Unit42 Cannon Nov 2018

Cannon can gather the username from the system.

Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.

Cannon can obtain a list of processes running on the system.

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.

An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.

Zebrocy uses HTTP for C2.

Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.

Zebrocy uses SMTP and POP3 for C2.

Zebrocy collects the OS version and computer name. Zebrocy also runs the systeminfo command to gather system information.

Cannon can gather system information from the victim’s machine such as the OS version, and machine name.

Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.

Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.

Cannon can download a payload for execution.

Cannon can take a screenshot of the desktop.

A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.

Zebrocy enumerates information about connected storage devices.

Cannon can collect the current time zone information from the victim’s machine.

Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.

Cannon adds the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon to establish persistence.

Cannon can gather drive information from the victim's machine.

Zebrocy collects the serial number for the storage volume C:\.