first_observed": "2015-12-21T19:00:00Z",
"last_observed": "2015-12-21T19:00:00Z",
"number_observed": 1,
"cybox": {
"spec_version": "3.0",
"objects": {
"0": {
"type": "file-object",
"hashes": {
"SHA-256": "ceafbfd424be2ca4a5f0402cae090dda2fb0526cf521b60b60077c0f622b285a"
},
"contains_ref":["1"]
},
"1": {
"type": "ipv4-addr",
"value": "1.2.3.4"
}
}
}
},
{
"type": "observed-data",
"labels":["dynamic-analysis"]
"id": "observed-data--32351ade-02ac-498a-92f9-328931124d45",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created": "2016-04-06T19:58:16Z",
"modified": "2016-04-06T19:58:16Z",
"version": 1,
"first_observed": "2015-12-21T19:00:00Z",
"last_observed": "2015-12-21T19:00:00Z",
"number_observed": 1,
"cybox": {
"spec_version": "3.0",
"objects": {
"0": {
"type": "ipv4-addr",
"value": "1.2.3.4"
}
}
}
},
{
"type": "observed-data",
"labels":["dynamic-analysis"]
"id": "observed-data--5301d22e-02ac-498a-92f9-32ed59f84412",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created": "2016-04-06T19:58:16Z",
"modified": "2016-04-06T19:58:16Z",
"version": 1,
"first_observed": "2015-12-21T19:00:00Z",
"last_observed": "2015-12-21T19:00:00Z",
"number_observed": 1,
"cybox": {
"spec_version": "3.0",
"objects": {
"0": {
"type": "file-object",
"hashes": {
"SHA-256": "ceafbfd424be2ca4a5f0402cae090dda2fb0526cf521b60b60077c0f622b285a"
}
}
}
}
},
{
"type": "relationship",
"id": "relationship--a4321b56-b8b0-4cba-9deb-aed34e3e1fa2",
"created": "2016-05-12T08:17:27.000000Z",
"modified": "2016-05-12T08:17:27.000000Z",
"version": 1,
"relationship_type": "describes",
"source_ref": "observed-data--5301d22e-02ac-498a-92f9-32ed59f84412",
"target_ref": "attack-pattern--7e33a43e-e34b-40ec-89da-36c9bb2cacd5"
},
{
"type": "relationship",
"id": "relationship--a4321b56-b8b0-4cba-9deb-aed34e3e1fa2",
"created": "2016-05-12T08:17:27.000000Z",
"modified": "2016-05-12T08:17:27.000000Z",
"version": 1,
"relationship_type": "describes",
"source_ref": "observed-data--32351ade-02ac-498a-92f9-328931124d45",
"target_ref": "attack-pattern--d8112eda-8ff7-4a4d-aa9d-8cd2184feb39"
},
{
"type": "relationship",
"id": "relationship--a4321b56-b8b0-4cba-9deb-aed34e3e1fa2",
"created": "2016-05-12T08:17:27.000000Z",
"modified": "2016-05-12T08:17:27.000000Z",
"version": 1,
"relationship_type": "derived-from",
"source_ref": "observed-data--5211d302-02ac-498a-92f9-518492f123c44",
"target_ref": "observed-data--5301d22e-02ac-498a-92f9-32ed59f84412"
},
{
"type": "relationship",
"id": "relationship--a4321b56-b8b0-4cba-9deb-aed34e3e1fa2",
"created": "2016-05-12T08:17:27.000000Z",
"modified": "2016-05-12T08:17:27.000000Z",
"version": 1,
"relationship_type": "derived-from",
"source_ref": "observed-data--5211d302-02ac-498a-92f9-518492f123c44",
"target_ref": "observed-data--32351ade-02ac-498a-92f9-328931124d45"
},
{
"type": "relationship",
"id": "relationship--a4321b56-b8b0-4cba-9deb-aed34e3e1fa2",
"created": "2016-05-12T08:17:27.000000Z",
"modified": "2016-05-12T08:17:27.000000Z",
"version": 1,
"relationship_type": "built-from",
"source_ref": "malware--1f2b5b88-8ff7-4a4d-aa9d-feb398cd01dc",
"target_ref": "observed-data--1d2530aa-02ac-498a-92f9-32f845f4412e9"
},
{
"type": "relationship",
"id": "relationship--a4321b56-b8b0-4cba-9deb-aed34e3e1fa2",
"created": "2016-05-12T08:17:27.000000Z",
"modified": "2016-05-12T08:17:27.000000Z",
"version": 1,
"relationship_type": "built-from",
"source_ref": "malware--1f2b5b88-8ff7-4a4d-aa9d-feb398cd01dc",
"target_ref": "observed-data--5211d302-02ac-498a-92f9-518492f123c44"
}
}
