{
  "Event": {
    "analysis": "2",
    "date": "2024-01-19",
    "extends_uuid": "",
    "info": "New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs",
    "publish_timestamp": "1705699443",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1705699430",
    "uuid": "86ed0c69-e420-4607-bcf8-9101bc260b8f",
    "Orgc": {
      "name": "CUDESO",
      "uuid": "56c42374-fdb8-4544-a218-41ffc0a8ab16"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:microsoft-activity-group=\"Mint Sandstorm\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"APT35\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Belgium\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"France\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Israel\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"United Kingdom\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Academia - University\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Research - Innovation\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"iran\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spear phishing messages with malicious links - T1369\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sigma-rules=\"Suspicious Double Extension Files\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sigma-rules=\"PUA - NirCmd Execution\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699187",
        "to_ids": false,
        "type": "link",
        "uuid": "81f19158-c871-4a4a-9ce6-de8339815078",
        "value": "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699208",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3605bae1-da4f-4a29-ba2c-4a7254b35f6d",
        "value": "east-healthy-dress.glitch.me"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699208",
        "to_ids": true,
        "type": "hostname",
        "uuid": "bf8f14ba-6a7d-4dd5-a275-13df2f541c57",
        "value": "coral-polydactyl-dragonfruit.glitch.me"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699208",
        "to_ids": true,
        "type": "hostname",
        "uuid": "fee8f468-6eb8-4301-bf2c-b44014fcdaeb",
        "value": "kwhfibejjyxregxmnpcs.supabase.co"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699208",
        "to_ids": true,
        "type": "hostname",
        "uuid": "cd6e22db-84f5-4063-b1c3-72345c697677",
        "value": "epibvgvoszemkwjnplyc.supabase.co"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699208",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5ba470bb-4d7c-4cdf-a828-35e81c5a56ce",
        "value": "ndrrftqrlblfecpupppp.supabase.co"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699208",
        "to_ids": true,
        "type": "hostname",
        "uuid": "926ab913-218a-4063-8e9d-6567f113e3a7",
        "value": "cloud-document-edit.onrender.com"
      },
      {
        "category": "Network activity",
        "comment": "curl command to retrieve a series of malicious files from attacker-controlled subdomains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699321",
        "to_ids": false,
        "type": "domain",
        "uuid": "3560e899-5b14-475c-ae15-7718d6720b5f",
        "value": "glitch.me"
      },
      {
        "category": "Network activity",
        "comment": "curl command to retrieve a series of malicious files from attacker-controlled subdomains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699321",
        "to_ids": false,
        "type": "domain",
        "uuid": "c1ea465c-d465-4100-8f32-6a7062fce715",
        "value": "supabase.co"
      },
      {
        "category": "Payload delivery",
        "comment": "added a file, typically named a.vbs, to the CurrentVersion\\Run registry key",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1705699358",
        "to_ids": false,
        "type": "filename",
        "uuid": "0985e398-4b87-49b5-9dcc-77d9f7e769cf",
        "value": "Persistence.vbs"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "24",
        "timestamp": "1705699247",
        "uuid": "4f35d584-fbec-4adb-8dd2-39b9f3e0ce6c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1705699247",
            "to_ids": true,
            "type": "sha256",
            "uuid": "99bfa67e-aa55-4004-a86b-d1dfdbffb7c6",
            "value": "f2dec56acef275a0e987844e98afcc44bf8b83b4661e83f89c6a2a72c5811d5f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "filename",
            "timestamp": "1705699247",
            "to_ids": true,
            "type": "filename",
            "uuid": "2507fba9-b9d1-4510-8fae-87b2539c5d88",
            "value": "MediaPl.dll"
          }
        ]
      }
    ]
  }
}