{
    "type": "bundle",
    "id": "bundle--729c36cf-1490-41a4-a3ab-8793d5eee394",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2023-03-08T12:51:42.067091Z",
            "modified": "2023-03-10T04:35:51.526813Z",
            "name": "USCISA",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--54a16ee0-2eee-4a6f-b918-9ef5c7b64d3b",
            "hashes": {
                "MD5": "5bef35496fcbdbe841c82f4d1ab8b7c2"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--97003151-c42c-4ca7-9193-8eff452fe58c",
            "value": "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--7b6de9f9-8fa7-4fe9-a9f2-d17b068a1603",
            "value": "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--b2522f66-2750-4f50-a4d7-f4629ac314f4",
            "created": "2026-08-20T01:44:40.971099Z",
            "modified": "2026-08-20T01:44:40.971099Z",
            "name": "YARA Rule",
            "pattern": "rule Wanna_Cry_Ransomware_Generic {\n    meta:\n        description = \"Detects WannaCry Ransomware on Disk and in Virtual Page\"\n        author = \"US-CERT Code Analysis Team\"\n        reference = \"not set\"\n        date = \"2017/05/12\"\n        hash0 = \"4DA1F312A214C07143ABEEAFB695D904\"\n    strings:\n        $s0 = {410044004D0049004E0024}\n        $s1 = \"WannaDecryptor\"\n        $s2 = \"WANNACRY\"\n        $s3 = \"Microsoft Enhanced RSA and AES Cryptographic\"\n        $s4 = \"PKS\"\n        $s5 = \"StartTask\"\n        $s6 = \"wcry@123\"\n        $s7 = {2F6600002F72}\n        $s8 = \"unzip 0.15 Copyrigh\"\n        $s9 = \"Global\\\\WINDOWS_TASKOSHT_MUTEX\"\n        $s10 = \"Global\\\\WINDOWS_TASKCST_MUTEX\"\n        $s11 = {7461736B736368652E657865000000005461736B5374617274000000742E776E7279000069636163}\n        $s12 = {6C73202E202F6772616E742045766572796F6E653A46202F54202F43202F5100617474726962202B68}\n        $s13 = \"WNcry@2ol7\"\n        $s14 = \"wcry@123\"\n        $s15 = \"Global\\\\MsWinZonesCacheCounterMutexA\"\n    condition:\n        $s0 and $s1 and $s2 and $s3 or\n        $s4 and $s5 and $s6 and $s7 or\n        $s8 and $s9 and $s10 or\n        $s11 and $s12 or\n        $s13 or $s14 or $s15\n}",
            "pattern_type": "yara",
            "valid_from": "2017-05-12T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f4b7773a-b62b-43cb-ac5e-c7b9cb315c47",
            "hashes": {
                "MD5": "4da1f312a214c07143abeeafb695d904"
            }
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5824ac63-ca42-48b3-9aaa-dc7a365c7daf",
            "created_by_ref": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2026-08-20T01:44:40.972105Z",
            "modified": "2026-08-20T01:44:40.972105Z",
            "name": "Indicators Associated With WannaCry Ransomware",
            "published": "2017-05-12T00:00:00Z",
            "object_refs": [
                "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
                "file--54a16ee0-2eee-4a6f-b918-9ef5c7b64d3b",
                "domain-name--97003151-c42c-4ca7-9193-8eff452fe58c",
                "url--7b6de9f9-8fa7-4fe9-a9f2-d17b068a1603",
                "indicator--b2522f66-2750-4f50-a4d7-f4629ac314f4",
                "file--f4b7773a-b62b-43cb-ac5e-c7b9cb315c47"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cisa.gov/news-events/alerts/2017/05/12/indicators-associated-wannacry-ransomware"
                }
            ]
        }
    ]
}