(Palo Alto) We were able to collect a second delivery document that shared the Joohn author from the crash list(Lion Air Boeing 737).docx document, as well as the 188.241.58[.]170 C2 IP to host its remote template. Structurally this sample was very similar to the initially analyzed document, but the payload turned out to be a completely new tool which we have named Cannon. The tool is written in C# whose malicious code exists in a namespace called cannon, which is the basis of the Trojan’s name. The Trojan functions primarily as a downloader that relies on emails to communicate between the Trojan and the C2 server. To communicate with the C2 server, the Trojan will send emails to specific email addresses via SMTPS over TCP port 587. The specific functions of Cannon can be seen in Table 1. This tool also has a heavy reliance on EventHandlers with timers to run its methods in a specific order and potentially increase its evasion capability.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
2022-07-18 by Unit 42 from Palo Alto Networks Unit 42
2018-11-27 by Vitali Kremez from Vitali Kremez Blog
2018-11-20 by Robert Falcone from Palo Alto Networks Unit 42
Tool: Cannon
Names: Cannon
Description: (Palo Alto) We were able to collect a second delivery document that shared the Joohn author from the crash list(Lion Air Boeing 737).docx document, as well as the 188.241.58[.]170 C2 IP to host its remote template. Structurally this sample was very similar to the initially analyzed document, but the payload turned out to be a completely new tool which we have named Cannon. The tool is written in C# whose malicious code exists in a namespace called cannon, which is the basis of the Trojan’s name. The Trojan functions primarily as a downloader that relies on emails to communicate between the Trojan and the C2 server. To communicate with the C2 server, the Trojan will send emails to specific email addresses via SMTPS over TCP port 587. The specific functions of Cannon can be seen in Table 1. This tool also has a heavy reliance on EventHandlers with timers to run its methods in a specific order and potentially increase its evasion capability.
Category: Malware
Type: Backdoor
Information: https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/
Mitre-attack: https://attack.mitre.org/software/S0351/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.cannon
Last-card-change: 2020-04-23
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1547.004 BOOT OR LOGON AUTOSTART EXECUTION : WINLOGON HELPER DLL cannon adds the registry key hkcu\software\microsoft\windows nt\currentversion\winlogon to establish persistence. | T1547.004 BOOT OR LOGON AUTOSTART EXECUTION : WINLOGON HELPER DLL cannon adds the registry key hkcu\software\microsoft\windows nt\currentversion\winlogon to establish persistence. | T1083 FILE AND DIRECTORY DISCOVERY cannon can obtain victim drive information as well as a list of folders in c:\program files. T1082 SYSTEM INFORMATION DISCOVERY cannon can gather system information from the victim’s machine such as the os version, machine name, and drive information. T1124 SYSTEM TIME DISCOVERY cannon can collect the current time zone information from the victim’s machine. | T1071.003 APPLICATION LAYER PROTOCOL : MAIL PROTOCOLS cannon uses smtp/s and pop3/s for c2 communications by sending and receiving emails. | T1041 EXFILTRATION OVER C2 CHANNEL cannon exfiltrates collected data over email via smtp/s and pop3/s c2 channels. |