From 009ae77217051e7838a6d500f552c70e7f7a016e Mon Sep 17 00:00:00 2001 From: Ryan Xu Date: Wed, 14 Feb 2024 09:27:20 -0500 Subject: [PATCH] 3.1 Updates (#145) * E/f updates (#143) * E/F Update, Update Install Cert ID * Small fixes * Update common objects link (#142) * Update README.md * Update 09152023.md * Update README.md * Update 12182023.md * Adding descriptions to micro-behaviors * Fixing dead links * V3.1 updates (#144) * minor fixes for v3.1 * correct id --------- Co-authored-by: Desiree Beck --- README.md | 2 +- .../debugger-detection.md | 6 ++-- anti-behavioral-analysis/debugger-evasion.md | 6 ++-- anti-behavioral-analysis/sandbox-detection.md | 6 ++-- .../virtual-machine-detection.md | 6 ++-- anti-static-analysis/disassembler-evasion.md | 6 ++-- anti-static-analysis/software-packing.md | 6 ++-- collection/input-capture.md | 2 +- collection/keylogging.md | 6 ++-- collection/screen-capture.md | 8 ++--- command-and-control/c2-communication.md | 6 ++-- defense-evasion/bootkit.md | 2 +- .../hidden-files-and-directories.md | 8 ++--- defense-evasion/hide-artifacts.md | 4 ++- defense-evasion/indicator-blocking.md | 2 +- defense-evasion/modify-registry.md | 8 ++--- defense-evasion/polymorphic-code.md | 6 ++-- defense-evasion/self-deletion.md | 2 +- discovery/system-information-discovery.md | 8 ++--- execution/send-poisoned-text-message.md | 6 ++-- execution/system-services.md | 2 +- impact/clipboard-modification.md | 6 ++-- impact/exploit-kit.md | 2 +- impact/generate-traffic-from-victim.md | 2 +- mbc_summary.md | 6 ++-- micro-behaviors/cryptography/encrypt-data.md | 6 ++-- micro-behaviors/data/compression-library.md | 6 ++-- micro-behaviors/file-system/copy-file.md | 6 ++-- .../file-system/create-directory.md | 6 ++-- .../file-system/delete-directory.md | 6 ++-- micro-behaviors/file-system/delete-file.md | 6 ++-- .../file-system/get-file-attributes.md | 6 ++-- micro-behaviors/file-system/move-file.md | 6 ++-- micro-behaviors/file-system/read-file.md | 6 ++-- .../file-system/set-file-attributes.md | 6 ++-- micro-behaviors/file-system/writes-file.md | 6 ++-- micro-behaviors/process/create-thread.md | 6 ++-- micro-behaviors/process/resume-thread.md | 6 ++-- privilege-escalation/README.md | 2 +- privilege-escalation/install-certificate.md | 8 ++--- .../AttackFlow/SearchAwesome_Adware.afb | 2 +- .../AttackFlow/SearchAwesome_Adware.json | 2 +- xample-malware/chopstick.md | 2 +- xample-malware/dnschanger.md | 34 +++++++++---------- xample-malware/mazarbot.md | 2 +- xample-malware/redhip.md | 2 +- xample-malware/searchawesome.md | 2 +- yfaq/README.md | 4 +-- ynewsletters/09152023.md | 2 +- ynewsletters/12182023.md | 2 +- 50 files changed, 145 insertions(+), 121 deletions(-) diff --git a/README.md b/README.md index c18d4dd..e3ed268 100644 --- a/README.md +++ b/README.md @@ -62,7 +62,7 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**. Objectives and behaviors can be used alone, but a method *must* be associated with a behavior. ### STIX 2.1 Representation ### -A STIX 2.1 representation for MBC v3.0 is available in the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository. It's based on a refined STIX 2.1 [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior) that includes new STIX domain objects for MBC objectives, behaviors, and methods. +A STIX 2.1 representation for MBC v3.0 is available in the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository. It's based on a refined STIX 2.1 [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9) that includes new STIX domain objects for MBC objectives, behaviors, and methods. ### Navigator View ### This visual representation of the MBC Matrix is based on the ATT&CK Navigator. Two views are available: diff --git a/anti-behavioral-analysis/debugger-detection.md b/anti-behavioral-analysis/debugger-detection.md index 72e5ab5..11aadff 100644 --- a/anti-behavioral-analysis/debugger-detection.md +++ b/anti-behavioral-analysis/debugger-detection.md @@ -17,7 +17,7 @@ Version -2.1 +2.2 Created @@ -25,7 +25,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -153,7 +153,7 @@ Details on detecting debuggers can be found in the references. [3] Peter Ferrie, "The 'Ultimate' Anti-Debugging Reference," 4 May 2011. https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf. -[4] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[4] https://web.archive.org/web/20200815134441/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [5] Ayoub Faouzi (LordNoteworthy), Al-Khaser v0.79. https://github.com/LordNoteworthy/al-khaser diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md index 157ebeb..ae98b9a 100644 --- a/anti-behavioral-analysis/debugger-evasion.md +++ b/anti-behavioral-analysis/debugger-evasion.md @@ -17,7 +17,7 @@ Version -2.1 +2.2 Created @@ -25,7 +25,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -103,6 +103,6 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162 [2] https://web.archive.org/web/20210225195315/https://www.synack.com/blog/analyzing-the-anti-analysis-logic-of-an-adware-installer/ -[3] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[3] https://web.archive.org/web/20200815134441/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [4] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/ diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md index cb60a90..b59087d 100644 --- a/anti-behavioral-analysis/sandbox-detection.md +++ b/anti-behavioral-analysis/sandbox-detection.md @@ -17,7 +17,7 @@ Version -2.1 +2.2 Created @@ -25,7 +25,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -138,7 +138,7 @@ mov bl, 1 [2] Splunk Threat Research Team,"From Macros to No Macros: Continuous Malware Improvements by QakBot," Splunk, blog,, 01 December 2022. [Online]. Available: https://www.splunk.com/en_us/blog/security/from-macros-to-no-macros-continuous-malware-improvements-by-qakbot.html. -[3] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[3] https://web.archive.org/web/20200815134441/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [4] https://blogs.cisco.com/security/talos/rombertik diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md index eb547d4..46a73bb 100644 --- a/anti-behavioral-analysis/virtual-machine-detection.md +++ b/anti-behavioral-analysis/virtual-machine-detection.md @@ -17,7 +17,7 @@ Version -2.1 +2.2 Created @@ -25,7 +25,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -238,7 +238,7 @@ jmp short loc_401CBB [5] https://github.com/LordNoteworthy/al-khaser -[6] https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[6] https://web.archive.org/web/20161025013916/https://web.archive.org/web/20200815134441/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [7] https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/ diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index de1f9cf..e2546cd 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -17,7 +17,7 @@ Version -2.1 +2.2 Created @@ -25,7 +25,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -61,7 +61,7 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented [1] M. Sikorski and A. Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, No Starch Press, 2012. -[2] https://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf +[2] https://web.archive.org/web/20220814013655/http://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf [3] https://www.kernelhacking.com/rodrigo/docs/blackhat2012-paper.pdf diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index fa2fcca..7d53787 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -17,7 +17,7 @@ Version -2.1 +2.2 Created @@ -25,7 +25,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -123,7 +123,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software [2] Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771 -[3] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[3] https://web.archive.org/web/20200815134441/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [4] https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ diff --git a/collection/input-capture.md b/collection/input-capture.md index 54d5f92..7918ea5 100644 --- a/collection/input-capture.md +++ b/collection/input-capture.md @@ -28,7 +28,7 @@ # Input Capture -Malware captures user input. +Malware may record user inputs, typically without the user's knowledge. This is often used to capture sensitive information such as usernames, passwords, credit card numbers, and other personal data. The most common form of input capture is keylogging, where the malware records every keystroke made on a device. However, it can also involve capturing mouse clicks, touch screen interactions, or even voice inputs. The captured data is then usually transmitted to the attacker for use in further malicious activities like identity theft or unauthorized access. See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), [T1417](https://attack.mitre.org/techniques/T1417/))**. diff --git a/collection/keylogging.md b/collection/keylogging.md index 8ee728a..15a99fd 100644 --- a/collection/keylogging.md +++ b/collection/keylogging.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,7 +21,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -82,7 +82,7 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te [5] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy -[6] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf +[6] https://web.archive.org/web/20210307034415/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf [7] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/collection/screen-capture.md b/collection/screen-capture.md index c090a7e..12e05bd 100644 --- a/collection/screen-capture.md +++ b/collection/screen-capture.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,14 +21,14 @@ Last Modified -5 December 2023 +6 February 2024 # Screen Capture -Malware takes screen captures of the desktop. +Malware takes screen captures of the desktop. This technique is often used by cyber attackers to gather sensitive information, such as login credentials, personal data, or confidential documents. The malware can use various methods to capture the screen, including using built-in functions of the operating system or third-party libraries. The captured screenshots are then typically sent back to the attacker's command and control server. This technique is commonly used by spyware, information stealers, and advanced persistent threats (APTs). See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/))**. @@ -70,7 +70,7 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/ [3] https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/ -[4] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf +[4] https://web.archive.org/web/20210307034415/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf [5] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/command-and-control/c2-communication.md b/command-and-control/c2-communication.md index b96c944..1bafee9 100644 --- a/command-and-control/c2-communication.md +++ b/command-and-control/c2-communication.md @@ -13,7 +13,7 @@ Version -2.2 +2.3 Created @@ -21,7 +21,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -159,7 +159,7 @@ jmp short loc_4019A2 [7] https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/ -[8] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf +[8] https://web.archive.org/web/20210307034415/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf [9] https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke diff --git a/defense-evasion/bootkit.md b/defense-evasion/bootkit.md index 2330e74..5ffa055 100644 --- a/defense-evasion/bootkit.md +++ b/defense-evasion/bootkit.md @@ -28,7 +28,7 @@ # Bootkit -The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). ATT&CK associates bootkits with the Persistence. See ATT&CK: **Pre-OS Boot: Bootkit ([T1067](https://attack.mitre.org/techniques/T1067/))**. +The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). ATT&CK associates bootkits with the Persistence. See ATT&CK: **Pre-OS Boot: Bootkit ([T1542.003](https://attack.mitre.org/techniques/T1542/003/))**. The MBC also associates the Bootkit behavior with Defense Evasion because the malware may execute before or external to the system's kernel or hypervisor (e.g., through the BIOS), making it more difficult to detect. (As of 2020, ATT&CK also associates the technique with Persistence.) diff --git a/defense-evasion/hidden-files-and-directories.md b/defense-evasion/hidden-files-and-directories.md index afa71c6..8a43824 100644 --- a/defense-evasion/hidden-files-and-directories.md +++ b/defense-evasion/hidden-files-and-directories.md @@ -13,7 +13,7 @@ Version -2.2 +2.3 Created @@ -21,14 +21,14 @@ Last Modified -5 December 2023 +6 February 2024 # Hidden Files and Directories -Malware may hide files and folders to avoid detection and/or to persist on the system. See potential methods below. +Malware may hide files and folders to avoid detection and/or to persist on the system. See potential methods below. This is achieved by marking files or directories as hidden or by using special characters in file names to prevent them from being displayed in standard directory listings. By hiding files or directories, malware can evade detection from users and some security software. This behavior is related to Unprotect technique U1230. @@ -73,7 +73,7 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https:// [2] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/ -[3] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf +[3] https://web.archive.org/web/20210307034415/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf [4] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/ diff --git a/defense-evasion/hide-artifacts.md b/defense-evasion/hide-artifacts.md index 5b2e22d..b6689d7 100644 --- a/defense-evasion/hide-artifacts.md +++ b/defense-evasion/hide-artifacts.md @@ -28,7 +28,9 @@ # Hide Artifacts -Malware may hide artifacts to evade detection and/or to persist on the system. See potential methods related to malware below. +Malware may conceal its presence and activities on a system. This can involve hiding files, directories, or other data that could reveal the malware's existence or behavior. Techniques can include using encryption or obfuscation, altering file timestamps, or manipulating data to blend in with normal system activity. The goal is to avoid detection by security tools and to prolong the period during which the malware can operate undetected on the victim's system. + +See potential methods related to malware below. See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/), [T1628](https://attack.mitre.org/techniques/T1628/))**. diff --git a/defense-evasion/indicator-blocking.md b/defense-evasion/indicator-blocking.md index 2e1b1ef..c347828 100644 --- a/defense-evasion/indicator-blocking.md +++ b/defense-evasion/indicator-blocking.md @@ -28,7 +28,7 @@ # Indicator Blocking -Malware blocks indicators or events that would indicate malicious activity. Methods relevant to the malware domain are below. +Malware blocks indicators or events that would indicate malicious activity. This is achieved by blocking indicators or alerts that would typically notify users or security tools of a potential infection. This can be done in several ways, such as disabling security software, interfering with event logging, or altering system settings to suppress notifications. By blocking these indicators, the malware can continue its malicious activities without being detected. Methods relevant to the malware domain are below. See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mitre.org/techniques/T1562/006/))**. diff --git a/defense-evasion/modify-registry.md b/defense-evasion/modify-registry.md index bf5a48b..ba11b9e 100644 --- a/defense-evasion/modify-registry.md +++ b/defense-evasion/modify-registry.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,14 +21,14 @@ Last Modified -5 December 2023 +6 February 2024 # Modify Registry -Malware may make changes to the Windows Registry to hide execution or to persist on the system (note that ATT&CK does not extend this behavior to the Persistence objective). +Malware may make changes to the Windows Registry to hide execution or to persist on the system (note that ATT&CK does not extend this behavior to the Persistence objective). The Windows registry is a database that stores low-level settings for the operating system and for applications that opt to use the registry. Malware may create, delete, or modify registry keys and values to change the behavior of the system or certain applications. For instance, malware may modify registry keys to enable remote desktop connections, disable security features, or to automatically start the malware whenever the system boots. This technique is commonly used by various types of malware, including ransomware, trojans, and worms. See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112/))**. @@ -131,7 +131,7 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112 [6] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/ -[7] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf +[7] https://web.archive.org/web/20210307034415/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf [8] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking diff --git a/defense-evasion/polymorphic-code.md b/defense-evasion/polymorphic-code.md index 45c6bb8..8607e00 100644 --- a/defense-evasion/polymorphic-code.md +++ b/defense-evasion/polymorphic-code.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,7 +21,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -52,7 +52,7 @@ Polymorphic code, a file with the same functionality but different execution, is ## References -[1] https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf +[1] https://pages.cs.wisc.edu/~vrastogi/static/papers/rcj13b.pdf [2] https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/ diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index d71fa8f..b6d9701 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -30,7 +30,7 @@ # Self Deletion -Malware may uninstall itself to avoid detection. +Malware may remove itself from an infected system, typically after it has achieved its primary objective. This is done to evade detection, remove evidence of its presence, and make forensic analysis more difficult. The malware may use built-in commands, scripts, or other methods to delete its files, processes, or registry entries. See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630.001](https://attack.mitre.org/techniques/T1630/001/)), Indicator Removal on Host: File Deletion ([T1070.004](https://attack.mitre.org/techniques/T1070/004/))**. diff --git a/discovery/system-information-discovery.md b/discovery/system-information-discovery.md index 137adb4..cda14b5 100644 --- a/discovery/system-information-discovery.md +++ b/discovery/system-information-discovery.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,14 +21,14 @@ Last Modified -5 December 2023 +6 February 2024 # System Information Discovery -Malware may attempt to get detailed information about the system. +Malware may attempt to get detailed information about the system. This can include details about the operating system, hardware configurations, installed software, system uptime, and other system-level details. See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/techniques/T1082/))**. @@ -113,7 +113,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec [5] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en -[6] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf +[6] https://web.archive.org/web/20210307034415/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf [7] https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf diff --git a/execution/send-poisoned-text-message.md b/execution/send-poisoned-text-message.md index 84e9495..8f89a3d 100644 --- a/execution/send-poisoned-text-message.md +++ b/execution/send-poisoned-text-message.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -1 February 2023 +6 February 2024 @@ -40,5 +40,5 @@ A malicious attachment is sent via spam SMS or MMS messages. When the user click [1] https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html -[2] https://www.player.one/new-android-sms-malware-can-completely-own-your-phone-just-one-text-how-avoid-mazar-512363 +[2] https://www.player.one/stub-56857 diff --git a/execution/system-services.md b/execution/system-services.md index b7fdb8c..9f23102 100644 --- a/execution/system-services.md +++ b/execution/system-services.md @@ -28,7 +28,7 @@ # System Services -Malware may abuse system services or daemons to execute. +Malware may manipulate, create, or interact with system services to achieve persistence, gain higher privileges, or execute malicious code. System services are background processes that are integral parts of an operating system's functionality. Malware can exploit these services by modifying their configurations, replacing legitimate service binaries with malicious ones, or creating new services that run malicious code. See ATT&CK: **System Services ([T1569](https://attack.mitre.org/techniques/T1569/))**. diff --git a/impact/clipboard-modification.md b/impact/clipboard-modification.md index 73fb54a..7e54498 100644 --- a/impact/clipboard-modification.md +++ b/impact/clipboard-modification.md @@ -17,7 +17,7 @@ Version -3.0 +3.1 Created @@ -25,7 +25,7 @@ Last Modified -5 December 2023 +12 February 2024 @@ -34,7 +34,7 @@ ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). MBC extends it to the Windows platform. -After E1510 was defined, T1510 was replaced by T1610.001, and Clipboard Data (T1115) was updated to include content modification. +After E1510 was defined, T1510 was replaced by T1641.001, and Clipboard Data (T1115) was updated to include content modification. ## Use in Malware diff --git a/impact/exploit-kit.md b/impact/exploit-kit.md index 5cebea8..45a2af5 100644 --- a/impact/exploit-kit.md +++ b/impact/exploit-kit.md @@ -32,7 +32,7 @@ # Exploit Kit -An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver malicious payloads (malware). +An exploit kit is a software system designed to exploit known vulnerabilities. Exploit kits typically include pre-written exploit code for known vulnerabilities and mechanisms to deliver the payload, such as malware, ransomware, or spyware, onto the victim's system. These kits are typically used by cybercriminals and are often sold on the dark web. They automate the exploitation process, making it easier for individuals with limited technical skills to launch attacks. See related ATT&CK Technique: **Exploit Public-Facing Application ([T1190](https://attack.mitre.org/techniques/T1190))**, which relates to Initial Access. Under the Impact objective, exploit behaviors are considered more broadly in MBC. diff --git a/impact/generate-traffic-from-victim.md b/impact/generate-traffic-from-victim.md index 96ff997..818ce46 100644 --- a/impact/generate-traffic-from-victim.md +++ b/impact/generate-traffic-from-victim.md @@ -32,7 +32,7 @@ # Generate Traffic from Victim -Malware may generate traffic from the victim system such as clicks of advertising links that generate fraudulent ad revenue. The ATT&CK technique, **Generate Traffic from Victim ([T1643](https://attack.mitre.org/techniques/T1643/))**, is only associated with the mobile platform, but the behavior is applicable to other platforms as well. +Malware may generate network traffic from a victim's system to achieve various malicious objectives. This could include disguising its own traffic, overwhelming a network with high traffic volume (Denial of Service attacks), exhausting the victim's system resources, or simulate clicks of advertising links that generate fraudulent ad revenue. The generated traffic can also be used to trigger network-based rules, alerts, or other types of indicators. This technique can make it difficult for defenders to identify malicious activity and can potentially lead to false positives. The ATT&CK technique, **Generate Traffic from Victim ([T1643](https://attack.mitre.org/techniques/T1643/))**, is only associated with the mobile platform, but the behavior is applicable to other platforms as well. ## Methods diff --git a/mbc_summary.md b/mbc_summary.md index c0e35e7..d16e585 100644 --- a/mbc_summary.md +++ b/mbc_summary.md @@ -158,7 +158,7 @@ |E1510|**[Clipboard Modification](https://github.com/MBCProject/mbc-markdown/blob/main/impact/clipboard-modification.md)**|IMPACT| |E1059|**[Command and Scripting Interpreter](https://github.com/MBCProject/mbc-markdown/blob/main/execution/command-and-scripting-interpreter.md)**|EXECUTION| |E1485|**[Data Destruction](https://github.com/MBCProject/mbc-markdown/blob/main/impact/data-destruction.md)**|IMPACT| -|E1486|**[Data Encrypted for Impact ](https://github.com/MBCProject/mbc-markdown/blob/main/impact/data-encrypted-for-impact-.md)**|IMPACT| +|E1486|**[Data Encrypted for Impact ](https://github.com/MBCProject/mbc-markdown/blob/main/impact/data-encrypted-for-impact.md)**|IMPACT| |E1190|**[Exploit Kit](https://github.com/MBCProject/mbc-markdown/blob/main/impact/exploit-kit.md)**|IMPACT| |E1203|**[Exploitation for Client Execution](https://github.com/MBCProject/mbc-markdown/blob/main/execution/exploitation-for-client-execution.md)**|EXECUTION, IMPACT| |E1083|**[File and Directory Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/file-and-directory-discovery.md)**|DISCOVERY| @@ -166,7 +166,6 @@ |E1564|**[Hide Artifacts](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/hide-artifacts.md)**|DEFENSE EVASION, PERSISTENCE| |E1105|**[Ingress Tool Transfer](https://github.com/MBCProject/mbc-markdown/blob/main/command-and-control/ingress-tool-transfer.md)**|COMMAND AND CONTROL, LATERAL MOVEMENT, PERSISTENCE| |E1056|**[Input Capture](https://github.com/MBCProject/mbc-markdown/blob/main/collection/input-capture.md)**|COLLECTION, CREDENTIAL ACCESS| -|E1608|**[Install Certificate](https://github.com/MBCProject/mbc-markdown/blob/main/privilege-escalation/install-certificate.md)**|PRIVILEGE ESCALATION| |E1112|**[Modify Registry](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/modify-registry.md)**|DEFENSE EVASION, PERSISTENCE| |E1027|**[Obfuscated Files or Information](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/obfuscated-files-or-information.md)**|ANTI-STATIC ANALYSIS, DEFENSE EVASION| |E1055|**[Process Injection](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/process-injection.md)**|DEFENSE EVASION, PRIVILEGE ESCALATION| @@ -187,10 +186,11 @@ |F0005|**[Hidden Files and Directories](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/hidden-files-and-directories.md)**|DEFENSE EVASION, PERSISTENCE| |F0015|**[Hijack Execution Flow](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/hijack-execution-flow.md)**|ANTI-BEHAVIORAL ANALYSIS, COLLECTION, CREDENTIAL ACCESS, DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION| |F0006|**[Indicator Blocking](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/indicator-blocking.md)**|DEFENSE EVASION| +|F0016|**[Install Certificate](https://github.com/MBCProject/mbc-markdown/blob/main/privilege-escalation/install-certificate.md)**|PRIVILEGE ESCALATION| |F0010|**[Kernel Modules and Extensions](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/kernel-modules-and-extensions.md)**|PERSISTENCE, PRIVILEGE ESCALATION| |F0002|**[Keylogging](https://github.com/MBCProject/mbc-markdown/blob/main/collection/keylogging.md)**|COLLECTION, CREDENTIAL ACCESS| |F0011|**[Modify Existing Service](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/modify-existing-service.md)**|PERSISTENCE, PRIVILEGE ESCALATION| -|F0012|**[Registry Run Keys / Startup Folder](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/registry-run-keys-/-startup-folder.md)**|PERSISTENCE| +|F0012|**[Registry Run Keys / Startup Folder](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/registry-run-keys-startup-folder.md)**|PERSISTENCE| |F0007|**[Self Deletion](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/self-deletion.md)**|DEFENSE EVASION| |F0001|**[Software Packing](https://github.com/MBCProject/mbc-markdown/blob/main/anti-static-analysis/software-packing.md)**|ANTI-BEHAVIORAL ANALYSIS, ANTI-STATIC ANALYSIS, DEFENSE EVASION| diff --git a/micro-behaviors/cryptography/encrypt-data.md b/micro-behaviors/cryptography/encrypt-data.md index e960684..0fe34d1 100644 --- a/micro-behaviors/cryptography/encrypt-data.md +++ b/micro-behaviors/cryptography/encrypt-data.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,7 +21,7 @@ Last Modified -5 December 2023 +6 February 2024 @@ -171,7 +171,7 @@ retn [4] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf -[5] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf +[5] https://web.archive.org/web/20210307034415/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf [6] https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/ diff --git a/micro-behaviors/data/compression-library.md b/micro-behaviors/data/compression-library.md index 7c04847..4fc487d 100644 --- a/micro-behaviors/data/compression-library.md +++ b/micro-behaviors/data/compression-library.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,13 +21,15 @@ Last Modified -5 December 2023 +6 February 2024 # Compression Library +Malware may utilize a compression library. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/copy-file.md b/micro-behaviors/file-system/copy-file.md index b5fc2a2..7871eed 100644 --- a/micro-behaviors/file-system/copy-file.md +++ b/micro-behaviors/file-system/copy-file.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,13 +21,15 @@ Last Modified -5 December 2023 +6 February 2024 # Copy File +Malware copies a file. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/create-directory.md b/micro-behaviors/file-system/create-directory.md index 65855fd..cf60127 100644 --- a/micro-behaviors/file-system/create-directory.md +++ b/micro-behaviors/file-system/create-directory.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,13 +21,15 @@ Last Modified -5 December 2023 +6 February 2024 # Create Directory +Malware creates a directory. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/delete-directory.md b/micro-behaviors/file-system/delete-directory.md index 27ba701..a282217 100644 --- a/micro-behaviors/file-system/delete-directory.md +++ b/micro-behaviors/file-system/delete-directory.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,13 +21,15 @@ Last Modified -13 September 2023 +6 February 2024 # Delete Directory +Malware deletes a directory. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/delete-file.md b/micro-behaviors/file-system/delete-file.md index da3872e..21c00d6 100644 --- a/micro-behaviors/file-system/delete-file.md +++ b/micro-behaviors/file-system/delete-file.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,13 +21,15 @@ Last Modified -5 December 2023 +6 February 2024 # Delete File +Malware deletes a file. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/get-file-attributes.md b/micro-behaviors/file-system/get-file-attributes.md index e752bd4..2ceed04 100644 --- a/micro-behaviors/file-system/get-file-attributes.md +++ b/micro-behaviors/file-system/get-file-attributes.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,13 +21,15 @@ Last Modified -13 September 2023 +6 February 2024 # Get File Attributes +Malware gets file attributes. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/move-file.md b/micro-behaviors/file-system/move-file.md index 41198d6..7e1fdc1 100644 --- a/micro-behaviors/file-system/move-file.md +++ b/micro-behaviors/file-system/move-file.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,13 +21,15 @@ Last Modified -5 December 2023 +6 February 2024 # Move File +Malware moves a file. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/read-file.md b/micro-behaviors/file-system/read-file.md index dd0b12e..e3afb55 100644 --- a/micro-behaviors/file-system/read-file.md +++ b/micro-behaviors/file-system/read-file.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,13 +21,15 @@ Last Modified -5 December 2023 +6 February 2024 # Read File +Malware reads a file. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/set-file-attributes.md b/micro-behaviors/file-system/set-file-attributes.md index 08ff587..e85c9f1 100644 --- a/micro-behaviors/file-system/set-file-attributes.md +++ b/micro-behaviors/file-system/set-file-attributes.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,13 +21,15 @@ Last Modified -13 September 2023 +6 February 2024 # Set File Attributes +Malware sets file attributes. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/writes-file.md b/micro-behaviors/file-system/writes-file.md index 2ee3f2a..44e5734 100644 --- a/micro-behaviors/file-system/writes-file.md +++ b/micro-behaviors/file-system/writes-file.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,13 +21,15 @@ Last Modified -5 December 2023 +6 February 2024 # Writes File +Malware writes to a file. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/process/create-thread.md b/micro-behaviors/process/create-thread.md index 1e35180..ac45153 100644 --- a/micro-behaviors/process/create-thread.md +++ b/micro-behaviors/process/create-thread.md @@ -13,7 +13,7 @@ Version -2.1 +2.2 Created @@ -21,13 +21,15 @@ Last Modified -5 December 2023 +6 February 2024 # Create Thread +Malware creates a thread. + ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/process/resume-thread.md b/micro-behaviors/process/resume-thread.md index 26b60fa..85c6961 100644 --- a/micro-behaviors/process/resume-thread.md +++ b/micro-behaviors/process/resume-thread.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,13 +21,15 @@ Last Modified -13 September 2023 +6 February 2024 # Resume Thread +Malware resumes a thread. + ## Use in Malware |Name|Date|Method|Description| diff --git a/privilege-escalation/README.md b/privilege-escalation/README.md index 790485c..fa401b5 100644 --- a/privilege-escalation/README.md +++ b/privilege-escalation/README.md @@ -21,4 +21,4 @@ Behaviors that enable malware to obtain higher level permissions. These behavior * **Kernel Modules and Extensions** [F0010](../persistence/kernel-modules-and-extensions.md) * **Modify Existing Service** [F0011](../persistence/modify-existing-service.md) * **Process Injection** [E1055](../defense-evasion/process-injection.md) -* **Install Certificate** [E1608](../privilege-escalation/install-certificate.md) \ No newline at end of file +* **Install Certificate** [F0016](../privilege-escalation/install-certificate.md) \ No newline at end of file diff --git a/privilege-escalation/install-certificate.md b/privilege-escalation/install-certificate.md index 1e33119..3b23e8a 100644 --- a/privilege-escalation/install-certificate.md +++ b/privilege-escalation/install-certificate.md @@ -1,7 +1,7 @@ - + @@ -13,7 +13,7 @@ - + @@ -21,14 +21,14 @@ - +
IDE1608F0016
Objective(s)
Version2.02.1
Created
Last Modified17 August 202210 February 2024
# Install Certificate -Malware may install a certificate to gain access to https traffic. +Malware may install a malicious or fraudulent certificate onto a victim's system. This can be used to facilitate a variety of attacks, such as man-in-the-middle attacks, where the attacker intercepts and potentially alters communication between two parties without their knowledge. By installing a certificate, the malware can trick the system into trusting it, allowing the attacker to bypass security measures, intercept sensitive data, or deliver additional malicious payloads. This technique can also be used to impersonate websites or services, tricking the user into revealing sensitive information. ## Use in Malware diff --git a/xample-malware/AttackFlow/SearchAwesome_Adware.afb b/xample-malware/AttackFlow/SearchAwesome_Adware.afb index 2e1e009..b018345 100644 --- a/xample-malware/AttackFlow/SearchAwesome_Adware.afb +++ b/xample-malware/AttackFlow/SearchAwesome_Adware.afb @@ -1 +1 @@ -{"version":"2.0.1","id":"e312fa60-4316-4433-a6eb-81e4c3111324","schema":{"page_template":"flow","templates":[{"id":"@__builtin__page","type":7,"role":0,"grid":[10,10],"properties":{"name":{"type":2,"value":"Untitled Document","is_primary":true}},"style":{"grid_color":"#1d1d1d","background_color":"#141414","drop_shadow":{"color":"rgba(0,0,0,.4)","offset":[3,3]}}},{"id":"@__builtin__anchor","type":0,"role":0,"radius":10,"line_templates":{"0":"@__builtin__line_horizontal_elbow","1":"@__builtin__line_vertical_elbow"},"style":{"color":"rgba(255, 255, 255, 0.25)"}},{"id":"@__builtin__line_handle","type":4,"role":0,"style":{"radius":6,"fill_color":"#fedb22","stroke_color":"#141414","stroke_width":1.5}},{"id":"@__builtin__line_source","type":3,"role":12288,"style":{"radius":6,"fill_color":"#fedb22","stroke_color":"#141414","stroke_width":1.5}},{"id":"@__builtin__line_target","type":3,"role":16384,"style":{"radius":6,"fill_color":"#fedb22","stroke_color":"#141414","stroke_width":1.5}},{"id":"@__builtin__line_horizontal_elbow","namespace":"horizontal_elbow","type":5,"role":8192,"hitbox_width":20,"line_handle_template":"@__builtin__line_handle","line_ending_template":{"source":"@__builtin__line_source","target":"@__builtin__line_target"},"style":{"width":5,"cap_size":16,"color":"#646464","select_color":"#646464"}},{"id":"@__builtin__line_vertical_elbow","namespace":"vertical_elbow","type":6,"role":8192,"hitbox_width":20,"line_handle_template":"@__builtin__line_handle","line_ending_template":{"source":"@__builtin__line_source","target":"@__builtin__line_target"},"style":{"width":5,"cap_size":16,"color":"#646464","select_color":"#646464"}},{"id":"flow","type":7,"role":4096,"grid":[10,10],"properties":{"name":{"type":2,"value":"Untitled Document","is_primary":true},"description":{"type":2},"author":{"type":6,"form":{"name":{"type":2,"is_primary":true},"identity_class":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["individual","Individual"],["group","Group"],["system","System"],["organization","Organization"],["class","Class"],["unknown","Unknown"]]}},"contact_information":{"type":2}}},"scope":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["incident","Incident"],["campaign","Campaign"],["threat-actor","Threat Actor"],["malware","Malware"],["other","Other"]]},"value":"incident"},"external_references":{"type":5,"form":{"type":6,"form":{"source_name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"url":{"type":2}}}},"created":{"type":3,"value":"2023-04-21T17:46:00.235Z","is_visible":false}},"style":{"grid_color":"#1d1d1d","background_color":"#141414","drop_shadow":{"color":"rgba(0,0,0,.4)","offset":[3,3]}}},{"id":"true_anchor","type":0,"role":0,"radius":10,"line_templates":{"0":"@__builtin__line_horizontal_elbow","1":"@__builtin__line_vertical_elbow"},"style":{"color":"rgba(255, 255, 255, 0.25)"}},{"id":"false_anchor","type":0,"role":0,"radius":10,"line_templates":{"0":"@__builtin__line_horizontal_elbow","1":"@__builtin__line_vertical_elbow"},"style":{"color":"rgba(255, 255, 255, 0.25)"}},{"id":"action","namespace":"attack_flow.action","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"tactic_id":{"type":2},"tactic_ref":{"type":2},"technique_id":{"type":2},"technique_ref":{"type":2},"description":{"type":2},"confidence":{"type":4,"options":{"type":5,"form":{"type":6,"form":{"text":{"type":2,"is_primary":true},"value":{"type":0}}},"value":[["speculative",{"text":"Speculative","value":0}],["very-doubtful",{"text":"Very Doubtful","value":10}],["doubtful",{"text":"Doubtful","value":30}],["even-odds",{"text":"Even Odds","value":50}],["probable",{"text":"Probable","value":70}],["very-probable",{"text":"Very Probable","value":90}],["certain",{"text":"Certain","value":100}]]},"value":null},"execution_start":{"type":3},"execution_end":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#637bc9","stroke_color":"#708ce6","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"asset","namespace":"attack_flow.asset","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#c26130","stroke_color":"#e57339","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"condition","namespace":"attack_flow.condition","type":1,"role":4096,"properties":{"description":{"type":2,"is_primary":true,"is_required":true},"pattern":{"type":2},"pattern_type":{"type":2},"pattern_version":{"type":2},"date":{"type":3}},"branches":[{"text":"True","anchor_template":"true_anchor"},{"text":"False","anchor_template":"false_anchor"}],"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#2a9642","stroke_color":"#32b34e","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"branch":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","vertical_padding":12,"horizontal_padding":30},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"or","namespace":"attack_flow.OR_operator","type":8,"role":4096,"properties":{"operator":{"type":2,"value":"OR","is_primary":true,"is_visible":false,"is_editable":false}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"fill_color":"#c94040","stroke_color":"#dd5050","text":{"font":{"family":"Inter","size":"14pt","weight":800},"color":"#d8d8d8","line_height":24},"border_radius":13,"select_outline":{"color":"#e6d845","padding":4,"border_radius":19},"anchor_markers":{"color":"#ffffff","size":3},"vertical_padding":18,"horizontal_padding":35}},{"id":"and","namespace":"attack_flow.AND_operator","type":8,"role":4096,"properties":{"operator":{"type":2,"value":"AND","is_primary":true,"is_visible":false,"is_editable":false}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"fill_color":"#c94040","stroke_color":"#dd5050","text":{"font":{"family":"Inter","size":"14pt","weight":800},"color":"#d8d8d8","line_height":24},"border_radius":13,"select_outline":{"color":"#e6d845","padding":4,"border_radius":19},"anchor_markers":{"color":"#ffffff","size":3},"vertical_padding":18,"horizontal_padding":35}},{"id":"attack_pattern","namespace":"stix_object.attack_pattern","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"aliases":{"type":5,"form":{"type":2}},"kill_chain_phases":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"campaign","namespace":"stix_object.campaign","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"aliases":{"type":5,"form":{"type":2}},"first_seen":{"type":3},"last_seen":{"type":3},"objective":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"course_of_action","namespace":"stix_object.course_of_action","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"action_type":{"type":2},"os_execution_envs":{"type":5,"form":{"type":2}},"action_bin":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"grouping","namespace":"stix_object.grouping","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true},"description":{"type":2},"context":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"identity","namespace":"stix_object.identity","type":2,"role":4096,"properties":{"name":{"type":2,"is_required":true,"is_primary":true},"description":{"type":2},"roles":{"type":5,"form":{"type":2}},"identity_class":{"type":2,"is_required":true},"sectors":{"type":5,"form":{"type":2}},"contact_information":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"indicator","namespace":"stix_object.indicator","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true},"description":{"type":2},"indicator_types":{"type":5,"form":{"type":2,"is_required":true}},"pattern":{"type":2,"is_required":true},"pattern_type":{"type":2,"is_required":true},"patter_version":{"type":2},"valid_from":{"type":3,"is_required":true},"valid_until":{"type":3},"kill_chain_phases":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"infrastructure","namespace":"stix_object.infrastructure","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"infrastructure_types":{"type":5,"form":{"type":2,"is_required":true}},"aliases":{"type":5,"form":{"type":2}},"kill_chain_phases":{"type":5,"form":{"type":2}},"first_seen":{"type":3},"last_seen":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"intrusion_set","namespace":"stix_object.intrusion_set","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"aliases":{"type":5,"form":{"type":2,"is_required":true}},"first_seen":{"type":3},"last_seen":{"type":3},"goals":{"type":5,"form":{"type":2}},"resource_level":{"type":2},"primary_motivation":{"type":2},"secondary_motivations":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"location","namespace":"stix_object.location","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true},"description":{"type":2},"latitude":{"type":1,"min":-90,"max":90},"longitude":{"type":1,"min":-180,"max":180},"precision":{"type":1},"region":{"type":2},"country":{"type":2},"administrative_area":{"type":2},"city":{"type":2},"street_address":{"type":2},"postal_code":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"malware","namespace":"stix_object.malware","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true},"description":{"type":2},"malware_types":{"type":5,"form":{"type":2,"is_required":true}},"is_family":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]},"is_required":true},"aliases":{"type":5,"form":{"type":2}},"kill_chain_phases":{"type":5,"form":{"type":2}},"first_seen":{"type":3},"last_seen":{"type":3},"os_execution_envs":{"type":5,"form":{"type":2}},"architecture_execution_envs":{"type":5,"form":{"type":2}},"implementation_languages":{"type":5,"form":{"type":2}},"capabilities":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"malware_analysis","namespace":"stix_object.malware_analysis","type":2,"role":4096,"properties":{"product":{"type":2,"is_primary":true,"is_required":true},"version":{"type":2},"configuration_version":{"type":2},"modules":{"type":5,"form":{"type":2}},"analysis_engine_version":{"type":2},"analysis_definition_version":{"type":2},"submitted":{"type":3},"analysis_started":{"type":3},"analysis_ended":{"type":3},"av_result":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"note","namespace":"stix_object.note","type":2,"role":4096,"properties":{"abstract":{"type":2,"is_primary":true},"content":{"type":2,"is_required":true},"authors":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"observed_data","namespace":"stix_object.observed_data","type":2,"role":4096,"properties":{"first_observed":{"type":3,"is_required":true},"last_observed":{"type":3,"is_required":true},"number_observed":{"type":0,"min":0,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"opinion","namespace":"stix_object.opinion","type":2,"role":4096,"properties":{"explanation":{"type":2,"is_primary":true},"authors":{"type":5,"form":{"type":2}},"opinion":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"report","namespace":"stix_object.report","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"report_types":{"type":5,"form":{"type":2,"is_required":true}},"published":{"type":3,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"threat_actor","namespace":"stix_object.threat_actor","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"threat_actor_types":{"type":5,"form":{"type":2,"is_required":true}},"aliases":{"type":5,"form":{"type":2}},"first_seen":{"type":3},"last_seen":{"type":3},"roles":{"type":5,"form":{"type":2}},"goals":{"type":5,"form":{"type":2}},"sophistication":{"type":2},"resource_level":{"type":2},"primary_motivation":{"type":2},"secondary_motivations":{"type":5,"form":{"type":2}},"personal_motivations":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"tool","namespace":"stix_object.tool","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"tool_types":{"type":5,"form":{"type":2,"is_required":true}},"aliases":{"type":5,"form":{"type":2}},"kill_chain_phases":{"type":5,"form":{"type":2}},"tool_version":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"vulnerability","namespace":"stix_object.vulnerability","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"artifact","namespace":"stix_observable.artifact","type":2,"role":4096,"properties":{"mime_type":{"type":2},"payload_bin":{"type":2},"url":{"type":2},"hashes":{"type":2},"encryption_algorithm":{"type":2},"decryption_key":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"autonomous_system","namespace":"stix_observable.autonomous_system","type":2,"role":4096,"properties":{"number":{"type":2,"is_primary":true,"is_required":true},"name":{"type":2},"rir":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"directory","namespace":"stix_observable.directory","type":2,"role":4096,"properties":{"path":{"type":2,"is_primary":true,"is_required":true},"path_enc":{"type":2},"ctime":{"type":3},"mtime":{"type":3},"atime":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"domain_name","namespace":"stix_observable.domain_name","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"email_address","namespace":"stix_observable.email_address","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true},"display_name":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"email_message","namespace":"stix_observable.email_message","type":2,"role":4096,"properties":{"is_multipart":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]},"is_required":true},"date":{"type":2},"content_type":{"type":2},"message_id":{"type":2},"subject":{"type":2,"is_primary":true},"received_lines":{"type":2},"additional_header_fields":{"type":2},"body":{"type":2},"body_multipart":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"file","namespace":"stix_observable.file","type":2,"role":4096,"properties":{"hashes":{"type":2},"size":{"type":2},"name":{"type":2,"is_primary":true},"name_enc":{"type":2},"magic_number_hex":{"type":2},"mime_type":{"type":2},"ctime":{"type":3},"mtime":{"type":3},"atime":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"ipv4_addr","namespace":"stix_observable.ipv4_addr","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"ipv6_addr","namespace":"stix_observable.ipv6_addr","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"mac_addr","namespace":"stix_observable.mac_addr","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"mutex","namespace":"stix_observable.mutex","type":2,"role":4096,"properties":{"name":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"network_traffic","namespace":"stix_observable.network_traffic","type":2,"role":4096,"properties":{"start":{"type":3},"end":{"type":3},"is_active":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"src_port":{"type":0,"min":0,"max":65535},"dst_port":{"type":0,"min":0,"max":65535},"protocols":{"type":5,"form":{"type":2,"is_required":true}},"src_byte_count":{"type":0,"min":0},"dst_byte_count":{"type":0,"min":0},"src_packets":{"type":0,"min":0},"dst_packets":{"type":0,"min":0},"ipfix":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"process","namespace":"stix_observable.process","type":2,"role":4096,"properties":{"is_hidden":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"pid":{"type":0,"min":0},"created_time":{"type":3},"cwd":{"type":2},"command_line":{"type":2,"is_required":true},"environment_variables":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"software","namespace":"stix_observable.software","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"cpe":{"type":2},"languages":{"type":5,"form":{"type":2}},"vendor":{"type":2},"version":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"url","namespace":"stix_observable.url","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"user_account","namespace":"stix_observable.user_account","type":2,"role":4096,"properties":{"user_id":{"type":2},"credential":{"type":2},"account_login":{"type":2},"account_type":{"type":2},"display_name":{"type":2,"is_primary":true,"is_required":true},"is_service_account":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"is_privileged":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"can_escalate_privs":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"is_disabled":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"account_created":{"type":3},"account_expires":{"type":3},"credential_last_changed":{"type":3},"account_first_login":{"type":3},"account_last_login":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"windows_registry_key","namespace":"stix_observable.windows_registry_key","type":2,"role":4096,"properties":{"key":{"type":2,"is_primary":true},"values":{"type":5,"form":{"type":2}},"modified_time":{"type":3},"number_of_subkeys":{"type":0,"min":0}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"x509_certificate","namespace":"stix_observable.x509_certificate","type":2,"role":4096,"properties":{"subject":{"type":2,"is_primary":true,"is_required":true},"is_self_signed":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"hashes":{"type":2},"version":{"type":2},"serial_number":{"type":2},"signature_algorithm":{"type":2},"issuer":{"type":2},"validity_not_before":{"type":3},"validity_not_after":{"type":3},"subject_public_key_algorithm":{"type":2},"subject_public_key_modulus":{"type":2},"subject_public_key_exponent":{"type":0,"min":0}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}}]},"objects":[{"id":"e312fa60-4316-4433-a6eb-81e4c3111324","x":-430,"y":1165,"attrs":0,"template":"flow","children":["cb85f8b2-a64d-49a3-beca-c307558fe4cb","638fbd7e-e680-4360-86d5-29454f354071","912ab340-e636-4742-8333-f692368ef2ee","f6677d9d-1c87-43bf-9b55-88099a820d4d","ef2455bc-724f-4abf-9b1d-6883128ae328","f829939a-e8cf-4d78-891c-35135405e046","d545cf7c-c227-49e8-b3ef-6836f9431513","3ab0e565-c92d-40c0-a0d8-5795cd1fd6a2","5fb732fb-80d7-4815-ba89-44d18484ed94","91742a64-73d0-4302-9b43-5ae374a7516a","9701d9a7-0c9b-4f07-b565-b01ffd871a36","7a8e4cde-b400-496a-9f9d-be1edd4a7886","5d87ab3b-1f4e-444c-a9e4-957a7699e9e0","37d758b2-64de-4bf5-996d-c96e63ccfacf","e3274fed-9e31-4701-abe0-4ebee9ada501","b0ba70ea-38d2-443e-aa01-889c8d3734f7","a690646e-fc36-4a2c-bd5f-511f7120a509","3c1a34a3-4b5c-4159-89c2-6ab79962dd2d","ca6b0b8d-ea3b-48fe-ade8-bf48920b7295","b4640bcf-36ce-4f5a-aef6-211b9ae93a31","b7f336e6-1ab3-48f4-a537-b1ee494e02e3"],"properties":[["name","SearchAwesome Adware"],["description","SearchAwesome adware intercepts encrypted web traffic to inject ads"],["author",[["name","Lauren Parker"],["identity_class","23b79ae0fc0f07a3669598dd23c694cc"],["contact_information","lparker@mitre.org"]]],["scope","3e072748feb6ecd1b1ba397704e009c0"],["external_references",[["1125df4a84cc115c5f2e21744ffc23ab",[["source_name","Malwarebytes Labs"],["description","Blog"],["url","https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection"]]],["53ec1f40a13a2b844fcaf0b1aa3735d6",[["source_name","Malware Behavior Catalogue"],["description","GitHub"],["url","https://github.com/MBCProject/mbc-markdown/blob/main/xample-malware/searchawesome.md"]]]]],["created","2023-04-21T17:46:00.235Z"]]},{"id":"cb85f8b2-a64d-49a3-beca-c307558fe4cb","x":-430,"y":-580,"attrs":256,"template":"action","children":["21c2c48d-4759-4848-8cde-1bd6df5c8cf5","290e5a65-266f-4378-9b5b-92a3e346ac2a","527acc8c-5d59-4d6c-ba75-08f9909f9e88","397258d1-8795-4e66-948f-8163bd85d419","8c5856d3-277a-448a-951c-03d6e63c9825","bb54f108-1175-47e0-aeca-656474a2caab","58531e75-ca2f-40e1-9c8f-071798f178dc","a48f72e4-3a9c-4165-8148-db93dfae70c5","3ee232fd-2e2a-4a91-990a-597291c57c09","06980f83-d47b-436f-ae0c-5c0c9aec00a5","f50e7e43-7b78-4afd-9906-aa403dc7ed60","a0874563-c613-4fd2-8245-a063417bd170"],"properties":[["name","User Execution"],["tactic_id",null],["tactic_ref",null],["technique_id","E1204"],["technique_ref",null],["description","The user opens a disk image file which invisibly installs its components"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"638fbd7e-e680-4360-86d5-29454f354071","x":-430,"y":70,"attrs":256,"template":"action","children":["453a07c3-b58f-4085-874b-c24cd535df30","6dfe26f5-00fe-4c54-b665-580326d7ea1c","1b9eaf74-609a-4731-b242-e5ff59a2150d","370027b0-ff44-4d93-b3b3-c6aa85864f56","5401b9b8-e5d3-4384-90ab-75e9989d99da","4e48abe8-5658-4737-9fd9-b9fb8669015a","0b6dfe61-a28a-49eb-a094-c7c709d3b8bd","abe9b9d3-3c76-4c22-b7ef-40f8305be143","382192ad-60cc-4bd4-bb9f-1c3586d79498","df743c0b-48c8-40fe-a80e-185856d31690","e8cb1c51-50a7-4bfd-8718-152f81e6dc01","381aeaf3-baa6-4ff1-91b1-370b041b9764"],"properties":[["name","Install Certificate"],["tactic_id",null],["tactic_ref",null],["technique_id","E1608"],["technique_ref",null],["description","The malware installs a certificate"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"912ab340-e636-4742-8333-f692368ef2ee","x":-430,"y":400,"attrs":256,"template":"action","children":["162cbbf4-d957-426f-948c-709cf057bfb5","7cd00608-04e0-4ebe-9289-5ee639d1c311","5f0cf371-3885-4675-95f5-c7cd43fe7ec2","ae479b68-1a76-4506-8ea0-c61b88d6b6bc","8cf8215b-aa05-41e8-9b15-ae8229cac662","a7cf986d-8bee-4045-a257-dec9679c661d","9d6b0e97-67e2-4d75-9941-93f51ba34553","e9389b82-d0ba-4bf3-b6c8-f98512b153fb","ccc4060b-1c4d-4ae8-869e-86830e7563a7","8b8a8818-b5b8-490b-a0cf-c0f52925722d","aa91b554-3c84-47a6-82f2-1fc557ff9e4d","331fdcdb-351b-4c1d-b9fd-74a91a1dd907"],"properties":[["name","Adversary-in-the-Middle"],["tactic_id",null],["tactic_ref",null],["technique_id","T1557"],["technique_ref",null],["description","Malware inserts itself into a chain of custody, typically within network packets"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"f6677d9d-1c87-43bf-9b55-88099a820d4d","x":-430,"y":770,"attrs":256,"template":"action","children":["d93a5111-56df-4efa-92ff-c0beed4c9f86","de1eb239-ab39-4e13-ba4e-23ca5870b130","291ff330-04c5-4316-a574-f42fc36daffe","ec52c210-5b02-454a-a2b2-1874e7c05242","3349891f-cf9d-4683-b8b4-7eab8e25fff7","bfd6f697-4303-40f8-8adc-4693f4df1092","f1f017ce-6066-4341-b2c6-886bbb7ba086","a2cc2a42-3e05-4250-9176-e0c9ca06f32d","8b660ee2-b477-41cd-93a2-3c8479cfccef","5bc535b0-ffe2-409e-a074-670f3e0bfa9b","ded5ca4d-e462-4a40-8e10-8cfe0094693b","43051fb4-2dfe-4865-8064-ced4c5348ef5"],"properties":[["name","Subvert Trust Controls"],["tactic_id",null],["tactic_ref",null],["technique_id","T1553"],["technique_ref",null],["description","The malware uses certificates to gain access to HTTPS traffic"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"ef2455bc-724f-4abf-9b1d-6883128ae328","x":-430,"y":1120,"attrs":256,"template":"action","children":["aee5c139-24a2-4625-9dd0-84aa69a316d8","a66299cc-7d46-4591-8d17-9bef24df6499","2bae656e-8a38-4e74-9b01-2132d48ad87d","f806c9a0-ea7d-4433-b01e-e65a23eb6071","e2c0d6f3-7335-4c89-8da8-d4d1839e1e5b","210d0ea5-f22a-44f5-af9f-db34ea31030e","72dd1bbf-b3bc-48ff-b57d-37d8f4de1c04","c4bd9a01-0d5a-4a5f-9ac0-400d45f29379","d1af7d19-9beb-4fac-a45d-1a0294a111d0","0ef2cfc9-adcf-43c4-b5dd-4a9a026d3aad","91524619-6ace-47c1-bdda-57be4517c390","05ca6852-0fbb-42c8-aa40-fbba6ca01695"],"properties":[["name","Install Additional Program"],["tactic_id",null],["tactic_ref",null],["technique_id","B0023"],["technique_ref",null],["description","Malware installs an open-source program called mitmproxy"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"f829939a-e8cf-4d78-891c-35135405e046","x":-430,"y":1470,"attrs":256,"template":"action","children":["68108e8a-4d6d-48c7-9943-2fe669d7d792","e3d86880-2df7-4801-9a39-0058cb09b205","a3ebe80e-c6ce-497e-aee1-ddaa4899f5cc","ba75a374-6075-4e22-8cc3-9835a8b7632d","9ac6aa3c-646b-48f2-ba27-28483bed5532","0edc4a75-0604-499c-98da-8d2c8de8cf9e","278c229b-fe7f-4646-9662-cdb22631e7a2","fbc15ae3-6fff-4b06-bfcd-c8aa87823d0a","108b1b50-5551-47b8-af2c-a71ab901cce0","971ee7b6-c80c-42f5-8248-f531045d63ba","a0be8feb-3183-4c33-86f6-5213db06b9f7","5c93f285-d7b7-48b1-a294-4257461a7690"],"properties":[["name","Proxy "],["tactic_id",null],["tactic_ref",null],["technique_id","T1090"],["technique_ref",null],["description","Malware uses mitmproxy to intercept and modify web traffic"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"d545cf7c-c227-49e8-b3ef-6836f9431513","x":-430,"y":1810,"attrs":256,"template":"action","children":["2dacd2f4-270a-4114-b2d2-f22f1cf1db21","9a64b509-1c9a-4571-87bb-2244ef93155e","c00d4de0-0ba6-444b-a56a-2c7cbc558633","df3c6274-552d-45e4-a8f9-8aaa433bbae7","c6c626f3-c520-4b0e-9e09-2c4dc481dc68","389b98ad-9afb-4eb4-bddc-dbc7f2f64376","8a7932f4-593a-41b2-b7c8-8f98f20fa1e9","1b83cf21-a000-46ee-8f35-128d34a06224","191e8a26-06a8-41c0-9781-62a9351ce117","cc21b629-ec19-46ec-90e2-b230e1c1e7be","4fcc9da5-e654-4d6c-b4a0-0eeef03820ea","7a46ea48-6e63-41a9-917e-81c3841a8d8a"],"properties":[["name","Manipulate Network Traffic"],["tactic_id",null],["tactic_ref",null],["technique_id","B0019"],["technique_ref",null],["description","Malware intercepts encrypted web traffic to inject ads"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"3ab0e565-c92d-40c0-a0d8-5795cd1fd6a2","x":-430,"y":2550,"attrs":256,"template":"action","children":["110a0fb2-2029-4caa-9e71-0ddeae753ae3","9354cbf0-3f11-4b89-8c97-784d74b96f7c","f119ca11-6cb2-4d4b-ad28-413e75ec9834","648eb88a-268c-4d2a-8c43-6daf38677013","48e2b057-c812-4de5-adc2-76932e8b9c73","d7abc87f-5c18-4e89-96b8-f445c3a08974","81a57a1f-bd27-4642-bcce-f748b0969d33","5456516c-7d73-4a08-8490-3535f6aca557","48a30206-416f-4759-b0c2-d3822f7640b5","2238c5ca-3298-4352-ad24-d4bc67ae6dc8","b0f2c262-5fdd-4035-a594-1578022b819c","4ea7a3c8-cb2c-47c6-98c6-7d6dd3b616c5"],"properties":[["name","Browser Session Hijacking"],["tactic_id",null],["tactic_ref",null],["technique_id","T1185"],["technique_ref",null],["description","Malware can modify web traffic for the purpose of injecting Javascript"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"5fb732fb-80d7-4815-ba89-44d18484ed94","x":-430,"y":2190,"attrs":256,"template":"action","children":["cb281959-6b20-4782-a88b-088521e1e4d6","aad6fe87-e0e7-4351-90b2-3c722fe4dd8c","fa443996-9be1-4f7f-8acd-9482dd743bd2","09451d11-5e82-4766-a3dd-15bc335fa746","dbe81a7d-f875-4fd6-8735-8b4445828906","173ff27a-cd54-4e55-bf93-a17779fc1f08","ccfc406c-a580-4da6-be5e-21e7c5260872","26a6e496-b404-4e10-8607-95c858f606db","d062b5f1-ef7f-4e29-8cda-843dfc7c8ffd","7944337a-a2a4-4223-b1c9-20f75b8edcee","8dedbb9c-f95b-4611-a504-8ac56d1e39c4","cee6a5e7-c9bf-470e-a7ae-3b0e0534c1cc"],"properties":[["name","Command and Scripting Interpreter"],["tactic_id",null],["tactic_ref",null],["technique_id","E1059"],["technique_ref",null],["description","Malware installs a script to inject a JavaScript script and modify web traffic"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"91742a64-73d0-4302-9b43-5ae374a7516a","x":-430,"y":-250,"attrs":256,"template":"action","children":["50d9d194-c7b4-47c4-a075-bebae26093ca","c9873cc8-35e9-42a1-ba0a-a0e742b0dd2e","980bf037-38f9-4ed5-a9e0-878776bfe4b8","a108d43e-0bba-4960-b9df-4c84f6484a87","d5276d85-3549-4485-8ef4-e3c1271d1c5b","bc635455-113e-4f8a-a0d2-d3e254da3980","217a788b-be1a-4dc6-b4c4-5b1e4eb3e54a","a69ddf9c-2ab6-4f40-9d0b-1fa7e246fcf7","306dec7f-3b4b-42e4-9a38-b5bdcb31f7ae","14cd4093-dce7-4125-a574-b12280d294fc","b8f106bc-171f-46bf-80f3-9b3ca45e445e","7635a6c3-e62e-4ebe-8523-6c9711199cee"],"properties":[["name","C2 Communication: Receive Data"],["tactic_id",null],["tactic_ref",null],["technique_id","B0030.002"],["technique_ref",null],["description","Malware receives data from the C2 server"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"9701d9a7-0c9b-4f07-b565-b01ffd871a36","x":-430,"y":2910,"attrs":256,"template":"action","children":["6ef6df70-6d88-4a88-9133-2fbcfaa744e0","01c717a2-8dc8-43cd-a7d5-c603d4f771eb","5f1dc053-16c5-481a-8b4c-1c9691625cb4","75b8e4cc-89fb-42e4-87f0-eb9c099bd476","b2c43fe3-f144-427b-8f41-8ccd9b5b21a9","15aa892e-9637-472b-9624-3d1c98d9f106","b9901bd3-7d52-4720-a715-661b12825d44","8e904bc8-7daa-4c6a-bf2c-fb0eb403f6b7","9fb3863b-edc1-412e-aa65-3ccb72214460","fbd8f5b1-9168-4c8a-a3c5-c2c93f475efe","3afeb322-076b-4a10-994f-0d68111826bd","bc5dae62-3fa8-48b4-bbac-cb52790bab8d"],"properties":[["name","Self Deletion"],["tactic_id",null],["tactic_ref",null],["technique_id","F0007"],["technique_ref",null],["description","Malware will monitor if a specific file gets deleted and then will delete itself"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"7a8e4cde-b400-496a-9f9d-be1edd4a7886","x":-430,"y":2730,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["9279aa15-6c9e-41ee-8e89-11e71df8eeaa","4a634e9a-dfe6-4298-adeb-37835aa62f2d","2e8bcbc8-d7cf-4330-bd28-e1d66464b694"],"properties":[]},{"id":"5d87ab3b-1f4e-444c-a9e4-957a7699e9e0","x":-430,"y":-410,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["71f212cb-0ef1-4dc4-b63d-a0d8d7432d2b","29bc61cd-6c27-4b82-b1ac-2b7c18ae68a8","d6867805-4c10-4fef-93a1-7f5865e3ebf0"],"properties":[]},{"id":"37d758b2-64de-4bf5-996d-c96e63ccfacf","x":-430,"y":-90,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["b1100efa-d7da-41fc-82af-e2492c036c28","4f3b656a-1bf9-46f3-95bc-5634d366d1f2","87720610-e84c-4e35-9499-0b3a7a27d364"],"properties":[]},{"id":"e3274fed-9e31-4701-abe0-4ebee9ada501","x":-430,"y":230,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["20b7ba28-59ca-46a4-b0f6-7a8d8151b67b","14727f47-6151-46aa-bde1-b7f5e836f745","d2c4b766-83ff-4614-8dde-d08659d94f9b"],"properties":[]},{"id":"b0ba70ea-38d2-443e-aa01-889c8d3734f7","x":-430,"y":585,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["983dd01c-b4ae-4496-a06e-122677393d96","5431af9d-d3b1-4cb5-921a-015b74d79a97","acbd1088-4051-4f40-acde-015a48b3cf6b"],"properties":[]},{"id":"a690646e-fc36-4a2c-bd5f-511f7120a509","x":-430,"y":945,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["b97b1d4a-4310-4524-99a4-30f3bf7f09b9","2f180274-eb81-492f-95ea-0ac782f3442b","067cdcd1-1a98-4ebe-980a-61ab98c8709b"],"properties":[]},{"id":"3c1a34a3-4b5c-4159-89c2-6ab79962dd2d","x":-430,"y":1295,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["58472c38-1dcc-44aa-85df-e10f0a295047","232296fa-3845-4fe5-a633-2dc7ab9177a4","00e01066-582b-4fbf-8178-d42b62b057d2"],"properties":[]},{"id":"ca6b0b8d-ea3b-48fe-ade8-bf48920b7295","x":-430,"y":1640,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["ff42725e-1249-492b-9db9-51c6c156555c","2ea564da-0a0c-4d56-a6fd-b37915dd6fde","cb2d0e4f-c434-4314-abcf-0164ec79cda8"],"properties":[]},{"id":"b4640bcf-36ce-4f5a-aef6-211b9ae93a31","x":-430,"y":2000,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["8f0ff297-1dc6-4dc7-a531-8ea3488dda37","d4b9b9c2-f78e-4882-ad28-61d33d00611a","8c2bfa97-ab0c-4dc1-8ff7-6835d26adbb9"],"properties":[]},{"id":"b7f336e6-1ab3-48f4-a537-b1ee494e02e3","x":-430,"y":2370,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["76fb7612-f30c-4d15-8777-271be3b5d86f","421b6966-5e42-4347-a92a-4f8ef37bd02c","4c8f5d28-d37b-474f-97ba-8cc9d83011bc"],"properties":[]},{"id":"21c2c48d-4759-4848-8cde-1bd6df5c8cf5","x":-518.5,"y":-711,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"290e5a65-266f-4378-9b5b-92a3e346ac2a","x":-430,"y":-711,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"527acc8c-5d59-4d6c-ba75-08f9909f9e88","x":-341.5,"y":-711,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"397258d1-8795-4e66-948f-8163bd85d419","x":-252,"y":-645.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8c5856d3-277a-448a-951c-03d6e63c9825","x":-252,"y":-580,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bb54f108-1175-47e0-aeca-656474a2caab","x":-252,"y":-514.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"58531e75-ca2f-40e1-9c8f-071798f178dc","x":-341.5,"y":-448,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a48f72e4-3a9c-4165-8148-db93dfae70c5","x":-430,"y":-448,"attrs":0,"template":"@__builtin__anchor","children":["71f212cb-0ef1-4dc4-b63d-a0d8d7432d2b"],"properties":[],"angle":1},{"id":"3ee232fd-2e2a-4a91-990a-597291c57c09","x":-518.5,"y":-448,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"06980f83-d47b-436f-ae0c-5c0c9aec00a5","x":-607,"y":-514.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"f50e7e43-7b78-4afd-9906-aa403dc7ed60","x":-607,"y":-580,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"a0874563-c613-4fd2-8245-a063417bd170","x":-607,"y":-645.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"453a07c3-b58f-4085-874b-c24cd535df30","x":-495,"y":-51,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"6dfe26f5-00fe-4c54-b665-580326d7ea1c","x":-430,"y":-51,"attrs":0,"template":"@__builtin__anchor","children":["87720610-e84c-4e35-9499-0b3a7a27d364"],"properties":[],"angle":1},{"id":"1b9eaf74-609a-4731-b242-e5ff59a2150d","x":-365,"y":-51,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"370027b0-ff44-4d93-b3b3-c6aa85864f56","x":-300,"y":9.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"5401b9b8-e5d3-4384-90ab-75e9989d99da","x":-300,"y":70,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"4e48abe8-5658-4737-9fd9-b9fb8669015a","x":-300,"y":130.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"0b6dfe61-a28a-49eb-a094-c7c709d3b8bd","x":-365,"y":192,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"abe9b9d3-3c76-4c22-b7ef-40f8305be143","x":-430,"y":192,"attrs":0,"template":"@__builtin__anchor","children":["20b7ba28-59ca-46a4-b0f6-7a8d8151b67b"],"properties":[],"angle":1},{"id":"382192ad-60cc-4bd4-bb9f-1c3586d79498","x":-495,"y":192,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"df743c0b-48c8-40fe-a80e-185856d31690","x":-560,"y":130.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"e8cb1c51-50a7-4bfd-8718-152f81e6dc01","x":-560,"y":70,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"381aeaf3-baa6-4ff1-91b1-370b041b9764","x":-560,"y":9.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"162cbbf4-d957-426f-948c-709cf057bfb5","x":-515,"y":269,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"7cd00608-04e0-4ebe-9289-5ee639d1c311","x":-430,"y":269,"attrs":0,"template":"@__builtin__anchor","children":["d2c4b766-83ff-4614-8dde-d08659d94f9b"],"properties":[],"angle":1},{"id":"5f0cf371-3885-4675-95f5-c7cd43fe7ec2","x":-345,"y":269,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"ae479b68-1a76-4506-8ea0-c61b88d6b6bc","x":-259,"y":334.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8cf8215b-aa05-41e8-9b15-ae8229cac662","x":-259,"y":400,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"a7cf986d-8bee-4045-a257-dec9679c661d","x":-259,"y":465.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"9d6b0e97-67e2-4d75-9941-93f51ba34553","x":-345,"y":532,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"e9389b82-d0ba-4bf3-b6c8-f98512b153fb","x":-430,"y":532,"attrs":0,"template":"@__builtin__anchor","children":["983dd01c-b4ae-4496-a06e-122677393d96"],"properties":[],"angle":1},{"id":"ccc4060b-1c4d-4ae8-869e-86830e7563a7","x":-515,"y":532,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"8b8a8818-b5b8-490b-a0cf-c0f52925722d","x":-600,"y":465.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"aa91b554-3c84-47a6-82f2-1fc557ff9e4d","x":-600,"y":400,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"331fdcdb-351b-4c1d-b9fd-74a91a1dd907","x":-600,"y":334.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"d93a5111-56df-4efa-92ff-c0beed4c9f86","x":-519,"y":639,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"de1eb239-ab39-4e13-ba4e-23ca5870b130","x":-430,"y":639,"attrs":0,"template":"@__builtin__anchor","children":["acbd1088-4051-4f40-acde-015a48b3cf6b"],"properties":[],"angle":1},{"id":"291ff330-04c5-4316-a574-f42fc36daffe","x":-341,"y":639,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"ec52c210-5b02-454a-a2b2-1874e7c05242","x":-251,"y":704.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"3349891f-cf9d-4683-b8b4-7eab8e25fff7","x":-251,"y":770,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bfd6f697-4303-40f8-8adc-4693f4df1092","x":-251,"y":835.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"f1f017ce-6066-4341-b2c6-886bbb7ba086","x":-341,"y":901,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a2cc2a42-3e05-4250-9176-e0c9ca06f32d","x":-430,"y":901,"attrs":0,"template":"@__builtin__anchor","children":["b97b1d4a-4310-4524-99a4-30f3bf7f09b9"],"properties":[],"angle":1},{"id":"8b660ee2-b477-41cd-93a2-3c8479cfccef","x":-519,"y":901,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"5bc535b0-ffe2-409e-a074-670f3e0bfa9b","x":-608,"y":835.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"ded5ca4d-e462-4a40-8e10-8cfe0094693b","x":-608,"y":770,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"43051fb4-2dfe-4865-8064-ced4c5348ef5","x":-608,"y":704.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"aee5c139-24a2-4625-9dd0-84aa69a316d8","x":-519.5,"y":989,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a66299cc-7d46-4591-8d17-9bef24df6499","x":-430,"y":989,"attrs":0,"template":"@__builtin__anchor","children":["067cdcd1-1a98-4ebe-980a-61ab98c8709b"],"properties":[],"angle":1},{"id":"2bae656e-8a38-4e74-9b01-2132d48ad87d","x":-340.5,"y":989,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"f806c9a0-ea7d-4433-b01e-e65a23eb6071","x":-250,"y":1054.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"e2c0d6f3-7335-4c89-8da8-d4d1839e1e5b","x":-250,"y":1120,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"210d0ea5-f22a-44f5-af9f-db34ea31030e","x":-250,"y":1185.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"72dd1bbf-b3bc-48ff-b57d-37d8f4de1c04","x":-340.5,"y":1252,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"c4bd9a01-0d5a-4a5f-9ac0-400d45f29379","x":-430,"y":1252,"attrs":0,"template":"@__builtin__anchor","children":["58472c38-1dcc-44aa-85df-e10f0a295047"],"properties":[],"angle":1},{"id":"d1af7d19-9beb-4fac-a45d-1a0294a111d0","x":-519.5,"y":1252,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"0ef2cfc9-adcf-43c4-b5dd-4a9a026d3aad","x":-609,"y":1185.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"91524619-6ace-47c1-bdda-57be4517c390","x":-609,"y":1120,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"05ca6852-0fbb-42c8-aa40-fbba6ca01695","x":-609,"y":1054.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"68108e8a-4d6d-48c7-9943-2fe669d7d792","x":-509,"y":1339,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"e3d86880-2df7-4801-9a39-0058cb09b205","x":-430,"y":1339,"attrs":0,"template":"@__builtin__anchor","children":["00e01066-582b-4fbf-8178-d42b62b057d2"],"properties":[],"angle":1},{"id":"a3ebe80e-c6ce-497e-aee1-ddaa4899f5cc","x":-351,"y":1339,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"ba75a374-6075-4e22-8cc3-9835a8b7632d","x":-272,"y":1404.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"9ac6aa3c-646b-48f2-ba27-28483bed5532","x":-272,"y":1470,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"0edc4a75-0604-499c-98da-8d2c8de8cf9e","x":-272,"y":1535.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"278c229b-fe7f-4646-9662-cdb22631e7a2","x":-351,"y":1601,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"fbc15ae3-6fff-4b06-bfcd-c8aa87823d0a","x":-430,"y":1601,"attrs":0,"template":"@__builtin__anchor","children":["ff42725e-1249-492b-9db9-51c6c156555c"],"properties":[],"angle":1},{"id":"108b1b50-5551-47b8-af2c-a71ab901cce0","x":-509,"y":1601,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"971ee7b6-c80c-42f5-8248-f531045d63ba","x":-588,"y":1535.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"a0be8feb-3183-4c33-86f6-5213db06b9f7","x":-588,"y":1470,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"5c93f285-d7b7-48b1-a294-4257461a7690","x":-588,"y":1404.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"2dacd2f4-270a-4114-b2d2-f22f1cf1db21","x":-513,"y":1679,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"9a64b509-1c9a-4571-87bb-2244ef93155e","x":-430,"y":1679,"attrs":0,"template":"@__builtin__anchor","children":["cb2d0e4f-c434-4314-abcf-0164ec79cda8"],"properties":[],"angle":1},{"id":"c00d4de0-0ba6-444b-a56a-2c7cbc558633","x":-347,"y":1679,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"df3c6274-552d-45e4-a8f9-8aaa433bbae7","x":-263,"y":1744.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"c6c626f3-c520-4b0e-9e09-2c4dc481dc68","x":-263,"y":1810,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"389b98ad-9afb-4eb4-bddc-dbc7f2f64376","x":-263,"y":1875.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8a7932f4-593a-41b2-b7c8-8f98f20fa1e9","x":-347,"y":1942,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"1b83cf21-a000-46ee-8f35-128d34a06224","x":-430,"y":1942,"attrs":0,"template":"@__builtin__anchor","children":["8f0ff297-1dc6-4dc7-a531-8ea3488dda37"],"properties":[],"angle":1},{"id":"191e8a26-06a8-41c0-9781-62a9351ce117","x":-513,"y":1942,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"cc21b629-ec19-46ec-90e2-b230e1c1e7be","x":-596,"y":1875.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"4fcc9da5-e654-4d6c-b4a0-0eeef03820ea","x":-596,"y":1810,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"7a46ea48-6e63-41a9-917e-81c3841a8d8a","x":-596,"y":1744.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"110a0fb2-2029-4caa-9e71-0ddeae753ae3","x":-519,"y":2419,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"9354cbf0-3f11-4b89-8c97-784d74b96f7c","x":-430,"y":2419,"attrs":0,"template":"@__builtin__anchor","children":["4c8f5d28-d37b-474f-97ba-8cc9d83011bc"],"properties":[],"angle":1},{"id":"f119ca11-6cb2-4d4b-ad28-413e75ec9834","x":-341,"y":2419,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"648eb88a-268c-4d2a-8c43-6daf38677013","x":-251,"y":2484.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"48e2b057-c812-4de5-adc2-76932e8b9c73","x":-251,"y":2550,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"d7abc87f-5c18-4e89-96b8-f445c3a08974","x":-251,"y":2615.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"81a57a1f-bd27-4642-bcce-f748b0969d33","x":-341,"y":2682,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"5456516c-7d73-4a08-8490-3535f6aca557","x":-430,"y":2682,"attrs":0,"template":"@__builtin__anchor","children":["9279aa15-6c9e-41ee-8e89-11e71df8eeaa"],"properties":[],"angle":1},{"id":"48a30206-416f-4759-b0c2-d3822f7640b5","x":-519,"y":2682,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"2238c5ca-3298-4352-ad24-d4bc67ae6dc8","x":-608,"y":2615.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"b0f2c262-5fdd-4035-a594-1578022b819c","x":-608,"y":2550,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"4ea7a3c8-cb2c-47c6-98c6-7d6dd3b616c5","x":-608,"y":2484.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"cb281959-6b20-4782-a88b-088521e1e4d6","x":-516.5,"y":2059,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"aad6fe87-e0e7-4351-90b2-3c722fe4dd8c","x":-430,"y":2059,"attrs":0,"template":"@__builtin__anchor","children":["8c2bfa97-ab0c-4dc1-8ff7-6835d26adbb9"],"properties":[],"angle":1},{"id":"fa443996-9be1-4f7f-8acd-9482dd743bd2","x":-343.5,"y":2059,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"09451d11-5e82-4766-a3dd-15bc335fa746","x":-257,"y":2124.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"dbe81a7d-f875-4fd6-8735-8b4445828906","x":-257,"y":2190,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"173ff27a-cd54-4e55-bf93-a17779fc1f08","x":-257,"y":2255.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"ccfc406c-a580-4da6-be5e-21e7c5260872","x":-343.5,"y":2322,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"26a6e496-b404-4e10-8607-95c858f606db","x":-430,"y":2322,"attrs":0,"template":"@__builtin__anchor","children":["76fb7612-f30c-4d15-8777-271be3b5d86f"],"properties":[],"angle":1},{"id":"d062b5f1-ef7f-4e29-8cda-843dfc7c8ffd","x":-516.5,"y":2322,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"7944337a-a2a4-4223-b1c9-20f75b8edcee","x":-603,"y":2255.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8dedbb9c-f95b-4611-a504-8ac56d1e39c4","x":-603,"y":2190,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"cee6a5e7-c9bf-470e-a7ae-3b0e0534c1cc","x":-603,"y":2124.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"50d9d194-c7b4-47c4-a075-bebae26093ca","x":-511.5,"y":-371,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"c9873cc8-35e9-42a1-ba0a-a0e742b0dd2e","x":-430,"y":-371,"attrs":0,"template":"@__builtin__anchor","children":["d6867805-4c10-4fef-93a1-7f5865e3ebf0"],"properties":[],"angle":1},{"id":"980bf037-38f9-4ed5-a9e0-878776bfe4b8","x":-348.5,"y":-371,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a108d43e-0bba-4960-b9df-4c84f6484a87","x":-266,"y":-310.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"d5276d85-3549-4485-8ef4-e3c1271d1c5b","x":-266,"y":-250,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bc635455-113e-4f8a-a0d2-d3e254da3980","x":-266,"y":-189.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"217a788b-be1a-4dc6-b4c4-5b1e4eb3e54a","x":-348.5,"y":-128,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a69ddf9c-2ab6-4f40-9d0b-1fa7e246fcf7","x":-430,"y":-128,"attrs":0,"template":"@__builtin__anchor","children":["b1100efa-d7da-41fc-82af-e2492c036c28"],"properties":[],"angle":1},{"id":"306dec7f-3b4b-42e4-9a38-b5bdcb31f7ae","x":-511.5,"y":-128,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"14cd4093-dce7-4125-a574-b12280d294fc","x":-593,"y":-189.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"b8f106bc-171f-46bf-80f3-9b3ca45e445e","x":-593,"y":-250,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"7635a6c3-e62e-4ebe-8523-6c9711199cee","x":-593,"y":-310.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"6ef6df70-6d88-4a88-9133-2fbcfaa744e0","x":-508.5,"y":2779,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"01c717a2-8dc8-43cd-a7d5-c603d4f771eb","x":-430,"y":2779,"attrs":0,"template":"@__builtin__anchor","children":["2e8bcbc8-d7cf-4330-bd28-e1d66464b694"],"properties":[],"angle":1},{"id":"5f1dc053-16c5-481a-8b4c-1c9691625cb4","x":-351.5,"y":2779,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"75b8e4cc-89fb-42e4-87f0-eb9c099bd476","x":-273,"y":2844.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"b2c43fe3-f144-427b-8f41-8ccd9b5b21a9","x":-273,"y":2910,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"15aa892e-9637-472b-9624-3d1c98d9f106","x":-273,"y":2975.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"b9901bd3-7d52-4720-a715-661b12825d44","x":-351.5,"y":3042,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"8e904bc8-7daa-4c6a-bf2c-fb0eb403f6b7","x":-430,"y":3042,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"9fb3863b-edc1-412e-aa65-3ccb72214460","x":-508.5,"y":3042,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"fbd8f5b1-9168-4c8a-a3c5-c2c93f475efe","x":-587,"y":2975.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"3afeb322-076b-4a10-994f-0d68111826bd","x":-587,"y":2910,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bc5dae62-3fa8-48b4-bbac-cb52790bab8d","x":-587,"y":2844.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"9279aa15-6c9e-41ee-8e89-11e71df8eeaa","x":-430,"y":2682,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"4a634e9a-dfe6-4298-adeb-37835aa62f2d","x":-430,"y":2730.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"2e8bcbc8-d7cf-4330-bd28-e1d66464b694","x":-430,"y":2779,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"71f212cb-0ef1-4dc4-b63d-a0d8d7432d2b","x":-430,"y":-448,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"29bc61cd-6c27-4b82-b1ac-2b7c18ae68a8","x":-430,"y":-409.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"d6867805-4c10-4fef-93a1-7f5865e3ebf0","x":-430,"y":-371,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"b1100efa-d7da-41fc-82af-e2492c036c28","x":-430,"y":-128,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"4f3b656a-1bf9-46f3-95bc-5634d366d1f2","x":-430,"y":-89.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"87720610-e84c-4e35-9499-0b3a7a27d364","x":-430,"y":-51,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"20b7ba28-59ca-46a4-b0f6-7a8d8151b67b","x":-430,"y":192,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"14727f47-6151-46aa-bde1-b7f5e836f745","x":-430,"y":230.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"d2c4b766-83ff-4614-8dde-d08659d94f9b","x":-430,"y":269,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"983dd01c-b4ae-4496-a06e-122677393d96","x":-430,"y":532,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"5431af9d-d3b1-4cb5-921a-015b74d79a97","x":-430,"y":585.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"acbd1088-4051-4f40-acde-015a48b3cf6b","x":-430,"y":639,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"b97b1d4a-4310-4524-99a4-30f3bf7f09b9","x":-430,"y":901,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"2f180274-eb81-492f-95ea-0ac782f3442b","x":-430,"y":945,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"067cdcd1-1a98-4ebe-980a-61ab98c8709b","x":-430,"y":989,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"58472c38-1dcc-44aa-85df-e10f0a295047","x":-430,"y":1252,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"232296fa-3845-4fe5-a633-2dc7ab9177a4","x":-430,"y":1295.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"00e01066-582b-4fbf-8178-d42b62b057d2","x":-430,"y":1339,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"ff42725e-1249-492b-9db9-51c6c156555c","x":-430,"y":1601,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"2ea564da-0a0c-4d56-a6fd-b37915dd6fde","x":-430,"y":1640,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"cb2d0e4f-c434-4314-abcf-0164ec79cda8","x":-430,"y":1679,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"8f0ff297-1dc6-4dc7-a531-8ea3488dda37","x":-430,"y":1942,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"d4b9b9c2-f78e-4882-ad28-61d33d00611a","x":-430,"y":2000.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"8c2bfa97-ab0c-4dc1-8ff7-6835d26adbb9","x":-430,"y":2059,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"76fb7612-f30c-4d15-8777-271be3b5d86f","x":-430,"y":2322,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"421b6966-5e42-4347-a92a-4f8ef37bd02c","x":-430,"y":2370.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"4c8f5d28-d37b-474f-97ba-8cc9d83011bc","x":-430,"y":2419,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]}],"location":{"x":-147.8160459630095,"y":2758.961776482524,"k":0.7071067811865483}} \ No newline at end of file +{"version":"2.0.1","id":"e312fa60-4316-4433-a6eb-81e4c3111324","schema":{"page_template":"flow","templates":[{"id":"@__builtin__page","type":7,"role":0,"grid":[10,10],"properties":{"name":{"type":2,"value":"Untitled Document","is_primary":true}},"style":{"grid_color":"#1d1d1d","background_color":"#141414","drop_shadow":{"color":"rgba(0,0,0,.4)","offset":[3,3]}}},{"id":"@__builtin__anchor","type":0,"role":0,"radius":10,"line_templates":{"0":"@__builtin__line_horizontal_elbow","1":"@__builtin__line_vertical_elbow"},"style":{"color":"rgba(255, 255, 255, 0.25)"}},{"id":"@__builtin__line_handle","type":4,"role":0,"style":{"radius":6,"fill_color":"#fedb22","stroke_color":"#141414","stroke_width":1.5}},{"id":"@__builtin__line_source","type":3,"role":12288,"style":{"radius":6,"fill_color":"#fedb22","stroke_color":"#141414","stroke_width":1.5}},{"id":"@__builtin__line_target","type":3,"role":16384,"style":{"radius":6,"fill_color":"#fedb22","stroke_color":"#141414","stroke_width":1.5}},{"id":"@__builtin__line_horizontal_elbow","namespace":"horizontal_elbow","type":5,"role":8192,"hitbox_width":20,"line_handle_template":"@__builtin__line_handle","line_ending_template":{"source":"@__builtin__line_source","target":"@__builtin__line_target"},"style":{"width":5,"cap_size":16,"color":"#646464","select_color":"#646464"}},{"id":"@__builtin__line_vertical_elbow","namespace":"vertical_elbow","type":6,"role":8192,"hitbox_width":20,"line_handle_template":"@__builtin__line_handle","line_ending_template":{"source":"@__builtin__line_source","target":"@__builtin__line_target"},"style":{"width":5,"cap_size":16,"color":"#646464","select_color":"#646464"}},{"id":"flow","type":7,"role":4096,"grid":[10,10],"properties":{"name":{"type":2,"value":"Untitled Document","is_primary":true},"description":{"type":2},"author":{"type":6,"form":{"name":{"type":2,"is_primary":true},"identity_class":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["individual","Individual"],["group","Group"],["system","System"],["organization","Organization"],["class","Class"],["unknown","Unknown"]]}},"contact_information":{"type":2}}},"scope":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["incident","Incident"],["campaign","Campaign"],["threat-actor","Threat Actor"],["malware","Malware"],["other","Other"]]},"value":"incident"},"external_references":{"type":5,"form":{"type":6,"form":{"source_name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"url":{"type":2}}}},"created":{"type":3,"value":"2023-04-21T17:46:00.235Z","is_visible":false}},"style":{"grid_color":"#1d1d1d","background_color":"#141414","drop_shadow":{"color":"rgba(0,0,0,.4)","offset":[3,3]}}},{"id":"true_anchor","type":0,"role":0,"radius":10,"line_templates":{"0":"@__builtin__line_horizontal_elbow","1":"@__builtin__line_vertical_elbow"},"style":{"color":"rgba(255, 255, 255, 0.25)"}},{"id":"false_anchor","type":0,"role":0,"radius":10,"line_templates":{"0":"@__builtin__line_horizontal_elbow","1":"@__builtin__line_vertical_elbow"},"style":{"color":"rgba(255, 255, 255, 0.25)"}},{"id":"action","namespace":"attack_flow.action","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"tactic_id":{"type":2},"tactic_ref":{"type":2},"technique_id":{"type":2},"technique_ref":{"type":2},"description":{"type":2},"confidence":{"type":4,"options":{"type":5,"form":{"type":6,"form":{"text":{"type":2,"is_primary":true},"value":{"type":0}}},"value":[["speculative",{"text":"Speculative","value":0}],["very-doubtful",{"text":"Very Doubtful","value":10}],["doubtful",{"text":"Doubtful","value":30}],["even-odds",{"text":"Even Odds","value":50}],["probable",{"text":"Probable","value":70}],["very-probable",{"text":"Very Probable","value":90}],["certain",{"text":"Certain","value":100}]]},"value":null},"execution_start":{"type":3},"execution_end":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#637bc9","stroke_color":"#708ce6","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"asset","namespace":"attack_flow.asset","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#c26130","stroke_color":"#e57339","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"condition","namespace":"attack_flow.condition","type":1,"role":4096,"properties":{"description":{"type":2,"is_primary":true,"is_required":true},"pattern":{"type":2},"pattern_type":{"type":2},"pattern_version":{"type":2},"date":{"type":3}},"branches":[{"text":"True","anchor_template":"true_anchor"},{"text":"False","anchor_template":"false_anchor"}],"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#2a9642","stroke_color":"#32b34e","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"branch":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","vertical_padding":12,"horizontal_padding":30},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"or","namespace":"attack_flow.OR_operator","type":8,"role":4096,"properties":{"operator":{"type":2,"value":"OR","is_primary":true,"is_visible":false,"is_editable":false}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"fill_color":"#c94040","stroke_color":"#dd5050","text":{"font":{"family":"Inter","size":"14pt","weight":800},"color":"#d8d8d8","line_height":24},"border_radius":13,"select_outline":{"color":"#e6d845","padding":4,"border_radius":19},"anchor_markers":{"color":"#ffffff","size":3},"vertical_padding":18,"horizontal_padding":35}},{"id":"and","namespace":"attack_flow.AND_operator","type":8,"role":4096,"properties":{"operator":{"type":2,"value":"AND","is_primary":true,"is_visible":false,"is_editable":false}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"fill_color":"#c94040","stroke_color":"#dd5050","text":{"font":{"family":"Inter","size":"14pt","weight":800},"color":"#d8d8d8","line_height":24},"border_radius":13,"select_outline":{"color":"#e6d845","padding":4,"border_radius":19},"anchor_markers":{"color":"#ffffff","size":3},"vertical_padding":18,"horizontal_padding":35}},{"id":"attack_pattern","namespace":"stix_object.attack_pattern","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"aliases":{"type":5,"form":{"type":2}},"kill_chain_phases":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"campaign","namespace":"stix_object.campaign","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"aliases":{"type":5,"form":{"type":2}},"first_seen":{"type":3},"last_seen":{"type":3},"objective":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"course_of_action","namespace":"stix_object.course_of_action","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"action_type":{"type":2},"os_execution_envs":{"type":5,"form":{"type":2}},"action_bin":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"grouping","namespace":"stix_object.grouping","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true},"description":{"type":2},"context":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"identity","namespace":"stix_object.identity","type":2,"role":4096,"properties":{"name":{"type":2,"is_required":true,"is_primary":true},"description":{"type":2},"roles":{"type":5,"form":{"type":2}},"identity_class":{"type":2,"is_required":true},"sectors":{"type":5,"form":{"type":2}},"contact_information":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"indicator","namespace":"stix_object.indicator","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true},"description":{"type":2},"indicator_types":{"type":5,"form":{"type":2,"is_required":true}},"pattern":{"type":2,"is_required":true},"pattern_type":{"type":2,"is_required":true},"patter_version":{"type":2},"valid_from":{"type":3,"is_required":true},"valid_until":{"type":3},"kill_chain_phases":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"infrastructure","namespace":"stix_object.infrastructure","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"infrastructure_types":{"type":5,"form":{"type":2,"is_required":true}},"aliases":{"type":5,"form":{"type":2}},"kill_chain_phases":{"type":5,"form":{"type":2}},"first_seen":{"type":3},"last_seen":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"intrusion_set","namespace":"stix_object.intrusion_set","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"aliases":{"type":5,"form":{"type":2,"is_required":true}},"first_seen":{"type":3},"last_seen":{"type":3},"goals":{"type":5,"form":{"type":2}},"resource_level":{"type":2},"primary_motivation":{"type":2},"secondary_motivations":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"location","namespace":"stix_object.location","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true},"description":{"type":2},"latitude":{"type":1,"min":-90,"max":90},"longitude":{"type":1,"min":-180,"max":180},"precision":{"type":1},"region":{"type":2},"country":{"type":2},"administrative_area":{"type":2},"city":{"type":2},"street_address":{"type":2},"postal_code":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"malware","namespace":"stix_object.malware","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true},"description":{"type":2},"malware_types":{"type":5,"form":{"type":2,"is_required":true}},"is_family":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]},"is_required":true},"aliases":{"type":5,"form":{"type":2}},"kill_chain_phases":{"type":5,"form":{"type":2}},"first_seen":{"type":3},"last_seen":{"type":3},"os_execution_envs":{"type":5,"form":{"type":2}},"architecture_execution_envs":{"type":5,"form":{"type":2}},"implementation_languages":{"type":5,"form":{"type":2}},"capabilities":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"malware_analysis","namespace":"stix_object.malware_analysis","type":2,"role":4096,"properties":{"product":{"type":2,"is_primary":true,"is_required":true},"version":{"type":2},"configuration_version":{"type":2},"modules":{"type":5,"form":{"type":2}},"analysis_engine_version":{"type":2},"analysis_definition_version":{"type":2},"submitted":{"type":3},"analysis_started":{"type":3},"analysis_ended":{"type":3},"av_result":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"note","namespace":"stix_object.note","type":2,"role":4096,"properties":{"abstract":{"type":2,"is_primary":true},"content":{"type":2,"is_required":true},"authors":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"observed_data","namespace":"stix_object.observed_data","type":2,"role":4096,"properties":{"first_observed":{"type":3,"is_required":true},"last_observed":{"type":3,"is_required":true},"number_observed":{"type":0,"min":0,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"opinion","namespace":"stix_object.opinion","type":2,"role":4096,"properties":{"explanation":{"type":2,"is_primary":true},"authors":{"type":5,"form":{"type":2}},"opinion":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"report","namespace":"stix_object.report","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"report_types":{"type":5,"form":{"type":2,"is_required":true}},"published":{"type":3,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"threat_actor","namespace":"stix_object.threat_actor","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"threat_actor_types":{"type":5,"form":{"type":2,"is_required":true}},"aliases":{"type":5,"form":{"type":2}},"first_seen":{"type":3},"last_seen":{"type":3},"roles":{"type":5,"form":{"type":2}},"goals":{"type":5,"form":{"type":2}},"sophistication":{"type":2},"resource_level":{"type":2},"primary_motivation":{"type":2},"secondary_motivations":{"type":5,"form":{"type":2}},"personal_motivations":{"type":5,"form":{"type":2}}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"tool","namespace":"stix_object.tool","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2},"tool_types":{"type":5,"form":{"type":2,"is_required":true}},"aliases":{"type":5,"form":{"type":2}},"kill_chain_phases":{"type":5,"form":{"type":2}},"tool_version":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"vulnerability","namespace":"stix_object.vulnerability","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"description":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"artifact","namespace":"stix_observable.artifact","type":2,"role":4096,"properties":{"mime_type":{"type":2},"payload_bin":{"type":2},"url":{"type":2},"hashes":{"type":2},"encryption_algorithm":{"type":2},"decryption_key":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"autonomous_system","namespace":"stix_observable.autonomous_system","type":2,"role":4096,"properties":{"number":{"type":2,"is_primary":true,"is_required":true},"name":{"type":2},"rir":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"directory","namespace":"stix_observable.directory","type":2,"role":4096,"properties":{"path":{"type":2,"is_primary":true,"is_required":true},"path_enc":{"type":2},"ctime":{"type":3},"mtime":{"type":3},"atime":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"domain_name","namespace":"stix_observable.domain_name","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"email_address","namespace":"stix_observable.email_address","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true},"display_name":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"email_message","namespace":"stix_observable.email_message","type":2,"role":4096,"properties":{"is_multipart":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]},"is_required":true},"date":{"type":2},"content_type":{"type":2},"message_id":{"type":2},"subject":{"type":2,"is_primary":true},"received_lines":{"type":2},"additional_header_fields":{"type":2},"body":{"type":2},"body_multipart":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"file","namespace":"stix_observable.file","type":2,"role":4096,"properties":{"hashes":{"type":2},"size":{"type":2},"name":{"type":2,"is_primary":true},"name_enc":{"type":2},"magic_number_hex":{"type":2},"mime_type":{"type":2},"ctime":{"type":3},"mtime":{"type":3},"atime":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"ipv4_addr","namespace":"stix_observable.ipv4_addr","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"ipv6_addr","namespace":"stix_observable.ipv6_addr","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"mac_addr","namespace":"stix_observable.mac_addr","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"mutex","namespace":"stix_observable.mutex","type":2,"role":4096,"properties":{"name":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"network_traffic","namespace":"stix_observable.network_traffic","type":2,"role":4096,"properties":{"start":{"type":3},"end":{"type":3},"is_active":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"src_port":{"type":0,"min":0,"max":65535},"dst_port":{"type":0,"min":0,"max":65535},"protocols":{"type":5,"form":{"type":2,"is_required":true}},"src_byte_count":{"type":0,"min":0},"dst_byte_count":{"type":0,"min":0},"src_packets":{"type":0,"min":0},"dst_packets":{"type":0,"min":0},"ipfix":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"process","namespace":"stix_observable.process","type":2,"role":4096,"properties":{"is_hidden":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"pid":{"type":0,"min":0},"created_time":{"type":3},"cwd":{"type":2},"command_line":{"type":2,"is_required":true},"environment_variables":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"software","namespace":"stix_observable.software","type":2,"role":4096,"properties":{"name":{"type":2,"is_primary":true,"is_required":true},"cpe":{"type":2},"languages":{"type":5,"form":{"type":2}},"vendor":{"type":2},"version":{"type":2}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"url","namespace":"stix_observable.url","type":2,"role":4096,"properties":{"value":{"type":2,"is_required":true}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"user_account","namespace":"stix_observable.user_account","type":2,"role":4096,"properties":{"user_id":{"type":2},"credential":{"type":2},"account_login":{"type":2},"account_type":{"type":2},"display_name":{"type":2,"is_primary":true,"is_required":true},"is_service_account":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"is_privileged":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"can_escalate_privs":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"is_disabled":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"account_created":{"type":3},"account_expires":{"type":3},"credential_last_changed":{"type":3},"account_first_login":{"type":3},"account_last_login":{"type":3}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"windows_registry_key","namespace":"stix_observable.windows_registry_key","type":2,"role":4096,"properties":{"key":{"type":2,"is_primary":true},"values":{"type":5,"form":{"type":2}},"modified_time":{"type":3},"number_of_subkeys":{"type":0,"min":0}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}},{"id":"x509_certificate","namespace":"stix_observable.x509_certificate","type":2,"role":4096,"properties":{"subject":{"type":2,"is_primary":true,"is_required":true},"is_self_signed":{"type":4,"options":{"type":5,"form":{"type":2},"value":[["true","True"],["false","False"]]}},"hashes":{"type":2},"version":{"type":2},"serial_number":{"type":2},"signature_algorithm":{"type":2},"issuer":{"type":2},"validity_not_before":{"type":3},"validity_not_after":{"type":3},"subject_public_key_algorithm":{"type":2},"subject_public_key_modulus":{"type":2},"subject_public_key_exponent":{"type":0,"min":0}},"anchor_template":"@__builtin__anchor","style":{"max_width":320,"head":{"fill_color":"#737373","stroke_color":"#8c8c8c","one_title":{"title":{"font":{"family":"Inter","size":"10.5pt","weight":800},"color":"#d8d8d8"}},"two_title":{"title":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#d8d8d8","padding":8},"subtitle":{"font":{"family":"Inter","size":"13pt","weight":800},"color":"#d8d8d8","line_height":23}},"vertical_padding":14},"body":{"fill_color":"#1f1f1f","stroke_color":"#383838","field_name":{"font":{"family":"Inter","size":"8pt","weight":600},"color":"#b3b3b3","padding":12},"field_value":{"font":{"family":"Inter","size":"10.5pt"},"color":"#bfbfbf","line_height":20,"padding":22},"vertical_padding":18},"select_outline":{"color":"#e6d845","padding":4,"border_radius":9},"anchor_markers":{"color":"#ffffff","size":3},"border_radius":5,"horizontal_padding":20}}]},"objects":[{"id":"e312fa60-4316-4433-a6eb-81e4c3111324","x":-430,"y":1165,"attrs":0,"template":"flow","children":["cb85f8b2-a64d-49a3-beca-c307558fe4cb","638fbd7e-e680-4360-86d5-29454f354071","912ab340-e636-4742-8333-f692368ef2ee","f6677d9d-1c87-43bf-9b55-88099a820d4d","ef2455bc-724f-4abf-9b1d-6883128ae328","f829939a-e8cf-4d78-891c-35135405e046","d545cf7c-c227-49e8-b3ef-6836f9431513","3ab0e565-c92d-40c0-a0d8-5795cd1fd6a2","5fb732fb-80d7-4815-ba89-44d18484ed94","91742a64-73d0-4302-9b43-5ae374a7516a","9701d9a7-0c9b-4f07-b565-b01ffd871a36","7a8e4cde-b400-496a-9f9d-be1edd4a7886","5d87ab3b-1f4e-444c-a9e4-957a7699e9e0","37d758b2-64de-4bf5-996d-c96e63ccfacf","e3274fed-9e31-4701-abe0-4ebee9ada501","b0ba70ea-38d2-443e-aa01-889c8d3734f7","a690646e-fc36-4a2c-bd5f-511f7120a509","3c1a34a3-4b5c-4159-89c2-6ab79962dd2d","ca6b0b8d-ea3b-48fe-ade8-bf48920b7295","b4640bcf-36ce-4f5a-aef6-211b9ae93a31","b7f336e6-1ab3-48f4-a537-b1ee494e02e3"],"properties":[["name","SearchAwesome Adware"],["description","SearchAwesome adware intercepts encrypted web traffic to inject ads"],["author",[["name","Lauren Parker"],["identity_class","23b79ae0fc0f07a3669598dd23c694cc"],["contact_information","lparker@mitre.org"]]],["scope","3e072748feb6ecd1b1ba397704e009c0"],["external_references",[["1125df4a84cc115c5f2e21744ffc23ab",[["source_name","Malwarebytes Labs"],["description","Blog"],["url","https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection"]]],["53ec1f40a13a2b844fcaf0b1aa3735d6",[["source_name","Malware Behavior Catalogue"],["description","GitHub"],["url","https://github.com/MBCProject/mbc-markdown/blob/main/xample-malware/searchawesome.md"]]]]],["created","2023-04-21T17:46:00.235Z"]]},{"id":"cb85f8b2-a64d-49a3-beca-c307558fe4cb","x":-430,"y":-580,"attrs":256,"template":"action","children":["21c2c48d-4759-4848-8cde-1bd6df5c8cf5","290e5a65-266f-4378-9b5b-92a3e346ac2a","527acc8c-5d59-4d6c-ba75-08f9909f9e88","397258d1-8795-4e66-948f-8163bd85d419","8c5856d3-277a-448a-951c-03d6e63c9825","bb54f108-1175-47e0-aeca-656474a2caab","58531e75-ca2f-40e1-9c8f-071798f178dc","a48f72e4-3a9c-4165-8148-db93dfae70c5","3ee232fd-2e2a-4a91-990a-597291c57c09","06980f83-d47b-436f-ae0c-5c0c9aec00a5","f50e7e43-7b78-4afd-9906-aa403dc7ed60","a0874563-c613-4fd2-8245-a063417bd170"],"properties":[["name","User Execution"],["tactic_id",null],["tactic_ref",null],["technique_id","E1204"],["technique_ref",null],["description","The user opens a disk image file which invisibly installs its components"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"638fbd7e-e680-4360-86d5-29454f354071","x":-430,"y":70,"attrs":256,"template":"action","children":["453a07c3-b58f-4085-874b-c24cd535df30","6dfe26f5-00fe-4c54-b665-580326d7ea1c","1b9eaf74-609a-4731-b242-e5ff59a2150d","370027b0-ff44-4d93-b3b3-c6aa85864f56","5401b9b8-e5d3-4384-90ab-75e9989d99da","4e48abe8-5658-4737-9fd9-b9fb8669015a","0b6dfe61-a28a-49eb-a094-c7c709d3b8bd","abe9b9d3-3c76-4c22-b7ef-40f8305be143","382192ad-60cc-4bd4-bb9f-1c3586d79498","df743c0b-48c8-40fe-a80e-185856d31690","e8cb1c51-50a7-4bfd-8718-152f81e6dc01","381aeaf3-baa6-4ff1-91b1-370b041b9764"],"properties":[["name","Install Certificate"],["tactic_id",null],["tactic_ref",null],["technique_id","F0016"],["technique_ref",null],["description","The malware installs a certificate"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"912ab340-e636-4742-8333-f692368ef2ee","x":-430,"y":400,"attrs":256,"template":"action","children":["162cbbf4-d957-426f-948c-709cf057bfb5","7cd00608-04e0-4ebe-9289-5ee639d1c311","5f0cf371-3885-4675-95f5-c7cd43fe7ec2","ae479b68-1a76-4506-8ea0-c61b88d6b6bc","8cf8215b-aa05-41e8-9b15-ae8229cac662","a7cf986d-8bee-4045-a257-dec9679c661d","9d6b0e97-67e2-4d75-9941-93f51ba34553","e9389b82-d0ba-4bf3-b6c8-f98512b153fb","ccc4060b-1c4d-4ae8-869e-86830e7563a7","8b8a8818-b5b8-490b-a0cf-c0f52925722d","aa91b554-3c84-47a6-82f2-1fc557ff9e4d","331fdcdb-351b-4c1d-b9fd-74a91a1dd907"],"properties":[["name","Adversary-in-the-Middle"],["tactic_id",null],["tactic_ref",null],["technique_id","T1557"],["technique_ref",null],["description","Malware inserts itself into a chain of custody, typically within network packets"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"f6677d9d-1c87-43bf-9b55-88099a820d4d","x":-430,"y":770,"attrs":256,"template":"action","children":["d93a5111-56df-4efa-92ff-c0beed4c9f86","de1eb239-ab39-4e13-ba4e-23ca5870b130","291ff330-04c5-4316-a574-f42fc36daffe","ec52c210-5b02-454a-a2b2-1874e7c05242","3349891f-cf9d-4683-b8b4-7eab8e25fff7","bfd6f697-4303-40f8-8adc-4693f4df1092","f1f017ce-6066-4341-b2c6-886bbb7ba086","a2cc2a42-3e05-4250-9176-e0c9ca06f32d","8b660ee2-b477-41cd-93a2-3c8479cfccef","5bc535b0-ffe2-409e-a074-670f3e0bfa9b","ded5ca4d-e462-4a40-8e10-8cfe0094693b","43051fb4-2dfe-4865-8064-ced4c5348ef5"],"properties":[["name","Subvert Trust Controls"],["tactic_id",null],["tactic_ref",null],["technique_id","T1553"],["technique_ref",null],["description","The malware uses certificates to gain access to HTTPS traffic"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"ef2455bc-724f-4abf-9b1d-6883128ae328","x":-430,"y":1120,"attrs":256,"template":"action","children":["aee5c139-24a2-4625-9dd0-84aa69a316d8","a66299cc-7d46-4591-8d17-9bef24df6499","2bae656e-8a38-4e74-9b01-2132d48ad87d","f806c9a0-ea7d-4433-b01e-e65a23eb6071","e2c0d6f3-7335-4c89-8da8-d4d1839e1e5b","210d0ea5-f22a-44f5-af9f-db34ea31030e","72dd1bbf-b3bc-48ff-b57d-37d8f4de1c04","c4bd9a01-0d5a-4a5f-9ac0-400d45f29379","d1af7d19-9beb-4fac-a45d-1a0294a111d0","0ef2cfc9-adcf-43c4-b5dd-4a9a026d3aad","91524619-6ace-47c1-bdda-57be4517c390","05ca6852-0fbb-42c8-aa40-fbba6ca01695"],"properties":[["name","Install Additional Program"],["tactic_id",null],["tactic_ref",null],["technique_id","B0023"],["technique_ref",null],["description","Malware installs an open-source program called mitmproxy"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"f829939a-e8cf-4d78-891c-35135405e046","x":-430,"y":1470,"attrs":256,"template":"action","children":["68108e8a-4d6d-48c7-9943-2fe669d7d792","e3d86880-2df7-4801-9a39-0058cb09b205","a3ebe80e-c6ce-497e-aee1-ddaa4899f5cc","ba75a374-6075-4e22-8cc3-9835a8b7632d","9ac6aa3c-646b-48f2-ba27-28483bed5532","0edc4a75-0604-499c-98da-8d2c8de8cf9e","278c229b-fe7f-4646-9662-cdb22631e7a2","fbc15ae3-6fff-4b06-bfcd-c8aa87823d0a","108b1b50-5551-47b8-af2c-a71ab901cce0","971ee7b6-c80c-42f5-8248-f531045d63ba","a0be8feb-3183-4c33-86f6-5213db06b9f7","5c93f285-d7b7-48b1-a294-4257461a7690"],"properties":[["name","Proxy "],["tactic_id",null],["tactic_ref",null],["technique_id","T1090"],["technique_ref",null],["description","Malware uses mitmproxy to intercept and modify web traffic"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"d545cf7c-c227-49e8-b3ef-6836f9431513","x":-430,"y":1810,"attrs":256,"template":"action","children":["2dacd2f4-270a-4114-b2d2-f22f1cf1db21","9a64b509-1c9a-4571-87bb-2244ef93155e","c00d4de0-0ba6-444b-a56a-2c7cbc558633","df3c6274-552d-45e4-a8f9-8aaa433bbae7","c6c626f3-c520-4b0e-9e09-2c4dc481dc68","389b98ad-9afb-4eb4-bddc-dbc7f2f64376","8a7932f4-593a-41b2-b7c8-8f98f20fa1e9","1b83cf21-a000-46ee-8f35-128d34a06224","191e8a26-06a8-41c0-9781-62a9351ce117","cc21b629-ec19-46ec-90e2-b230e1c1e7be","4fcc9da5-e654-4d6c-b4a0-0eeef03820ea","7a46ea48-6e63-41a9-917e-81c3841a8d8a"],"properties":[["name","Manipulate Network Traffic"],["tactic_id",null],["tactic_ref",null],["technique_id","B0019"],["technique_ref",null],["description","Malware intercepts encrypted web traffic to inject ads"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"3ab0e565-c92d-40c0-a0d8-5795cd1fd6a2","x":-430,"y":2550,"attrs":256,"template":"action","children":["110a0fb2-2029-4caa-9e71-0ddeae753ae3","9354cbf0-3f11-4b89-8c97-784d74b96f7c","f119ca11-6cb2-4d4b-ad28-413e75ec9834","648eb88a-268c-4d2a-8c43-6daf38677013","48e2b057-c812-4de5-adc2-76932e8b9c73","d7abc87f-5c18-4e89-96b8-f445c3a08974","81a57a1f-bd27-4642-bcce-f748b0969d33","5456516c-7d73-4a08-8490-3535f6aca557","48a30206-416f-4759-b0c2-d3822f7640b5","2238c5ca-3298-4352-ad24-d4bc67ae6dc8","b0f2c262-5fdd-4035-a594-1578022b819c","4ea7a3c8-cb2c-47c6-98c6-7d6dd3b616c5"],"properties":[["name","Browser Session Hijacking"],["tactic_id",null],["tactic_ref",null],["technique_id","T1185"],["technique_ref",null],["description","Malware can modify web traffic for the purpose of injecting Javascript"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"5fb732fb-80d7-4815-ba89-44d18484ed94","x":-430,"y":2190,"attrs":256,"template":"action","children":["cb281959-6b20-4782-a88b-088521e1e4d6","aad6fe87-e0e7-4351-90b2-3c722fe4dd8c","fa443996-9be1-4f7f-8acd-9482dd743bd2","09451d11-5e82-4766-a3dd-15bc335fa746","dbe81a7d-f875-4fd6-8735-8b4445828906","173ff27a-cd54-4e55-bf93-a17779fc1f08","ccfc406c-a580-4da6-be5e-21e7c5260872","26a6e496-b404-4e10-8607-95c858f606db","d062b5f1-ef7f-4e29-8cda-843dfc7c8ffd","7944337a-a2a4-4223-b1c9-20f75b8edcee","8dedbb9c-f95b-4611-a504-8ac56d1e39c4","cee6a5e7-c9bf-470e-a7ae-3b0e0534c1cc"],"properties":[["name","Command and Scripting Interpreter"],["tactic_id",null],["tactic_ref",null],["technique_id","E1059"],["technique_ref",null],["description","Malware installs a script to inject a JavaScript script and modify web traffic"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"91742a64-73d0-4302-9b43-5ae374a7516a","x":-430,"y":-250,"attrs":256,"template":"action","children":["50d9d194-c7b4-47c4-a075-bebae26093ca","c9873cc8-35e9-42a1-ba0a-a0e742b0dd2e","980bf037-38f9-4ed5-a9e0-878776bfe4b8","a108d43e-0bba-4960-b9df-4c84f6484a87","d5276d85-3549-4485-8ef4-e3c1271d1c5b","bc635455-113e-4f8a-a0d2-d3e254da3980","217a788b-be1a-4dc6-b4c4-5b1e4eb3e54a","a69ddf9c-2ab6-4f40-9d0b-1fa7e246fcf7","306dec7f-3b4b-42e4-9a38-b5bdcb31f7ae","14cd4093-dce7-4125-a574-b12280d294fc","b8f106bc-171f-46bf-80f3-9b3ca45e445e","7635a6c3-e62e-4ebe-8523-6c9711199cee"],"properties":[["name","C2 Communication: Receive Data"],["tactic_id",null],["tactic_ref",null],["technique_id","B0030.002"],["technique_ref",null],["description","Malware receives data from the C2 server"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"9701d9a7-0c9b-4f07-b565-b01ffd871a36","x":-430,"y":2910,"attrs":256,"template":"action","children":["6ef6df70-6d88-4a88-9133-2fbcfaa744e0","01c717a2-8dc8-43cd-a7d5-c603d4f771eb","5f1dc053-16c5-481a-8b4c-1c9691625cb4","75b8e4cc-89fb-42e4-87f0-eb9c099bd476","b2c43fe3-f144-427b-8f41-8ccd9b5b21a9","15aa892e-9637-472b-9624-3d1c98d9f106","b9901bd3-7d52-4720-a715-661b12825d44","8e904bc8-7daa-4c6a-bf2c-fb0eb403f6b7","9fb3863b-edc1-412e-aa65-3ccb72214460","fbd8f5b1-9168-4c8a-a3c5-c2c93f475efe","3afeb322-076b-4a10-994f-0d68111826bd","bc5dae62-3fa8-48b4-bbac-cb52790bab8d"],"properties":[["name","Self Deletion"],["tactic_id",null],["tactic_ref",null],["technique_id","F0007"],["technique_ref",null],["description","Malware will monitor if a specific file gets deleted and then will delete itself"],["confidence","efe6b2c2589e25605d9f62170933c925"],["execution_start",null],["execution_end",null]]},{"id":"7a8e4cde-b400-496a-9f9d-be1edd4a7886","x":-430,"y":2730,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["9279aa15-6c9e-41ee-8e89-11e71df8eeaa","4a634e9a-dfe6-4298-adeb-37835aa62f2d","2e8bcbc8-d7cf-4330-bd28-e1d66464b694"],"properties":[]},{"id":"5d87ab3b-1f4e-444c-a9e4-957a7699e9e0","x":-430,"y":-410,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["71f212cb-0ef1-4dc4-b63d-a0d8d7432d2b","29bc61cd-6c27-4b82-b1ac-2b7c18ae68a8","d6867805-4c10-4fef-93a1-7f5865e3ebf0"],"properties":[]},{"id":"37d758b2-64de-4bf5-996d-c96e63ccfacf","x":-430,"y":-90,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["b1100efa-d7da-41fc-82af-e2492c036c28","4f3b656a-1bf9-46f3-95bc-5634d366d1f2","87720610-e84c-4e35-9499-0b3a7a27d364"],"properties":[]},{"id":"e3274fed-9e31-4701-abe0-4ebee9ada501","x":-430,"y":230,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["20b7ba28-59ca-46a4-b0f6-7a8d8151b67b","14727f47-6151-46aa-bde1-b7f5e836f745","d2c4b766-83ff-4614-8dde-d08659d94f9b"],"properties":[]},{"id":"b0ba70ea-38d2-443e-aa01-889c8d3734f7","x":-430,"y":585,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["983dd01c-b4ae-4496-a06e-122677393d96","5431af9d-d3b1-4cb5-921a-015b74d79a97","acbd1088-4051-4f40-acde-015a48b3cf6b"],"properties":[]},{"id":"a690646e-fc36-4a2c-bd5f-511f7120a509","x":-430,"y":945,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["b97b1d4a-4310-4524-99a4-30f3bf7f09b9","2f180274-eb81-492f-95ea-0ac782f3442b","067cdcd1-1a98-4ebe-980a-61ab98c8709b"],"properties":[]},{"id":"3c1a34a3-4b5c-4159-89c2-6ab79962dd2d","x":-430,"y":1295,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["58472c38-1dcc-44aa-85df-e10f0a295047","232296fa-3845-4fe5-a633-2dc7ab9177a4","00e01066-582b-4fbf-8178-d42b62b057d2"],"properties":[]},{"id":"ca6b0b8d-ea3b-48fe-ade8-bf48920b7295","x":-430,"y":1640,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["ff42725e-1249-492b-9db9-51c6c156555c","2ea564da-0a0c-4d56-a6fd-b37915dd6fde","cb2d0e4f-c434-4314-abcf-0164ec79cda8"],"properties":[]},{"id":"b4640bcf-36ce-4f5a-aef6-211b9ae93a31","x":-430,"y":2000,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["8f0ff297-1dc6-4dc7-a531-8ea3488dda37","d4b9b9c2-f78e-4882-ad28-61d33d00611a","8c2bfa97-ab0c-4dc1-8ff7-6835d26adbb9"],"properties":[]},{"id":"b7f336e6-1ab3-48f4-a537-b1ee494e02e3","x":-430,"y":2370,"attrs":0,"template":"@__builtin__line_vertical_elbow","children":["76fb7612-f30c-4d15-8777-271be3b5d86f","421b6966-5e42-4347-a92a-4f8ef37bd02c","4c8f5d28-d37b-474f-97ba-8cc9d83011bc"],"properties":[]},{"id":"21c2c48d-4759-4848-8cde-1bd6df5c8cf5","x":-518.5,"y":-711,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"290e5a65-266f-4378-9b5b-92a3e346ac2a","x":-430,"y":-711,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"527acc8c-5d59-4d6c-ba75-08f9909f9e88","x":-341.5,"y":-711,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"397258d1-8795-4e66-948f-8163bd85d419","x":-252,"y":-645.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8c5856d3-277a-448a-951c-03d6e63c9825","x":-252,"y":-580,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bb54f108-1175-47e0-aeca-656474a2caab","x":-252,"y":-514.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"58531e75-ca2f-40e1-9c8f-071798f178dc","x":-341.5,"y":-448,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a48f72e4-3a9c-4165-8148-db93dfae70c5","x":-430,"y":-448,"attrs":0,"template":"@__builtin__anchor","children":["71f212cb-0ef1-4dc4-b63d-a0d8d7432d2b"],"properties":[],"angle":1},{"id":"3ee232fd-2e2a-4a91-990a-597291c57c09","x":-518.5,"y":-448,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"06980f83-d47b-436f-ae0c-5c0c9aec00a5","x":-607,"y":-514.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"f50e7e43-7b78-4afd-9906-aa403dc7ed60","x":-607,"y":-580,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"a0874563-c613-4fd2-8245-a063417bd170","x":-607,"y":-645.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"453a07c3-b58f-4085-874b-c24cd535df30","x":-495,"y":-51,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"6dfe26f5-00fe-4c54-b665-580326d7ea1c","x":-430,"y":-51,"attrs":0,"template":"@__builtin__anchor","children":["87720610-e84c-4e35-9499-0b3a7a27d364"],"properties":[],"angle":1},{"id":"1b9eaf74-609a-4731-b242-e5ff59a2150d","x":-365,"y":-51,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"370027b0-ff44-4d93-b3b3-c6aa85864f56","x":-300,"y":9.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"5401b9b8-e5d3-4384-90ab-75e9989d99da","x":-300,"y":70,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"4e48abe8-5658-4737-9fd9-b9fb8669015a","x":-300,"y":130.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"0b6dfe61-a28a-49eb-a094-c7c709d3b8bd","x":-365,"y":192,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"abe9b9d3-3c76-4c22-b7ef-40f8305be143","x":-430,"y":192,"attrs":0,"template":"@__builtin__anchor","children":["20b7ba28-59ca-46a4-b0f6-7a8d8151b67b"],"properties":[],"angle":1},{"id":"382192ad-60cc-4bd4-bb9f-1c3586d79498","x":-495,"y":192,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"df743c0b-48c8-40fe-a80e-185856d31690","x":-560,"y":130.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"e8cb1c51-50a7-4bfd-8718-152f81e6dc01","x":-560,"y":70,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"381aeaf3-baa6-4ff1-91b1-370b041b9764","x":-560,"y":9.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"162cbbf4-d957-426f-948c-709cf057bfb5","x":-515,"y":269,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"7cd00608-04e0-4ebe-9289-5ee639d1c311","x":-430,"y":269,"attrs":0,"template":"@__builtin__anchor","children":["d2c4b766-83ff-4614-8dde-d08659d94f9b"],"properties":[],"angle":1},{"id":"5f0cf371-3885-4675-95f5-c7cd43fe7ec2","x":-345,"y":269,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"ae479b68-1a76-4506-8ea0-c61b88d6b6bc","x":-259,"y":334.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8cf8215b-aa05-41e8-9b15-ae8229cac662","x":-259,"y":400,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"a7cf986d-8bee-4045-a257-dec9679c661d","x":-259,"y":465.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"9d6b0e97-67e2-4d75-9941-93f51ba34553","x":-345,"y":532,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"e9389b82-d0ba-4bf3-b6c8-f98512b153fb","x":-430,"y":532,"attrs":0,"template":"@__builtin__anchor","children":["983dd01c-b4ae-4496-a06e-122677393d96"],"properties":[],"angle":1},{"id":"ccc4060b-1c4d-4ae8-869e-86830e7563a7","x":-515,"y":532,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"8b8a8818-b5b8-490b-a0cf-c0f52925722d","x":-600,"y":465.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"aa91b554-3c84-47a6-82f2-1fc557ff9e4d","x":-600,"y":400,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"331fdcdb-351b-4c1d-b9fd-74a91a1dd907","x":-600,"y":334.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"d93a5111-56df-4efa-92ff-c0beed4c9f86","x":-519,"y":639,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"de1eb239-ab39-4e13-ba4e-23ca5870b130","x":-430,"y":639,"attrs":0,"template":"@__builtin__anchor","children":["acbd1088-4051-4f40-acde-015a48b3cf6b"],"properties":[],"angle":1},{"id":"291ff330-04c5-4316-a574-f42fc36daffe","x":-341,"y":639,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"ec52c210-5b02-454a-a2b2-1874e7c05242","x":-251,"y":704.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"3349891f-cf9d-4683-b8b4-7eab8e25fff7","x":-251,"y":770,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bfd6f697-4303-40f8-8adc-4693f4df1092","x":-251,"y":835.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"f1f017ce-6066-4341-b2c6-886bbb7ba086","x":-341,"y":901,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a2cc2a42-3e05-4250-9176-e0c9ca06f32d","x":-430,"y":901,"attrs":0,"template":"@__builtin__anchor","children":["b97b1d4a-4310-4524-99a4-30f3bf7f09b9"],"properties":[],"angle":1},{"id":"8b660ee2-b477-41cd-93a2-3c8479cfccef","x":-519,"y":901,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"5bc535b0-ffe2-409e-a074-670f3e0bfa9b","x":-608,"y":835.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"ded5ca4d-e462-4a40-8e10-8cfe0094693b","x":-608,"y":770,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"43051fb4-2dfe-4865-8064-ced4c5348ef5","x":-608,"y":704.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"aee5c139-24a2-4625-9dd0-84aa69a316d8","x":-519.5,"y":989,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a66299cc-7d46-4591-8d17-9bef24df6499","x":-430,"y":989,"attrs":0,"template":"@__builtin__anchor","children":["067cdcd1-1a98-4ebe-980a-61ab98c8709b"],"properties":[],"angle":1},{"id":"2bae656e-8a38-4e74-9b01-2132d48ad87d","x":-340.5,"y":989,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"f806c9a0-ea7d-4433-b01e-e65a23eb6071","x":-250,"y":1054.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"e2c0d6f3-7335-4c89-8da8-d4d1839e1e5b","x":-250,"y":1120,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"210d0ea5-f22a-44f5-af9f-db34ea31030e","x":-250,"y":1185.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"72dd1bbf-b3bc-48ff-b57d-37d8f4de1c04","x":-340.5,"y":1252,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"c4bd9a01-0d5a-4a5f-9ac0-400d45f29379","x":-430,"y":1252,"attrs":0,"template":"@__builtin__anchor","children":["58472c38-1dcc-44aa-85df-e10f0a295047"],"properties":[],"angle":1},{"id":"d1af7d19-9beb-4fac-a45d-1a0294a111d0","x":-519.5,"y":1252,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"0ef2cfc9-adcf-43c4-b5dd-4a9a026d3aad","x":-609,"y":1185.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"91524619-6ace-47c1-bdda-57be4517c390","x":-609,"y":1120,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"05ca6852-0fbb-42c8-aa40-fbba6ca01695","x":-609,"y":1054.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"68108e8a-4d6d-48c7-9943-2fe669d7d792","x":-509,"y":1339,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"e3d86880-2df7-4801-9a39-0058cb09b205","x":-430,"y":1339,"attrs":0,"template":"@__builtin__anchor","children":["00e01066-582b-4fbf-8178-d42b62b057d2"],"properties":[],"angle":1},{"id":"a3ebe80e-c6ce-497e-aee1-ddaa4899f5cc","x":-351,"y":1339,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"ba75a374-6075-4e22-8cc3-9835a8b7632d","x":-272,"y":1404.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"9ac6aa3c-646b-48f2-ba27-28483bed5532","x":-272,"y":1470,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"0edc4a75-0604-499c-98da-8d2c8de8cf9e","x":-272,"y":1535.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"278c229b-fe7f-4646-9662-cdb22631e7a2","x":-351,"y":1601,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"fbc15ae3-6fff-4b06-bfcd-c8aa87823d0a","x":-430,"y":1601,"attrs":0,"template":"@__builtin__anchor","children":["ff42725e-1249-492b-9db9-51c6c156555c"],"properties":[],"angle":1},{"id":"108b1b50-5551-47b8-af2c-a71ab901cce0","x":-509,"y":1601,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"971ee7b6-c80c-42f5-8248-f531045d63ba","x":-588,"y":1535.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"a0be8feb-3183-4c33-86f6-5213db06b9f7","x":-588,"y":1470,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"5c93f285-d7b7-48b1-a294-4257461a7690","x":-588,"y":1404.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"2dacd2f4-270a-4114-b2d2-f22f1cf1db21","x":-513,"y":1679,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"9a64b509-1c9a-4571-87bb-2244ef93155e","x":-430,"y":1679,"attrs":0,"template":"@__builtin__anchor","children":["cb2d0e4f-c434-4314-abcf-0164ec79cda8"],"properties":[],"angle":1},{"id":"c00d4de0-0ba6-444b-a56a-2c7cbc558633","x":-347,"y":1679,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"df3c6274-552d-45e4-a8f9-8aaa433bbae7","x":-263,"y":1744.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"c6c626f3-c520-4b0e-9e09-2c4dc481dc68","x":-263,"y":1810,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"389b98ad-9afb-4eb4-bddc-dbc7f2f64376","x":-263,"y":1875.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8a7932f4-593a-41b2-b7c8-8f98f20fa1e9","x":-347,"y":1942,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"1b83cf21-a000-46ee-8f35-128d34a06224","x":-430,"y":1942,"attrs":0,"template":"@__builtin__anchor","children":["8f0ff297-1dc6-4dc7-a531-8ea3488dda37"],"properties":[],"angle":1},{"id":"191e8a26-06a8-41c0-9781-62a9351ce117","x":-513,"y":1942,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"cc21b629-ec19-46ec-90e2-b230e1c1e7be","x":-596,"y":1875.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"4fcc9da5-e654-4d6c-b4a0-0eeef03820ea","x":-596,"y":1810,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"7a46ea48-6e63-41a9-917e-81c3841a8d8a","x":-596,"y":1744.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"110a0fb2-2029-4caa-9e71-0ddeae753ae3","x":-519,"y":2419,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"9354cbf0-3f11-4b89-8c97-784d74b96f7c","x":-430,"y":2419,"attrs":0,"template":"@__builtin__anchor","children":["4c8f5d28-d37b-474f-97ba-8cc9d83011bc"],"properties":[],"angle":1},{"id":"f119ca11-6cb2-4d4b-ad28-413e75ec9834","x":-341,"y":2419,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"648eb88a-268c-4d2a-8c43-6daf38677013","x":-251,"y":2484.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"48e2b057-c812-4de5-adc2-76932e8b9c73","x":-251,"y":2550,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"d7abc87f-5c18-4e89-96b8-f445c3a08974","x":-251,"y":2615.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"81a57a1f-bd27-4642-bcce-f748b0969d33","x":-341,"y":2682,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"5456516c-7d73-4a08-8490-3535f6aca557","x":-430,"y":2682,"attrs":0,"template":"@__builtin__anchor","children":["9279aa15-6c9e-41ee-8e89-11e71df8eeaa"],"properties":[],"angle":1},{"id":"48a30206-416f-4759-b0c2-d3822f7640b5","x":-519,"y":2682,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"2238c5ca-3298-4352-ad24-d4bc67ae6dc8","x":-608,"y":2615.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"b0f2c262-5fdd-4035-a594-1578022b819c","x":-608,"y":2550,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"4ea7a3c8-cb2c-47c6-98c6-7d6dd3b616c5","x":-608,"y":2484.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"cb281959-6b20-4782-a88b-088521e1e4d6","x":-516.5,"y":2059,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"aad6fe87-e0e7-4351-90b2-3c722fe4dd8c","x":-430,"y":2059,"attrs":0,"template":"@__builtin__anchor","children":["8c2bfa97-ab0c-4dc1-8ff7-6835d26adbb9"],"properties":[],"angle":1},{"id":"fa443996-9be1-4f7f-8acd-9482dd743bd2","x":-343.5,"y":2059,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"09451d11-5e82-4766-a3dd-15bc335fa746","x":-257,"y":2124.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"dbe81a7d-f875-4fd6-8735-8b4445828906","x":-257,"y":2190,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"173ff27a-cd54-4e55-bf93-a17779fc1f08","x":-257,"y":2255.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"ccfc406c-a580-4da6-be5e-21e7c5260872","x":-343.5,"y":2322,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"26a6e496-b404-4e10-8607-95c858f606db","x":-430,"y":2322,"attrs":0,"template":"@__builtin__anchor","children":["76fb7612-f30c-4d15-8777-271be3b5d86f"],"properties":[],"angle":1},{"id":"d062b5f1-ef7f-4e29-8cda-843dfc7c8ffd","x":-516.5,"y":2322,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"7944337a-a2a4-4223-b1c9-20f75b8edcee","x":-603,"y":2255.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"8dedbb9c-f95b-4611-a504-8ac56d1e39c4","x":-603,"y":2190,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"cee6a5e7-c9bf-470e-a7ae-3b0e0534c1cc","x":-603,"y":2124.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"50d9d194-c7b4-47c4-a075-bebae26093ca","x":-511.5,"y":-371,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"c9873cc8-35e9-42a1-ba0a-a0e742b0dd2e","x":-430,"y":-371,"attrs":0,"template":"@__builtin__anchor","children":["d6867805-4c10-4fef-93a1-7f5865e3ebf0"],"properties":[],"angle":1},{"id":"980bf037-38f9-4ed5-a9e0-878776bfe4b8","x":-348.5,"y":-371,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a108d43e-0bba-4960-b9df-4c84f6484a87","x":-266,"y":-310.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"d5276d85-3549-4485-8ef4-e3c1271d1c5b","x":-266,"y":-250,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bc635455-113e-4f8a-a0d2-d3e254da3980","x":-266,"y":-189.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"217a788b-be1a-4dc6-b4c4-5b1e4eb3e54a","x":-348.5,"y":-128,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"a69ddf9c-2ab6-4f40-9d0b-1fa7e246fcf7","x":-430,"y":-128,"attrs":0,"template":"@__builtin__anchor","children":["b1100efa-d7da-41fc-82af-e2492c036c28"],"properties":[],"angle":1},{"id":"306dec7f-3b4b-42e4-9a38-b5bdcb31f7ae","x":-511.5,"y":-128,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"14cd4093-dce7-4125-a574-b12280d294fc","x":-593,"y":-189.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"b8f106bc-171f-46bf-80f3-9b3ca45e445e","x":-593,"y":-250,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"7635a6c3-e62e-4ebe-8523-6c9711199cee","x":-593,"y":-310.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"6ef6df70-6d88-4a88-9133-2fbcfaa744e0","x":-508.5,"y":2779,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"01c717a2-8dc8-43cd-a7d5-c603d4f771eb","x":-430,"y":2779,"attrs":0,"template":"@__builtin__anchor","children":["2e8bcbc8-d7cf-4330-bd28-e1d66464b694"],"properties":[],"angle":1},{"id":"5f1dc053-16c5-481a-8b4c-1c9691625cb4","x":-351.5,"y":2779,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"75b8e4cc-89fb-42e4-87f0-eb9c099bd476","x":-273,"y":2844.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"b2c43fe3-f144-427b-8f41-8ccd9b5b21a9","x":-273,"y":2910,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"15aa892e-9637-472b-9624-3d1c98d9f106","x":-273,"y":2975.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"b9901bd3-7d52-4720-a715-661b12825d44","x":-351.5,"y":3042,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"8e904bc8-7daa-4c6a-bf2c-fb0eb403f6b7","x":-430,"y":3042,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"9fb3863b-edc1-412e-aa65-3ccb72214460","x":-508.5,"y":3042,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":1},{"id":"fbd8f5b1-9168-4c8a-a3c5-c2c93f475efe","x":-587,"y":2975.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"3afeb322-076b-4a10-994f-0d68111826bd","x":-587,"y":2910,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"bc5dae62-3fa8-48b4-bbac-cb52790bab8d","x":-587,"y":2844.5,"attrs":0,"template":"@__builtin__anchor","children":[],"properties":[],"angle":0},{"id":"9279aa15-6c9e-41ee-8e89-11e71df8eeaa","x":-430,"y":2682,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"4a634e9a-dfe6-4298-adeb-37835aa62f2d","x":-430,"y":2730.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"2e8bcbc8-d7cf-4330-bd28-e1d66464b694","x":-430,"y":2779,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"71f212cb-0ef1-4dc4-b63d-a0d8d7432d2b","x":-430,"y":-448,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"29bc61cd-6c27-4b82-b1ac-2b7c18ae68a8","x":-430,"y":-409.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"d6867805-4c10-4fef-93a1-7f5865e3ebf0","x":-430,"y":-371,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"b1100efa-d7da-41fc-82af-e2492c036c28","x":-430,"y":-128,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"4f3b656a-1bf9-46f3-95bc-5634d366d1f2","x":-430,"y":-89.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"87720610-e84c-4e35-9499-0b3a7a27d364","x":-430,"y":-51,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"20b7ba28-59ca-46a4-b0f6-7a8d8151b67b","x":-430,"y":192,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"14727f47-6151-46aa-bde1-b7f5e836f745","x":-430,"y":230.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"d2c4b766-83ff-4614-8dde-d08659d94f9b","x":-430,"y":269,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"983dd01c-b4ae-4496-a06e-122677393d96","x":-430,"y":532,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"5431af9d-d3b1-4cb5-921a-015b74d79a97","x":-430,"y":585.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"acbd1088-4051-4f40-acde-015a48b3cf6b","x":-430,"y":639,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"b97b1d4a-4310-4524-99a4-30f3bf7f09b9","x":-430,"y":901,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"2f180274-eb81-492f-95ea-0ac782f3442b","x":-430,"y":945,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"067cdcd1-1a98-4ebe-980a-61ab98c8709b","x":-430,"y":989,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"58472c38-1dcc-44aa-85df-e10f0a295047","x":-430,"y":1252,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"232296fa-3845-4fe5-a633-2dc7ab9177a4","x":-430,"y":1295.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"00e01066-582b-4fbf-8178-d42b62b057d2","x":-430,"y":1339,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"ff42725e-1249-492b-9db9-51c6c156555c","x":-430,"y":1601,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"2ea564da-0a0c-4d56-a6fd-b37915dd6fde","x":-430,"y":1640,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"cb2d0e4f-c434-4314-abcf-0164ec79cda8","x":-430,"y":1679,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"8f0ff297-1dc6-4dc7-a531-8ea3488dda37","x":-430,"y":1942,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"d4b9b9c2-f78e-4882-ad28-61d33d00611a","x":-430,"y":2000.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"8c2bfa97-ab0c-4dc1-8ff7-6835d26adbb9","x":-430,"y":2059,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]},{"id":"76fb7612-f30c-4d15-8777-271be3b5d86f","x":-430,"y":2322,"attrs":0,"template":"@__builtin__line_source","children":[],"properties":[]},{"id":"421b6966-5e42-4347-a92a-4f8ef37bd02c","x":-430,"y":2370.5,"attrs":0,"template":"@__builtin__line_handle","children":[],"properties":[]},{"id":"4c8f5d28-d37b-474f-97ba-8cc9d83011bc","x":-430,"y":2419,"attrs":0,"template":"@__builtin__line_target","children":[],"properties":[]}],"location":{"x":-147.8160459630095,"y":2758.961776482524,"k":0.7071067811865483}} \ No newline at end of file diff --git a/xample-malware/AttackFlow/SearchAwesome_Adware.json b/xample-malware/AttackFlow/SearchAwesome_Adware.json index 7bbe784..9b55305 100644 --- a/xample-malware/AttackFlow/SearchAwesome_Adware.json +++ b/xample-malware/AttackFlow/SearchAwesome_Adware.json @@ -114,7 +114,7 @@ } }, "name": "Install Certificate", - "technique_id": "E1608", + "technique_id": "F0016", "description": "The malware installs a certificate", "confidence": 100, "effect_refs": [ diff --git a/xample-malware/chopstick.md b/xample-malware/chopstick.md index c812a54..f67a93f 100644 --- a/xample-malware/chopstick.md +++ b/xample-malware/chopstick.md @@ -59,4 +59,4 @@ SHA256 Hashes ## References -[1] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf +[1] https://web.archive.org/web/20210307034415/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md index 88eee5c..88c9bd8 100644 --- a/xample-malware/dnschanger.md +++ b/xample-malware/dnschanger.md @@ -34,15 +34,15 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev |Name|Use| |---|---| -|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|DNSChanger sets file attributes. [[3]](#3)| -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|DNSChanger accesses PE headers. [[3]](#3)| +|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|DNSChanger sets file attributes. [[2]](#2)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|DNSChanger accesses PE headers. [[2]](#2)| ## ATT&CK Techniques |Name|Use| |---|---| -|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[3]](#3)| -|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[3]](#3)| +|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[2]](#2)| +|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[2]](#2)| ## Enhanced ATT&CK Techniques @@ -50,22 +50,22 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev |---|---| |[Impact::Generate Traffic from Victim::Advertisement Replacement Fraud (E1643.m02)](../impact/generate-traffic-from-victim.md)|The malware alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)| |[Defense Evasion::Disable or Evade Security Tools (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|DNSChanger prevents the infected system from installing anti-virus software updates. [[1]](#1)| -|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|DNSChanger encodes data using XOR. [[3]](#3)| -|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|DNSChanger attaches user process memory. [[3]](#3)| +|[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|DNSChanger encodes data using XOR. [[2]](#2)| +|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|DNSChanger attaches user process memory. [[2]](#2)| ## MBC Behaviors |Name|Use| |---|---| -|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|DNSChanger encrypts data using RC4 PRGA. [[3]](#3)| -|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|DNSChanger encodes data using XOR. [[3]](#3)| -|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|DNSChanger gets file attributes. [[3]](#3)| -|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|DNSChanger reads files on Windows. [[3]](#3)| -|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|DNSChanger sets file attributes. [[3]](#3)| -|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|DNSChanger writes Fileon Windows. [[3]](#3)| -|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|DNSChanger allocates RWX memory. [[3]](#3)| -|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|DNSChanger queries or enumerates registry values. [[3]](#3)| -|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|DNSChanger sets registry keys. [[3]](#3)| +|[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|DNSChanger encrypts data using RC4 PRGA. [[2]](#2)| +|[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|DNSChanger encodes data using XOR. [[2]](#2)| +|[File System::Get File Attributes (C0049)](../micro-behaviors/file-system/get-file-attributes.md)|DNSChanger gets file attributes. [[2]](#2)| +|[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|DNSChanger reads files on Windows. [[2]](#2)| +|[File System::Set File Attributes (C0050)](../micro-behaviors/file-system/set-file-attributes.md)|DNSChanger sets file attributes. [[2]](#2)| +|[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|DNSChanger writes Fileon Windows. [[2]](#2)| +|[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|DNSChanger allocates RWX memory. [[2]](#2)| +|[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|DNSChanger queries or enumerates registry values. [[2]](#2)| +|[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|DNSChanger sets registry keys. [[2]](#2)| ## Indicators of Compromise @@ -77,6 +77,4 @@ SHA256 Hashes [1] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html -[2] https://www.joesandbox.com/analysis/258032/0/html - -[3] capa v4.0, analyzed at MITRE on 10/12/2022 +[2] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/xample-malware/mazarbot.md b/xample-malware/mazarbot.md index 1149b85..b8f9e36 100644 --- a/xample-malware/mazarbot.md +++ b/xample-malware/mazarbot.md @@ -58,6 +58,6 @@ SHA256 Hashes [1] https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html -[2] https://www.player.one/new-android-sms-malware-can-completely-own-your-phone-just-one-text-how-avoid-mazar-512363 +[2] https://www.player.one/stub-56857 [3] https://heimdalsecurity.com/blog/security-alert-mazar-bot-active-attacks-android-malware/ diff --git a/xample-malware/redhip.md b/xample-malware/redhip.md index 849fca6..eb5b738 100644 --- a/xample-malware/redhip.md +++ b/xample-malware/redhip.md @@ -96,7 +96,7 @@ SHA256 Hashes ## References -[1] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[1] https://web.archive.org/web/20200815134441/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [2] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/xample-malware/searchawesome.md b/xample-malware/searchawesome.md index 49569a6..3e6fc5c 100644 --- a/xample-malware/searchawesome.md +++ b/xample-malware/searchawesome.md @@ -46,7 +46,7 @@ SearchAwesome adware intercepts encrypted web traffic to inject ads. |---|---| |[Execution::User Execution (E1204)](../execution/user-execution.md)|The user opens a disk image file which invisibly installs its components. [[1]](#1)| |[Defense Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|The malware will monitor if a specific file gets deleted and then will delete itself. [[1]](#1)| -|[Privilege Escalation::Install Certificate (E1608)](../privilege-escalation/install-certificate.md)|The malware installs a certificate. [[1]](#1)| +|[Privilege Escalation::Install Certificate (F0016)](../privilege-escalation/install-certificate.md)|The malware installs a certificate. [[1]](#1)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The malware installs a script to inject a JavaScript script and modify web traffic. [[1]](#1)| ## MBC Behaviors diff --git a/yfaq/README.md b/yfaq/README.md index 831d31d..0058565 100644 --- a/yfaq/README.md +++ b/yfaq/README.md @@ -12,7 +12,7 @@ * **MBC v3.0** - The latest MBC release includes behavior detection information, expanded descriptions, and new properties, such as version and created and modified dates. -* **STIX 2.1 Representation** - MBC content is available in an updated STIX format based on the new [STIX 2.1 Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior). +* **STIX 2.1 Representation** - MBC content is available in an updated STIX format based on the new [STIX 2.1 Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9). * **Attack Flow Examples** - Example attack flows for [Shamoon](../xample-malware/shamoon.md) and [SearchAwesome](../xample-malware/searchawesome.md) reference MBC behaviors. @@ -150,7 +150,7 @@ Malware behaviors and adversary behaviors can overlap because adversaries someti MBC content is available in STIX 2.1 format. See the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository for details. MBC content is also available in an [older STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2) based on the representation used for ATT&CK. ### Why was MBC's STIX representation updated? ### -The previous STIX 2.1 representation is valid, but it doesn't take advantage of the STIX 2.1 Extension Definition Object. MBC users said they found the MBC representation (and ATT&CK) kludgy, so we defined new SDOs and extended the STIX Malware Object in a [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior). We think it works much better! +The previous STIX 2.1 representation is valid, but it doesn't take advantage of the STIX 2.1 Extension Definition Object. MBC users said they found the MBC representation (and ATT&CK) kludgy, so we defined new SDOs and extended the STIX Malware Object in a [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9). We think it works much better! ### How are malware corpus examples captured in STIX? ### Corpus examples are captured using the Malware SDO. Three new properties are defined in the STIX 2.1 Malware Behavior extension: diff --git a/ynewsletters/09152023.md b/ynewsletters/09152023.md index 0b38e4f..2ae032f 100644 --- a/ynewsletters/09152023.md +++ b/ynewsletters/09152023.md @@ -5,7 +5,7 @@ Hi all! Recent MBC activity includes: -* Finalized the STIX 2.1 Malware Behavior Extension, which includes new STIX domain objects for MBC objectives, behaviors, and methods. Documentation and the JSON schemas are available in the OASIS [STIX Common Objects](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior) repository. +* Finalized the STIX 2.1 Malware Behavior Extension, which includes new STIX domain objects for MBC objectives, behaviors, and methods. Documentation and the JSON schemas are available in the OASIS [STIX Common Objects](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9) repository. * Preparing MBC 3.0 (release date 29 September). * Preparing release of the STIX 2.1 representation for MBC 3.0, which is based on the new malware behavior extension and will be available in a new [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository (release date 29 September). * Revised the [MBC FAQ](https://github.com/MBCProject/mbc-markdown/tree/main/yfaq), adding new content and updating and reorganizing existing content. diff --git a/ynewsletters/12182023.md b/ynewsletters/12182023.md index 434c868..2a89318 100644 --- a/ynewsletters/12182023.md +++ b/ynewsletters/12182023.md @@ -6,7 +6,7 @@ Hello all! Here are recent MBC developments: * Released [MBC 3.0](https://github.com/MBCProject/mbc-markdown/releases/tag/v3.0). -* Released the [STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2.1) for MBC 3.0, which is based on the new [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior). +* Released the [STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2.1) for MBC 3.0, which is based on the new [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9). * Tagged malware corpus with malware type. * Updated MBC for ATT&CK v14. * Added CAPE signature information to behavior pages (detection section).